Panel of service providers for internal audit and related services (36 months) – MEGA/2027/05

Closing date: 12 November 2026 at 12:00 (South African time, GMT+2).

Enquiry deadline: 02 November 2026 (enquiries via email only).

No compulsory briefing or site visit is stated.

SCM enquiries:

• Contact: Mr. Sibusiso Lekhuleni
• Email: [email protected]
• Telephone: +27 13 492 5818

Technical enquiries:

• Contact: Ms. Fikile Nyathi
• Email: [email protected]
• Telephone: +27 13 492 5818

Submission address:

MEGA Head Office

02 Eastern Boulevard, Riverside

Mbombela, 1200

(Ground floor tender box)

Submission method: sealed envelope deposited in the tender box at MEGA Office Park, 02 Eastern Boulevard, Riverside, Mbombela, 1200, Ground floor.

• Envelope must be marked with the bidder's name, bid number (MEGA/2027/05), bid description, and closing date.
• Submit one original and one copy on USB.
• Bids must be submitted on the official forms provided (not re-typed).
• Late bids will not be accepted.
• Bids remain valid for 120 days from the closing date.

Returnable forms and documents (all mandatory, failure to provide may disqualify):

• SBD 1 (Invitation to Bid): bidder details and signed offer cover page.
• SBD 4 (Declaration of Interest): discloses any state employment or connections to the procuring institution; false disclosure disqualifies.
• SBD 6.1 (Preference Points Claim): claims specific goals points under the 80/20 system.
• Fully completed pricing schedule.
• Company/CC/Trust/Partnership registration certificates.
• Letter of authority to sign the bidding documents (e.g. company resolution).
• Certified copies of directors' or shareholders' identity documents.
• Proof of CSD registration (detailed report).
• Letter of approval from the Executive Authority to do business if any member is a government employee.
• SARS Tax Compliance Status PIN or CSD number (each party in a consortium/JV/sub-contractor must submit separately).
• Proof of professional memberships as applicable (IIA, ISACA/EC Council, SAICA or equivalent).

Disqualification risks:

• Any mandatory document omitted, unsigned, or incomplete.
• Fraudulent, factually untrue, or inaccurate information.
• Bids from persons in the service of the state, or companies/CCs with directors/members in the service of the state.
• Failure to disclose all CSD-registered active companies linked to directors.

Three-stage evaluation:

• Stage 1: Responsiveness assessment against mandatory requirements.
• Stage 2: Functionality assessment (minimum threshold 70/100).
• Stage 3: Price and specific goals evaluation (80/20 system).

Functionality scoring (100 points total, minimum 70 to proceed):

• Company experience (25 points): 0 for no reference letters; 15 for 1-3; 20 for 4-6; 25 for more than 6. Reference letters must be on client letterhead, include client contact details, description and duration of work, and client signature.
• Experience of key personnel (30 points): Audit Manager and Engagement Director combined. Below 3 years = 0; 3-5 years = 10; 6-10 years = 20; above 10 years = 30.
• Academic and professional qualifications (30 points): No qualifications = 0; Diploma/B. Degree = 10; Post-graduate degree = 20; Certified Internal Auditor = 30.
• Methodology, approach and organisational capacity (15 points): 0 if no methodology; 5 for 1 of 3 scoped services; 10 for 2 of 3; 15 for all 3. Include organogram.

Price and specific goals (80/20 system):

• Price: 80 points.
• Specific goals: 20 points total, allocated as 4 points each for enterprise owned by Black people, women, youth, disabled, and SMMEs (QSE/EME).
• Bidders must submit evidence to support specific goals claims; failure to do so means no points claimed.

MEGA reserves the right to appoint one or more bidders, negotiate final fees/rates, and consider National Treasury cost containment hourly rates.

MEGA (a Schedule 3D entity of the Mpumalanga Provincial Government) seeks to appoint a panel of up to five service providers to supplement its Internal Audit Unit with specialised internal audit and related services on an as-and-when-required basis for 36 months.

Scope of work covers three service categories:

1. Internal Audit Assurance and Advisory Services:

• Risk-based internal audit assignments per the approved Internal Audit Plan.
• Assessment of governance, risk management, and internal control processes.
• Compliance reviews.
• Performance and operational audits.
• Supply chain management and procurement/probity reviews.
• Follow-up reviews on previously reported findings.
• Governance and risk management reviews.
• Fraud risk and control-related reviews.
• Other approved assurance and advisory assignments.

2. ICT Assurance Services:

• General and application controls reviews.
• IT governance reviews.
• Cybersecurity-related assurance reviews.
• Information security assessments.
• Data analytics.
• Threat and vulnerability assessments.
• Business continuity and disaster recovery reviews.
• Other specialised ICT assurance assignments.

3. Financial Statements and Financial Reporting Reviews:

• Review of Annual Financial Statements and supporting working papers.
• Review of financial statement disclosures.
• Review of AFS for compliance with the applicable financial reporting framework.
• Review of supporting schedules and reconciliations.
• Review of audit-readiness processes.
• Other financial reporting-related assurance services.

Individual assignments will be issued via assignment-specific Terms of Reference. Appointment to the panel does not guarantee any minimum work or expenditure.

Bidders must submit a methodology and approach covering the three scoped service categories (internal audit assurance, ICT assurance, and financial statements review).

The methodology must demonstrate understanding of assignment planning and execution, quality assurance, reporting, resource allocation, and organisational capacity.

An organogram and resource plan must be included to show capacity to execute assignments.

Audit assignments must be performed using the firm's audit approach/methodology, aligned with the Code of Conduct and professional standards of the relevant associations.

Methodology scoring: 0 points if no methodology; 5 for 1 of 3 services; 10 for 2 of 3; 15 for all 3.

Company experience: bidders must demonstrate relevant and verifiable experience in providing internal audit services to the public sector and/or State-Owned Entities. Reference letters must be on client letterhead, include client contact details, description and duration of work, and client signature. Scoring: 0 for none; 15 for 1-3; 20 for 4-6; 25 for more than 6.

Key personnel experience (Audit Manager and Engagement Director):

• Audit Manager = most senior consultant/lead auditor responsible for carrying out the audit engagement.
• Engagement Director = senior director/manager responsible for overseeing and signing off on the overall audit engagement.
• Scoring: below 3 years = 0; 3-5 years = 10; 6-10 years = 20; above 10 years = 30.
• Attach concise CVs for both roles.

Academic and professional qualifications of key personnel:

• No qualifications = 0.
• Diploma/B. Degree in Auditing/Commerce/Accounting or equivalent = 10.
• Post-graduate degree in Auditing/Commerce/Accounting or equivalent = 20.
• Certified Internal Auditor = 30.
• Attach certified copies of qualifications.

Professional memberships are mandatory per discipline (IIA, ISACA/EC Council, SAICA or equivalent).

Pricing must be submitted on the provided schedule, showing hourly and daily rates (8-hour day) for each personnel category for each of the three years.

Personnel categories: Engagement/Project Director; Senior Manager/Engagement Manager; Audit/Project Manager; Senior Consultant/Auditor/Specialist; Junior Consultant/Auditor.

Escalation rates for Year 2 and Year 3 must be stated as percentages.

Include all items, rates per unit, total costs, and VAT where applicable.

The pricing schedule is for evaluation only and does not guarantee any volume of work.

Actual fees will be determined per assignment scope and contract terms.

MEGA may negotiate final fees/rates and may apply National Treasury cost containment hourly rates.

Pricing schedule format: hourly and daily rates (8-hour day) for each personnel category, for each of the three years.

Personnel categories:

• Engagement / Project Director
• Senior Manager / Engagement Manager
• Audit / Project Manager
• Senior Consultant / Auditor / Specialist
• Junior Consultant / Auditor

Escalation rates: Year 2 and Year 3 escalation rates must be stated as percentages.

Pricing must include all items, rates per unit, total costs, and VAT where applicable.

The pricing schedule is for evaluation only and does not guarantee any volume of work.

MEGA may negotiate final fees/rates with preferred bidders and may apply National Treasury Instruction 01 of 2014 cost containment hourly rates.

No bid security, bond, or retention is stated.

Tax compliance:

• Bidders must submit their SARS Tax Compliance Status (TCS) PIN, or a printed TCS certificate, or a CSD number if registered on the CSD.
• Each party in a consortium/JV/sub-contractor must submit a separate TCS certificate/PIN/CSD number.
• Bids from persons in the service of the state, or entities with directors/members in the service of the state, will not be considered.

CSD registration: proof of registration on the Central Supplier Database (detailed report) is mandatory.

Professional memberships (mandatory, per discipline):

• Internal Audit Assurance: IIA membership for the proposed Audit Manager and Engagement Director.
• ICT Assurance: ISACA, IIA, or EC Council membership for the proposed ICT Audit Manager and Engagement Director.
• Financial Statements Review: SAICA or equivalent (SAIPA, ACCA, IAC, CACA, CFA Society SA, SAIBA, IRBA) for the proposed Project Manager and Project Director.

B-BBEE / specific goals:

• 80/20 preference point system applies.
• Specific goals: 4 points each for enterprise owned by Black people, women, youth, disabled, and SMMEs (QSE/EME).
• Evidence must be submitted with the bid to claim these points; otherwise no points are awarded.

No CIDB grading is required (not construction-related).

Panel contract term: 36 months.

Panel composition: maximum of five service providers who meet all mandatory requirements, achieve at least 70 functionality points, and obtain the highest final scores.

Appointment to the panel does not guarantee any minimum work, expenditure, or number of assignments.

Assignments will be allocated through an equitable panel-utilisation mechanism considering expertise, capacity, availability, and performance.

Where quotations are required, TORs will be issued to qualifying panel members.

Individual assignments will be awarded per the approved evaluation methodology, MEGA SCM Policy, and applicable procurement prescripts.

If fewer than five bidders meet all requirements, MEGA is not obliged to appoint five.

All panel appointments and assignments are subject to the PFMA, Treasury Regulations and Instructions, MEGA SCM Policy, and preferential procurement requirements.

MEGA may appoint one or more bidders, negotiate final fees/rates, and consider National Treasury cost containment hourly rates.

Bids must remain valid for 120 days from closing date.

Confidentiality: all bid information must be held in strict confidence and used only for bid preparation.

Three-stage evaluation:

• Stage 1: Responsiveness assessment against mandatory requirements.
• Stage 2: Functionality assessment (minimum 70/100).
• Stage 3: Price and specific goals evaluation (80/20 system).

Functionality scoring (100 points):

• Company experience: 25 points max.
• Key personnel experience: 30 points max.
• Academic/professional qualifications: 30 points max.
• Methodology and organisational capacity: 15 points max.

Minimum functionality threshold: 70 points.

Price and specific goals:

• Price: 80 points.
• Specific goals: 20 points (4 each for Black-owned, women-owned, youth-owned, disabled-owned, SMME-owned).

MEGA reserves the right to appoint one or more bidders, negotiate fees, and apply cost containment rates.