External quality assurance review (eqar) for raf internal audit department

The Road Accident Fund (RAF) is a Schedule 3A public entity established under the Road Accident Fund Act, 1996. This RFQ seeks a service provider to conduct an External Quality Assurance Review (EQAR) of the Internal Audit Department. The review is required by the Global Internal Audit Standards every five years; the previous assessment has expired. The contract period is three months, effective from the date of the last signature on the agreement. The service address is the RAF Head Office in Centurion.

RFQ issued: 30 October 2026

Closing: 12 November 2026 at 11:00

Enquiries

• Contact: Tshilidzi Lithole
• Email: [email protected]
• Telephone: 012 429 5886

Submission

• Method: email
• Submission email: [email protected]

Service delivery address:

RAF Head Office

420 Witch Hazel Avenue

Eco Glades

Pretoria, 0046

Submit via email only to [email protected], using the reference PR10118915. Quotations received after the closing time will not be considered. All annexures and required documents must be completed, signed and submitted with the quotation.

Returnable documents:

• SBD 4: Declaration of Interest – discloses whether any director or shareholder is employed by the state or connected to anyone at the RAF.
• SBD 6.1: Preference Points Claim in terms of PPR 2022.
• Annexure A: Security Measures.

Disqualification risks:

• Submitting a quotation to the wrong email address.
• Late submission.
• Omitted or unsigned mandatory documents.
• Submitting more than one proposal from multiple registered companies sharing a common director or shareholder.
• Bidders currently on the RAF Internal Audit Panel are automatically disqualified due to conflict of interest.
• Offering gifts or hospitality to RAF officials; solicited bribery must be reported to the fraud line (0800 005919) or the bidder is treated as an accomplice.

Evaluation in three phases:

Phase 1 – Mandatory requirements (comply/not comply): must meet all for further evaluation.

Phase 2 – Functional/Technical evaluation: minimum qualifying score of 60 out of 100. Allocation:

• Partner or Director: EQAR projects led (minimum 4 at Director/Partner level) – 40 points
• Project Manager: EQAR projects managed (minimum 2) – 30 points
• Two certified Quality Assurance Assessors – 30 points

Phase 3 – Price and Specific Goals under the 80/20 preference point system:

• Price: 80 points
• Specific Goals: 20 points

Bidders failing any mandatory requirement are disqualified and not evaluated further.

Scope: Conduct an External Quality Assurance Review (EQAR) of the RAF Internal Audit Department, covering both General Assurance and IT Audit sub-units, in line with the Global Internal Audit Standards issued by the Institute of Internal Auditors (IIA).

Activities required:

• Meet with the Internal Audit project team to agree on scope, implementation plan and roles.
• Conduct interviews with key stakeholders (Audit Committee Chairman, CEO, senior executives, Audit Executive and Internal Audit staff).
• Conduct and review survey results on the Internal Audit function.
• Review working paper files for compliance with the Global IIA Standards.
• Review governance documents (e.g. Charter, methodology) and departmental practices.
• Provide recommendations to enhance conformance and add value.

Reporting requirements:

• Draft report in Microsoft Word; final report in PDF.
• Report contents: introduction, background, objective, scope, observations/findings, recommendations, distribution, and opinion on conformance to the Global IIA Standards.
• Draft report: discuss with Internal Audit management and obtain management comments.
• Final draft report: presented to the CEO and Audit and Risk Management Committee.
• Final report: presented to the Board.

Quotations must be VAT inclusive (if VAT registered) in South African Rand. Prices for non-VAT registered suppliers are deemed all-inclusive; no VAT will be added after award. Non-VAT registered suppliers who charge VAT will be disqualified. Prices must be submitted in the cost breakdown table only. No price changes after the Award Letter/Purchase Order is issued. Prices valid for 30 days from closing date.

CSD registration is mandatory – the RAF only does business with CSD-registered suppliers. Tax matters must be declared in order by SARS. Bidders must not be on the RAF Internal Audit Panel (conflict of interest). Mandatory proof of experience and certifications:

• Company experience: minimum 5 signed reference letters from clients where EQAR was conducted (each letter on company letterhead, including type of service, year, and number of reviews).
• Partner/Director: valid Certified Internal Auditor (CIA) and Certified Quality Assurance Assessor certificates, both issued by the IIA, plus a CV detailing EQARs led at Director/Partner level.
• Project Manager: valid Certified Quality Assurance Assessor certificate issued by the IIA.
• Two additional Certified Quality Assurance Assessor resources: valid certificates issued by the IIA.

Bidders with disabilities must provide a valid medical certificate as proof.

Preference points are awarded under the 80/20 system (80 points for price, 20 points for specific goals).

• Specific goals and their maximum points: historically disadvantaged individuals 10, women 8, persons with disability 2.
• Bidders must complete and submit SBD 6.1 to claim these points.
• Claims must be supported by proof or documentation; unsupported claims are not awarded points.
• The organ of state may require substantiation of any claim before or after adjudication.
• Fraudulent claims can lead to disqualification, contract cancellation, recovery of costs, restriction from doing business with the state for up to 10 years, and criminal prosecution.

The applicable preference point system is the 80/20 system, which applies to requirements with a rand value up to R50,000,000 (all applicable taxes included).

No specific pre-qualification compliance requirements (such as CSD registration, tax clearance, or B-BBEE level) are stated in the available document.

• Bidders must complete and submit SBD 6.1 (Preference Points Claim Form) to claim points for specific goals.
• Bidders must provide documented proof of their claims for specific goals when required.

This annexure defines the technical and organisational security measures the service provider must implement when handling the Road Accident Fund's (RAF) confidential, private, personal or sensitive information ('files, data and/or documents'). The provider must have policies in place to meet RAF requirements and the Protection of Personal Information Act (POPIA).

No submission-specific instructions (channel, copies, returnable forms) are stated in the available document.

Security screening or vetting may be conducted on company directors and provided resources; the service provider must cooperate with RAF audits and monitoring of compliance with data protection and cybersecurity standards.

The service provider must have policies in place to comply with the Protection of Personal Information Act (POPIA) and RAF information security requirements.

Compliance requirements: The service provider must maintain policies and measures aligned with the Protection of Personal Information Act (POPIA). The RAF reserves the right to conduct security screening or vetting of company directors and provided resources. Subcontractors or third parties engaged must adhere to the same data protection and cybersecurity standards, and the service provider is responsible for their compliance.

The service provider's premises must have fire suppression systems (including carbon dioxide fire extinguishers) to prevent damage or loss of documents in case of fire. The premises must have a secure perimeter with controlled access and/or surveillance systems, secure doors, locks, and alarms to prevent unauthorised access.

The service provider is obliged to maintain physical security of all records in their possession. Any real, attempted, or suspected breach of physical security must be reported to the RAF, along with any relevant CCTV footage, police report, and linked alarm system records. The RAF reserves the right to audit and monitor the provider's compliance with this policy, and the provider must cooperate with any such audits or assessments.