Appointment of a Service Provider for Governance, Risk and Compliance (grc) Solution, a Legislative Library and Background Verification Platform Including Maintenance, Updates and Support for a Period of Thirty-eight (38) Months.

The KwaZulu-Natal Growth Fund Agency (KZNGFA) is a Development Finance Institution (DFI)

established by the Provincial Government to provide debt and equity funding. KZNGFA’s mandate is to

support job creation, economic development and transformation while promoting Broad-Based Black

Economic Empowerment (B-BBEE).

Given its regulatory and compliance obligations, the organisation requires a fit-for-purpose GRC system

to ensure sound governance, effective risk management and adherence to legislative and regulatory

frameworks

3. RFP SCOPE OF REQUIREMENTS/ FUNCTIONALITY INTRODUCTION

KZNGFA requires an integrated GRC solution that enables efficient governance, effective risk

management, regulatory compliance oversight, probity checking, and legislative monitoring.

The main objectives of the GRC solution are to:

• Streamline governance, risk and compliance processes, reducing administrative burden.

• Enable effective identification, analysis, assessment and evaluation of organisational risks.

• Enhance risk monitoring, reporting and communication.

• Improve tracking of risk management strategies, mitigation plans and action items.

• Integrate with existing systems to support efficient data sharing and better decision-making.

• Link risk management to organisational strategy and performance.

• Provide standardised and consistent reporting across the organisation.

• Improve workflow management for risk and compliance activities

• A GRC platform for enterprise risk and compliance management.

• An Online Legislative Library for legal research and regulatory updates.

• A Background Verification and Probity Checking Module for employees, clients and suppliers.

• A single repository for all risks, controls, compliance requirements and incidents.

• A dashboard-driven view of organisational risk exposure and compliance status.

• Standardised workflows aligned with approval structures.

• Automated reporting and timely access to risk and compliance information.

• Integration capabilities with internal and external data sources.

4.1. Risk Management

4.1.1. Conduct risk assessments using configurable workflows aligned to the organisation’s risk

management framework.

4.1.2. Enable qualitative and quantitative risk rating methodologies.

4.1.3. Assign risk owners, action owners, treatment plans and due dates.

4.1.4. Track and monitor progress on mitigation actions.

4.1.5. Provide automated alerts, notifications and escalations for outstanding or overdue tasks.

4.1.6. Maintain and update multiple organisational risk registers (strategic, operational, project, ICT,

fraud, etc.).

4.1.7. Maintain a central knowledge base of risk definitions to eliminate duplication.

4.1.8. Support multiple risk domains and departmental risk structures.

4.1.9. Provide dashboards, heatmaps and summary views for management and board reporting.

4.1.10. Support incident reporting, incident classification and linking incidents to corresponding risks.

4.2. BACKGROUND VERIFICATION & COMPLIANCE SCREENING MODULE

4.2.1. Identity & Registration Verification

• Verify identity details of natural persons (ID/passport) through recognised and compliant

databases such as the Department of Home Affairs (DHA).

• Verify juristic persons through the Companies and Intellectual Property Commission (CIPC),

including directors, entity status and registration history.

• Validate ultimate beneficial ownership (UBO) details.

4.2.2. Sanctions, PEP & Adverse Media Screening

a) Screen individuals and entities against:

• Politically Exposed Persons (PEP) lists

• Prominently Influential Persons (PIP) lists

• Local and international sanctions lists (UN, OFAC, EU, etc.)

• Public sector datasets

• Adverse media databases

• Fraud, crime, court and police records

b) Identify relational links to PEPs/PIPs and high-risk individuals.

4.2.3. AML, KYC & Due-Diligence Compliance

• Conduct Anti-Money Laundering (AML), Know Your Customer (KYC) and due-diligence

checks aligned with FICA requirements.

• Generate risk profiles and risk scores.

• Provide configurable KYC checklists and onboarding workflows.

• Maintain secure storage of compliance documents with full audit trails.

4.2.4. Credit, Legal & Financial Checks

• Ability to integrate with credit bureaus (TransUnion, Experian, XDS, etc.).

• Provide credit scores, judgments, high court listings, adverse listings and fraud databases.

4.2.5. Reporting & Traceability

• Provide consolidated due-diligence reports.

• Provide audit logs for every check performed.

• Store historical checks for future reference.

4.2.6. System Enhancement Support

ensure continuous improvement relevant to KZNGFA’s evolving environment.

4.3. LEGISLATIVE LIBRARY

include (but is not limited to) the following resources:

• National Legislation (Bills, Acts and Regulations), including a Legal Citator

• Gazettes Online (1910 – Current), including legal, administrative and general notices

• Provincial Legislation for all nine provinces (Acts and Regulations)

• All South African Law Reports (1828 to date), including a Legal Citator

• Judgments Online (JOL) – reported and unreported judgments, including a Legal Citator

• Legal Encyclopaedia or equivalent comprehensive legal reference

• General Law Reports

• Updates on new or amended legislation

• Access to Information resources

• Business Contracts Compendium

• Corporate Governance: An Essential Guide for South African Companies

• Labour Relations Law: A Comprehensive Guide

• Dismissal-related legal resources

• Labour Relations Handbook – practical guide for effective labour relations management

• A Practical Guide to Disciplinary Hearings

4.4. MAIN AND OTHER USERS

The desired tool will primarily be used by personnel within the risk management function and others

that support risk and compliance management activities, such as risk/ action owners (executive

members and business unit leaders) as well as risk and ethics champions. Additionally, all

Thus, we estimate that the KZNGFA will have around 28 internal users (with varying access

permissions).

Total number of employees that will be using the tool 28

4.5. REPORTING MANAGEMENT

4.5.1. Generate user and risk reports using pre-defined templates and dashboards.

4.5.2. Generate system user activity reports.

4.5.3. Provide historical reporting for past audits and assessments.

4.5.4. Provide configurable dashboards for Board, Audit & Risk Committee, and Executive reporting.

4.6. TECHNICAL REQUIREMENTS

4.6.1. System Architecture & Access

• Fully auditable system with immutable logs.

• Cloud-based, hosted (SaaS) or hybrid solution.

• Web-based and securely accessible via standard browsers.

• Multi-device and multi-browser compatibility.

• Offline capability through exportable templates with later synchronisation.

4.6.2. Integration Requirements

Support APIs for integration with:

• Internal systems (ERP, CRM, DMS, HR, Finance)

• External verification databases (CIPC, DHA, credit bureaus, sanctions list)

• Reporting and BI tools

4.6.3. Data Security and Compliance

• Comply with POPIA, PAIA, PFMA, FICA and King IV.

• Encryption of data at rest and in transit.

• Role-based access control and data masking for sensitive information.

4.6.4. Support and Development

• User-driven development with active enhancement roadmap.

• Dedicated local support with helpdesk facilities.

4.7. ADDITIONAL REQUIREMENTS

4.7.1. Provide a high-level implementation plan with timelines and key milestones.

4.7.2. Provide onboarding and post-implementation handholding training for all users.

4.7.3. Provide a skills-transfer plan for internal IT.

4.7.4. Ensure data migration and full handover of all KZNGFA data upon contract termination.

5. EXPERTISE AND CAPACITY

It is expected that the key resources to be deployed in the project would have the following minimum proficiency

in the role they are proposed for the project:

5.1. Project Leader/Lead Consultant

experience in managing the implementation the proposed GRC tool. The Project Leader/Lead Consultant

will be responsible for overall project management, planning, monitoring and ensuring successful delivery

of the GRC tool.

5.2. Technical Resource

hands-on experience in configuring, supporting and maintaining the proposed GRC tool. The Technical

Resource will be responsible for system configuration, technical support, troubleshooting and ensuring that

the platform operates effectively.

5.3. Training Specialist

years’ experience in delivering end-user training in GRC systems. This role will be responsible for

conducting training sessions for relevant users, preparing training materials and supporting user adoption

during and after implementation.

C.3 CONDITIONS OF BID AND CONTRACT

Confirmation

Conditions

Yes No Noted If no, indicate

deviation

1. GUIDELINE ON COMPLETION

paragraph-by-paragraph basis. Indicate compliance with

the relevant bid requirements by marking the YES box and

non-compliance by marking the NO box. If the contents of

the paragraph only need to be noted, please mark the

from these requirements are offered and the reason

therefore. If an explanatory note is provided, the

the bid submission. Bids not completed in the manner

prescribed may be considered incomplete and rejected.

2. KZNGFA SERVICE LEVEL AGREEMENT

2.1 The KZNGFA Service Level Agreement (SLA) will be the

only contract signed by both parties and will form the basis

of this contract. KZNGFA’s terms and conditions will not

be negotiated.

3. ADDITIONAL INFORMATION REQUIREMENTS

3.1 During evaluation of the bids, additional information may

be requested in writing from bidders. Replies to such

as otherwise indicated. Failure to comply, may lead to the

bid being disregarded.

4. CONFIDENTIALITY

4.1 The bid and all information in connection therewith shall

be held in strict confidence by bidders and usage of such

information shall be limited to the preparation of the bid.

4.2 All bidders are bound by a confidentially agreement

preventing the unauthorised disclosure of any information

regarding KZNGFA or of its activities to any other

organisation or individual. The bidders may not disclose

any information, documentation or products to other

clients without written approval of the accounting authority

or the delegate.

Yes No Noted If no, indicate

5. INTELLECTUAL PROPERTY, INVENTIONS AND deviation

COPYRIGHT

5.1 Copyright of all documentation relating to this assignment

belongs to KZNGFA. The successful bidders may not

disclose any information, documentation or products to

other clients without the written approval of the accounting

authority or the delegate.

5.2 All the intellectual property rights arising from the

execution of this Agreement shall vest in KZNGFA and the

service provider undertakes to honour such intellectual

property rights and all future rights by keeping the know-

how and all published and unpublished material

confidential.

5.3 In the event that the service provider would like to use any

information or data generated in terms of the Services, the

5.4 KZNGFA shall own all materials produced by the service

provider during the course of, or as part of the Services

including without limitation, deliverables, computer

programmes (source code and object code), programming

aids and tools, documentation, reports, data, designs,

concepts, know-how and other information whether

capable of being copyrighted or not (“IP”) which IP

KZNGFA shall be entitled to freely cede and assign to

parties nominated by KZNGFA.

6 PAYMENTS

6.1 KZNGFA will pay the service provider for the actual

services rendered in line with the SLA.

6.2 The service provider shall from time to time during the

duration of the contract, invoice KZNGFA for the services

rendered. No payment will be made to the service provider

unless an invoice complying with section 20 of VAT Act No

has been submitted to KZNGFA.

6.3 Payment shall be made into the bidder’s bank account

normally 30 days after receipt of an acceptable, valid

this bid is awarded).

7 NON-COMPLIANCE WITH DELIVERY TERMS

7.1 As soon as it becomes known to the service provider that

he will not be able to deliver the goods/services within the

delivery period and/or against the quoted price and/or as

notice to this effect. KZNGFA reserves the right to

implement remedies as provided for in the SLA.

8 WARRANTIES Yes No Noted If no, indicate

deviation

8.1 The service provider warranties that it is able to conclude

this Agreement to the satisfaction of KZNGFA.

8.2 Although the service provider will be entitled to provide

services to persons other than KZNGFA, the service

provider shall not without the prior written consent of

KZNGFA, be involved in any manner whatsoever, directly

or indirectly, in any business or venture which competes

or conflicts with the obligations of the contractor to provide

the Services.

9. PARTIES NOT AFFECTED BY WAIVER OR

BREACHES

9.1 The waiver (whether express or implied) by any Party of

any breach of the terms or conditions of this Agreement by

the other Party shall not prejudice any remedy of the

waiving party in respect of any continuing or other breach

of the terms and conditions hereof

9.2 No favour, delay, relaxation or indulgence on the part of

any Party in exercising any power or right conferred on

such Party in terms of this Agreement shall operate as a

waiver of such power or right nor shall any single or partial

exercise of any such power or right under this Agreement.

10 SUBMITTING BIDS

Agency email: [email protected]

Closing date: 06 March 2026 at 11:00am

11 LATE BIDS

11.1 Late submissions will not be accepted. A submission will

be considered late if it arrived one second after 11:00 or

any time thereafter.

Bidders are therefore strongly advised to ensure that bids

be dispatched allowing enough time for any unforeseen

events that may delay the delivery of the bid.

12. BRIEFING SESSIONS AND CLARIFICATIONS Yes No Noted If no, indicate

deviation

12.1 Compulsory Briefing session

See above for details

or interpretation of the Terms of Reference, or any other

aspect concerning the bid, is to be requested in writing (e-

mail).

Please make reference to Tender Notice and Invitation to

Tender page of this bid pack for contact details.

The bid number should be mentioned in all correspondence.

Telephonic requests for clarification will not be accepted. If

appropriate, the clarifying information will be made available

to all bidders by e-mail only.

13. FORMAT OF BIDS

advised that their proposal should be concise, written in

plain English and simply presented.

13.2 Bidders are to set out their proposal in the following format:

13.2.1 Part 1: Invitation to Bid & Introduction

13.2.2 Part 2: Compliance to Special Conditions of Bid and

Noting of Evaluation Criteria

13.2.3 Part 3: National Treasury CSD report

13.2.4 Part 4: Bidders Disclosure and Certificate of Authority to

Sign a Bid

13.2.5 Part 5: BBBEE Certificate / Affidavit

13.2.6 Part 6: Joint venture/ consortium

13.2.7 Part 7: Technical proposal/ Functionality

13.2.8 Part 8: Deviation from request for Bid

13.2.9 Part 9: Procurement timelines

13.2.10 Part 10: Annexures

Yes No Noted If no, indicate

14.1 PART 1: INVITATION TO BID (FORM C1) deviation

Bidders are to note the information on C1 detailing the

Compulsory Briefing Session, the closing date and time as

well as the submission requirements

14.2 PART 2: COMPLIANCE TO SPECIAL CONDITIONS

OF BID AND NOTING OF EVALUATION CRITERIA

(FORM C4)

compliance or noted. In case of non-compliance details and

14.3 PART 3: NATIONAL TREASURY CSD REPORT

information will be verified with Central Supplier Database

(CSD). In case of a joint venture, or where sub-contractors

are utilised, each joint venture member and/or sub-

and the information will be verified on Central Supplier

Database (CSD).

14. 4 PART 4: BIDDERS DISCLOSURE AND CERTIFICATE

OF AUTHORITY TO SIGN A BID (FORM C5, C10 AND

C11)

• Certificate of Authority to Sign a Bid

• Bidders Disclosure Form (SBD 4)

• Preferential Points Form (SBD 6.1)

deal with KZNGFA. Any other irrelevant sections to the

14.5 PART 5: BBBEE CERTIFICATE / AFFIDAVIT

a Verification Agency accredited by the South African

Accreditation System (SANAS) or Affidavit from a

Registered Auditor approved by the Independent

Regulatory Board of Auditors (IRBA) or an Accounting

Officer as contemplated in the Close Corporation Act (CCA)

14.5.2 For a consortium or joint venture:

A trust, consortium or joint venture, will qualify for points for

their B-BBEE status level as a legal entity, provided that

the entity submits their B-BBEE status level certificate.

A trust, consortium or joint venture will qualify for points for

their B-BBEE status level as an unincorporated entity,

provided that the entity submits their consolidated B-BBEE

scorecard as if they were a group structure and that such a

consolidated B-BBEE scorecard is prepared for every

separate bid.

14.6 PART 6: JOINTVENTURE/CONSORTIUM AGREEMENT Yes No Noted If no, indicate

deviation

included.

14.7 PART 7: TECHNICAL PROPOSAL/FUNCTIONALITY

PROPOSAL (FORM C8)

letterhead including contact details, for the previous, current

or ongoing projects of similar nature. This will be verified by

KZNGFA.

14.8 PART 8: DEVIATIONS FROM REQUEST FOR BID

(FORM C14)

14.8.1 Please indicate deviations or modifications to this Request

for Bid on form C14

sign

14.9 PART 9: PROCUREMENT TIMELINES (FORM C6)

14.9.1 This part of a bid documents informs bidders when the bid

process is expected to be finalised. It may not necessarily

be followed.

14.9.2 Terms of reference (TOR) are the requirements by

certain that TOR are understood and has the capacity to

offer a specified service.

14.10 PART 10: ANNEXURES

This can include professional registrations, insurances etc.

14.11 VAT

(where applicable).

14.11.2 KZNGFA reserves the right to request the preferred bidder

to register for VAT if the award is anticipated to be in excess

of R1m for 12 conservative months as the VAT Act requires.

15 PRESENTATIONS

15.1 KZNGFA reserves the right to invite bidders for

presentations before the award of the bid.

15.2 Presentation may affect the points awarded for functionality.

Yes No Noted If no, indicate

16 NEGOTIATION deviation

16.1 KZNGFA has the right to enter into negotiation with a

prospective contractor regarding any terms and conditions,

including price(s), of a proposed contract.

16.2 KZNGFA shall not be obliged to accept the lowest or any

financial offer or proposal. Furthermore, KZNGFA reserve

the right not to award the tender to highest ranking bidder

in terms of PPPFA.

16.3 All bidders will be informed whether they have been

successful or not. A contract will only be deemed to be

concluded when reduced to writing in a contract form signed

by the designated responsible person of both parties.

17 DOMICILIUM

17.1 The parties hereto choose domicilium citandi et executandi

for all purposes of and in connection with the final contract

as follows:

18 COST OF BID PREPARATION

18.1 Bidders shall prepare and submit a bid at their own

expense.

Yes No Noted If no, indicate

BID VALIDITY PERIOD deviation

19.1

Bid will be valid for a period of 120 days

19.2

The bidder will hold the tender offer(s) valid for acceptance

by the employer at any time during the validity period stated

in the tender data after the closing time stated in the tender

data.

19.3

If requested by the employer, the bidder will consider

extending the validity period stated in the tender data for an

agreed additional period.

20 ISSUE ADDENDA

20.1

If necessary, KZNGFA may issue addenda that may amend

or amplify the tender documents to each tenderer during the

period from the date that tender documents are available

until seven days before the tender closing time stated in the

Tender Data. If, as a result a tenderer applies for an

extension to the closing time stated in the Tender Data, the

Employer may grant such extension and, shall then notify

those tendering entities appearing on the attendance list

20.2

tendering entity. Addenda will be issued to and tenders will

be received only from those tendering entities appearing on

the attendance list

20.3

Tenderers are obliged to acknowledge, in writing, receipt of

addenda to the tender documents, which the employer may

issue.

SUBMITTING OF FRAUDULENT DOCUMENTS Yes No Noted If no, indicate

deviation

21.1

KZNGFA will disregard the bid of any bidder if that bidder or

any of its directors have abused the institution’s supply

chain management system and or committed fraud or any

other improper conduct in relation to such system.

21.2

KZNGFA will list bidders/ directors in the list of restricted

suppliers, and they will not conduct any business with an

organ of state.

GENERAL CONDITIONS OF CONTRACT (GCC)

22.1

KZNGFA will disregard the bid of any bidder if that bidder

has not initialled and signed the GCC

SPECIAL CONDITIONS OF CONTRACT (SCC)

23.1

KZNGFA will disregard the bid of any bidder if that bidder

has not initialled and signed the SCC

C.4 CERTIFICATE OF AUTHORITY TO SIGN A BID

(I) (II) (III) (IV) (V) (VI)

CLOSE COMPAN SOLE PARTNE CO- JOINT

CORPOR IES PROPRIE RSHIP OPERATI VENTURE /

ATION TOR VE CONSORTIUM

Incorporate

d

Unincorpor

ated

I/We, the undersigned, being the Member(s) of Cooperative/ Sole Owner (Sole Proprietor)/

Close Corporation/ Partners (Partnership)/ Company (Representative) or Lead Partner

(Joint Venture / Consortium), in the enterprise trading as:

.....................................................................................................................

...............

hereby authorise Mr/Mrs/Ms ..........................................................................................

acting in the capacity of .................................................................................................

whose signature is .........................................................................................................

to sign all documents in connection with this bid and any contract resulting therefrom on behalf of the enterprise.

NAME ADDRESS SIGNATURE DATE

(if the space provided is not enough, please list all the director in the resolution letter)

Note:

signatory to sign all documents in connection with this bid and any contract resulting therefrom on behalf of the

enterprise.

Note: Director/s may appoint themselves if they will be the one signing all documents in connection

with this bid and any contract resulting therefrom on behalf of the enterprise.

C.5 PROCUREMENT TIMELINES

PROCUREMENT TIMELINE DATE TIME

06 February 2026

RFP Release Date 10:00am

16 February 2026 Compulsory briefing session and

09:00am

clarification

24 February 2026 Written questions of clarification – closing

16:00pm

date

27 February 2026

Written response to all clarifications 16:00pm

06 March 2026

Service Provider Proposals Due 11:00am

05 June 2025

Completion of Bid Evaluations 16:00pm

12 June 2026

Anticipated letter of Award 16:00pm

01 July 2026

Commencement Date 09:00am

*Indicative dates

C.6 EVALUATION PROCESS & CRITERIA

proposals.

EVALUATION PROCESS

1.1 STAGE ONE: ADMINISTRATION COMPLIANCE

All bids duly lodged will be examined to determine

1.1.1 compliance with bidding requirements and conditions.

Bids with obvious deviations from the

requirements/conditions, will be eliminated from further

adjudication.