Internal audit services for fasset (CON3599/26)

Compulsory briefing session: Online Microsoft Teams on 18 August 2026, 11:00 am to 12:00 pm. Link: https://teams.microsoft.com/meet/310272946476636?p=yxd8KG7yqqa8XwqpMz, Meeting ID: 310 272 946 476 636, Passcode: C2tR37zi.

Closing date: 04 September 2026 at 11:00 am. Late bids will not be considered.

SCM enquiries deadline: 25 August 2026 at 11:00 am.

Technical enquiries deadline: 25 August 2026 at 11:00 am.

Compulsory briefing session: Online Microsoft Teams on 18 August 2026, 11:00 am to 12:00 pm. Link: https://teams.microsoft.com/meet/310272946476636?pwd=yxd8KG7yqqa8XwqpMz, Meeting ID: 310272946476636, Passcode: C2tR37zi.

SCM enquiries: [email protected], by 25 August 2026 at 11:00 am.

Technical enquiries: [email protected], by 25 August 2026 at 11:00 am.

Two-envelope system: Envelope 1 (Technical Proposal) must contain functional ability, experience, project methodology, and preferential procurement goals; the financial offer must not be included or hinted at. Envelope 2 (Financial Proposal) must contain detailed pricing, cost breakdowns, and total bid amount.

Submissions must be made online via the provided link, labelled with the tender number. Email and fax submissions are not accepted. Late submissions will be disqualified.

Returnable documents: completed and signed SBD forms (initialled on all pages), three contactable reference letters, latest valid CSD report, valid company registration documents, valid original or certified B-BBEE certificate or sworn affidavit, and for a Joint Venture a consolidated B-BBEE certificate and joint venture agreement. Tax compliance status PIN required.

Disqualification risks: missing or unsigned returnable forms, failure to initial all pages, late submissions, or submissions by email/fax.

Functionality evaluation: minimum threshold of 70 out of 100 points must be achieved to qualify for further evaluation on the 80/20 preference points system.

Criteria and weights:

• Overall Experience (40 points): Company Experience in public sector internal audit (15), Reference Letters in public sector (5), Company Experience in SETA (15), Reference Letters in SETA (5).
• Project Plan and Methodology (10 points).
• Resources and allocation (40 points): Resource Plan, Capacity and Financial Sustainability (10 points), Expertise and Capability of Staff (30 points).
• Quality Assurance and Improvement Programme (10 points).

Scoring for company experience in public sector: more than 15 years = 5 points, 12-15 years = 4, 10-12 years = 3, 8-10 years = 2, 5-8 years = 1, failure to substantiate = 0.

Reference letters must be on official letterhead, relate to completed contracts within the last 10 years, describe services and contract period, provide contactable reference person, and be from different institutions. Scoring: 5 or more letters = 5 points, 4 = 4, 3 = 3, 2 = 2, 1 = 1, none = 0.

Scoring for company experience in SETA: more than 15 years = 5 points, 12-15 = 4, 10-12 = 3, 8-10 = 2, 5-8 = 1, failure to substantiate = 0. SETA reference letters must meet same requirements and be from different SETAs.

Project Plan and Methodology: 5 points for addressing all five requirements (methodology, project plan, quality assurance, reporting arrangements, progress monitoring), 4 for four, 3 for three, 2 for two, 1 for one, 0 for none or failure to submit.

Resource Plan, Capacity and Financial Sustainability: 5 points for addressing all four sub-sections (resource plan and team structure, approach to resourcing, tools/methodologies/systems, financial sustainability), 3 for three, 2 for two, 1 for one, 0 for none or failure to substantiate.

Expertise and Capability of Staff: score each of six positions (Engagement Partner/Director, Senior Audit Manager, Internal Audit Manager, IT Specialist, Senior Internal Auditor, Internal Auditor) out of 5 points based on meeting minimum requirements and years of experience. For Internal Auditor position, score based on least experienced proposed auditor.

QAIP: 5 points for documented QAIP aligned to Global Internal Audit Standards, internal quality reviews, monitoring and corrective actions, and readiness for external reviews; 3 for partial arrangements; 1 for minimal or ad hoc controls; 0 for failure to substantiate.

Pricing and preferential point system (80/20): 80 points for price, 20 for specific goals: Black People Ownership (100% = 5, 51% = 3, less than 51% = 0), Black Woman Ownership (100-50% = 5, 49% and less = 0), Black Youth Ownership (100-50% = 5, 49% and less = 0), People with Disability Ownership (1 or more = 5, none = 0).

Objective: appoint a suitable, independent service provider to provide internal audit services to FASSET for a period commencing on 1 September 2026 or the contract commencement date, whichever occurs first, and ending on 31 March 2030.

Role: Provide independent assurance and advisory services to support the Audit and Risk Committee (ARC), Accounting Authority, and management. The function reports functionally to the ARC and administratively to the CEO.

Mandatory core services:

• Risk-based planning: prepare a rolling three-year strategic internal audit plan and a detailed annual plan for ARC approval.
• Execution of internal audit engagements: assurance over governance, risk management, controls, financial and operational reporting, compliance, safeguarding of assets, and performance.
• Information systems and IT assurance: audits of IT governance, application, and IT general controls, including the cyber environment.
• Communication and reporting: report findings to management, obtain responses, submit final reports to the ARC, escalate significant matters promptly.
• Follow-up on audit actions: perform follow-up procedures and report progress and overdue actions to the ARC.
• ARC support: attend ARC meetings, provide updates, and provide an annual overall conclusion on the audited control environment.
• Combined assurance coordination: coordinate with external auditors and other assurance providers.
• Ethics, independence, and quality: maintain a Quality Assurance and Improvement Programme (QAIP).

Value-added services (subject to ARC approval): advisory or consulting engagements, special reviews or ad hoc assignments, data analytics and CAATs, support for Combined Assurance Model maturity, and advisory on emerging risks including AI, Microsoft Copilot, and ICT governance.

Exclusions: Internal Audit shall not perform operational or management functions, design or implement controls, make management decisions, or assume risk ownership.

Fraud and irregularities: significant weaknesses in internal controls that may result in fraud or irregularities must be reported immediately to the CEO and/or ARC. Suspected or detected fraud must not be disclosed to other employees except as required for investigation or corrective action.

Competence requirements: The service provider must be independent, possess necessary skills and resources, demonstrate conformance with Global Internal Audit Standards, and ensure the Lead Engagement Partner holds an appropriate professional qualification (e.g., CIA, CA(SA), CISA, CFE). The provider must have a minimum of five years' experience in public sector internal audit (other than SETA) and five years' experience in the SETA environment.

Project Plan and Methodology: The bidder must submit a tentative comprehensive project plan and audit methodology that clearly explains how the internal audit services will be delivered. The submission must include:

1. A clear internal audit methodology, including risk-based internal audits and, where applicable, IT audits, performance audits, and internal financial controls.
2. A project plan outlining key activities, milestones, timelines, and expected deliverables.
3. Quality assurance arrangements to ensure audit work complies with professional standards.
4. Clear reporting arrangements, including reporting lines and formats.
5. A mechanism to monitor and report progress against the audit plan.

Scoring: 5 points for addressing all five requirements, 4 for four, 3 for three, 2 for two, 1 for one, 0 for none or failure to submit.

Resource Plan, Capacity and Financial Sustainability: The bidder must submit a resource plan demonstrating capacity, capability, tools, and financial sustainability. The submission must include:

1. Resource Plan and Team Structure: clear organogram, defined roles and responsibilities, appropriate mix of skills (governance, financial, compliance, IT audit), and ability to deploy additional staff.
2. Approach to Resourcing: how resources will be allocated to develop the internal audit plan and execute audits, and demonstration of capacity to cover FASSET's operational, ICT, and compliance risk areas.
3. Tools, Methodologies, and Systems: use of recognised internal audit methodologies aligned to IIA standards, and availability of audit tools and systems.
4. Financial Sustainability: audited or independently reviewed financial statements for the past three years confirming the entity is a going concern.

Scoring: 5 points for addressing all four sub-sections, 3 for three, 2 for two, 1 for one, 0 for none or failure to substantiate.

Expertise and Capability of Staff: The bidder must demonstrate the expertise and experience of the proposed project team. CVs of key personnel must be submitted, together with certified copies of relevant qualifications and proof of registration with recognised professional bodies, where applicable.

Scoring: Score each of six positions out of 5 points based on meeting minimum requirements and years of experience. For the Internal Auditor position, the score is based on the least experienced proposed auditor.

Positions and minimum requirements:

1. Engagement Partner/Director: relevant qualification at minimum NQF Level 8, membership of a recognised professional body (e.g., IIA SA, SAICA, SAIPA) with proof of registration, experience in internal audit or related assurance services within the public sector including SETA, and a detailed CV.
2. Senior Audit Manager: relevant qualification at minimum NQF Level 8, membership of a recognised professional body with proof of registration, experience in internal audit or related assurance services within the public sector including SETA, and a detailed CV.
3. Internal Audit Manager: relevant qualification at minimum NQF Level 7, membership of a recognised professional body with proof of registration, experience in internal audit or related assurance services within the public sector, and a detailed CV.
4. IT Specialist: relevant professional accreditation (e.g., CISA or equivalent) with proof of registration/certification, experience in IT audit or related assurance services, and a detailed CV.
5. Senior Internal Auditor: relevant qualification (minimum NQF Level 6/7 or IAT/PIA designation) with certified copy, experience in internal audit or related assurance services, and a detailed CV.
6. Internal Auditor: relevant qualification at minimum NQF Level 6 for all proposed internal auditors, experience in internal audit or related assurance services, and detailed CVs for all proposed internal auditors.

Experience bands: For each position, points are awarded according to years of relevant experience, with higher points for more years. If any minimum requirement is not met or no evidence is submitted, the position scores 0 points.

Quality Assurance and Improvement Programme (QAIP): The service provider must maintain a QAIP covering all aspects of the internal audit activity, in accordance with the Global Internal Audit Standards. The function shall be subject to an External Quality Assurance Review at least once every five years, performed by a qualified, independent assessor or assessment team, under the oversight of the Audit and Risk Committee.

QAIP scoring: 5 points for a documented QAIP aligned to Global Internal Audit Standards, internal quality reviews covering audit planning, execution, reporting, and follow-up, regular monitoring of audit quality and corrective actions, and readiness for or experience with external quality assurance reviews; 3 for partial arrangements or informal quality review processes; 1 for minimal or ad hoc quality controls; 0 for failure to substantiate.

Audit documentation: All audit documentation, including working papers and supporting records, shall be retained and made available to FASSET as required, including after the expiry or termination of the contract.

Pricing: Bidders must provide the basis on which services will be charged, reflect service discounts on the pricing schedule (Annexure A: Financial Proposal), and provide a detailed breakdown of the bid amount.

Prices must include all applicable taxes and all other costs related to the execution of the services. Prices must not be changed after submission, including subsequent VAT registration.

Arithmetic errors: if there is a discrepancy between words and figures, the amount in words takes precedence. If a line-item total differs from the unit rate multiplied by quantity, the line-item total governs and the unit rate is corrected. FASSET will notify the bidder of errors and offer a chance to confirm the corrected amount or withdraw.

Bid amount must be in South African Rand.

Payment: The successful service provider shall be paid in line with the accepted and approved Financial Proposal (part of the SLA) and satisfactory work detailed in the scope and submission of supporting documents.

CSD registration: proof of registration with the Central Supplier Database, with a CSD report not older than three months. Each party in a Joint Venture must provide proof.

Tax compliance: valid tax compliance status PIN required.

B-BBEE: valid original or certified B-BBEE certificate or sworn affidavit. For a Consortium/Joint Venture, a consolidated valid B-BBEE certificate and a joint venture agreement must be submitted.

Professional body registration: proof of registration, membership, or accreditation with a recognised professional body relevant to internal auditing (e.g., IIA SA, ISACA, SAICA). Failure to submit results in disqualification.

Standard Bidding Documents: completed and signed, initialled on all pages.

Joint Venture: written agreement setting out roles and responsibilities, with resolutions authorising signing.

National Treasury Restricted List: bidders or directors/shareholders on the list will be disqualified.

Company registration: valid company registration documents required.

Contract duration: Commencing on 1 September 2026 or the contract commencement date, whichever occurs first, and ending on 31 March 2030. Performance will be monitored against the SLA. FASSET may terminate the contract with written notice if performance is unsatisfactory.

Terms of engagement: The successful bidder shall not take more than one month from contract date to render services unless agreed. All data and information gained must be kept confidential. FASSET may require written permission before replacing proposed individuals. Documentation will be exchanged using Microsoft Office products. Reports and presentations may be required for Accounting Authority consideration. Fraudulent attempts to gain information or influence evaluation will result in disqualification. FASSET reserves the right not to appoint or award.

Conditions of tender: Proposals must include relevant information about the bidder, describe methodology, be comprehensive, and adhere to GCC and any Special Conditions. The person completing the bid must have requisite authority. No alteration to the contract is permitted unless agreed in writing. Misrepresentation of facts results in disqualification and cancellation.

Acceptance of submissions: No submission is accepted until a formal award letter is executed. Submissions remain open for 120 days from the returnable date. Extensions may be granted with notice. FASSET does not bind itself to accept the lowest or any bid and is not responsible for costs incurred by bidders. No change in bid amount after submission. FASSET may request amplification of unclear matters; failure to respond may lead to rejection.

Bid documents: The document in its entirety serves as the complete bid document. Proposals offering only part of the requirements will be rejected. Bidders must examine all instructions, forms, terms, and specifications. Failure to comply is at bidder's risk. Descriptive material may be included as annexes. The successful bidder's proposal may be incorporated into the final contract. Proprietary information should be marked.

Period of validity: Proposals shall remain valid for 120 days after submission. Shorter validity may be rejected. Extensions may be solicited in writing. Format and signing: Two envelope submissions (Functionality and Financial) signed by authorised person. No interlineations, erasures, or overwriting except corrections initialled.

Performance-based agreement: This is a performance-based agreement running from award to completion. Payment: The successful service provider shall be paid in line with the accepted and approved Financial Proposal (part of SLA) and satisfactory work. Due diligence: FASSET reserves the right to exercise due diligence on submitted tenders. Compliance with all relevant legislation is required.

Compliance with minimum requirements: Bidders must provide proof of CSD registration not older than three months (each party for JV), completed and signed Standard Bidding Documents, and for JV a written agreement setting out roles and responsibilities with resolutions authorising signing.

Mandatory requirements: The bidder must submit proof of registration, membership, or accreditation with a recognised professional body relevant to internal auditing (e.g., IIA SA, ISACA, SAICA). For individuals, proof of membership for the proposed engagement partner or CAE may be submitted. Failure to submit results in disqualification.

Returnable documents: completed and signed SBD forms, initialled on all pages, three contactable reference letters, latest valid CSD report, valid company registration documents, valid original or certified B-BBEE certificate or sworn affidavit, and for JV a consolidated B-BBEE certificate and joint venture agreement. Tax clearance certificate (SBD 2) and B-BBEE status level verification certificate (SBD 6.1) must be submitted.

Functionality evaluation: The minimum threshold score of 70 out of 100 must be achieved to qualify for further evaluation on the 80/20 preference points system. Criteria and weights: Overall Experience (40 points) - Company Experience in public sector internal audit (15 points), Reference Letters in public sector (5 points), Company Experience in SETA (15 points), Reference Letters in SETA (5 points); Project Plan and Methodology (10 points); Resources and allocation (40 points) - Resource Plan, Capacity and Financial Sustainability (10 points), Expertise and Capability of Staff (30 points); Quality Assurance and Improvement Programme (10 points).

Scoring for company experience in public sector internal audit: more than 15 years = 5 points, 12-15 years = 4, 10-12 years = 3, 8-10 years = 2, 5-8 years = 1, failure to substantiate = 0. Reference letters must be on official letterhead, relate to completed contracts within last 10 years, describe services and contract period, provide contactable reference person, and be from different institutions. Scoring: 5 or more letters = 5 points, 4 = 4, 3 = 3, 2 = 2, 1 = 1, none = 0.

Scoring for company experience in SETA environment: more than 15 years = 5 points, 12-15 = 4, 10-12 = 3, 8-10 = 2, 5-8 = 1, failure to substantiate = 0. Reference letters for SETA must meet same requirements as public sector letters and be from different SETAs. Scoring: 5 or more = 5, 4 = 4, 3 = 3, 2 = 2, 1 = 1, none = 0.

Project Plan and Methodology scoring: 5 points for addressing all five requirements (methodology, project plan, quality assurance, reporting arrangements, progress monitoring), 4 for four requirements, 3 for three, 2 for two, 1 for one, 0 for none or failure to submit.

Resource Plan, Capacity and Financial Sustainability scoring: 5 points for addressing all four sub-sections (resource plan and team structure, approach to resourcing, tools/methodologies/systems, financial sustainability), 3 for three, 2 for two, 1 for one, 0 for none or failure to substantiate.

Expertise and Capability of Staff scoring: Score each of six positions (Engagement Partner/Director, Senior Audit Manager, Internal Audit Manager, IT Specialist, Senior Internal Auditor, Internal Auditor) out of 5 points based on meeting minimum requirements and years of experience. For Internal Auditor position, score based on least experienced proposed auditor.

QAIP scoring: 5 points for documented QAIP aligned to Global Internal Audit Standards, internal quality reviews, monitoring and corrective actions, and readiness for external reviews; 3 for partial arrangements; 1 for minimal or ad hoc controls; 0 for failure to substantiate.

Pricing and preferential point system (80/20): Bidders achieving minimum 70% on functionality are evaluated on price and specific goals. 80 points for price, 20 for specific goals: Black People Ownership (100% = 5, 51% = 3, less than 51% = 0), Black Women Ownership (100-50% = 5, 49% and less = 0), Black Youth Ownership (100-50% = 5, 49% and less = 0), People with Disability Ownership (1 or more = 5, none = 0).

Summary of compliance and elimination reasons: Bidders must submit one Functionality and one Financial Proposal, otherwise disqualified. Bidders or directors/shareholders on the National Treasury Restricted List will be disqualified. Additional elimination criteria include failure to initial all pages, non-compliance with B-BBEE requirements, and missing VAT registration where applicable.