RFI: development of a compliance risk assessment and monitoring (cram) tool – national treasury

Background on the project

Prepared by:

SCM CRAM Tool Orientation DIRECTORATE: June 2025 3 (Version 02) GOVERNANCE, MONITORING & COMPLIANCE

House with solid fill

Introduction Methodology Orientation Risk library Implementation

Office of the Chief Procurement Officer

In 2023, the Governance, Monitoring and Compliance (GMC) directorate under the Office of the Chief Procurement Officer (OCPO) initiated on a research project to improve and solidify

Supply Chain Management (SCM) compliance risk assessments and monitoring across the various spheres of government. The primary objective of this project is to conduct effective research

aimed at assisting accounting officers and authorities in improving service delivery by enhancing compliance with SCM prescripts. This research is crucial for achieving government’s goals

through the improvement of processes, procedures, and adherence to legislative and regulatory requirements within the public sector. The secondary objectives include providing a content-

relevant, quality-assured, and approved Compliance Risk Assessment. This will serve as the basis for the development and implementation of a Compliance Monitoring Plan across all

spheres of government. Additionally, this project seeks to address the compliance deficiencies identified by the Auditor-General in the General Reports on procurement audit outcomes and in

the audit reports of state organs. The outcome will be relevant to state institutions and will help in strengthening governance and accountability within public sector SCM processes.

Following a situational analysis and interviews a SCM Compliance Risk Assessment and Monitoring (SCM CRAM) tool was developed to assist departments, municipalities, and public entities

to:

• Evaluating their current SCM compliance risk environment maturity levels and risks.
• Identifying areas for improvement,
• Developing improvement plans, and
• Monitoring the implementation of these plans

The SCM CRAM tool integrates SCM legislation, compliance, and risk management principles, enabling a proactive approach to enhance the overall SCM risk and compliance environment

within public sector organisations.

Purpose of this document

The purpose of this document is to provide step-by-step guidance on how to use the SCM CRAM Tool, along with background information on its development and the next phase of this

project.

Prepared by:

SCM CRAM Tool Orientation DIRECTORATE: June 2025 4 (Version 02) GOVERNANCE, MONITORING & COMPLIANCE

House with solid fill

Introduction Methodology Orientation Risk library Implementation

Office of the Chief Procurement Officer

SCM Compliance Risk Management

An overarching SCM Compliance Risk Management Framework integrates three distinct and established frameworks or best practices, as illustrated below. Thus, the SCM CRAM Tool has

incorporated all the following key areas to ensure that a comprehensive assessment tool was developed.

SCM

Legislative

landscape,

SCM Legislative landscape & SCM frameworks

Risk management framework Compliance framework and guides framework/ guide

• Environment & functionality
• Environment
• Legislation, regulations, circulars, etc.
• Policy
• Risk identification
• Roles & responsibilities (capacity requirements) SCM
• Elements of SCM
• Risk Assessment Compliance
• Key processes
• Combined assurance
• Risk response Risk
• Identification of universe Management
• Communication/ Reporting
• Compliance plan
• Monitoring
• Compliance risk assessment Compliance Risk
• Compliance monitoring plan framework management

framework

In addition to the above frameworks, the existing Financial Management Capabilities Maturity Model (FMCMM) was specifically utilised to

define the various levels of maturity and identify key characteristics at each level. To further zone in and easily identify which area or

enabler of the entity was lacking or excelling in SCM Compliance Risk Management, the People, Processes, and Technology (PPT)

framework was also incorporated into both the framework and the tool.

Prepared by:

SCM CRAM Tool Orientation DIRECTORATE: June 2025 5 (Version 02) GOVERNANCE, MONITORING & COMPLIANCE

House with solid fill

Introduction Methodology Orientation Risk library Implementation

Office of the Chief Procurement Officer

{"name":null,"email":null,"phone":null,"department":"National Treasury (Office of the Chief Procurement Officer)","address":"evelopment and implementation of a Compliance Monitoring Plan across all"}

The document does not specify eligibility criteria such as CSD registration, tax clearance, B-BBEE level, or CIDB grading. As this is an RFI, no formal evaluation criteria are provided. Bidders are expected to respond to the information requested, which includes details on the tool's development and functionality.

The SCM CRAM Tool is a self-assessment instrument designed for public sector entities to evaluate and monitor their supply chain management compliance. The tool is structured into 6 areas (A to F) covering the compliance universe, each with associated risks and capabilities. It uses a maturity model with 6 levels and requires quarterly updates on the implementation status of mitigation actions. The tool will be used by departments, municipalities, and public entities. The document describes an Excel-based tool with a cover page, content page, and step-by-step orientation (Steps 1 to 10) covering: maturity assessment, risk assessment, gap analysis, and improvement/monitoring planning. Users must select dropdown optionscars to reflect progress, and update mitigation statuses quarterly.

The tool was developed through a research project initiated in 2023 by the Governance, Monitoring and Compliance directorate. The methodology involved analysing the legislative and compliance framework, identifying key areas and elements, and defining maturity levels based on the Financial Management Capabilities Maturity Model (FMCMM). The tool incorporates People, Processes, and Technology (PPT) framework and covers areas such as SCM Compliance Risk Environment, Demand Management, Acquisition Management, Contract Management, Performance Management, and Other areas.

No specific requirements found

B-BBEE Minimum Level: 1

Background

In 2023, the Governance, Monitoring and Compliance (GMC) directorate under the Office of the Chief Procurement Officer (OCPO) initiated on a research project to improve and solidify

Supply Chain Management (SCM) compliance risk assessments and monitoring across the various spheres of government. The primary objective of this project is to conduct effective research

aimed at assisting accounting officers and authorities in improving service delivery by enhancing compliance with SCM prescripts. This research is crucial for achieving government’s goals

through the improvement of processes, procedures, and adherence to legislative and regulatory requirements within the public sector. The secondary objectives include providing a content-

relevant, quality-assured, and approved Compliance Risk Assessment. This will serve as the basis for the development and implementation of a Compliance Monitoring Plan across all

spheres of government. Additionally, this project seeks to address the compliance deficiencies identified by the Auditor-General in the General Reports on procurement audit outcomes and in

the audit reports of state organs. The outcome will be relevant to state institutions and will help in strengthening governance and accountability within public sector SCM processes.

Following a situational analysis and interviews a SCM Compliance Risk Assessment and Monitoring (SCM CRAM) tool was developed to assist departments, municipalities, and public entities

to:

• Evaluating their current SCM compliance risk environment maturity levels and risks.

• Identifying areas for improvement,

• Developing improvement plans, and

• Monitoring the implementation of these plans

• Environment & functionality

• Environment

• Legislation, regulations, circulars, etc.

• Policy

• Risk identification

• Roles & responsibilities (capacity requirements) SCM

• Elements of SCM

• Risk Assessment Compliance

• Key processes

• Combined assurance

• Risk response Risk

• Identification of universe Management

• Communication/ Reporting

• Compliance plan

• Monitoring

• Compliance risk assessment Compliance Risk

• Compliance monitoring plan framework management

framework

In addition to the above frameworks, the existing Financial Management Capabilities Maturity Model (FMCMM) was specifically utilised to

define the various levels of maturity and identify key characteristics at each level. To further zone in and easily identify which area or

enabler of the entity was lacking or excelling in SCM Compliance Risk Management, the People, Processes, and Technology (PPT)

framework was also incorporated into both the framework and the tool.

compliance risk assessment & aimed at helping entities assess and monitor their

monitoring framework SCM compliance risk environment. The process

starts with creating a framework or guide that

provides an understanding of SCM Compliance

Level 2 Developmental impact

• Risk of non-competitive practices and supplier favouritism.

in place, but lacking standardisation and consistency.

• Limited controls over supplier selection and contract management.
• Standardised and documented procurement procedures consistently enforced.

A public sector entity with a focus on ensuring adequate

• Clear roles and responsibilities for procurement activities.

Level 3 Controlling the environment resources, asset safeguarding, reliable data, and controlled

• Established vendor selection criteria and competitive bidding processes.

operations (compliant)

• Reduced risk of fraud, waste, and abuse in procurement.
• Standardised and consistently enforced procurement procedures with a focus on cost-

The diagram illustrates the annual implementation cycle of the SCM CRAM tool, beginning with two assessments: Maturity Assessment: Evaluates an entity's SCM compliance

capabilities against a predefined maturity model. Risk Assessment: Identifies risks based on the entity's maturity level, with lower maturity often linked to higher risks.

risk assessment, an analysis is performed that identifies controls needed to mitigate risks. Unimplemented controls and actions are added to a consolidated Improvement

Step 5 SCM Compliance Risk Assessment & Analysis 2. Risk - Assessment risks. An analysis is performed to identify which mitigations are not in place. The default risk rating is

determined by the level of maturity.

Step 6 SCM Compliance Risk Assessments & Analysis - Results 2. Risk - Dashboard The results of the risk assessment are displayed in this tab.

An analysis is performed to determine which actions need to be implemented to progress to the desired Step 7 Gap Analysis 3. Analysis - Gap level of maturity.

All mitigation actions from the risk assessment and the actions from the gap analysis are consolidated in Step 8 Improvement & Monitoring Plan 4. Improve. & Monitor plan this tab, providing a comprehensive list of actions to be implemented.

Step 9 Updating of Improvement & Monitoring Plan – Status 4. Improve. & Monitor plan The progress of the various actions needs to be updated quarterly to reflect the status of implementation.

This tab provides graphs and tables that can be filtered to summarise the progress of the implementation Step 10 Improvement & Monitoring Plan Dashboard 5. Monitoring - Dashboard plan.

Throughout the document various colours are used for “cells”, this is to indicate the following:

Key:

1. In the folder where the document is saved, right click on the file to reveal various options, select the “Properties” option.

The update button does not work (macro not

2 working) OR

Security risk notification appears 2. On the Properties window, under “General” tab, ensure that at the bottom, where it speaks about “Security”, the “Unlock” block is selected and then click on “Apply”

and then “OK” for it to close the window.

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Office of the Chief Procurement Officer SCM Compliance Risk Maturity Assessment – Results

To access the maturity assessment results, click on “Results” after completing the SCM Compliance Risk Maturity Assessment or it can be accessed from the Content page.

Ref. 1 2 3 4 5 6 7

When you click on Update Provides the user with a Summarises the level of Takes you to back to Allows you to update the Results the followingInstructions/ Takes you back to Takes you to the Risk guide on the colour scale maturity for each of the 6 the Maturity results, if any changes notification will appear,comment the “Home” page assessment tab. used for each of the areas and an overall rating for Assessment tab. are made. confirming that the results maturity levels. each enabler. have been updated.

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Office of the Chief Procurement Officer SCM Compliance Risk Assessment & Analysis – Results

To access the risk assessment results, click on “Results” after completing the SCM Compliance Risk Assessment or it can be accessed from the Content page.

1 Takes you back to the “Home” Takes you to back to the Risk Assessment tab.

7 element and enabler. The number represents the average risk

rating based on the assessment performed.

When you click on Update Results the following notification 8 will appear, confirming that the results have been updated

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10

Office of the Chief Procurement Officer SCM Compliance Risk Assessment & Analysis – Results

Included on the risk assessment results page is a list of the entity’s top risks based on the risk rating.

requirements mitigation factors tool an understanding of the compliance universe was

unpacked and data from interviews to address

Incorporated all data from interviews – allowing us to specific risks and practical mitigation actions.

generate practical risks and mitigation actions

Assessments: During the implementation phase (i.e. the

Maturity & Risk utilisation of the tool) the entity first begins by

assessing their current maturity level in SCM

Level 1 Starting up

• Absence of vendor selection criteria or competitive bidding processes.

policies, practices, or control frameworks

• Increased risk of fraud, waste, and abuse due to lack of controls over procurement and

supplier relationships.

• Procurement procedures exist but may not be fully documented or consistently applied.

Level 4 Information integration

systems for efficient and economical resource management.

• Strong vendor management practices to mitigate risks.
• Procurement information integrated with financial systems for better decision-making.
• Strategic procurement practices focused on cost optimization and value for money.

A public sector entity that uses financial and operational

• Supplier performance metrics integrated with financial data for informed sourcing decisions.

Level 5 Management of resources information to optimise resource utilisation and achieve cost-

• Dynamic risk management adapting to changing conditions and opportunities.

effective results.

• Cost-benefit analysis incorporated into decision-making processes.
• Strategic sourcing practices leverage market intelligence and supplier innovation.

A public sector entity that leverages internal and external

• Supply chain optimization for cost reduction, efficiency, and agility.

Level 6 Optimisation information for strategic improvement and value creation.

• Proactive risk management anticipating future challenges and opportunities.
• Risk mitigation strategies aligned with strategic objectives and continuous improvement

(risk mitigation actions) to be implemented

As you scroll to the right, after “Mitigation action – grouping” column, the following columns are also present and is used to identify what mitigation actions need to be implemented. This

information is consolidated and included in the improvement and monitoring tab.

Ref. 1 2 3 4 5 6 7

recommended “No”, the action will be Select the applicable mitigation action is or automatically added. Input the target date Select the applicable Input who theInstructions/ Select the priority level financial year that this isn’t already in place. Or Should the response be that this action will be quarter that this action responsible person will

comment for this action. action will be if it needs enhancement “Yes” no further implemented by. will be implemented by. be. implemented by. or an alternative action information needs to be

is required. completed.

recommended “No”, the action will be Select the applicable mitigation action is or automatically added. Input the target date Select the applicable Input who the Instructions/ Select the priority level financial year that this isn’t already in place. Or Should the response be that this action will be quarter that this action responsible person will comment for this action. action will be if it needs enhancement “Yes” no further implemented by. will be implemented by. be. implemented by. or an alternative action information needs to be

is required. completed.

Supplier Relationship and Performance Management 1 3 1 5

Consequence Management and Dispute Resolution 1 8 3 12

E Performance Management Enhancement of SCM Processes and Systems 1 5 1 7

SCM, Bid Documentation Management and Reporting 1 8 4 13

Asset Management 1 2 2 5

F Other Disposal Management 1 3 1 5

Logistics Management 1 1 1 3

Grand Total 25 74 33 132

• Environment & functionality

relevant, quality-assured, and approved Compliance Risk Assessment. This will serve as the basis for the development and implementation of a Compliance Monitoring Plan across all

No document content found in ZIP archive

Bidders must submit a valid original SARS Tax Clearance Certificate. Bidders must comply with all applicable General Conditions of Contract (GCC), including prohibitions on corrupt, fraudulent, and restrictive practices. The successful bidder must provide a performance security within 30 days of contract award (amount specified in Special Conditions of Contract). The Department may impose a restriction of up to 10 years on bidders found guilty of default, corruption, or collusive bidding.

provisions

in the SCC shall prevail.

Table of clauses

1. Definitions
2. Application
3. General
4. Standards
5. Use of contract documents and information; inspection
6. Patent rights
7. Performance security
8. Inspections, tests and analysis
9. Packing
10. Delivery and documents
11. Insurance
12. Transportation
13. Incidental services

Bidders must submit a valid original SARS Tax Clearance Certificate before award; no contract is concluded with a bidder whose tax matters are not in order.

The successful bidder must furnish a performance security within 30 days of contract award, in the amount and form specified in the Special Conditions of Contract (bank guarantee, irrevocable letter of credit, or cashier's/certified cheque).

Bidders must comply with the General Conditions of Contract, including prohibitions on corrupt, fraudulent, and restrictive practices. Collusive bidding may be referred to the Competition Commission and can result in bid invalidation, contract termination, or restriction from public-sector business for up to 10 years.

The National Industrial Participation Programme (NIPP) applies to contracts subject to the NIP obligation.

The General Conditions of Contract (GCC) form part of all bid documents and may not be amended. Special Conditions of Contract (SCC), where applicable, supplement the GCC and prevail in any conflict.

Contract amendments require a written amendment signed by both parties. The supplier may not assign obligations without the purchaser's prior written consent, and must notify the purchaser in writing of all subcontracts awarded.

Payment: the supplier invoices with a copy of the delivery note; payment is made within 30 days of invoice or claim, in Rand unless otherwise stated in the SCC.

Prices: quoted prices may not vary from the bid, except for adjustments authorised in the SCC or a bid validity extension.

Warranty: goods must be new and defect-free; the warranty runs 12 months after delivery and acceptance, or 18 months after shipment, whichever ends earlier, unless the SCC states otherwise.

Delays: the supplier must notify the purchaser in writing of any conditions impeding timely delivery. Penalties for late delivery are calculated on the delayed price using the current prime interest rate per day of delay.

Termination for default: the purchaser may terminate in whole or part for failure to deliver, failure to perform obligations, or corrupt/fraudulent practices, and may restrict the supplier from public-sector business for up to 10 years.

Force majeure: the supplier is not liable for delay caused by force majeure, but must notify the purchaser in writing and continue performing as far as reasonably practical.

Disputes: parties first attempt amicable resolution; after 30 days, either party may give notice to commence mediation; unresolved disputes may be settled in a South African court.

Limitation of liability: the supplier is not liable for indirect or consequential loss, and aggregate liability is limited to the total contract price, except for penalties, damages, or defective equipment repair.

Governing language and law: the contract is in English and interpreted under South African law.

Confidentiality: the supplier must not disclose contract documents or information without prior written consent; documents remain the purchaser's property and must be returned on completion.

Inspection: the purchaser may inspect the supplier's premises and records; non-compliant supplies may be rejected and replaced at the supplier's cost.

Taxes and duties: local suppliers are responsible for all taxes and duties until delivery; foreign suppliers for levies outside the purchaser's country.

Restrictive practices: collusive bidding is prohibited under the Competition Act; the purchaser may refer matters to the Competition Commission and restrict guilty bidders from public-sector business for up to 10 years.

The RFI is for the development of a Compliance Risk Assessment and Monitoring (CRAM) tool for National Treasury.

Closing date: 04 September 2026 at 11:00 AM.

Bidding procedure enquiries: National Treasury. Technical enquiries: [email protected].

Returnable documents: SBD 3.3 Pricing Schedule (professional services), completed and signed. The offer must be valid for 90 days from the closing date. Bidders must quote in accordance with the attached terms of reference and provide a total cost breakdown. Quotations must be submitted by the closing time.

The RFI is for the development of a Compliance Risk Assessment and Monitoring (CRAM) tool for National Treasury. Services must be quoted in accordance with the attached terms of reference.

Pricing must be in South African Rand, inclusive of VAT. Bidders must provide a total cost for the assignment and a cost breakdown. The financial proposal must cover all assignment activities and outputs. Bidders must state the period required for commencement after acceptance of the bid. Rates must be firm for the full period; if not, provide the basis for adjustments (e.g., CPI).

Pricing must be in South African Rand, inclusive of VAT. Bidders must provide a total cost for the assignment and a cost breakdown. The financial proposal must cover all assignment activities and outputs. Bidders must state the period required for commencement after acceptance of the bid. Rates must be firm for the full period; if not, provide the basis for adjustments (e.g., CPI).

No specific requirements found

Bidding procedure enquiries: National Treasury. Technical enquiries: [email protected].

National Treasury seeks information from seasoned service providers for the design, development and implementation of a Compliance Risk Assessment and Monitoring (CRAM) Tool. The tool enables organizations to systematically identify, assess, and manage SCM compliance risks across all spheres of government. The objective of this RFI is to obtain comprehensive information into the costs of designing, developing, and implementing the CRAM Tool, while identifying industry-leading practices and implementation strategies that can optimize operational effectiveness. Currently compliance officers, supply chain practitioners, risk managers, and senior officials within government institutions use manual processes to monitor SCM compliance. National Treasury Office of the Chief Procurement Officer (OCPO) has developed the SCM Compliance Framework to support ongoing compliance monitoring, risk management, and strategic planning within SCM functions.

{"closingDate":"04 SEPTEMBER 2026","closingTime":"11H00"}

{"name":null,"email":null,"phone":null,"department":"al /Institutional SCM Policy","address":"mpliance Risk Assessment & Analysis"}

No formal eligibility or pre-qualification criteria are stated in the RFI. Bidders must be seasoned service providers with experience in implementing supply chain management governance monitoring for government or private sector clients. The RFI is open to any vendor able to demonstrate relevant experience and alignment with National Treasury's operational requirements. No CSD registration, tax clearance, B-BBEE level, CIDB grading, or other mandatory thresholds are specified in the document.

Ff

Request for information (RFI)

RFI002-2026: request for information (RFI) for

Development of a compliance risk assessment and

Monitoring (cram) tool for national treasury.

Closing date and time of RFI

04 september 2026 at 11h00

of 11

Request for information (RFI) for development of a request for compliance risk assessment and monitoring (cram)

Tool for national treasury information

Table of Contents

1. Section a: request for information .................................................................. 5

2. Introduction ............................................................................................................ 5

3. Background .............................................................................................................. 5

4. Objectives .................................................................................................................. 5

5. Information requested ......................................................................................... 6

of 11

Request for information (RFI) for development of a request for compliance risk assessment and monitoring (cram)

Tool for national treasury information

Annexures

Annexure A : NT SCM CRAM Tool - User guide

Annexure B : SCM CRAM Tool Content Spreadsheet (Designs/Wireframes)

Annexure C : SCM CRAM Tool Risk Library

of 11

Request for information (RFI) for development of a request for compliance risk assessment and monitoring (cram)

Tool for national treasury information

Legislative framework

• The constitution of the Republic of SA, 1996.

• Section 217. (1) When an organ of state in the national, provincial or local sphere of government, or any other

institution identified in national legislation, contracts for goods or services, it must do so in accordance with

a system which is fair, equitable, transparent, competitive and cost-effective.

• Public Finance Management Act (PFMA and its regulations)

• Municipal Finance Management Act (MFMA and its regulations)

• Municipal Systems Act

• Public Procurement Act of 2024

• Preferential Procurement Policy Framework Act (PPPFA and its regulations)

• Broad - Based Black Economic Empowerment Act (B-BBEE)

• Construction Industry Development Board Act No. (CIDB)

• Promotion of access to information Act (PAIA)

• Promotion of Administrative Justice Act (PAJA) 3 0f 2000

• The Prevention and Combating of Corrupt Activities Act No. .

• National Treasury Practice and Instruction notes and Circulars.

• SCM: A guide to Accounting Officers (Not an Act – Not a regulation)

• Departmental /Institutional SCM Policy

• Preferential Procurement Regulations Of 2022 (PPR)

• Public procurement Act

of 11

Request for information (RFI) for development of a request for compliance risk assessment and monitoring (cram)

Tool for national treasury information

Section a: request for information

Information from seasoned service providers is being sought by National Treasury for the design,

development and implementation of a Compliance Risk Assessment and Monitoring (CRAM)

Tool. The CRAM Tool enables organizations to systematically identify, assess, and manage SCM

compliance risks across all spheres of government. The objective of this RFI is to obtain

comprehensive information into the costs of designing, developing, and implementing the CRAM

Tool, while identifying industry-leading practices and implementation strategies that can

optimize operational effectiveness.

Currently compliance officers, supply chain practitioners, risk managers, and senior officials

within government institutions use manual processes to monitor SCM compliance. Compliance

risk assessment and monitoring tools play a critical role in helping institutions evaluate their

existing compliance frameworks, prioritize risks, and implement improvement plans aligned with

regulatory requirements and industry standards. National Treasury Office of the Chief

Procurement Officer (OCPO) have developed the SCM Compliance Framework to support

ongoing compliance monitoring, risk management, and strategic planning within SCM functions.

3. Objectives

The objective of this Request for Information (RFI) is to obtain detailed information on the costs

associated with the design, development, and implementation of the electronic Compliance,

Risk Assessment and Monitoring (CRAM) Tool. Service providers are requested to provide

information that will enable the Department to:

4.1. Gather data on estimated costs, industry best practices, and implementation timelines.

4.2. Assess the capabilities and experience of potential service providers.

Determine the value that a third-party provider could bring to the implementation and

operation of the CRAM Tool.

4.3. Evaluate the proposed deployment, maintenance, and support arrangements of

prospective service providers.

4.4. Assess the feasibility of integrating the CRAM Tool with existing government systems.

4.5. Confirm compliance with applicable security, regulatory, and governance requirements.

of 11

Request for information (RFI) for development of a request for compliance risk assessment and monitoring (cram)

Tool for national treasury information

4.6. Obtain a comprehensive understanding of the business models and service offerings of

potential providers.

4.7. Explore innovative solutions and alternative approaches that could enhance

transparency, improve efficiency, and deliver cost savings to government.

4. Information requested

Interested vendors are requested to provide information on the following aspects:

5.1. Company Information

• Company profile and experience in implementing supply chain management governance

monitoring for government or private sector clients.

• Key clients relevant to this RFI.

5.2. Solution Overview

• Proposed CRAM Tool, including key features and functionalities.
• Technical architecture and technology stack. (refer to paragraph 5.7)
• Scalability and flexibility of the solution to accommodate future needs.

5.3. Functional Requirements

• Assessments (Maturity Assessment, Risk Assessment, Risk Analysis, & Gap Analysis)
• Assessments approvals, queries, and activities
• Improvement Plan and Monitoring
• Forecasted assessment
• Results, Reporting Dashboards and Risk Library
• Search functionality, Standard Reports, and Integrations
• User management, FAQs, Help functionality and User guide
• Post implementation support
• Search engine optimization
• Business Intelligence Reports
• System Administration

5.4. Non-Functional Requirements

• Performance and load handling capabilities.
• Usability and accessibility features.
• Reliability and uptime guarantee.

of 11

Request for information (RFI) for development of a request forcompliance risk assessment and monitoring (cram)

Tool for national treasury information

• Security measures, including data protection and encryption.
• Compliance with relevant standards and regulations.

5.5. Implementation Approach

The two phases, namely Project Initiation and Requirements Gathering, have been

completed. This project will resume in defining scope and the following:

• Proposed implementation methodology and timeframe.
• Solution Design
• Development & Configuration
• Testing & Quality Assurance
• Deployment & Release Management
• Training & Change Management
• Project Governance
• Post-Implementation Support

5.6. Costing

• Pricing models and cost estimates for development of the core solution including

implementation costs.

• Post implementation support for six months

5.7. Scope

Prospective suppliers are requested to provide a detailed description of their proposed

design, development and implementation approach of the electronic CRAM Tool. The scope

entails development of assessments (Maturity, Risk & Gap Analysis). Maturity assessment

module has 6 maturity levels (risk, demand, acquisition, contract, performance and general

management) to be built. Risk Assessment has 6 risk assessment ratings (Very high, High,

Medium, Low and Very Low) to be built. Risk Analysis has Risk ID, Area, Element, Risk, and

Mitigating Action to be developed. Gap Analysis has questions grouped into sections by area

with 6 levels. Workflow management for all assessments reviews, approvals, and queries has

to be built. Assessments activities for all assessment types to be built. Improvement plan

with areas of improvement must be built. Forecasted results for all assessments. Reviews of

all assessments (Maturity, Risk, Gap and Analysis) and consolidated dashboard. Risk Library

to accommodate submitted risks. Search functionality and standard reports to be built. APIs

for Integrations. User management. Frequently Asked questions and Help functionality

of 11

Request for information (RFI) for development of a request forcompliance risk assessment and monitoring (cram)

Tool for national treasury information

required. System demonstration & training. User guide compilation. The following but not

limited to components should be covered in your proposal:

a) SCM Compliance Risk Maturity Assessment:

o This assessment evaluates the current level of maturity of the organisation by having the

user answer a series of questions and identify the most appropriate responses.

b) SCM Compliance Risk Maturity Assessment – Results

o The results of the maturity assessment are displayed in this tab.

c) SCM Compliance Risk Assessment & Analysis:

o This assessment provides a risk rating for each question and suggests mitigation actions

to address these risks. An analysis is performed to identify which mitigations are not in

place. The default risk rating is determined by the level of maturity.

d) SCM Compliance Risk Assessments & Analysis - Results

o The results of the risk assessment are displayed in this tab.

e) Gap Analysis:

o An analysis is performed to determine which actions need to be implemented to progress

to the desired level of maturity.

f) Controls needed to mitigate risks.:

o Risk management and internal controls.

g) Improvement and Monitoring Plan:

o All mitigation actions from the risk assessment and the actions from the gap analysis are

consolidated in this tab, providing a comprehensive list of actions to be implemented.

h) Updating of Improvement and Monitoring Plan – Status

o The progress of the various actions needs to be updated quarterly to reflect the status of

implementation.

i) Improvement and Monitoring Plan – Dashboard

o This tab provides graphs and tables that can be filtered to summarise the progress of the

implementation plan.

of 11

Request for information (RFI) for development of a request forcompliance risk assessment and monitoring (cram)

Tool for national treasury information

j) Security and Compliance:

o Data Security: Measures for protecting sensitive government and supplier data, including

encryption, access controls, and regular security audits.

o Regulatory Compliance: Adherence to all relevant regulations, including procurement

laws, data protection acts, and industry standards.

o Risk Management: Comprehensive risk assessment and management strategies to

safeguard the marketplace against fraud, cyber threats, and operational disruptions.

5.8. Technology Stack

National Treasury has standardised on Microsoft technologies across its enterprise

environment, it is therefore a requirement that the bidder note the technology stack required,

namely:

• .NET Environment: .NET runtime SDK
• Local file system with RAID configuration
• Elasticsearch for fast search capabilities
• Windows Server Backup for basic backup functionality
• SSL for data in transit
• ASP.NET Core Identity for application-level authentication and authorization

The proposed approach should provide the scalability necessary for future growth while

remaining responsive to evolving government business and operational requirements.

5.9. Additional Information

• Any additional features or capabilities that would benefit the CRAM Tool platform.
• References from previous clients.

5.10. Submission Guidelines

Vendors are invited to submit a proposal of approximately 10 pages, excluding any

supplementary information, outlining their approach to the development and

implementation of a compliance risk assessment and monitoring (CRAM) tool for

National Treasury.

of 11

Request for information (RFI) for development of a request for compliance risk assessment and monitoring (cram)

Tool for national treasury information

Responses must be submitted by 04 September 2026. Submissions should include the

following:

a) A cover letter highlighting the vendor's interest in the opportunity and demonstrating its

suitability to deliver the proposed solution.

b) Contact details of the designated primary representative.

c) Company and supplier profile.

d) Overview of the proposed solution.

e) Development, deployment, and implementation approach.

f) Pricing.

g) Value chain management framework.

h) Evidence of compliance with the specified requirements.

i) Any additional supporting information deemed relevant by the vendor.

j) Submissions should be sent via eTenders eSubmission.

6. Assessment and Next Steps

Submissions will be assessed against factors including relevant experience, alignment with

National Treasury's operational requirements, and the feasibility of implementation.

7. Disclaimer

This RFI is intended exclusively to obtain information and gain insights into costs relating to the

design, development and implementation of the CRAM Tool. It does not create any contractual

obligation, commitment, or procurement undertaking on the part of National Treasury. National

Treasury reserves the right to modify, postpone, or cancel this RFI at its sole discretion and

without prior notification.

Although National Treasury seeks to assess vendor offerings and conduct market research on the

implementation of a Government CRAM Tool, the issuance of this RFI should not be construed as

an obligation or commitment by National Treasury to:

7.1. Go out on a tender or

7.2. Accept any Request for Information received from vendors or

7.3. Include vendors responding to this Request for Information in any future tender

invitation or

of 11

Request for information (RFI) for development of a request for compliance risk assessment and monitoring (cram)

Tool for national treasury information

7.4. Any other commitment to suppliers whatsoever, including any intention to form a

contract with any supplier.

8. National Treasury remains the sole custodian of the documents issued with this TOR,

including spreadsheet content, designs, the Risk Library, and the User Guide. Suppliers are

not authorized to use these materials for the development of software solutions on behalf of

their clients, nor may they use them to establish ownership rights over any related source

code

9. RFI closing date

No: RFI002-2026

Description: REQUEST FOR INFORMATION (RFI) FOR DEVELOPMENT OF A COMPLIANCE RISK

Assessment and monitoring (cram) tool for national treasury.

RFI closing date and time: 04 SEPTEMBER 2026 AT 11H00AM

10. Contact details

General enquiries: [email protected]

of 11

The proposed approach should provide the scalability necessary for future growth while remaining responsive to evolving government business and operational requirements. The technology stack required is: .NET Environment (.NET runtime SDK), Local file system with RAID configuration, Elasticsearch for fast search capabilities, Windows Server Backup for basic backup functionality, SSL for data in transit, ASP.NET Core Identity for application-level authentication and authorization.

• Search functionality, Standard Reports, and Integrations
• User management, FAQs, Help functionality and User guide
• Testing & Quality Assurance
• Preferential Procurement Policy Framework Act (PPPFA and its regulations)

to accommodate submitted risks. Search functionality and standard reports to be built. APIs

for Integrations. User management. Frequently Asked questions and Help functionality

The RFI is for the development of a Compliance Risk Assessment and Monitoring (CRAM) tool for National Treasury.

Closing date: 04/09/2026 at 11:00 AM.

Bidding procedure and technical enquiries: Supply Chain Management, e-mail [email protected].

Proposals must be submitted online via the e-Tender Portal (https://www.etenders.gov.za/). A tutorial on uploading bid documents is available at https://youtu.be/B7pNseNJYHM.

Bids must be submitted on the official forms provided, not re-typed, and by the stipulated time; late bids will not be accepted.

Returnable documents include:

• SBD 1 (Invitation to Bid): bidder details, signed as the offer cover page.
• Proof of authority to sign (e.g., company resolution).
• Tax compliance status PIN or CSD number (see compliance requirements).
• SBD 7 (Contract Form) will be required from the successful bidder.

The RFI is for the development of a Compliance Risk Assessment and Monitoring (CRAM) tool for National Treasury. No further technical specifications are provided in this document.

Bidders must be tax compliant and must submit their unique SARS Tax Compliance Status (TCS) PIN. Alternatively, if registered on the Central Supplier Database (CSD), a CSD number must be provided.

For consortia, joint ventures, or sub-contractors, each party must submit a separate TCS certificate/PIN/CSD number.

Bids will not be considered from persons in the service of the state, or companies/close corporations with directors/members in the service of the state.

Failure to provide or comply with any of the above may render the bid invalid.

Bidding procedure and technical enquiries: Supply Chain Management, e-mail [email protected]. Proposals to be submitted online on the e-Tender Portal (https://www.etenders.gov.za/).

{"name":null,"email":null,"phone":null,"department":"SUPPLY CHAIN MANAGEMENT","address":null}

Bidders listed on the Register for Tender Defaulters or the List of Restricted Suppliers are automatically disqualified. A false declaration on the SBD 4 form may lead to rejection of the bid or referral to the Competition Commission, the National Prosecuting Authority, or restriction from public sector business for up to ten years.

Supply chain management system should

This declaration prove to be false.

.................................... .....................................................

Signature Date

.................................... ......................................................

Position Name of bidder

Returnable form — SBD 4 (Bidder's Disclosure): bidders must declare whether they or any connected person is employed by the state, has a relationship with anyone at the procuring institution, or has an interest in another related enterprise. Persons listed on the Register for Tender Defaulters or the List of Restricted Suppliers are automatically disqualified. A false declaration may result in the bid being rejected and referral to the Competition Commission, NPA, or restriction from public sector business for up to ten years.