Audit management software (audit tool) for SAFCOL internal audit – RFB017/2026

Closing date: 20 October 2026 at 12:00

Compulsory briefing session: 07 October 2026, 11:00–12:30, via Microsoft Teams (link provided in the RFP). Failure to attend leads to disqualification.

Closing date for questions/enquiries: 14 October 2026 at 12:00

Bid validity: 90 days from closing date (20 October 2026).

SCM enquiries:

• Contact: Ms. Lungile Moeketsi
• Email: [email protected]

Technical enquiries:

• Contact: Sipho Aphane
• Email: [email protected]

Submission address:

SAFCOL Nelspruit Office

ABSA Square

3rd Floor; Reception

20 Paul Kruger Street

Mbombela, Nelspruit

Submission method: hand delivery or courier to the SAFCOL Nelspruit office bid box.

Address: SAFCOL Nelspruit Office, ABSA Square, 3rd Floor; Reception, 20 Paul Kruger Street, Mbombela, Nelspruit.

Bid box accessible 08:00–16:30, Monday to Friday. Late bids will not be accepted.

Submit an original bid document and a USB. If copies differ, the original hand-signed document prevails.

All bids must be on official forms (not retyped). Complete in black ink. Original signatures required.

Returnable forms (all must be completed and signed):

• SBD 1 (Invitation to Bid): bidder details and signed offer cover page.
• Specifications, Conditions of tender and Undertakings by Tenderer: signed by authorised representative.
• SBD 3.1 (Pricing Schedule): total bid price, VAT inclusive.
• SBD 4 (Declaration of Interest): discloses any connection to state employees or the procuring institution.
• SBD 6.1 (Preference Points Claim Form): claims B-BBEE preference points.
• Certified CIPC registration documents listing all members with percentages (close corporation) or certified latest share certificates (company).
• Breakdown of fees and work split between consortium/JV members.
• Supporting documents for mandatory criteria responses.
• CSD Registration Summary Report.
• Proof of authority to sign (e.g., resolution of directors).

Disqualification risks:

• Late delivery, regardless of reason.
• Missing or unsigned returnable forms.
• Incomplete or fraudulent information.
• Non-attendance at the compulsory briefing.
• Qualifying the bid with own conditions.
• Submitting via email or internet (bidders with RSA offices).
• Bidders listed on National Treasury's restricted suppliers or defaulters database.

Evaluation by an SAFCOL evaluation panel.

Preference point system: 80/20 (price 80 points, specific goals 20 points).

Price points formula: Ps = 80(1 - (Pt - Pmin)/Pmin).

Specific goal: procurement from black-owned entities (at least 51% ownership) — 20 points, claimed via B-BBEE certificate or affidavit.

Bidders must explicitly state 'Comply' or 'Do not Comply' for each condition; non-compliance may affect evaluation.

SAFCOL may conduct benchmarks, pre-award surveys, and oral presentations (optional).

The lowest or any bid need not be accepted.

The department requires an audit management software tool ('Audit Tool') for the SAFCOL Group Internal Audit department, including support services.

The software must support the full audit lifecycle: planning, execution, reporting, follow-up, risk management, and project management.

Key functionality:

• Planning: import/create/maintain audit plans, generate process flows, engagement letters, planning documentation, requests for information, audit notifications; risk-based audit approach.
• Project Execution: work outside SAFCOL network, generate audit and forensic working papers per methodologies, store/retrieve audit evidence, hyperlink sources, manage access controls (including restricted forensic files).
• Reporting and Follow-up: generate internal and forensic audit reports, database of findings categorised by period/department/location/risk value, flag recurring findings, management comments and action plans, follow-up reminders, client satisfaction surveys.
• Risk Management: create/import risk registers (MS formats), analyse risks (impact, likelihood, control effectiveness), map risks to controls and procedures, generate Risk and Control Matrix.
• Project Management and Monitoring: automated project plans, Gantt charts, resource planning, timesheets, task tracking with alerts, dashboards on working paper status, statement of internal controls, audit trail of reviews.
• Data Analytics and additional functionality (further details in the RFP).

The software must be configured to conform to general Forensic, ICT Audit and Internal Audit methodologies.

Successful bidder's employees and subcontractors may require security clearances (cost for bidder) and must sign non-disclosure agreements.

All employees must be covered under the Compensation for Occupational Injuries and Diseases Act.

The audit software must be configured to conform to general Forensic, ICT Audit and Internal Audit methodologies.

The software must support a risk-based audit approach in line with the Risk Management requirements.

The software must enable efficient project management across planning, execution, and reporting phases.

The software must generate audit working papers and reports as per the Internal Audit Methodology and Forensic Audit Methodology.

The software must provide dashboards, automated project plans, Gantt charts, and timesheets for monitoring.

The software must retain an audit trail of reviews from planning to reporting.

All services must be certified to all legal requirements as per South African law.

The software must be configured to conform to general Forensic, ICT Audit and Internal Audit methodologies.

The bidder must provide full and accurate answers to all mandatory questions, substantiating responses where necessary.

SAFCOL may conduct benchmarks on products/services during and after evaluation.

SAFCOL may conduct pre-award surveys to evaluate contractor capabilities.

Total bid price must be stated on SBD 3.1 and in the Price Declaration Form, VAT inclusive in ZAR.

The price must cover all services described in the RFP; SAFCOL will incur no additional costs.

Rates must be firm for the full contract period unless otherwise stated; if not firm, provide basis for adjustments (e.g., CPI) and cost breakdown.

No price adjustments 100% linked to exchange rate variations are allowed; bidders must indicate any portion linked to exchange rate.

All additional costs must be clearly specified.

Offer valid for 90 days from closing date.

Pricing: total bid price must be quoted VAT inclusive in South African Rand (ZAR).

The total bid price must be stated on SBD 3.1 and in the Price Declaration Form; if they differ, the one on SBD 3.1 prevails.

Rates must be firm for the full contract period unless otherwise stated; if not firm, provide basis for adjustments (e.g., CPI) and cost breakdown.

No price adjustments 100% linked to exchange rate variations are allowed; bidders must indicate any portion of price linked to exchange rate.

All additional costs must be clearly specified.

Bid validity: 90 days from closing date.

No interest payable on disputed accounts.

CSD registration: mandatory for award; provide CSD number or registration summary report. Foreign suppliers with no local registered entity are exempt.

Tax compliance: submit SARS Tax Compliance Status (TCS) PIN or CSD number; each JV/consortium/subcontractor party must submit separate proof.

B-BBEE: submit a valid B-BBEE certificate or sworn affidavit (for EMEs/QSEs) to claim preference points.

CIPC: certified registration documents (close corporation) or share certificates (company).

No bids from persons in the service of the state, or companies/CCs with directors/members in state service.

Bidders must not be listed on National Treasury's restricted suppliers or defaulters database.

Bidders must comply with the SAFCOL Supplier Code of Conduct (link in RFP).

Bidders must not be foreign suppliers without a local registered entity (unless exempt from CSD).

All employees (including subcontractors) must be covered under the Compensation for Occupational Injuries and Diseases Act (COIDA) for the duration of the bid and any resulting contract.

SAFCOL may request proof of registration and 'good standing' with the Compensation Fund.

Employees and subcontractors may be required to hold security clearances (cost for bidder) and sign non-disclosure agreements.

Bidders must not qualify the proposal with own conditions; if not withdrawn when called upon, the bid is invalid.

Bidders who withdraw before validity expiry may be liable for additional costs incurred by SAFCOL.

SAFCOL may cancel the award with 90 days' notice if parties fail to agree on price adjustments or specification changes.

Bidders must provide signed agreements for consortium/JV/subcontractors stipulating work split and rand value.

Bidders who are distributors/resellers/installers of network equipment must submit back-to-back agreements and SLAs with principals.

Bidders must accept the evaluation criteria as stands.

Bidders must comply with the SAFCOL Supplier Code of Conduct.

Bidders must not make any news releases without SAFCOL consent.

Bidders must submit supporting documents for responses to mandatory criteria.

B-BBEE certificate or sworn affidavit must be submitted to claim preference points.

Proof of authority to sign the bid must be attached.

Bidders must be registered on the CSD (unless foreign supplier with no local entity).

Bidders must provide a CSD number or SARS TCS PIN.

Bidders must not be persons in the service of the state.

Bidders must not be listed on National Treasury's restricted suppliers or defaulters database.

Evaluation by an SAFCOL evaluation panel.

Price points: 80 points (80/20 system).

Specific goals: 20 points (procurement from black-owned entities, at least 51% ownership).

Price formula: Ps = 80(1 - (Pt - Pmin)/Pmin).

Bidders must explicitly state 'Comply' or 'Do not Comply' for each condition.

SAFCOL may conduct benchmarks, pre-award surveys, and oral presentations.

The lowest or any bid need not be accepted.