Internal Audit Services (3-Year Contract)

The Council for Medical Schemes (CMS), a statutory body established under the Medical Schemes Act 131 of 1998 and classified as a Schedule 3A public entity, is inviting proposals from qualified firms to provide outsourced internal audit services for a three-year period. The contract will be reviewed annually and monitored under Supply Chain Management requirements. The internal audit function will report administratively to the Accounting Officer and functionally to the Audit and Risk Committee (ARC), and the appointed provider must act as Chief Audit Executive for CMS audits, with the Senior Manager Risk and Audit overseeing contract management.

The scope of work is broad and includes preparing a rolling three-year strategic internal audit plan, an annual internal audit plan, an audit charter and strategy, and an annual combined assurance plan, along with quarterly performance reports to the ARC. Specific audit areas include ICT systems and cybersecurity reviews, data integrity, fraud detection audits, financial controls and review of annual financial statements, procurement and supply chain management processes, real-time probity reviews on tenders, contract management, performance information, compliance, follow-up on audit findings, project readiness and business process reviews. Work must conform to the Global Internal Audit Standards, and the provider must coordinate with external auditors and other assurance providers. Bidders must also demonstrate familiarity with the PFMA, National Treasury Regulations, the Medical Schemes Act and the medical schemes industry.

Bidders must meet strict mandatory requirements. Attendance at the compulsory hybrid briefing on 13 November 2026 at 11:00 is required, with RSVPs due by 12 November 2026, and failure to attend leads to automatic disqualification. Firms must submit at least two testimonial letters from public-sector clients for internal audit work issued within the last five years, and key team members must hold valid professional registrations, with the engagement leader holding a CA(SA) or CIA. Technical proposals are scored out of 100, with a minimum of 75 points required to proceed. Evaluation is based on methodology, quality assurance reviews by an IIA-accredited external reviewer, team experience and qualifications, and price, using an 80/20 preference point system that includes specific goals such as B-BBEE ownership and status. Bids must be submitted in sealed physical form to the CMS Tender Box in Centurion by 11:00 on 30 November 2026, with pricing in a separate sealed envelope. Email and fax submissions are not accepted, and late bids are returned.