External Quality Assurance Review of Internal Audit

The Road Accident Fund (RAF) has issued a request for quotation (PR10118915) to appoint a qualified and experienced service provider to conduct an External Quality Assurance Review (EQAR) of its Internal Audit Department. The review must be carried out in line with the Global Internal Audit Standards issued by the Institute of Internal Auditors (IIA) and is required to run for a period of three (3) months. The engagement is categorised as a professional service and is intended to independently assess whether the Internal Audit function conforms to recognised international standards, identify gaps, and recommend improvements that strengthen governance, risk management and control oversight within a public entity.

Beyond the audit methodology itself, the successful bidder will be entrusted with confidential RAF files, data and documents, and must therefore comply with the attached Technical and Organisational Security Measures (Annexure A). These requirements include documented protocols for the secure handling and transport of files using lockable containers, detailed record-keeping of document storage, retrieval and access activities, and secure storage in lockable cabinets with controlled, monitored access. Physical security standards call for a secure perimeter, controlled access points, surveillance or 24/7 monitoring, and fire suppression measures. Any actual, attempted or suspected physical security breach must be reported to RAF with supporting evidence such as CCTV footage, police reports and alarm records.

On the digital side, service providers must demonstrate robust cybersecurity controls, including encryption of data in transit and at rest, firewalls, intrusion detection, strong authentication, need-to-know access management, regular patching, and a documented incident response plan. Compliance with the Protection of Personal Information Act (POPIA), Act 4 of 2013, is mandatory. Subcontractors and third parties must meet the same standards and sign data protection agreements, the service provider remains fully accountable for them, and RAF reserves the right to audit compliance and to vet company directors and assigned resources. Bidders should review the Standard Bidding Document, the RFQ document, SBD 6.1 under PPR 2022, and Annexure A carefully before submitting. The closing date for submissions is 12 November 2026.