Objectives

The primary objective of this tender is to procure a centralized Third-Party Risk Management (TPRM) or Due Diligence Platform for SANPC. The system aims to identify, assess, monitor, and mitigate risks associated with SANPC’s external partners, vendors, suppliers, and other third parties (both domestic and international) throughout the lifecycle of contractual relationships. It is intended to ensure compliance with regulatory, operational, cybersecurity, and ethical standards, supporting transparent, ethical, and compliant business relationships aligned with South African statutory obligations and King IV principles.

Scope

The scope involves providing a robust third-party risk management system with capabilities including:

• Third-Party Identification & Onboarding:
  • Collect key data about potential vendors or partners
  • Automate questionnaires and documentation requests
  • Verify business registration, ownership, and compliance status
  • Evaluate third parties across multiple risk domains such as environmental, social, governance, reputational, legal, ownership, and geopolitical
  • Generate risk scores or ratings using internal assessments and external data sources
  • Conduct background checks, sanctions screenings, adverse media monitoring, politically exposed persons databases, credit ratings, financial statements, and document reviews
  • Integrate with external data providers (e.g., Dun & Bradstreet, LexisNexis, Refinitiv) for continuous updates
  • Continuously monitor for risk changes and send alerts
  • Support structured approval workflows and audit trails
  • Document all decisions, assessments, and communications
• Reporting & Analytics:
  • Provide dashboards, risk heat maps, escalation protocols, and compliance reports
  • Support internal and regulatory reporting requirements
  • Enable integration with existing internal systems
• Screening and Monitoring: The system must screen all relevant third parties involved in procurement, sale, transportation, financing, storage, or exchange of commodities and related services.

Technical Requirements

The technical specifications include:

• A centralized, automated risk management platform with capabilities for onboarding, risk assessment, monitoring, and reporting
• Integration with external data providers for real-time updates
• Risk scoring and rating functionalities across multiple domains
• Automated background checks, sanctions screening, and adverse media monitoring
• Alerting system for emerging risks or compliance issues
• Support for structured workflows, approvals, and audit trails
• Dashboards and analytics tools for risk visualization and reporting
• Compliance with South African statutory obligations and King IV governance principles

Skills Requirements

The successful bidder must demonstrate:

• Expertise in developing and implementing third-party risk management systems
• Experience integrating with external data providers such as Dun & Bradstreet, LexisNexis, and Refinitiv
• Knowledge of South African regulatory and compliance frameworks, including King IV principles
• Ability to deliver a system supporting automated onboarding, risk assessment, monitoring, and reporting functionalities
• Capability to provide ongoing support, updates, and continuous monitoring features
• Proven track record in deploying secure, scalable, and compliant risk management solutions