Objectives

The primary objective of this tender is to appoint a service provider to undertake an ERP Application Controls Audit for SAFCOL Group Internal Audit. The audit aims to provide reasonable assurance that the application controls of the newly implemented SAGE X3 ERP system are adequately designed and operating effectively to support reliable, secure, and compliant business processes.

Scope

The scope of work includes:

• Conducting an internal audit focusing on ERP application controls related to key business processes such as User Access & Security Controls, e-Procurement, Contract Management, Account Payables, Account Receivables & Revenue Accounting, and Grower processes.
• Evaluating whether application controls are properly designed and functioning effectively to ensure data accuracy, processing integrity, and compliance.
• Assessing integration and interface controls to ensure applications are complete, accurate, timely, secure, and authorized, supporting reliable end-to-end business processing.
• Excluding system configuration areas where processes are not yet integrated into SAGE X3 ERP.

Technical Requirements

The service provider must:

• Plan, execute, and report on the audit in line with SAFCOL’s Internal Audit Methodology.
• Implement quality review processes before communicating audit results.
• Provide regular progress updates to the CAE and/or Senior Audit Manager.
• Complete the audit within the specified timeline, with final reports due within 6 weeks of commencement.
• Deliver a comprehensive work plan outlining approach, methodology, tasks, timelines, responsibilities, and budget.

Skills Requirements

The bid must demonstrate:

• Experience in providing assurance on ERP Application Controls, with recent references from similar projects within the last six years.
• Qualified key personnel, including:
• Engagement Director with a valid CISA / CISM / CISSP / CEH qualification and over 5 years of experience (preferably over 8 years).
• Internal Audit Manager with relevant experience (over 3 years) and a qualification such as CISA / CISM / CISSP / CEH.
• Two Internal Auditors with relevant qualifications (Diploma/B-tech/BCom in Computer Science/Information Systems Audit or equivalent) and at least 3 years of experience each.
• Membership in good standing with the Information Systems Audit and Control Association (ISACA) for all key personnel.
• The ability to allocate resources effectively and deliver within the project timelines.
• A detailed work plan demonstrating approach, methodology, and timeline alignment with SAFCOL’s requirements.