Section one: Contracting authority
one.1) Name and addresses
Financial Conduct Authority
12 Endeavour Square
London
E20 1JN
Contact
Phil Lamacraft
Telephone
+44 2070661000
Country
United Kingdom
Region code
UK - United Kingdom
National registration number
01920623
Internet address(es)
Main address
Buyer's address
one.3) Communication
The procurement documents are available for unrestricted and full direct access, free of charge, at
https://atamis-fca.my.salesforce.com/
Additional information can be obtained from the above-mentioned address
Tenders or requests to participate must be submitted electronically via
https://atamis-fca.my.salesforce.com/
Tenders or requests to participate must be submitted to the above-mentioned address
one.4) Type of the contracting authority
Other type
Financial Regulator
one.5) Main activity
Other activity
Financial Regulation
Section two: Object
two.1) Scope of the procurement
two.1.1) Title
Risk, Audit and Compliance Solution
Reference number
CON-23-235
two.1.2) Main CPV code
- 48517000 - IT software package
two.1.3) Type of contract
Supplies
two.1.4) Short description
The FCA is establishing a contractual mechanism to implement a Risk, Internal Audit and Compliance Solution to the FCA for a period of three years starting from 1 September 2024 with an option to extend by two further periods of 12 months each (maximum term 5 years).
two.1.5) Estimated total value
Value excluding VAT: £3,500,000
two.1.6) Information about lots
This contract is divided into lots: No
two.2) Description
two.2.3) Place of performance
NUTS codes
- UKI4 - Inner London – East
Main site or place of performance
Inner London - East
two.2.4) Description of the procurement
The FCA is establishing a contractual mechanism to implement a Risk, Internal Audit and Compliance Solution to the FCA for a period of three years starting from 1 September 2024 with an option to extend by two further periods of 12 months each (maximum term 5 years).
As a fully independent subsidiary of the FCA, the PSR operates to a shared service agreement, but each retains full data segregation. Any proposed solution will be required to maintain this segregation.
The system will support the further embedding of the Risk Management Frameworks that are operated by the FCA and PSR respectively, enabling greater levels of risk maturity across both organisations and ensuring efficient and effective risk-conscious decision making and prioritisation.
Risk Management plays an essential role in helping to deliver on our Strategy and statutory and operational objectives. It does this by helping to ensure we are operating in an effective and efficient risk-based manner in identifying and delivering the timely interventions to appropriately identify, prevent, mitigate, manage, influence and report on actual and potential Risks of Harm.
The current risk system is a commercial off the shelf (COTS), software as a service (SaaS) platform. This has been configured to support, as examples, the FCA’s risk of harm and own risk taxonomies and scoring methodologies, to automate aspects of the FCA’s Risk and Control Self-Assessment (RCSA) process; Risk Event Management process; risk acceptance and various risk and assurance reviews that are conducted by 2LOD. Additionally, it includes a small number of cross-cutting Risks of Harm.
The current Internal Audit (IA) system is used as a workflow tool to manage the activities associated with internal audits, including findings and actions. This is also a COTS SaaS, with a component hosted on desktop.
Both systems are functionally similar platforms and classified as ‘Governance, Risk and Compliance’ software tools. Moving to a single platform for all risk and audit information will support the consolidation of our IT estate.
A unified platform is envisaged to benefit day to day users, providing a clear view of the risks and controls they manage, linking the outcomes of IA reviews to wider risk management activities. In addition, this would provide stakeholders with an improved view of risk exposures and resultant mitigations by connecting the data to enable more effective and efficient decision making.
The system will be required to support the FCA’s roadmap for critical risk management tools and processes and must therefore be able to support existing (and new) capabilities that have not previously been automated, such as Compliance (i.e., policy management and the implementation of a standardised control library) and Key Risk Indicator management.
We anticipate the system will provide access to real time risk and audit data, providing a high degree of flexibility in the ability to analyse and report on that data on an individual and aggregated risk basis to identify and monitor trends over time. For example, linkages across various records and metrics on a one-to-one, one-to-many and/or one-to-all basis.
The system must be implemented with minimal disruption to current processes and business operations. The supplier will demonstrate a robust approach to significant change and issue resolution, working cohesively with the FCA Product Group to support and independently configure the product.
two.2.5) Award criteria
Price is not the only award criterion and all criteria are stated only in the procurement documents
two.2.6) Estimated value
Value excluding VAT: £3,500,000
two.2.7) Duration of the contract, framework agreement or dynamic purchasing system
Start date
1 September 2024
End date
31 August 2029
This contract is subject to renewal
No
two.2.10) Information about variants
Variants will be accepted: No
two.2.11) Information about options
Options: No
two.2.13) Information about European Union Funds
The procurement is related to a project and/or programme financed by European Union funds: No
two.2.14) Additional information
The contract will have an initial term of 3 years and is envisaged to allow for a further 2 x 12 month extensions
Section three. Legal, economic, financial and technical information
three.1) Conditions for participation
three.1.2) Economic and financial standing
Selection criteria as stated in the procurement documents
three.1.3) Technical and professional ability
Selection criteria as stated in the procurement documents
Section four. Procedure
four.1) Description
four.1.1) Type of procedure
Open procedure
four.1.8) Information about the Government Procurement Agreement (GPA)
The procurement is covered by the Government Procurement Agreement: Yes
four.2) Administrative information
four.2.2) Time limit for receipt of tenders or requests to participate
Date
4 March 2024
Local time
12:00pm
four.2.4) Languages in which tenders or requests to participate may be submitted
English
four.2.6) Minimum time frame during which the tenderer must maintain the tender
Tender must be valid until: 1 September 2024
four.2.7) Conditions for opening of tenders
Date
4 March 2024
Local time
12:00pm
Section six. Complementary information
six.1) Information about recurrence
This is a recurrent procurement: No
six.4) Procedures for review
six.4.1) Review body
Financial Conduct Authority
12 Endeavour Square
London
E20 1JN
Country
United Kingdom