IRBA Accredited Registered Auditors in Cape Town

Public-sector tender applications can ask for several business and financial documents, and the exact list depends on the tender. A missing or expired document can make an application non-responsive, so start with the tender notice and build a checklist from its requirements before preparing the submission.

This guide covers common documents South African businesses may need, how to check them, and where an audit or independent review may be relevant. It is general information, not a substitute for the specific tender conditions or professional advice on a particular bid.

Start with the tender notice

Use the official eTenders portal to find public-sector tender opportunities. Read the full tender notice and all attached bid documents, including any amendments. The notice sets the actual requirements, format, submission method, briefing arrangements and closing time.

Create a document checklist from the tender pack. Mark each item as required, not applicable, or awaiting confirmation. Check whether documents must be certified, recently issued, signed, submitted in a particular format, or uploaded to a specified platform. Do not assume that a document accepted for one tender will meet another tender’s requirements.

Common tender documents to prepare

The documents below appear in many tender packs, but they are not universal requirements. Use the tender’s own checklist as the final authority.

1. SARS tax compliance status

Tendering businesses are often asked to provide or confirm their SARS tax compliance information. SARS describes tax compliance status as information a small business may need to share when applying for a tender or contract. Check the tender documents to see whether the buyer requests a Tax Compliance Status PIN, a particular tax certificate, or another form of confirmation.

Before submitting, confirm that the business’s tax affairs and SARS profile are in order and that the information provided matches the tender instructions. If the PIN or status cannot be verified, allow time to resolve the issue rather than waiting until the closing day.

2. CIPC company information

For a registered company, check that its details are current and consistent across the tender forms and supporting documents. This may include the company’s registered name and number, director information, registered address and other particulars requested in the bid pack.

CIPC provides services for company annual returns and for submitting audited or independently reviewed annual financial statements where applicable. Check the company’s CIPC records and the tender’s specific requirements before making the submission.

3. B-BBEE certificate or affidavit

The tender may ask for a B-BBEE certificate or a sworn affidavit. Which document is acceptable depends on the business and the tender’s rules. CIPC says that qualifying exempt micro-enterprises with turnover below R10 million may use a sworn affidavit in place of a B-BBEE certificate. Confirm that the business qualifies and that the tender accepts the document being submitted.

Check that the entity details and other information on the affidavit or certificate match the business records. Do not assume an older document remains suitable if the company’s circumstances or the tender requirements have changed.

4. Financial statements and assurance report

Some tender packs ask for current and prior-year financial statements, and may specify audited or independently reviewed statements. The required form of assurance depends on the company’s circumstances and applicable law, as well as the tender’s own terms.

The company’s Public Interest Score (PIS) is one factor relevant to determining financial-statement requirements under the Companies Act. Other factors can also matter, including the company’s ownership and whether it holds assets in a fiduciary capacity. A PIS result on its own should not be treated as a final legal determination of every requirement.

If a tender asks for audited or independently reviewed statements, check the exact wording and reporting period. Confirm that the statements are final, signed where required, and accompanied by the report or other supporting document requested. If the company is unsure which assurance requirement applies, obtain advice before choosing the submission document.

5. Public Interest Score calculation

Some tender packs request a PIS or information used to establish the company’s financial reporting requirements. The score is calculated for the relevant financial year under the Companies Act regulations. Keep the calculation and its supporting records with the company’s annual financial-statement file.

SC Audit has a five-step Public Interest Score calculator to help a business work through its score. A calculator is a starting point, not a substitute for checking the company’s circumstances and the specific tender requirements. If the result affects whether audited or independently reviewed statements are needed, confirm the position with an appropriately qualified professional.

6. Central Supplier Database details

Some public-sector opportunities require supplier registration or details from the Central Supplier Database (CSD). Check the tender pack to see whether CSD registration is required, which supplier information must be supplied, and whether it must be current at submission.

7. Tender forms, declarations and supporting records

Complete every required returnable form. Depending on the tender, the pack may request signed declarations, conflict-of-interest information, company registration documents, banking confirmation, proof of address, identification documents, a company profile, or evidence of relevant experience.

Use the forms supplied with the tender. Make sure the authorised signatory signs where required, and that the names, registration number and contact details match across the documents. Leave no required field blank; where an item does not apply, follow the tender’s instruction for marking it as not applicable.

A simple way to check the file

Before uploading or delivering the bid, review the tender file against the published requirements:

1. Use the latest tender pack. Check the official notice and any amendments.
2. Make a returnable-documents checklist. Record each required form and supporting document.
3. Check dates and validity. Confirm certificates, tax status and other time-sensitive information meet the tender’s requirements.
4. Match business details. Check the company name, registration number, address and signatory details across the pack.
5. Confirm financial-statement requirements. Read whether the tender asks for audited, independently reviewed or other statements. Check the company’s legal requirements separately.
6. Follow submission instructions. Use the required format, platform and file naming conventions, and submit before the stated closing time.
7. Keep proof of submission. Save the confirmation or delivery record and a copy of the final tender file.

Where audit and review services fit

An audit or independent review is not a tender-winning service. It is an assurance engagement that may be required by law, the company’s circumstances, or the tender’s stated conditions. The buyer decides what documents it will accept, and the tender documents remain the source for bid-specific requirements.

SC Audit provides statutory audits and independent reviews. The firm can discuss the company’s financial-statement requirements and help clarify the information needed to assess its PIS. Businesses should allow enough time for any engagement and document preparation, particularly when a tender has a fixed closing date.

Frequently asked questions

What documents are usually needed for a tender in South Africa?

Requirements vary by tender. Common requests include SARS tax compliance information, CIPC company details, a B-BBEE certificate or affidavit, financial statements, CSD information, and completed tender forms or declarations. Check the specific tender pack for the final list.

Does every tender require audited financial statements?

No. The tender documents state what the buyer requires. A company’s own statutory financial-statement requirements are a separate question and can depend on its Public Interest Score and other circumstances. Confirm both before submitting.

How can I calculate my company’s Public Interest Score?

Use SC Audit’s five-step Public Interest Score calculator to work through the calculation. Some tender packs ask for the PIS or related financial information; others do not. Check the returnable-documents list. The calculator is a starting point, and the company should confirm any resulting reporting requirements against its circumstances and the tender documents.

Can an exempt micro-enterprise submit a B-BBEE affidavit?

CIPC says a qualifying exempt micro-enterprise with turnover below R10 million may use a sworn affidavit instead of a B-BBEE certificate. Check that the business qualifies and that the tender accepts the affidavit.

Can an auditor help prepare my tender application?

An audit firm can discuss audit or independent-review requirements and related financial statements within the scope of its services. The business remains responsible for completing the tender forms and meeting the buyer’s submission rules. An audit or review does not guarantee that a bid will be accepted or awarded.

Discuss your financial-statement requirements

If a tender asks for audited or independently reviewed financial statements, or you are unsure how your Public Interest Score affects your company, contact SC Audit to discuss the requirement. SC Audit is an IRBA-registered audit firm based in Bellville, Cape Town. Its partners Niel Schoeman, Simone Coetzee and Hennie Meyer work with businesses on statutory audits and independent reviews.

Contact SC Audit to discuss your company’s requirements. For tender-specific document rules, always follow the latest tender notice and bid pack.

Sources

• South African eTenders portal
• SARS: Small Businesses – Taxpayers
• CIPC: Enterprise maintenance, financial statements and B-BBEE information
• Companies Act 71 of 2008 and Companies Regulations, 2011. Confirm the current provisions applicable to the company and financial year.

Frequently Asked Questions

What documents are usually needed for a tender in South Africa?
Requirements vary by tender. Common requests include SARS tax compliance information, CIPC company details, a B-BBEE certificate or affidavit, financial statements, CSD information, and completed tender forms or declarations. Check the specific tender pack for the final list.

Does every tender require audited financial statements?
No. The tender documents state what the buyer requires. A company own statutory financial-statement requirements are a separate question and can depend on its Public Interest Score and other circumstances. Confirm both before submitting.

How can I calculate my company Public Interest Score?
Use SC Audit five-step Public Interest Score calculator at https://scaudit.co.za/do-i-need-an-audit/ to work through the calculation. Some tender packs ask for the PIS or related financial information; others do not. Check the returnable-documents list. The calculator is a starting point, and the company should confirm any resulting reporting requirements against its circumstances and the tender documents.

Can an exempt micro-enterprise submit a B-BBEE affidavit?
CIPC says a qualifying exempt micro-enterprise with turnover below R10 million may use a sworn affidavit instead of a B-BBEE certificate. Check that the business qualifies and that the tender accepts the affidavit.

Can an auditor help prepare my tender application?
An audit firm can discuss audit or independent-review requirements and related financial statements within the scope of its services. The business remains responsible for completing the tender forms and meeting the buyer submission rules. An audit or review does not guarantee that a bid will be accepted or awarded.

How auto-assessment works

Each year SARS uses third-party data from employers, banks, medical schemes, and retirement funds to assess taxpayers whose affairs are less complex. If your information is complete, SARS issues an auto-assessment by SMS, email, or notification. If you agree that the figures are correct, you do nothing. SARS processes the outcome, and any refund due is paid within 72 hours provided your details are in order.

For the 2026 filing season, the auto-assessment period ran from 1 to 12 July 2026. The broader filing period for provisional and non-provisional taxpayers who must submit returns runs from 13 July to 23 October 2026. Provisional taxpayers have until 22 January 2027.

Auto-assessment is convenient, but it is only as accurate as the data SARS holds. Business owners should never accept an assessment without checking it first.

Who gets auto-assessed

SARS selects taxpayers with less complex tax matters and whose information has been fully provided by third-party data providers. This typically means salaried individuals with standard deductions.

If you earn business income, rental income, or other income that third parties do not report to SARS, an auto-assessment may not capture your full tax position. Provisional taxpayers — which includes most business owners — must still submit a return even if they receive an auto-assessment notification.

Five things to verify before accepting

1. Salary and business income against your IRP5s

Compare the income on the assessment with your IRP5 certificates and your own records. If you run a business, check whether your business income, professional fees, commission, or freelance earnings are reflected. Third-party data often misses income that is not reported through payroll systems.

2. Deductions and allowances

Check that retirement fund contributions, medical scheme contributions, donations, and travel allowances are correctly reflected. If you claimed home office expenses, business travel, or wear-and-tear on business assets in prior years, confirm whether those deductions appear. Missing deductions mean you pay more tax than you owe.

3. Banking details

SARS pays refunds into the bank account on record. Confirm that the account number and branch details are current. Refunds paid into closed or incorrect accounts cause delays that can take weeks to resolve. Update your banking particulars on eFiling before accepting if anything has changed.

4. Third-party data gaps

Auto-assessments depend on data from employers, banks, medical schemes, and fund administrators. If any provider submitted late or incorrect data, your assessment will be wrong. Common gaps include:

• Medical scheme contributions not yet submitted
• Retirement annuity contributions made directly by the taxpayer
• Rental income not reported by managing agents
• Capital gains from asset disposals
• Foreign income or foreign tax credits

If any of these apply to you, file a return rather than accepting the assessment as is.

5. Your provisional taxpayer status

If you earn business income, you are likely a provisional taxpayer. Provisional taxpayers must submit returns for the full tax year and make provisional tax payments in August and February. An auto-assessment does not replace these obligations. Accepting an auto-assessment that omits your business income leaves you exposed to additional assessments, interest, and understatement penalties later.

What to do if the assessment is wrong

Do not accept it. File a tax return through eFiling or the SARS MobiApp with the correct figures. SARS allows you to submit a return that overrides the auto-assessment, provided you file within the filing season deadlines:

• Non-provisional taxpayers: 23 October 2026
• Provisional taxpayers: 22 January 2027

There is no need to visit a SARS branch to correct an assessment. SARS has asked taxpayers not to visit service centres unnecessarily and to use digital channels instead. A virtual waiting room manages high volumes on eFiling, and contact centres operate on weekdays from 08:00 to 16:00.

Key 2026 filing season dates

Do a pre-filing health check

Before the season closes, SARS encourages every taxpayer to confirm that personal details, banking particulars, contact information, and tax affairs are up to date. Outstanding returns from prior years, unfiled provisional payments, or incorrect contact details can delay refunds and trigger compliance notices.

For business owners, the health check should also cover:

• All IRP5 and IT3 certificates received and reconciled
• Business income records complete for the full tax year
• Expense claims supported by invoices and receipts
• Provisional tax payments for the year accounted for
• Tax compliance status PIN current (needed for tenders and contracts)

The bottom line

Auto-assessment works well when SARS holds complete data. For business owners with income beyond a salary, it rarely tells the full story. Checking the five items in this article takes less than an hour and can save a costly dispute later. When in doubt, file a return with the correct figures before the deadline.

SC Audit is an IRBA-registered audit firm based in Bellville, Cape Town. SC Audit’s partners Niel Schoeman, Simone Coetzee, and Hennie Meyer support business owners with tax compliance, provisional tax, SARS queries, and financial statement preparation. Contact SC Audit before the filing deadline to review your 2026 position.

Frequently Asked Questions

What is a SARS auto-assessment?

An auto-assessment is a tax assessment SARS issues using third-party data from employers, banks, medical schemes, and retirement funds. If the figures are correct, you do nothing. SARS processes the outcome automatically.

Do I still need to file if I was auto-assessed?

If every figure on the assessment is correct and complete, no further action is needed. If anything is missing or wrong — especially business income, rental income, or deductions — you must file a return with the correct figures before the deadline.

What are the 2026 filing season deadlines?

Non-provisional taxpayers must file by 23 October 2026. Provisional taxpayers have until 22 January 2027. The auto-assessment period ran from 1 to 12 July 2026.

How long does a SARS refund take?

If your banking details and tax affairs are in order, SARS issues refunds within 72 hours of finalising the assessment.

I am a provisional taxpayer and received an auto-assessment. What should I do?

Do not rely on the auto-assessment alone. Provisional taxpayers must submit a full return covering all income, including business income that third-party data does not capture. File through eFiling before 22 January 2027.

How AI changed fraud

The fraud schemes themselves are not new. Fake vendors, diverted payments, and executives issuing urgent payment instructions have existed for decades. What changed is speed and believability.

In 2026, fraudsters use AI to generate convincing deepfake video and voice, clone supplier invoices with correct logos and reference numbers, and craft phishing messages without the spelling errors and awkward phrasing that used to give them away. Industry surveys report that more than half of businesses saw fraud attempts increase over the past year, with over 40% saying attacks are growing more sophisticated. Finance teams that relied on spotting suspicious cues in emails are finding those cues gone.

For SMEs, the risk is acute. Smaller businesses often route payments through one or two people, verify suppliers informally, and trust familiar voices on the phone. Each of those habits is now a vulnerability.

Six red flags for AI-enabled fraud

1. Urgent payment instructions from an executive

The classic business email compromise now arrives as a voice note or video call that sounds and looks like the owner or a director. Urgency is the weapon: the fraudster wants payment released before anyone verifies.

2. Changed supplier banking details

A supplier emails new banking details, and everything looks legitimate — correct letterhead, correct contact names, correct invoice history. AI makes it easy to replicate a supplier’s full identity. Any request to change payment details deserves independent verification.

3. New vendors with perfect paperwork

Fraudsters generate complete vendor profiles: registration documents, tax numbers, reference letters, and websites. Paperwork alone no longer proves a vendor is real. Verification must go beyond documents to people and physical presence.

4. Invoices just below approval thresholds

AI tools can study your approval patterns if they gain access to your inbox. Invoices pitched just under the amount that triggers dual authorisation are a sign that someone understands your controls.

5. Refusal to use verification channels

A supplier who insists on email-only communication, avoids video calls, or becomes evasive when you propose an independent callback may not be who they claim to be.

6. Pressure to bypass process

Any request — from anyone — to skip the normal approval process because of urgency, confidentiality, or executive instruction should be treated as suspicious until verified through an independent channel.

Five controls that still work

1. Out-of-band verification with a code word

Agree a code word or challenge phrase with directors and key staff. Before releasing any unusual payment, the finance team confirms identity using this phrase through a separate channel — a callback to a known number, not a reply to the message that requested payment. Analog verification defeats digital deception.

2. Dual authorisation on every payment above a threshold

No single person should be able to release a payment alone. Dual authorisation means a fraudster must compromise two people, not one. Set the threshold low enough that meaningful payments always require a second pair of eyes.

3. Independent supplier onboarding

Verify new suppliers through channels you initiate: call a publicly listed number, check the business address, confirm banking details with a callback — never with details from the email that requested the change. Document every verification step.

4. Complete audit trails

Modern finance systems record every document upload, edit, approval, and payment. These trails let investigators reconstruct events quickly and act as a deterrent. If your system does not produce them, that is itself a control weakness worth fixing.

5. AI-assisted detection of your own

Fraudsters use AI to find patterns in your processes. Use the same approach in defence: anomaly detection on payment flows, duplicate invoice checks, and alerts on changed vendor details. Even basic rules — flagging first-time payments above a threshold — catch schemes that human review misses.

When to call a forensic auditor

If a payment has already left your account under suspicious circumstances, act within hours, not days. Contact your bank to attempt a recall, preserve all messages and documents exactly as received, and engage a forensic auditor to trace the funds and document the evidence. Do not confront suspects or alter your finance system before the investigation begins, as either step can destroy evidence or alert perpetrators.

A forensic audit after an AI-enabled fraud focuses on reconstructing the communication chain, tracing fund flows through bank records, and identifying which controls failed. The findings support recovery action and, critically, show what must change before the next attempt.

The bottom line

AI has not invented new fraud. It has made old fraud faster, cheaper, and harder to spot. The defences that worked two years ago — watching for suspicious email addresses, trusting a familiar voice — are no longer enough. Out-of-band verification, dual authorisation, independent supplier checks, audit trails, and anomaly detection form the control set that holds up in 2026.

SC Audit is an IRBA-registered audit firm based in Bellville, Cape Town. SC Audit’s partners Niel Schoeman, Simone Coetzee, and Hennie Meyer support businesses with fraud prevention, internal controls, forensic audits, and risk assessments. Contact SC Audit to review whether your payment controls hold up against AI-enabled fraud.

Frequently Asked Questions

What is AI-powered fraud?

AI-powered fraud uses artificial intelligence to make traditional schemes more convincing — deepfake voice and video impersonating executives, cloned supplier identities, and phishing messages without the errors that used to expose them.

How can a small business verify a payment instruction?

Call back on a known number, use an agreed code word, and require dual authorisation. Never verify using contact details from the message that requested the payment.

What should I do if we already paid a fraudulent invoice?

Contact your bank immediately to attempt a recall, preserve all evidence untouched, and engage a forensic auditor. Time matters: recovery chances fall sharply after the first 24 to 48 hours.

Are traditional internal controls still effective?

Segregation of duties and reconciliations remain essential, but they are no longer sufficient on their own. Add out-of-band verification and anomaly detection to cover the gaps AI has opened.

Does my auditor check for AI-enabled fraud?

A statutory audit is not designed to detect all fraud, and AI-enabled schemes are specifically built to evade normal procedures. If fraud is suspected, a dedicated forensic audit is the appropriate response.