SUPPLY, DELIVERY, INSTALLATION AND COMMISSIONING OF ENTERPRISE RISK MANAGEMENT SOFTWARE.

TENDER DOCUMENT FOR SUPPLY, DELIVERY, INSTALLATION AND COMMISSIONING OF ENTERPRISE RISK MANAGEMENT SOFTWARE. KRA/HQS/NCB-044/2014-2015 TIMES TOWER BUILDING P.O. BOX 48240 00100 TEL: +254 02 2817022 EMAIL: eprocurement@kra.go.ke NAIROBI, KENYA. CLOSING DATE: 16 TH APRIL, 2015 TIME: 12:00 NOON 1

TABLE OF CONTENTS PAGE SECTION I INVITATION TO TENDER.. 3 SECTION II INSTRUCTIONS TO TENDERERS. 4 Appendix to Instructions to Tenderers.. 17 SECTION III GENERAL CONDITIONS OF CONTRACT.. 19 SECTION IV SPECIAL CONDITIONS OF CONTRACT. 24 SECTION V TECHNICAL SPECIFICATIONS.. 26 SECTION VI SCHEDULE OF REQUIREMENTS. 31 SECTION VII PRICE SCHEDULE FOR PROCUREMENT.. 57 SECTION VIII STANDARD FORMS... 58 8.1 FORM OF TENDER..... 59 8.2 CONFIDENTIAL BUSINESS QUESTIONNAIRES FORMS.. 60 8.3 TENDER SECURITY FORM..... 63 8.4 CONTRACT FORM.... 64 8.5 PERFORMANCE SECURITY FORM..... 65 8.6 BANK GUARANTEE FOR ADVANCE PAYMENT FORM... 66 8.7 MANUFACTURER S AUTHORIZATION FORM. 67 8.8 LETTER OF NOTIFICATION............ 68 2

SECTION I INVITATION TO TENDER DATE TENDER REF NO. KRA/HQS/NCB-044/2014-2015 TENDER NAME: Supply, Delivery, Installation and Commissioning of Enterprise Risk Management Software. 1.1 The Kenya Revenue Authority invites sealed bids from eligible candidates for the Supply, Delivery, Installation and Commissioning of Enterprise Risk Management Software. 1.2 Interested eligible candidates may obtain further information from and inspect the tender documents at the office of Kenya Revenue Authority, Procurement & Supplies Services Division, Haile Selassie Avenue, Times Tower, 25 th Floor during normal working hours. 1.3 A complete set of tender documents may be obtained by interested candidates upon payment of the non-refundable fee of Kenya Shillings One Thousand (Kshs.1,000.00) paid in cash or Bankers Cheque. The documents can also be viewed and downloaded from the Authority s website (www.kra.go.ke) at no fee. Bidders who download the documents must forward their particulars immediately for records and communication of any further clarifications to eprocurement@kra.go.ke 1.4 Completed tender documents are to be enclosed in plain sealed envelopes marked with tender reference number and be deposited in the Tender Box on Ground Floor, Times Tower Building, Haile Selassie Avenue, Nairobi, or be addressed to Kenya Revenue Authority, Procurement & Supplies Services Division, Haile Selassie Avenue, Times Tower Building, so as to be received on or before Thursday, 16 th April, 2015 at 12:00 noon. Tenders must be accompanied by a security in the form and amount specified in the tender documents. 1.5 Prices quoted should be inclusive of all taxes and delivery costs, and must be in Kenya Shillings and shall remain valid for 120 days from the closing date of the tender. 1.6 Tenders will be opened immediately thereafter in the presence of the Candidates or their representatives who choose to attend at the Convention Centre on 5 th Floor, Times Tower Building. Tender Documents submitted after 12.00 noon, 15 th April, 2015 shall not be accepted for evaluation irrespective of circumstances. A pre-bid briefing will be held on Thursday 9 th April, 2015 at 10.00am in the Convention Centre on 5 th Floor, Times Tower Building. You are encouraged to attend the briefing. Any canvassing or giving of false information will lead to automatic disqualification. For: Commissioner General Kenya Revenue Authority 3

SECTION II - INSTRUCTIONS TO TENDERERS Table of Clauses Page 2.1 Eligible Tenderers... 5 2.2 Eligible Goods... 5 2.3 Cost of Tendering.... 5 2.4 Contents of Tender Document.... 6 2.5 Clarification of Documents.... 6 2.6 Amendment of Documents.... 6 2.7 Language of Tender... 7 2.8 Documents Comprising the tender... 7 2.9 Tender Forms.... 7 2.10 Tender Prices. 7 2.11 Tender Currencies.. 8 2.12 Tenderers Eligibility and Qualifications. 8 2.13 Goods Eligibility and conformity to Tender Documents.. 8 2.14 Tender Security. 9 2.15 Validity of Tenders.. 10 2.16 Format and Signing of Tenders... 10 2.17 Sealing and Marking of Tenders.. 11 2.18 Deadline for Submission of Tender.. 11 2.19 Modification and Withdrawal of Tenders.. 11 2.20 Opening of Tenders. 12 2.21 Clarification of Tenders 12 2.22 Preminary Examination 12 2.23 Conversion to Single Currency.. 13 2.24 Evaluation and Comparison of Tenders.. 13 2.25 Preference 14 2.26 Contacting the Procuring Entity.. 14 2.27 Award of Contract.... 14 (a) Post qualification..... 14 (b) Award criteria. 15 (c) Procuring Entity s Right to Vary Quantities.. 15 (d) Procuring entity s Right to Accept or Reject any or all Tenders 15 2.28 Notification of Award. 15 2.29 Signing of Contract.. 15 2.30 Performance Security... 16 2.31 Corrupt or Fraudulent Practices. 16 4

SECTION II - INSTRUCTIONS TO TENDERERS 2.1 Eligible Tenderers 2.1.1 This Invitation for Tenders is open to all Tenderers eligible as described in the Invitation to Tender. Successful Tenderers shall complete the supply of goods by the intended completion date specified in the Schedule of Requirements Section VI. 2.1.2 The Kenya Revenue Authority s employees, committee members, board members and their relative (spouse and children) are not eligible to participate in the tender. 2.1.3 Tenderers shall provide the qualification information statement that the tenderer (including all members of a joint venture and subcontractors) is not associated, or have been associated in the past, directly or indirectly, with a firm or any of its affiliates which have been engaged by the Kenya Revenue Authority (KRA) to provide consulting services for the preparation of the design, specifications, and other documents to be used for the procurement of the goods under this Invitation for tenders. 2.1.4 Tenderers shall not be under a declaration of ineligibility for corrupt and fraudulent practices. 2.2 Eligible Goods 2.2.1 All goods to be supplied under the contract shall have their origin in eligible source countries. 2.2.2 For purposes of this clause, origin means the place where the goods are mined, grown, or produced. Goods are produced when, through manufacturing, processing, or substantial and major assembly of components, a commercially-recognized product results that is substantially different in basic characteristics or in purpose or utility from its components 2.2.3 The origin of goods is distinct from the nationality of the tenderer. 2.3 Cost of Tendering 2.3.1 The Tenderer shall bear all costs associated with the preparation and submission of its tender, and the KRA, will in no case be responsible or liable for those costs, regardless of the conduct or outcome of the tendering process. 2.3.2 The price to be charged for the tender document shall not exceed Kshs.1,000.00 All firms found capable of performing the contract satisfactorily in accordance to the set prequalification criteria shall be prequalified. 5

2.4 The Tender Document 2.4.1 The Tender document comprises the documents listed below and addenda issued in accordance with clause 2.6 of these instructions to Tenderers (i) Invitation to Tender (ii) Instructions to Tenderers (iii) General Conditions of Contract (iv) Special Conditions of Contract (v) Schedule of requirements (vi) Technical Specifications (vii) Tender Form and Price Schedules (viii) Tender Security Form (ix) Contract Form (x) Performance Security Form (xi) Bank Guarantee for Advance Payment Form (xii) Manufacturer s Authorization Form (xiii) Confidential Business Questionnaire 2.4.2 The Tenderer is expected to examine all instructions, forms, terms, and specifications in the tender documents. Failure to furnish all information required by the tender documents or to submit a tender not substantially responsive to the tender documents in every respect will be at the tenderers risk and may result in the rejection of its tender. 2.5 Clarification of Documents 2.5.1 A prospective tenderer requiring any clarification of the tender document may notify the Procuring entity in writing or by post at the entity s address indicated in the Invitation to Tender. The Procuring entity will respond in writing to any request for clarification of the tender documents, which it receives not later than seven (7) days prior to the deadline for the submission of tenders, prescribed by the procuring entity. Written copies of the KRA s response (including an explanation of the query but without identifying the source of inquiry) will be sent to all prospective Tenderers that have received the tender document. 2.5.2 The procuring entity shall reply to any clarifications sought by the tenderer within 3 days of receiving the request to enable the tenderer to make timely submission of its tender. 2.6 Amendment of Documents 2.6.1 At any time prior to the deadline for submission of tenders, the Procuring entity, for any reason, whether at its own initiative or in response to a clarification requested by a prospective tenderer, may modify the tender documents by amendment. 2.6.2 All prospective candidates that have received the tender documents will be notified of the amendment in writing or 6

by post and will be binding on them. 2.6.3 In order to allow prospective Tenderers reasonable time in which to take the amendment into account in preparing their tenders, the KRA, at its discretion, may extend the deadline for the submission of tenders. 2.7 Language of Tender 2.7.1 The tender prepared by the tenderer, as well as all correspondence and documents relating to the tender exchange by the tenderer and the KRA, shall be written in English language, provided that any printed literature furnished by the tenderer may be written in another language provided they are accompanied by an accurate English translation of the relevant passages in which case, for purposes of interpretation of the tender, the English translation shall govern. 2.8 Documents Comprising the Tender 2.8.1 The tender prepared by the Tenderers shall comprise the following components: (a) a Tender Form and a Price Schedule completed in accordance with paragraph 2.9, 2.10 and 2.11 below; (b) documentary evidence established in accordance with paragraph 2.1.2 that the tenderer is eligible to tender and is qualified to perform the contract if its tender is accepted; (c) documentary evidence established in accordance with paragraph 2.2.1 that the goods and ancillary services to be supplied by the tenderer are eligible goods and services and conform to the tender documents; and (d) 2.9 Tender Forms tender security furnished in accordance with paragraph 2.14 2.9.1 The tenderer shall complete the Tender Form and the appropriate Price Schedule furnished in the tender documents, indicating the goods to be supplied, a brief description of the goods, their country of origin, quantity, and prices. 2.10 Tender Prices 2.1 The tenderer shall indicate on the appropriate Price Schedule the unit prices and total tender price of the goods it proposes to supply under the contract. 2.10.2 Prices indicated on the Price Schedule shall include all costs including taxes, insurances and delivery to the premises of the KRA. 2.10.3 Prices quoted by the tender shall be fixed during the 7

Tender s performance of the contract and not subject to variation on any account. A tender submitted with an adjustable price quotation will be treated as nonresponsive and will be rejected, pursuant to paragraph 2.22. 2.10.4 The validity period of the tender shall be 120 days from the date of opening of the tender. 2.11 Tender Currencies 2.11.1 Prices shall be quoted in Kenya Shillings unless otherwise specified in the Appendix to Instructions to Tenderers. 2.12 Tenderers Eligibility and Qualifications 2.12.1 Pursuant to paragraph 2.1 the tenderer shall furnish, as part of its tender, documents establishing the Tenderers eligibility to tender and its qualifications to perform the contract if its tender is accepted. 2.12.2 The documentary evidence of the Tenderers eligibility to tender shall establish the Authority s satisfaction that the tenderer, at the time of submission of its tender, is from an eligible source country as defined under paragraph 2.1. 2.12.3 The documentary evidence of the Tenderers qualifications to perform the contract if its tender is accepted shall be established to the Authority s satisfaction; (a) (b) (c) that, in the case of a tenderer offering to supply goods under the contract which the tenderer did not manufacture or otherwise produce, the tenderer has been duly authorized by the goods Manufacturer or producer to supply the goods; that the tenderer has the financial, technical, and production capability necessary to perform the contract; and that, in the case of a tenderer not doing business within Kenya, the tenderer is or will be (if awarded the contract) represented by an Agent in Kenya equipped, and able to carry out the Tenderer s maintenance, repair, and spare parts-stocking obligations prescribed in the Conditions of Contract and/or Technical Specifications. 2.13 Goods Eligibility and Conformity to Tender Documents 2.13.1 Pursuant to paragraph 2.2 of this section, the tenderer shall furnish, as part of its tender documents establishing the eligibility and conformity to the tender documents of all goods which the tenderer proposes to supply under the contract 2.13.2 The documentary evidence of the eligibility of the goods shall consist of a statement in the Price Schedule of the 8

country of origin of the goods and services offered which shall be confirmed by a certificate of origin issued at the time of shipment. 2.13.3 The documentary evidence of conformity of the goods to the tender documents may be in the form of literature, drawings, and data, and shall consist of: (a) (b) a detailed description of the essential technical and performance characteristic of the goods; a list giving full particulars, including available source and current prices of spare parts, special tools, etc., necessary for the proper and continuing functioning of the goods for a period of two (2) years, following commencement of the use of the goods by the Authority; and (c) a clause-by-clause commentary on the Authority s Technical Specifications demonstrating substantial responsiveness of the goods and service to those specifications, or a statement of deviations and exceptions to the provisions of the Technical Specifications. 2.13.4 For purposes of the documentary evidence to be furnished pursuant to paragraph 2.13.3 (c) above, the tenderer shall note that standards for workmanship, material, and equipment, as well as references to brand names or catalogue numbers designated by the Procurement entity in its Technical Specifications, are intended to be descriptive only and not restrictive. The tenderer may substitute alternative standards, brand names, and/or catalogue numbers in its tender, provided that it demonstrates to the Procurement entity s satisfaction that the substitutions ensure substantial equivalence to those designated in the Technical Specifications. 2.14 Tender Security 2.14.1 The tenderer shall furnish, as part of its tender, a tender security for the amount specified in the Appendix to Invitation to Tenderers. 2.14.2 The tender security shall be in the amount of 0.5 2 per cent of the tender price. 2.14.3 The tender security is required to protect the Authority against the risk of Tenderer s conduct which would warrant the security s forfeiture, pursuant to paragraph 2.14.8. 2.14.4 The tender security shall be denominated in Kenya Shillings or in another freely convertible currency, and shall be in the form of a bank guarantee or a bank draft issued by a reputable bank located in Kenya or abroad, or a guarantee issued by a reputable insurance company in the form provided in the tender documents or another 9

form acceptable to the Authority and valid for thirty (30) days beyond the validity of the tender. 2.14.5 Any tender not secured in accordance with paragraph 2.14.1 and 2.14.3 will be rejected by the Authority as non responsive, pursuant to paragraph 2.22. 2.14.6 Unsuccessful Tenderer s tender security will be discharged or returned as promptly as possible as but not later than thirty (30) days after the expiration of the period of tender validity prescribed by the Authority. 2.14.7 The successful Tenderer s tender security will be discharged upon the tenderer signing the contract, pursuant to paragraph 2.27 and furnishing the performance security, pursuant to paragraph 2.28. 2.14.8 The tender security may be forfeited: (a) (b) 2.15 Validity of Tenders if a tenderer withdraws its tender during the period of tender validity specified by the Authority on the Tender Form; or in the case of a successful tenderer, if the tenderer fails: (i) to sign the contract in accordance with paragraph 2.27; or (ii) to furnish performance security in accordance with paragraph 2.28. 2.15.1 Tenders shall remain valid for 120 days or as specified in the Invitation to Tender after the date of tender opening prescribed by the Authority pursuant to paragraph 2.18. A tender valid for a shorter period shall be rejected by the Authority as non responsive. 2.15.2 In exceptional circumstances, the Authority may solicit the Tenderer s consent to an extension of the period of validity. The request and the responses thereto shall be made in writing. The tender security provided under paragraph 2.14 shall also be suitably extended. A tenderer may refuse the request without forfeiting its tender security. A tenderer granting the request will not be required nor permitted to modify its tender. 2.16 Format and Signing of Tender 2.16.1 The bidder shall prepare two copies of the tender, clearly marking each ORIGINAL TENDER and COPY OF TENDER, as appropriate. In the event of any discrepancy between them, the original shall govern. 2.16.2 The original and all copies of the tender shall be typed or written in indelible ink and shall be signed by the tenderer or a person or persons duly authorized to bind the tenderer to the contract. The latter authorization shall be indicated by written power-of-attorney accompanying the 10

tender. All pages of the tender, except for unamended printed literature, shall be initialed by the person or persons signing the tender. 2.16.3 The tender shall have no interlineations, erasures, or overwriting except as necessary to correct errors made by the tenderer, in which case such corrections shall be initialed by the person or persons signing the tender. 2.17 Sealing and Marking of Tenders 2.17.1 The Tenderer shall seal the original and each copy of the tender in separate envelopes, duly marking the envelopes as ORIGINAL and COPY The envelopes shall then be sealed in an outer envelope. 2.17.2 The inner and outer envelopes shall: (a) (b) be addressed to the Authority at the address given in the Invitation to Tender: bear, tender number and name in the Invitation for Tenders and the words, DO NOT OPEN BEFORE THURSDAY 16 TH APRIL, 2015 2.17.3 The inner envelopes shall also indicate the name and address of the tenderer to enable the tender to be returned unopened in case it is declared late. 2.17.4 If the outer envelope is not sealed and marked as required by paragraph 2.17.2, the Authority will assume no responsibility for the tender s misplacement or premature opening. 2.18 Deadline for Submission of Tenders 2.18.1 Tenders must be received by the Authority at the address specified under paragraph 2.17.2 no later than THURSDAY 16 TH APRIL, 2015 at 12.00 Noon 2.18.2 The Authority may, at its discretion, extend this deadline for the submission of tenders by amending the tender documents in accordance with paragraph 2.6, in which case all rights and obligations of the Authority and candidates previously subject to the deadline will therefore be subject to the deadline as extended 2.19 Modification and Withdrawal of Tenders 2.19.1 The tenderer may modify or withdraw its tender after the tender s submission, provided that written notice of the modification, including substitution or withdrawal of the tenders, is received by the Authority prior to the deadline prescribed for submission of tenders. 2.19.2 The Tenderer s modification or withdrawal notice shall be prepared, sealed, marked, and dispatched in accordance with the provisions of paragraph 2.17. A withdrawal notice may also be sent by cable, telex but followed by a signed confirmation copy, postmarked not later than the 11

deadline for submission of tenders. 2.19.3 No tender may be modified after the deadline for submission of tenders. 2.19.4 No tender may be withdrawn in the interval between the deadline for submission of tenders and the expiration of the period of tender validity specified by the tenderer on the Tender Form. Withdrawal of a tender during this interval may result in the Tenderer s forfeiture of its tender security, pursuant to paragraph 2.14.8 2.19.5 The Authority may at any time terminate procurement proceedings before contract award and shall not be liable to any person for the termination. 2.19.6 The Authority shall give prompt notice of the termination to the Tenderers and on request give its reasons for termination within 14 days of receiving the request from any tenderer. 2.20 Opening of Tenders 2.2 The Authority will open all tenders in the presence of Tenderers representatives who choose to attend, at 12:00 noon on THURSDAY 16 TH APRIL, 2015 in the location specified in the Invitation to Tender. The Tenderers representatives who are present shall sign a register evidencing their attendance. 2.20.2 The Tenderers names, tender modifications or withdrawals, tender prices, discounts and the presence or absence of requisite tender security and such other details as the Authority, at its discretion, may consider appropriate, will be announced at the opening. 2.20.3 The Authority will prepare minutes of the tender opening. 2.21 Clarification of Tenders 2.21.1 To assist in the examination, evaluation and comparison of tenders the Authority may, at its discretion, ask the tenderer for a clarification of its tender. The request for clarification and the response shall be in writing, and no change in the prices or substance of the tender shall be sought, offered, or permitted. 2.21.2 Any effort by the tenderer to influence the Authority in the Authority s tender evaluation, tender comparison or contract award decisions may result in the rejection of the Tenderers tender. 2.22 Preliminary Examination 2.22.1 The Authority will examine the tenders to determine whether they are complete, whether any computational errors have been made, whether required sureties have been furnished, whether the documents have been properly signed, and whether the tenders are generally in order. 12

2.22.2 Arithmetical errors will be rectified on the following basis. If there is a discrepancy between the unit price and the total price that is obtained by multiplying the unit price and quantify, the unit price shall prevail, and the total price shall be corrected. If the candidate does not accept the correction of the errors, its tender will be rejected, and its tender security forfeited. If there is a discrepancy between words and figures the amount in words will prevail. 2.22.3 The Authority may waive any minor informality or nonconformity or irregularity in a tender which does not constitute a material deviation, provided such waiver does not prejudice or effect the relative ranking of any tenderer. 2.22.4 Prior to the detailed evaluation, pursuant to paragraph 2.23 the Authority will determine the substantial responsiveness of each tender to the tender documents. For purposes of these paragraphs, a substantially responsive tender is one, which conforms to all the terms and conditions of the tender documents without material deviations. The Authority determination of a tender s responsiveness is to be based on the contents of the tender itself without recourse to extrinsic evidence. 2.22.5 If a tender is not substantially responsive, it will be rejected by the Authority and may not subsequently be made responsive by the tenderer by correction of the non conformity. 2.23 Conversion to Single Currency 2.23.1 Where other currencies are used, the Authority will convert these currencies to Kenya Shillings using the selling exchange rate on the date of tender closing provided by the Central Bank of Kenya. 2.24 Evaluation and Comparison of Tenders 2.24.1 The Authority will evaluate and compare the tenders which have been determined to be substantially responsive, pursuant to paragraph 2.22 2.24.2 The tender evaluation committee shall evaluate the tender within 30 days of the validity period from the date of opening the tender. 2.24.3 A tenderer who gives false information in the tender document about its qualification or who refuses to enter into a contract after notification of contract award shall be considered for debarment from participating in future public procurement. 2.24.4 The comparison shall be of the price including all costs as well as duties and taxes payable on all the materials to be used in the provision of the services. 2.24.5 The KRA s evaluation of a tender will take into account, in addition to the tender price, the following factors, in the manner and to the extent indicated in paragraph 2.22.4 13

and in the technical specifications: (a) Operational plan proposed in the tender; (b) Deviations in payment schedule from that specified in the Special Conditions of Contract. 2.24.6 Pursuant to paragraph 22.3 the following evaluation methods will be applied: (a) Operational Plan The KRA requires that the services under the Invitation for Tenders shall be performed at the time specified in the Schedule of Requirements. Tenders offering to perform longer than the KRA s required delivery time will be treated as non-responsive and rejected. (b) Deviation in Payment Schedule Tenderers shall state their tender price for the payment on a schedule outlined in the special conditions of contract. Tenders will be evaluated on the basis of this base price. Tenderers are, however, permitted to state an alternative payment schedule and indicate the reduction in tender price they wish to offer for such alternative payment schedule. The KRA may consider the alternative payment schedule offered by the selected tenderer. 2. 24.7 The tender evaluation committee shall evaluate the tender within 30 days from the date of opening the tender. 2.24.8 To qualify for contract awards, the tenderer shall have the following:- (a) Necessary qualifications, capability experience, services, equipment and facilities to provide what is being procured. (b) Legal capacity to enter into a contract for procurement (c) Shall not be insolvent, in receivership, bankrupt or in the process of being wound up and is not the subject of legal proceedings relating to the foregoing (d) Shall not be debarred from participating in public procurement. 2.25 Preference 2.25.1 Kenya Revenue Authority does not allow any margin of preference. 2.26 Contacting the Kenya Revenue Authority 2.26.1 Subject to paragraph 2.21 no tenderer shall contact the Authority on any matter related to its tender, from the time of the tender opening to the time the contract is awarded. 2.26.2 Any effort by a tenderer to influence the Authority in its decisions on tender, evaluation, tender comparison, or contract award may result in the rejection of the Tenderer s tender. 14

2.27 Award of Contract (a) Post-qualification 2.27.1 In the absence of pre-qualification, the Authority will determine to its satisfaction whether the tenderer that is selected as having submitted the lowest evaluated responsive tender is qualified to perform the contract satisfactorily. 2.27.2 The determination will take into account the tenderer financial, technical, and production capabilities. It will be based upon an examination of the documentary evidence of the Tenderers qualifications submitted by the tenderer, pursuant to paragraph 2.12.3 as well as such other information as the Authority deems necessary and appropriate. 2.27.3 An affirmative determination will be a prerequisite for award of the contract to the tenderer. A negative determination will result in rejection of the Tenderer s tender, in which event the Authority will proceed to the next lowest evaluated tender to make a similar determination of that Tenderer s capabilities to perform satisfactorily. (b) Award Criteria 2.27.4 The Authority will award the contract to the successful tenderer(s) whose tender has been determined to be substantially responsive and has been determined to be the lowest evaluated tender, provided further that the tenderer is determined to be qualified to perform the contract satisfactorily. (c) KRA s Right to Vary Quantities 2.27.5 The Authority reserves the right at the time of contract award to increase or decrease the quantity of goods originally specified in the Schedule of requirements without any change in unit price or other terms and conditions (d) KRA S Right to Accept or Reject Any or All Tenders 2.27.6 The Authority reserves the right to accept or reject any tender, and to annul the tendering process and reject all tenders at any time prior to contract award, without thereby incurring any liability to the affected tenderer or tenderers or any obligation to inform the affected tenderer or tenderers of the grounds for the Authority s action 2.28 Notification of Award 2.28.1 Prior to the expiration of the period of tender validity, the Authority will notify the successful tenderer in writing that 15

its tender has been accepted. 2.28.2 The notification of award will constitute the formation of the Contract but will have to wait until the contract is finally signed by both parties. 2.28.3 Upon the successful Tenderer s furnishing of the performance security pursuant to paragraph 2.28, the Authority will promptly notify each unsuccessful Tenderer and will discharge its tender security, pursuant to paragraph 2.14. 2.29 Signing of Contract 2.29.1 At the same time as the Authority notifies the successful tenderer that its tender has been accepted, the Authority will send the tenderer the Contract Form provided in the tender documents, incorporating all agreements between the parties. 2.29.2 The parties to the contract shall have it signed within 30 days from the date of notification of contract award unless thee is an administrative review request. 2.29.3 Within thirty (30) days of receipt of the Contract Form, the successful tenderer shall sign and date the contract and return it to the Authority 2.30 Performance Security 2.3 Within Thirty (30) days of the receipt of notification of award from the Authority, the successful tenderer shall furnish the performance security in accordance with the Conditions of Contract, in the Performance Security Form provided in the tender documents, or in another form acceptable to the Authority. 2.30.2 Failure of the successful tenderer to comply with the requirements of paragraph 2.27 or paragraph 2.28 shall constitute sufficient grounds for the annulment of the award and forfeiture of the tender security, in which event the Authority may make the award to the next lowest evaluated Candidate or call for new tenders. 2.31 Corrupt or Fraudulent Practices 2.31.1 The Authority requires that tenderers observe the highest standard of ethics during the procurement process and execution of contracts when used in the present regulations, the following terms are defined as follows; (i) corrupt practice means the offering, giving, receiving, or soliciting of any thing of value to influence the action of a public official in the procurement process or in contract execution; and (ii) fraudulent practice means a misrepresentation of facts in order to influence a procurement process or the 16

execution of a contract to the detriment of the Kenya Revenue Authority, and includes collusive practice among tenderer (prior to or after tender submission) designed to establish tender prices at artificial noncompetitive levels and to deprive the Kenya Revenue Authority of the benefits of free and open competition; 2.31.2 The Kenya Revenue Authority will reject a proposal for award if it determines that the tenderer recommended for award has engaged in corrupt or fraudulent practices in competing for the contract in question. 2.31.3 Further a tenderer who is found to have indulged in corrupt or fraudulent practices risks being debarred from participating in public procurement in Kenya. 17

Appendix to Instructions to Tenderers The following information regarding the particulars of the tender shall complement supplement or amend the provisions of the instructions to tenderers. Wherever there is a conflict between the provision of the instructions to tenderers and the provisions of the appendix, the provisions of the appendix herein shall prevail over those of the instructions to tenderers. INSTRUCTIONS TO TENDERERS REFERENCE PARTICULARS OF APPENDIX TO INSTRUCTIONS TO TENDERS 2.1.1 This invitation for Tenders is open to all Tenderers eligible as described in the Invitation to Tender. Bidders are supposed to have appropriate and valid business registration. 2.1.2 The declaration of No Conflict of Interest is incorporated in the Confidential Business Questionnaire 2.3.2 The bid document shall be charged Kshs.1,000 per set for hard copy and free for downloaded copy. 2.10.4 Tender Validity Period is 120 days from THURSDAY 16 TH APRIL,2015 Tender prices are to be quoted in Kenya Shillings Only 2.13.1 The clause-by-clause commentary of the technical specifications is given in the Clause by clause tables of Technical specifications. 2.14.1 Tenders must be accompanied with a Tender security denominated in Kenya Shillings in the form of Cash deposit, Bank Guarantee, or a guarantee issued by a reputable insurance company registered with Insurance Regulatory Agency. The amount of tender security required is Kenya Shillings Three hundred thousand Only (Kshs.300, 000) or the equivalent in freely convertible currency. The tender security must be valid for 150 days from THURSDAY 16 TH APRIL,2015 2.16.2 The bidder must provide an appropriate written power of attorney establishing the authorization of the signatory to the tender documents to bind the bidder. 2.17 This tender is based on the two-envelope bid system. The bidder must submit a bid which has a technical proposal in one envelop and a financial proposal in another envelope. These two envelopes are then placed in one envelope to form a complete bid. Bids must be submitted in TWO copies. 2.18.1 Time, date, and place for bid opening are: 12:00 hours, local time, on THURSDAY 16 TH APRIL 2015 Place: Convention Centre on the 5 th Floor of Times Tower Building. Street: Haile Sellasie Avenue City: Nairobi Country: Kenya. 2.2 Opening of Technical Proposals will be done in public at the time of closing the tender. 18

2.22 Opening of Financial Proposals of the bids that meet the minimum technical specifications will be done upon completion of the technical evaluation. The qualified bidders will be invited to witness the opening of the Financial proposals. Bidders are expected to examine all instructions, forms, terms, specifications, and other information in the Bidding Documents. Failure to furnish all information required by the Bidding Documents or to submit a bid not substantially responsive to the Bidding Documents in every respect will be at the Bidder s risk and may result in the rejection of its bid. The bid evaluation will take into account technical factors in addition to cost factors. The weight for price is 30% while the weight for technical specifications is 70%. Bidders must conform to the specific Technical Requirements in Section IV. 2.24 The evaluation of the responsive bids will take into account technical factors, in addition to cost factors. An Evaluated Bid Score (B) will be calculated for each responsive bid using the following formula, which permits a comprehensive assessment of the bid price and the technical merits of each bid: 2.25 B C C low X + T where: C = Evaluated Bid Price C low = the lowest of all Evaluated Bid Prices among responsive bids T = the total Technical Score awarded to the bid X = weight for the Price as specified in the BDS (i.e. 0.3) The bid with the highest Evaluated Bid Score (B) among responsive bids shall be termed the Lowest Evaluated Bid and is eligible for Contract award. Bidders must conform to the specific Technical Requirements in Section IV. The Authority will not grant any preferences. 2.30 The performance security required will be 10% of the Contract Value. 19

SECTION III: CONTRACT GENERAL CONDITIONS OF Table of Clauses 3.1 Definitions... 20 3.2 Application. 20 3.3 Country of Origin 20 3.4 Standards 20 3.5 Use of Contract Documents and Information 20 3.6 Patent Rights 21 3.7 Performance Security.. 21 3.8 Inspection and Tests. 21 3.9 Packing. 22 3.10 Delivery and Documents 22 3.11 Insurance... 22 3.12 Payment.. 22 3.13 Price.. 22 3.14 Assignments. 22 3.15 Sub contracts... 22 3.16 Termination for Default.... 23 3.17 Liquidated Damages.... 23 3.18 Resolution of Disputes. 23 3.19 Language and law... 23 3.20 Force Majeure... 23 3.21 Notices..... 23 20

SECTION III - CONTRACT GENERAL CONDITIONS OF 3.1 Definitions 3.1.1 In this Contract, the following terms shall be interpreted as indicated:- (a) (b) (c) (d) (e) (f) (g) (h) The Contract means the agreement entered into between the Procuring entity and the tenderer, as recorded in the Contract Form signed by the parties, including all attachments and appendices thereto and all documents incorporated by reference therein. The Contract Price means the price payable to the tenderer under the Contract for the full and proper performance of its contractual obligations The Goods means all of the equipment, machinery, and/or other materials, which the tenderer is required to supply to the Procuring entity under the Contract. The Procuring entity means Kenya Revenue Authority (KRA), the organization purchasing the Goods under this Contract. The Tenderer means the individual or firm supplying the Goods under this Contract. GCC means the General Conditions of Contract SCC means the Special Conditions of Contract Day means calendar day 3.2 Application 3.2.1 These General Conditions shall apply in all Contracts made by the Authority for the procurement installation and commissioning of equipment 3.3 Country of Origin 3.3.1 For purposes of this clause, Origin means the place where the Goods were mined, grown or produced. 3.3.2 The origin of Goods and Services is distinct from the nationality of the tenderer. 3.4 Standards 3.4.1 The Goods supplied under this Contract shall conform to the standards mentioned in the Technical Specifications. 3.5 Use of Contract Documents and Information 3.5.1 The tenderer shall not, without the Authority s prior written consent, disclose the Contract, or any provision therefore, or any specification, plan, drawing, pattern, sample, or information furnished by or on behalf of the Authority in connection therewith, to any person other than a person employed by the tenderer in the performance of the Contract. 3.5.2 The tenderer shall not, without the Authority s prior written consent, make use of any document or information enumerated in paragraph 3.5.1 above. 21

3.5.3 Any document, other than the Contract itself, enumerated in paragraph 3.5.1 shall remain the property of the Procuring entity and shall be returned (all copies) to the KRA on completion of the Tenderer s performance under the Contract if so required by the Authority. 3.6 Patent Rights The tenderer shall indemnify the Procuring entity against all third-party claims of infringement of patent, trademark, or industrial design rights arising from use of the Goods or any part thereof in the Authority s country. 3.7 Performance Security 3.7.1 Within thirty (30) days of receipt of the notification of Contract award, the successful tenderer shall furnish to the Procuring entity the performance security in the amount specified in Special Conditions of Contract. 3.7.2 The proceeds of the performance security shall be payable to the Authority as compensation for any loss resulting from the Tenderer s failure to complete its obligations under the Contract. 3.7.3 The performance security shall be denominated in the currency of the Contract, or in a freely convertible currency acceptable to the Authority and shall be in the form of a bank guarantee or an irrevocable letter of credit issued by a reputable bank located in Kenya or abroad, acceptable to the Authority, in the form provided in the tender documents. 3.7.4 The performance security will be discharged by the Authority and returned to the Candidate not later than thirty (30) days following the date of completion of the Tenderer s performance obligations under the Contract, including any warranty obligations, under the Contract. 3.8 Inspection and Tests 3.8.1 The Authority or its representative shall have the right to inspect and/or to test the goods to confirm their conformity to the Contract specifications. The Authority shall notify the tenderer in writing in a timely manner, of the identity of any representatives retained for these purposes. 3.8.2 The inspections and tests may be conducted in the premises of the tenderer or its subcontractor(s), at point of delivery, and/or at the Goods final destination If conducted on the premises of the tenderer or its subcontractor(s), all reasonable facilities and assistance, including access to drawings and production data, shall be furnished to the inspectors at no charge to the Authority. 3.8.3 Should any inspected or tested goods fail to conform to the Specifications, the Procuring entity may reject the equipment, and the tenderer shall either replace the rejected equipment or make alternations necessary to make specification requirements free of costs to the Authority. 3.8.4 The Authority s right to inspect, test and where necessary, reject the goods after the Goods arrival shall in no way be limited or waived by reason of the equipment having previously been inspected, tested and passed by the Procuring entity or its 22

representative prior to the equipment delivery. 3.8.5 Nothing in paragraph 3.8 shall in any way release the tenderer from any warranty or other obligations under this Contract. 3.9 Packing 3.9.1 The tenderer shall provide such packing of the Goods as is required to prevent their damage or deterioration during transit to their final destination, as indicated in the Contract. 3.9.2 The packing, marking, and documentation within and outside the packages shall comply strictly with such special requirements as shall be expressly provided for in the Contract. 3.10 Delivery and Documents 3.1 Delivery of the Goods shall be made by the tenderer in accordance with the terms specified by Procuring entity in its Schedule of Requirements and the Special Conditions of Contract. 3.11 Insurance 3.11.1 The Goods supplied under the Contract shall be fully insured against loss or damage incidental to manufacturer or acquisition, transportation, storage, and delivery in the manner specified in the Special conditions of contract. 3.12 Payment 3.12.1 The method and conditions of payment to be made to the tenderer under this Contract shall be specified in Special Conditions of Contract. 3.12.2 Payments shall be made promptly by the KRA as specified in the contract. 3.13 Prices 3.13.1 Prices charged by the tenderer for goods delivered and services performed under the Contract shall not, with the exception of any price adjustments authorized in Special Conditions of Contract, vary from the prices by the tenderer in its tender. 3.13.2 Contract price variations shall not be allowed for contracts not exceeding one year (12 months). 3.13.3 Where contract price variation is allowed, the variation shall not exceed 10% of the original contract price. 3.13.4 Price variation request shall be processed by the procuring entity within 30 days of receiving the request. 3.14 Assignment 3.14.1 The tenderer shall not assign, in whole or in part, its obligations to perform under this Contract, except with the Authority s prior written consent. 3.15 Subcontracts 3.15.1 The tenderer shall notify the Procuring entity in writing of all subcontracts awarded under this Contract if not already specified in the tender. Such notification, in the original tender or later, shall not relieve the tenderer from any liability or obligation under the Contract. 23

3.16 Termination for Default 3.16.1 The Authority may, without prejudice to any other remedy for breach of Contract, by written notice of default sent to the tenderer, terminate this Contract in whole or in part: (a) (b) (c) if the tenderer fails to deliver any or all of the goods within the periods) specified in the Contract, or within any extension thereof granted by the Authority; if the tenderer fails to perform any other obligation(s) under the Contract; if the tenderer, in the judgment of the Authority has engaged in corrupt or fraudulent practices in competing for or in executing the Contract. 3.16.2 In the event the Authority terminates the Contract in whole or in part, it may procure, upon such terms and in such manner as it deems appropriate, equipment similar to those undelivered, and the tenderer shall be liable to the Procuring entity for any excess costs for such similar goods. 3.17 Liquidated Damages 3.17 If the tenderer fails to deliver any or all of the goods within the period(s) specified in the contract, the procuring entity shall, without prejudice to its other remedies under the contract, deduct from the contract prices liquidated damages sum equivalent to 0.5% of the delivered price of the delayed items up to a maximum deduction of 10% of the delayed goods. After this the tenderer may consider termination of the contract. 3.18 Resolution of Disputes 3.18.1 The Authority and the tenderer shall make every effort to resolve amicably by direct informal negotiation and disagreement or dispute arising between them under or in connection with the contract 3.18.2 If, after thirty (30) days from the commencement of such informal negotiations both parties have been unable to resolve amicably a contract dispute, either party may require adjudication in an agreed national or international forum, and/or international arbitration. 3.19 Language and Law 3.19.1 The language of the contract and the law governing the contract shall be English language and the Laws of Kenya respectively unless otherwise stated. 3.20 Force Majeure 3.2 The tenderer shall not be liable for forfeiture of its performance security or termination for default if and to the extent that it s delay in performance or other failure to perform its obligations under the Contract is the result of an event of Force Majeure. 3.21 Notices 3.21.1 Any notices given by one party to the other pursuant to this contract shall be sent to the other by post, Fax or Email and confirmed in writing to the other party s address specified in SCC 3.21.2 A notice shall be effective when delivered or on the notices effective date, whichever is later. 24

SECTION IV - CONTRACT SPECIAL CONDITIONS OF 4.1. Special Conditions of Contract shall supplement the General Conditions of Contract. Whenever there is a conflict, between the GCC and the SCC, the provisions of the SCC herein shall prevail over these in the GCC. 4.2. Special conditions of contract as relates to the GCC. REFERENCE OF GCC SPECIAL CONDITIONS OF CONTRACT 3.7 The performance bond must be issued in the form of a bank guarantee. The bank guarantee must be valid in Kenya and be at least 10% of the contract value. 3.9 3.10 Delivery Packaging The tenderer shall provide such packing of the Goods as is required to prevent their damage or deterioration during transit to their final destination, as indicated in the Contract. All packages must be clearly labeled with description of contents and quantities. Supply, Delivery, Installation and Commissioning of Enterprise Risk Management Software will be installed at Times Tower. Conditions of delivery will be in the Local service order and contract within the period indicated by the successful bidder(s) from the date of receiving the Local Service Order (LPO). 3.12 Payment Terms 3.13 The Kenya Revenue Authority (KRA) payment terms are that payment shall be made within thirty (30) days from the date of delivery, commissioning and signing of acceptance report for capital expenses. However, KRA may negotiate mutually acceptable payment terms with the successful tenderer. Prices Prices charged by the tenderer for goods delivered and services performed under the Contract shall not, with the exception of any price adjustments authorized in Special Conditions of Contract, vary from the prices by the tenderer in its tender. All prices quoted by the tenderers must be inclusive of all taxes, discounts and delivery costs to Times Tower, Nairobi, Kenya 3.17 Liquidated Damages If the delivery date is extended (except by mutual consent) a penalty amounting to 0.5% of the total cost will be charged per day up to a maximum of twenty (20) days. No deliveries shall be accepted after the twentieth working day in which 25

case the LPO will automatically lapse and be deemed to have been cancelled at the close of business on the twentieth day. The Authority shall then be at liberty to realize the performance bond. In this clause, days means working days. 3.18 Resolutions of Disputes Any dispute, controversy or claim between the Parties arising out of this Contract or the breach, termination or invalidity thereof, unless settled amicably under the preceding paragraph of this Article within sixty (60) days after receipt by one Party of the other Party's request for such amicable settlement, shall be referred by either Party to arbitration in accordance with the UNCITRAL Arbitration Rules then obtaining. The place of arbitration shall be Nairobi. The arbitral tribunal shall have no authority to award punitive damages. In addition, unless otherwise expressly provided in this Contract, the arbitral tribunal shall have no authority to award interest. The parties shall be bound by any arbitration award rendered as a result of such arbitration as the final adjudication of any such controversy, claim or dispute. 3.19 The language of all correspondence and documents related to the bid is: English. Unless explicitly specified in the Technical Requirements section, the key passages of all accompanying printed literature in any other language must be translated into the above language. 3.21 Notices Kenya Revenue Authority Deputy Commissioner-Procurement & Supplies Services Times Tower Building, 25th Floor, P.O Box 48240 00100 GPO, Tel. +254 020 3310900 Nairobi, Kenya. Email erprocurement@kra.go.ke website: www.kra.go.ke I/We hereby certify that I/We have read the special conditions of contract (Section E), confirm that I/We have understood and I/We shall abide by them. Tenderer------------------------------------------- Date-------------------------------- Signature-------------------------------------- official Rubber stamp--------------- 26

SECTION V - SCHEDULE OF REQUIREMENTS 5.1 General The Kenya Revenue Authority requires installation and commissioning of Enterprise Risk Management Software services through competent bidders. 5.2 Submission of Bids (i) The Tenderer must submit a two-envelope bid in the following format: Technical:-comprising of the following documents Tender Notice/Invitation to Tender. Tender Security. Certificate of Incorporation/Registration. Company Registry Certificate of Directorship-C12 for Limited Companies Duly Filled Confidential Business Questionnaire. Valid Tax Compliance Certificate. Audited Accounts for the last three (3) years and Three (3) months Certified Bank Statements CR. 12 Form Power of Attorney. Financial: - comprising of: Tender Form, Financial Summary Proposal Submission Form and Price Schedules (only) (ii) Sealing and Marking of Bids: The inner envelopes should be clearly marked as follows: ORIGINAL TECHNICAL COPY TECHNICAL A: KRA/HQS/NCB-044/2014/2015 B: KRA/HQS/NCB-044/2014/2015 ORIGINAL FINANCIAL A: KRA/HQS/NCB-044/2014/2015 COPY FINANCIAL B: KRA/HQS/NCB-044/2014/2015 The envelopes shall then be sealed in an outer envelope. The inner and outer envelopes shall be addressed to: Commissioner General Kenya Revenue Authority P.O Box 48240, 00100 Nairobi. 27

5.3 Tender Responsiveness Criteria The submission of the following items will be required in the determination of the Completeness of the Bid. Bids that do not contain all the information required will be declared non responsive and shall not be evaluated further. Description of Criteria 1 Submission of Tender Documents Two envelope bid Tender Security Confidential Business Questionnaire CR. 12 Forms Power of Attorney (where applicable) 2 Company Profile Attach copy of Certificate of Incorporation, Memorandum and Articles of Association or Registration of Business Name 3 Managerial and Key Personnel Competency Profiles Attach: Organization chart Key Staff Competency Profiles 4 Financial Resources Submit: Last 3 years Audited Accounts 1 Three months Certified Bank statements 5 Physical Facilities Physical Address: State if owned or leased and attach copy of title or lease documents and latest utility bill. Equipment and other resources related to the procurement item. 6 Experience State number of years of experience in Procurement Item. Experience in services of similar nature. Demonstrate by listing of clients/contracts in last two years. 7 Reputation Submit evidence of five (5) major clients with contracts of value of similar nature. Provide recommendation letters, value of contracts and contact person, address and telephone numbers. 8 Social Obligations Submit certificate of compliance for the following; Valid Tax Compliance 2 1 Firms that have been in existence for less than three years should submit audited accounts for the period of operation. 2 A Current Certificate of Compliance should be sought from the KRA in the case of local suppliers or agents. International bidders will be required to swear an affidavit to the effect that they have complied with taxation requirements in their country. 28

5.4 Vendor Evaluation Criteria The following criteria will be used in the evaluation of all potential suppliers. International Bidders must attach the same for local representatives. The documents submitted will be evaluated for suitability and awarded marks which will contribute to a maximum 20% of the total tender evaluation. Description of Criteria Company Profile Suitability of Bidder and legal capacity to deliver goods/services. Tender Security (1 mark) Confidential Business Questionnaire (1 mark) Power of Attorney where applicable (1 mark) Certificate of Incorporation OR Registration of Business Name Certificate (1 mark) Memorandum and Articles of Association where applicable (1 mark) Managerial and Key Personnel Competency Profiles Qualification of Key Staff and operational capacity to deliver goods/service. Organization chart (1 marks) Key Staff Competency Profiles. CV of the lead consultant or other support staff (1 mark) Financial Resources Financial Ratios to be Evaluated: Cash and Cash Equivalent : Total Assets (1 mark) Current Assets : Current Liabilities (1 mark) Working Capital (1 mark) Or Three Months financial statement for individual consultants (1 mark) Physical Facilities Proof of physical Address State if owned or leased and attach copy of title or lease documents and latest utility bill (1 mark) Equipment and other resources related to the procurement item (1 mark) Experience No. of Continuous Years of Service in procurement item or in consultancy services related to the procurement item At least five years experience (2 marks) Reputation Submit details of five major clients, summary of services rendered, value of contracts and contact person, address and telephone numbers (1 mark) Proof of works of Similar Magnitude and Complexity undertaken in the last three years (1 mark) Maximum Cut off Score Score 5 4 2 2 3 2 2 1 2 2 3 2 Provide litigation History (1 mark) Social Obligations Proof of having satisfied Key Social Obligations Tax Compliance (3 marks) 3 3 Total Score 20 15 29

5.5 Overall Tender Evaluation Criteria The tender evaluation criteria is weighted as follows; - Criteria Maximum Cut Off Scores Score Tender Responsiveness mandatory requirement Vendor Evaluation 20 15 Responsiveness to the 50 40 Technical Specifications Financial Schedules 30 20 Totals 100 75 30

SECTION VI - TECHNICAL SPECIFICATIONS 6.1 General This tender covers the Supply, Delivery, Installation and Commisioning of Enterprise Risk Management Software. 6.1.1 These specifications describe the requirements for goods/services. Tenderers are requested to submit with their offers the detailed specifications. 6.1.2 Tenderers must indicate on the specifications sheets whether the goods offered comply with each specified requirement. 6.1.3 All the specifications of the products to be supplied shall not be less than those required in these specifications. Deviations from the basic requirements, if any shall be explained in detail in writing with the offer, with supporting data such as calculation sheets, etc. The procuring entity reserves the right to reject the goods/products, if such deviations shall be found critical to the use and operation of the products. 6.1.4 The tenderers are requested to present information along with their offers as follows: (i) (ii) 6.2 Particulars Shortest possible delivery period of each product Information on proper representative including their names and addresses This tender covers the Supply, Delivery, Installation and Commissioning of Enterprise Risk Management Software. Specifications are given in Technical requirements section. 6.3 Warranty Successful Bidder shall ensure that the products have a manufacturer s / developer s written warranty as required in the detailed specifications. 31

GENERAL REQUIREMENTS 1.1 Introduction Kenya Revenue Authority (KRA) is the tax collection agency of the Government of Kenya established by Cap. 469 of the laws of Kenya. The Commissioner General is in charge of the day to day management of Authority assisted by commissioners and departmental heads. The Authority s Board of Directors is responsible for providing oversight and direction on its affairs. The Authority is responsible for assessing, collecting and accounting for all revenues in accordance with specific laws, advising the National Treasury on matters relating to revenue administration and performing such other functions in relation to revenue administration as the Cabinet Secretary to the National Treasury may direct. 1.2 Background The reforms being undertaken in the Authority under its Revenue Administration Reforms and Modernization Programme as part of the wider public service reforms have identified the need for more effective corporate governance framework in the public sector. Key amongst this is the adoption of Enterprise Risk Management (ERM), to provide a basis for management to effectively deal with the uncertainties and the associated risks. KRA has an ongoing programme of implementation of ERM based on ISO 31000 International Standard Risk Management Principles and Guidelines. The Authority intends to engage a firm to supply and install an appropriate state-of-the art Enterprise Risk Management (ERM) software platform and provide other related services necessary for a successful ERM implementation. Specifically, the software is intended to automate the following Enterprise Risk Management processes for greater efficiency; i. Risk and Control Self Assessment (RCSA) procedures and workflows which include the following; a) Identification and recording of risks b) Quantitative Risk Assessments based on Likelihood and Consequence c) Capturing of both inherent and residual risks d) Identification of existing and proposed controls related to each risk e) Evaluation of control effectiveness f) Built in RCSA scheduling ii. Incident reporting that will allow staff and Business Units within the Authority to capture and report on incidents, breaches, losses, complaints and control failures, including anonymous reporting of incidents. The system must allow for analysis of the incidents to determine the root cause, controls that failed if any and have ability to reference back to the RCSA. iii. Tracking and reporting on key risk and control indicators (KRIs). These will act as early warning signals by providing the capability to indicate existence of predefined risk factors that will allow the Authority to take proactive action. 32

iv. Tracking of risk reduction activities including person responsible, timeframes for resolution and status of proposed actions v. Mapping and tracking of compliance to legal and regulatory requirements vi. Generation of dashboards, heat maps and scorecards to support decision making. 1.3 Objectives The objectives of the automation assignment will include but not limited to: a) Supply, delivery, installation and commissioning of ERM software b) Undertake capacity building on the ERM software through training and knowledge transfer. c) Undertake capacity building on Enterprise Risk Management. d) Carry out operational risk assessment for the various business processes of KRA 1.4 Scope of the Assignment The successful firm will be required to familiarize themselves with the Authority s strategic plan including the vision, mission, core mandate, goals, objectives and departmental work plans and undertake the following: a) Supply, delivery, installation and commissioning of Enterprise Risk Management software. Supply and installation of the hardware platform is not in the scope of this assignment but bidders are required to provide the recommended hardware and system software specification for the successful implementation of their proposed software at KRA. b) Customize the ERM software to automate the Authority s Enterprise Risk Management process as outlined in the Authority s Risk Management Policy and Framework. c) Provide administrator and end-user training on the ERM software. d) Develop and document an ERM system users manual e) Work with the Authority throughout the full cycle of ERM software implementation. f) Undertake a post ERM software implementation review. 1.5 Deliverables The minimum expected deliverables of the assignment are as follows: a) An Enterprise Risk Management System that is hosted and operated on a state-of-art ICT platform which includes modules for the ERM framework tools, namely; 33

Risk and Control Self Assessment (RCSA) module Key Risk Indicators (KRIs) module Compliance attestation module (for key controls and legal & regulatory compliance monitoring) Action tracking module for monitoring progress in implementation of control improvement actions Incidence recording and management module with capabilities for post incidence analysis b) ERM process deliverables, including: Automated Risk Registers (with identified and assessed risks and KRIs, Identified key controls, Compliance attestation questions and identified improvement actions) for a minimum of 20 business units/ processes in the Authority, to be derived from RCSAs conducted using the software Automated Incidence registers for a minimum of 20 business units/ processes Automated Risk heat maps and dashboards for a minimum of 20 business units/ processes Automated Key Risk Indicators (KRIs) dashboards for a minimum of 20 business units/ processes Automated Compliance Monitoring Framework with key controls and legal/regulatory requirements to be monitored for a minimum of 20 business units/ processes Automated Improvement Action Tracking dashboards indicating desired control improvements for a minimum of 20 business units/ processes. Review the ERM policies and give recommendations for improvement as necessary. c) Software end-user and system administrator training Undertake skills assessment and determine the skills gap Training curriculum and materials to be based on skills gaps analysis by the vendor/trainer Training sessions designed to address the identified skills gaps (KRA will provide training venues/facilities) o System administrator training to be provided for 10 system administrators from ICT and the Corporate Risk Management Department o System end users training and Operational Risk Management training to be provided to 100 staff Training report including skills assessment and training evaluation d) ERM system users manual e) Post-ERMS implementation review report. f) ERM Software Support and Maintenance for two (2) years, including, software upgrades 34

2.0 Scope of Usage of the software The ERM software will be used throughout the Authority for risk management in both the business and support services departments. The software is therefore envisaged to support management of the business risks and operational risks. The key users of the system will therefore be the Risk Management Officers of the various departments/ divisions and regions of the Authority and the Risk Champions appointed at the various sections/ stations of the revenue and support departments. The Authority s Management will also be a key user and consumer of the management reports generated from the system either a users with access rights or recipients of the reports. It is anticipated that the software will have an incremental usage as more business units and processes undergo risk and control self assessment (RCSA). The respondents are therefore requested to provide costs based on incremental usage as follows; i. Cost for 200 users ii. Cost for 500 users iii. Cost for 1000 users iv. Cost for 1,500 users 3.0 Objectives of automation of the ERM process i. Provide a system that supports the ERM framework operation to ensure adequate management of risks ii. Facilitate effective reporting on risk management to ensure risk based decision making in the Authority both at the strategic and operational levels. iii. Provide a medium of monitoring risks through integration with KRA business and support service systems. 35

SECTION VI SCHEDULE CLAUSE BY CLAUSE TECHNICAL REQUIREMENTS 5.0 Technical Requirements 5.1 Acronyms 1. Authority Refers to Kenya Revenue Authority 2. RCSA (Risk and Control Self Assessment) Refers to the process of identifying, recording and assessing risk exposures and the effectiveness of related controls in mitigating those risks. 3. KRI-Key Risk Indicators 4. Cause and events libraries- Collection of risk causes and events collated into a single repository. 5. ERM-Enterprise Risk Management 6. Full cycle of implementation refers to; supply, delivery, installation, configuration, testing, quality assurance, issue resolution, training, holding RCSA Workshops, commissioning, system warranty and annual maintenance on ERM Software. 5.2 The bidders are required to provide appropriate responses to the requirements listed in the table below: 36

Item No Sub functions Minimum requirements Bidder s Response YES/NO 1.0 System Functional Requirements If Response is YES Explain Maximum Score 1.1 Risk and Control Self Assessment (RCSA) Module 1.1.1 Scheduling of RCSAs 1.1.2 Linkage of Corporate and Business Unit Objectives to risks 1.1.3 Risk identification and Cause, event effect analysis (Bow tie analysis) The system must be able to 1. Allow scheduling of all business processes to carry out RCSAs 2. Assign specific periods for RCSA for individual business units 3. Notify users when RCSA are due by sending emails via lotus 0.5 email for 1st and 2nd reminders prior to due dates of the RCSA The system must be able to 1. Record corporate objectives 2. Record the individual objectives of each business unit for up to 100 business units with scalability. 3. Link the objectives of the business units to the corporate objectives 4. Record critical success factors for achievement of the business unit objectives The system must be able to 1. Record identified inherent risks that exist in each business unit 2. Record the causes and effects of the risks 3. Amalgamate all identified causes and effects to create a library of causes and effects 4. Enable identification of risk causes and effects through drill down to the libraries from the identified risks 37

1.1.4 Risk Assessment The system must be able to 1.1.5 Evaluation of controls 1. Record the likelihood and consequence of occurrence of the inherent risk 2. Record the likelihood and consequence of occurrence of the residual risk 3. Record the ranking of the inherent and residual risks based on the product of the likelihood and consequence 4. Classify the risks into High, Medium and Low risks based on the risk rankings with corresponding colour skims (High-Red, Medium-Amber and Low-Green) 5. Filter risks above the set desired risk ranking (High and Medium risks) 6. Record improvement in controls for risks filtered as High and Medium. The system must be able to 1. Recording of controls related to each risk -must allow recording of more than one control for each risk 2. Compute the control effectiveness as a percentage difference between the inherent and residual risk ranking 3. Recording of the desired control effectiveness thresholds 4. Filter controls that are below the set desired control effectiveness thresholds 5. Record action to be taken on controls filtered as below the desired control effectiveness threshold 38

1.2 Compliance Monitoring Module 1.2.1 Control Compliance 1.2.2 Legal and regulatory compliance The system must be able to 1. Filter controls with effectiveness above predetermined thresholds (key controls) 2. Record key control ownership 3. Record frequency of application for the key control 4. Record evidence of key control performance (performance attestation) 5. Record evidence of review of the key control for accuracy and completeness 6. Generate reports on ownership, frequency and performance of key controls 7. Generate reports on key controls without details of ownership, frequency and performance 8. Escalate controls without ownership, frequency and evidence of performance to specified users The system must be able to 1. Record key legislation and regulatory requirements that KRA need to adhere to 2. Record responsible officers to attest to/confirm compliance to identified key legislation and regulatory requirements 3. Record evidence of compliance to identified key legislation and regulatory requirements 4. Record evidence of review of attestation to compliance to identified key legislation and regulatory requirements 5. Escalate to predetermined users key legislation and regulatory requirements that have not been attested to at a given point in time and/or over a given period 6. Generate reports on key legislation and regulatory requirements that do not have attestation on performance 39

1.3 Key Risk Indicators Module 1.3.1 Collection of KRI data 1.3.2 Analysis of KRIs 1.3.3 Tracking of KRIs The system must be able to 1. Record key risk indicators (KRIs) 1 2. Input KRI data by assigned users 1 3. Upload key risk indicator data from KRA business systems (Customs Simba System, Domestic Taxes ITMS and i-tax and KRA ERP system ) 1 The system must be able to 1. Record of parameters to allow classification/scaling of KRIs 1 into High-Red, Medium-Amber and Low-Green 2. Compare the KRI data to scaling parameters 1 The system must be able to 1. Flag out predetermined KRI exceptions (e.g KRIs in Red and 1 Amber) 2. Send emails via Lotus mail to users for the exceptions 1 3. Record action taken for KRIs flagged as red and amber 1 4. Provide reports on KRIs trends 1 1.4 Incidence recording and management module 1.4.1 Recording of incidences (incidence registers) The system must be able to record incident details as follows: 1. Business area to which the incident relates 2. Description of the incident 3. Whether the risk is sensitive and should have restricted viewing access 4. Cause and Event type category of the incidence 5. Whether the incident relates to a larger group of incidents and if so, which group 6. The dates the incident started, ended, was identified and reported. 40

Recording of incidences (incidence registers) 1.4.2 Tracking of incidences 7. The nature and size of each incident 8. The key control(s) that failed to permit the incident to occur or controls that did not exist and are to be added to the RCSA to mitigate the likelihood of the risk incidence occurring again. 9. Suggested improvement to prevent the incident from recurring and to minimise its consequence should it occur, together with a due by date and person responsible The system must be able to 1. Assign unique reference numbers for each incidence recorded 2. Facilitate assignment of action to deal with incidents 3. Send notification/ alerts through lotus mail to defined users of recorded incidences and incidences not acted on 4. Escalate recorded incidences based on defined parameters 5. Facilitate attachment of evidence of incidence in file formats (e.g., PDF, Excel, HTML, XML, CSV, etc.) 6. Provide document indexing and search capabilities 7. Provide document versioning and archiving 8. Provide sufficient document security for attached evidence 9. Provide multiple access from various points 10. Provide access controls to limit incident recorder to view their incidences alone 11. Provide anonymous recording of incidences 12. Generate Status reports on incidents 41

1.5 Action tracking module 1.5.1 Recording of improvement actions 1.5.2 Tracking of improvement actions 1.6 Reporting module 1.6.1 Risk and Control Self Assessments (RCSA) reports The system must be able to 1. Record suggested control improvements for controls assessed 0.5 as not effective enough 2. Record owners of the control improvements 0.5 3. Record the due dates for the control improvement 0.5 4. Record the importance of the agreed improvement in terms of 0.5 High, Medium and Low 5. Record defined actions for High, Medium and Low 0.5 improvement actions 6. Record agreed action plan 0.5 7. Record employee responsible for implementing the plan 0.5 8. Record the due by date of the action plan 0.5 The system must be able to 1. Notify control improvement owners of due dates for control improvement actions 2. Escalate outstanding control improvement actions to specified user through Lotus notes email 3. Generate reports on overdue control improvement actions at business unit level, department level and corporate level. The system must be able to 1. Summary of all RCSAs completed in the month 2. Results of RCSAs completed highlighting the top risks in the business unit as well as all high (red) and medium (yellow) risks on a net residual risk basis. 3. Have drill down/up mechanism to facilitate viewing of underlying risks, causes and effects for business unit, region, department and corporate risks 0.5 0.5 0.5 42

1.6.2 Key Control Compliance 1.6.3 Legislative and regulatory compliance 1.6.4 Key Risk Indicators The system must be able to 1. Generate a summary of the number of key controls being attested to across the Authority by business unit showing the: Total number of key controls Number that have and have not been attested to in the month Number that have been attested to but with a negative response together with an explanation for the negative response 2. Generate dashboard reports for Key Controls that have not been attested to or have not been reviewed The system must be able to 1. Generate a summary of the number of key legislation and regulations being attested to across the Authority by business unit showing the: Total number of key legislation and regulations Number that have and have not been attested to in the month Number that have been attested to but with a negative response together with an explanation for the negative response 2. Generate dashboard reports for Key legislations and regulations that have not been attested to or have not been reviewed The system must be able to 1. Generate a summary of KRIs for each business unit and across the Authority showing all high (red) and medium (yellow) rated KRIs together with management comment for follow up action. 0.5 43

Key Risk Indicators 1.6.5 Incidence recording and management 2. Generate dash board reports for KRIs which include KRIs in red, amber and green by business units, process and corporate levels, with drill down capability to the basic unit such as business process The system must be able to generate a summary of risk incidents by business unit with details of all events that have a consequence in excess of set appetite levels. 0.5 0.5 1.6.6 Action Point Tracking The system must be able to 1. Generate a summary of outstanding and overdue action points by business unit. 2. Generate dashboard reports for completed improvement actions, actions in progress and overdue improvement actions by department with drill down capability to the basic unit such as business unit or process 1.6.7 Other reports The system must be able to 1. Generate risk registers for each business units which contain the following fields; Objectives, CSFs, Risk events, Controls, risk assessment and ranking (colour schemed), risk owner, improvement action, KRIs, Key controls. 2. Generate reports in various formats including word, excel, PDF, power point, graphics e.t.c 1.7 Other functional requirements 0.5 0.5 0.5 1.7.1 The vendor must be able to do a practical demonstration of how the software fulfils the requirements 1.1 to 1.6 above at a venue to be determined by the purchaser, prior to award of the tender. The purchaser reserves the right to make site visits to the client referees to confirm the working of the software. 1.7.2 The software must be able to support at least 100 concurrent users 1 6 44

1.7.3 The software should have replica ability for remote site usability 1 1.7.4 The software must have an ad-hoc query builder facility to enable deeper analysis 1.7.5 The software must have the ability to import/upload/export/download data in PDF, Excel, HTML, XML, CSV formats. 2.0 Software Support and Maturity Requirements 2.1 ERM Software Maturity and Support 2.1.1 The ERM software must have been in the market and use in various installation(s) for the last three (3) years 2.1.2 The proportion of the software manufacturer s current technical staff dedicated to the development and support of the proposed ERM software 2.1.3 Evidence that the bidder is officially authorized by the manufacturer to sell and support the proposed ERM software 2.1.4 State the number of years the bidder has been providing technical support of the proposed ERM software. 2.1.5 Brief statement of approach to training of key users and administrators on the ERM software 2.1.6 State the ERM software licensing approach (e.g per user, per module...) and the duration of the licences 2.1.7 The bidder should commit to install the software products in KRA premises. NB: Software as a service will not be acceptable. 2.1.8 State the intellectual property rights ownership and service level agreements that will apply to the software. I.e. Bidder is required to confirm that client has the right to customise the software. 3.0 Related Services Implementation Capability 1 1 2 1 1 1 1 2 1 1 45

3.1 ERM Software Implementation Capability 3.1.1 State the number of years of the ERM software implementation experience that bidder possess. 3.1.2 State the number of years of the ERM software implementation experience that each of the proposed bidder s project team(s) possess. 3.1.3 State the number of years of ERM software implementation experience the proposed senior consultant/team leader possesses. 3.1.4 Demonstrate how you intend to meet KRA defined deliverables including associated activities for ERM Software implementation which the bidder is of the view would make this project a success 3.2 Knowledge of Similar Business Environment 3.2.1 Provide a list and contacts of reference public organizations where the proposed senior consultant/team leader has participated in a leading role in ERM software implementation. 3.2.2 Ability to implement the proposed ERM software and conduct all related services in English language. 3.3 Reference Clients 3.3.1 Provide a list and contacts of at least three (3) reference organizations where the proposed ERM software has been implemented and is in use over the last five years, using the format provided as part of the tender document (See Appendix 1). The reference sites should be from public sector organisations or their equivalents. 2 2 2 10 2 2 5 SUB-TOTAL 80 4 System Non-Functional Requirements 46

4.1. Quality Requirements 4.2 Usability/Trainin g Requirements 4.3 Volume & Storage Requirements 4.4 Compatibility Requirements The system must deliver ERM functions in conformance to ISO 9001:2008 and ISO 31000:2009 requirements The system must be web based and must operate in a multi-office organization format, i.e. system must be accessible to all KRA stations countrywide The system must be structured in such a way as to be understood by a novice user within a short period The system should provide predictive input/ menu based input functionality where possible to minimize user interaction The system should have common look and feel across modules, e.g. common placements of buttons, boxes, choices and even messages so that users are not confused. This will shorten the user learning curve The solution must have adequate documentation that describes at minimum, the design, functionality and use of the system The system must address optimal storage capability as necessary and implement relevant compression strategy. System must support compression to allow large amounts of data transfers over any network medium for efficiency and economizing The system must be able to allow for expanding the disk space The system should be a N-Tier Web based system and provide seamless integration with KRA's existing Domino Mail Server system (Lotus Notes )for automated reminders as well as other systems The system modules must have the capability of being enhanced or modified with minimal impact to other interfacing modules The system must be able to integrate seamlessly with existing KRA business and support systems (Customs Services Simba System, Domestic Taxes ITMS and i-tax and KRA ERP) and Java applications (swing client, Web clients and EJBs). 3 1.2 47

4.5 Reliability Requirements 4.6 Availability Requirements 4.7 Warranty and Support Requirements The system must be able to recover data and must be able to roll back Error logging - the system will have comprehensive error handling routines. The error description should be logged to aid system developers in tracing and solving the error The system shall be capable of running 24 x 7 continuously with minimal downtime The average response times for interactive transactions should be less than 2 seconds Warranty and support provision (including online support, knowledge-bases, upgrades and releases) must be provided for at least 1 year and the rate for subsequent annual maintenance (after 1 year) must be specified. SUB-TOTAL 7.7 48

Item No Minimum requirements Bidder s Response YES/NO System Security Requirements 1. User Authentication 1.1 The solution should support Multi-factor authentication (MFA) schemes (in addition to the digital certificates under the national PKI) 1.1.1 Each user must be authenticated with a unique user-id / username and password on the application. The User IDs / Usernames should be case sensitive 1.1.2 The solution should make a provision for authentication through digital certificates using Public Key Infrastructure (PKI) under the National Public Key Infrastructure. This is currently under pilot in itax 1.1.3 The authentication should be configurable to use username/password or digital certificates (under PKI) or both 1.2 All user accounts must be managed with reference to and in synchronization with an authoritative central user management system e.g. identifying personal numbers in KRA s active staff database (Active Directory, Central HR database or the ERP etc.) for internal KRA users and National PIN database for external KRA users. NB: User accounts management activities include but not limited to new user creation, user maintenance, and user authentication (during login) 1.3 All new user accounts must have a system-generated random password when created. A secure way of communicating the initial password to the user should be utilized, e.g. via an e-mail account 1.4 The solution must prompt users to change their passwords the first time they log on to the application 1.5 The solution must support password expiry features with a configurable frequency. This should be parameterized to allow flexibility in adjusting this value as required 1.5.1 The solution should not support automatic logins to guard against brute force attacks. The login page should include a challenge which the user responds to before If Response is YES Explain Maximum Score 49

proceeding with the login 1.6 The solution must implement the following Password Strength Controls: 1.6.1 Passwords should have a configurable minimum and maximum lengths 1.6.2 Password must meet a configurable combination of the following 4 complexity rules: 1.6.2.1 at least 1 uppercase character (A-Z) 1.6.2.2 at least 1 lowercase character (a-z) 1.6.2.3 at least 1 digit (0-9) 1.6.2.4 at least 1 special character (punctuation) 1.6.3 These password features should be configurable to support future complexity requirements 1.7 During password change, if the new password doesn't comply with the complexity policy, the error message should describe EVERY complexity rule that the new password does not comply with 1.8 The solution should implement a secure self-service password recovery mechanism in the event the user forgot their password 1.8.1 Any password reset/recovery mechanism option must not reveal whether or not an account is valid, preventing username harvesting 1.9 The login page and all subsequent authenticated pages must be exclusively accessed over TLS. All active sessions must be encrypted 1.10 The solution should support expiring of newly created accounts if not used for a configurable period of time. This should be parameterized to allow flexibility in adjusting this value as required 1.11 The solution must support a password change notification and a configurable number of grace logins. The password must be changed after a configurable duration. This should be parameterized for flexibility 50

1.12 The solution must support password lock out after a configurable number of unsuccessful login attempts. This should be parameterized to allow flexibility in adjusting this value as required 1.13 The solution should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account. The generic message should not reveal which of the authentication parameters is invalid 1.14 The solution must expire a user account after the session has been idle for a configurable period of time. This should be parameterized to allow flexibility in adjusting this value as required 1.15 The solution should support re-authentication for sensitive features e.g. before updating sensitive account information such as the user's password, user's email, or before performing sensitive transactions. The function(s) requiring re-authentication should be configurable/determined 1.16 The solution must not allow the re-use of a past password until a set period of time and a set number of password changes have been made. This should be parameterized to allow flexibility in adjusting this value as required 2. Session Management 2.1 The solution should allow only one session per user operating from a single computer unless a specific business case has been established for allowing multiple sessions per user. The allowing of multiple sessions to users based on business needs should be configurable 2.1.1 Concurrent user logins by a user from multiple computers should not be allowed 2.2 All relevant session information should be captured and stored in a secure and auditable location 2.3 The solution should implement secure session IDs, generation of identifiers (IDs or tokens) must meet the following properties: 2.3.1 Session ID fingerprinting: The name used by the session ID should not be extremely descriptive nor offer unnecessary details about the purpose and meaning of the ID. The default session ID name of the web development framework should be changed 51

to a generic name 2.3.2 Session ID length: The session ID must be long enough to prevent brute force attacks, must be at least 128 bits (16 bytes) 2.3.3 Session ID entropy: The session ID must be unpredictable (random enough) to prevent guessing attacks, a good PRNG (Pseudo Random Number Generator) should be used 3. Session Expiration 3.1 Expiration timeouts must be set for every session regardless of the activity. All sessions should implement an idle or inactivity timeout. The duration should be parameterized and configurable 3.2 The solution must provide a visible and easily accessible logout (logoff, exit, or close session) button that is available on the web application header or menu and reachable from every web application resource and page, so that the user can manually close the session at any time 3.3 When a session expires, the solution must take active actions to invalidate the session on both sides, client and server. The logs should record the session expiration details 3.4 When the user logs out of the application the session and corresponding data on the server must be destroyed. This ensures that the session cannot be accidentally revived 3.5 The solution should also force session logout on web browser close window events 3.6 The session ID exchange mechanism based on cookies must use multiple security features in the form of cookie attributes such as Secure flags, HttpOnly, Domain, Path, Expire and Max-age attributes 3.7 In the solution design, backward process flows should clear all authentication fields 3.8 The solution should implement Role based Access Control (RBAC) profiles for authorization based on business definitions 3.8.1 Roles should be granted permissions based on the principle of least privilege i.e. the solution should support an additive access model 3.8.2 Access control must be granular to facilitate adequate separation of duties, for example: 52

3.8.2.1 Functions should be independently available for allocation to a role 3.8.2.2 There should be separation of duties e.g. data entry, authorization and final approval 3.8.2.3 Data entry staff should have the minimum access levels required to enter data 3.8.2.4 Authorization staff should have an access level that allows them to authorize but not necessarily change the data that was entered 3.8.2.5 Final approval staff should have the required access level to finalize the process /transaction 3.9 The solution should not access the database(s) as a privileged or administrative user. The application should always connect as a non-privileged user 3.9.1 If the database is accessed through a common application user, that user should not own the objects in the database 3.10 Credentials should never be stored directly within the application code (hardcoding credentials) 3.1 Credentials should always be encrypted 3.11 The solution should perform consistent authorization checking routines when navigating on all application pages to ensure that the user accesses what they are explicitly authorized to access by their roles 3.11.1 The solution should use the POST method over GET for processing HTTP requests 3.12 The solution should log all access authorization requests to a secure and auditable location 3.13 Error messages should be standard and not provide information alluding to the reason for the error allowing an attacker to deduce effective attack methods 3.14 Logs should not contain password information 3.15 Copy and paste must not work for data entry when authenticating to the application 3.16 All input fields must be validated to accept matching data types including case sensitivity where necessary 3.17 All data entry fields must have input validation mechanisms to prevent cross-site scripting attacks 53

3.18 Sensitive information must not be stored in a persistent cookie, or other location on the client computer that does not have enforceable access control mechanisms 3.19 Any sensitive content sent to the client machine must not be cached, unless encrypted using approved methods. The application should set the proper directive to cause the client not to cache the sensitive data 3.20 The solution should not present any sensitive information to unauthenticated users 3.21 All data exchanges between the solution and other systems including with trader systems should be encrypted by an approved method 3.22 The solution should only implement cryptographic functions selected from an approved list. Any cryptographic functions used that are not previously approved require an exception 3.22.1 Recommended algorithms (with minimum bit lengths), in order of preference, are: 3.22.1.1 Hashing: SHA 512, SHA 256 or better 3.22.1.2 Symmetric: AES256, AES192, AES128, 3 DES (168 bits), Blowfish(minimum 128 bits), Twofish (minimum 128 bits), IDEA (128 bits),and RC4 (128 bits) 3.22.1.3 Public-Private key (Asymmetric): RSA(minimum 2048 bits) and DSA(minimum 2048 bits), ElGamal (minimum 2048 bits) or ECDSA with relatively short key & signature lengths but with same high security level to other stated algorithms (since the signature is to be incorporated on to tax invoice issued, it needs to be short) 3.22.1.4 NB: Weak algorithms, such as MD5 or SHA1 should not be used 3.23 Hashing should be salted and the values used for salting protected. Only the hashed and salted value should be stored. (Passwords should be encrypted) 3.24 All user activities and transactions such as printing, viewing, updates, inserts and other data manipulation should capture and log to the minimum the date and time, user ID, session ID, the URL accessed and the source IP & remote IP. They should indicate the parameters necessary to uniquely identify the specific transactions done in the respective transaction tables. This should be implemented independently from the database audit trails 54

4. Logging & Auditing 4.1 The solution should collect and log the following application event logs: 4.1.1 Authentication successes and failures 4.1.2 Authorization failures 4.1.3 Session management failures 4.1.4 Solution errors, alerts and events 4.1.5 The solution start-ups and shut-downs, and logging initialization (starting and stopping) 4.1.6 Use of higher-risk functionality e.g. addition or deletion of users, changes to privileges, creation and deletion of system-level objects etc 4.1.7 URL of the web page(s) accessed by a user for Internet facing applications 4.1.8 Modifications to the application 4.2 All database audits must log the following: 4.2.1 Application User-id 4.2.2 Date & Time of event 4.2.3 The source and remote IP address 4.2.4 Type of event/action performed by the user 4.2.5 Module accessed by the user 55

4.2.6 Success or failure of the event 4.2.7 Source of the event 4.2.8 Before and after values (where applicable, i.e. master files) 4.2.9 Account creation, lockouts, modification, or deletion 4.2.10 Modifications of privileges and access controls 4.2.11 The solution should correlate application activity logs and database transactions. That is for every database transaction, it should be possible to explicitly identify the application activity responsible 4.2.11.1 Every change to a database record should be identifiable to an application user with a record of the time of activity and type of operation on the record i.e. insert, update or delete 4.3 A violation log must exist to track any attempted unauthorized access to the application and should bear the following information: 4.3.1 URL accessed by the user 4.3.2 Particular activity intended/attempted by the user 4.3.3 Particulars sufficient to identify targeted transactions if available 4.3.4 Workstation-id or IP address of access 4.3.5 Date & Time of event 4.4 All updates, inserts and deletes must be clearly traceable to an application user with corresponding time and source information (IP module and function) 4.5 The solution should provide an interface to review and report on solution logs 4.6 Transaction data stored should capture information that allows similar traceability, with database audit trailing implemented 56

4.7 All valid and failed login attempts must be logged with meaningful information that is actionable for investigative purposes if fraud is detected. However, passwords must not be logged 4.8 All password recovery reset attempts must be logged with meaningful information that is actionable for investigative purposes if fraud is detected 4.8.1 All user and account management changes and attempts must be logged 4.9 Database audit trails should be present for all dynamic and static tables of interest, e.g. Parameter tables, Transaction Tables, etc 4.10 All system servers are kept in sync with a time synchronization mechanism 4.11 All data entry and manipulations must be done through the application interfaces and never directly to the database 4.12 Where data is supplied to the application from an authoritative source, the application must NOT allow users to modify this data 4.12.1 Reference data should not be altered by users in subsequent transactions 4.12.2 Sensitive information is NOT stored in hidden fields if the application is web-based 4.13 For web based interfaces, the solution must use a secure method to transmit data e.g. Using the HTTP POST method instead of the less secure GET method 4.14 If the application connects to a database, application server, or any system that utilizes application IDs, it is using an account that has been granted access to only objects and functions needed for operation of the application. The application does NOT connect to a database as a privileged user, such as the SA account in SQL Server or SYSTEM account in Oracle, Postgres etc 4.15 If the system directly faces the Internet, it does NOT store or cache confidential data, even for a short duration. This includes file uploads and downloads, source code, etc 4.16 The solution should have mechanisms/controls to guard against URL manipulation and/or targeted URL attacks 4.17 The solution should have mechanisms to guard against user impersonations 57

4.18 The solution should allow identified functions to be accessible from restricted networks SUB-TOTAL 12.3 TOTAL 100 58

Appendix 1: BIDDERS REFERENCE SITE(S): PROJECT SUMMARY FOR EACH REFERENCE SITE Please provide the following information on the listed reference clients; 1. Entity/client name: 2. Brief description of the clients business; 3. Brief description of the project;.. 4. Duration of project implementation (dates); 5. Value of the project: 6. Contacts of referee;... 7. Contact person:... 8. Title:... 9. Telephone Contact:... E-Mail Address:... 10. Signed and stamped/sealed by bidder: 11. Name of the Authorised Person... 12. Designation:... 59

SECTION VII - PRICE SCHEDULE FOR PROCUREMENT Name of tenderer Tender Number Page of s/no. Deliverable/Activity Quantity Cost, Inclusive of all Taxes (Ksh) 1 Delivery and Installation of ERM Software 1 2 Review of the KRA Risk Management Policy and Framework and give recommendations for necessary improvements. 3 Risk and Control Self Assessment and risk registers for at least 20 business units 4 Development of Automated Key Risk Indicators (KRIs) and Improvement Action Tracking dashboards indicating desired controlled improvements. 5 Development of Automated Compliance Monitoring Framework with key controls and legal/regulatory requirements to be monitored 6 Development of automated incidence registers Automated heats maps and dashboards for at least 20 business units 7 Skills gap assessment and development of training materials 8 System administration training for 10 system administrators 9 System end user training for 100 operational staff 1 20 Business Units 20 Business Units 20 Business Units 20 Business Units 20 Business Units 1 10 staff 100 staff 10 Development of ERM system users manual 1 11 Post-ERM system implementation review 1 12 ERM Software Support and Maintenance for one (1) year. 13 Any other cost (please specify) 1 year Note: In case of discrepancy between unit price and total, the unit price shall prevail. 60

Tender s Signature Official Stamp FINANCIAL SUMMARY PROPOSAL SUBMISSION FORM [Date] To: [Name and address of Client] Ladies/Gentlemen: We, the undersigned, offer to provide the consulting services for ( ) [Title of services] in accordance with your Request for Proposal dated ( ) [Date] and our Proposal. Our attached Financial Proposal is for the total sum of ( ) [Amount in words and figures] inclusive of the taxes. We remain, Yours sincerely, [Authorized Signature]: [Name and Title of Signatory]: [Name of Firm]: [Address]: 61

SECTION VIII - STANDARD FORMS Notes on the Sample Forms 1 Form of Tender- The form of tender must be completed by the tenderer and submitted with the tender documents. It must also be duly signed by duly authorized representatives of the tenderer. 2 Confidential Business Questionnaire Form - This form must be completed by the tenderer and submitted with the tender documents. 3 Tender Security Form- When required by the tender documents the tender shall provide the tender security either in the form included herein or in another format acceptable to the procuring entity. 4 Contract Form- The Contract Form shall not be completed by the tenderer at the time of submitting the tender. The Contract Form shall be completed after contract award and should incorporate the accepted contract price. 5 Performance Security Form- The performance security form should not be completed by the tenderers at the time of tender preparation. Only the successful tenderer will be required to provide performance security in the form provided herein or in another form acceptable to the procuring entity. 6 Bank Guarantee for Advance Payment Form- When Advance payment is requested for by the successful bidder and agreed by the procuring entity, this form must be completed fully and duly signed by the authorized officials of the bank. 7 Manufacturers Authorization Form- When required by the ender documents this form must be completed and submitted with the tender documents. This form will be completed by the manufacturer of the goods where the tenderer is an agent. 8 Anti Corruption Affidavit This form will be completed by the bidder s authorized representative and it must be sworn before a commissioner of oaths or equivalent according to applicable laws in the country of the bidder. 62

8.1 FORM OF TENDER To: KENYA REVENUE AUTHORITY P. O. BOX 48240 00100 NAIROBI. Date Tender No. Gentlemen and/or Ladies: 1. Having examined the tender documents including Addenda Nos.. [insert numbers].the receipt of which is hereby duly acknowledged, we, the undersigned, offer to, Supply delivery, Installation and testing of the equipment (Insert item description) in conformity with the said tender documents for the sum of (total tender amount in words and figures) or such other sums as may be ascertained in accordance with the Schedule of Prices attached herewith and made part of this Tender. 2. We undertake, if our Tender is accepted Supply delivery, Installation and testing of the equipment in accordance with the delivery schedule specified in the Schedule of Requirements. 3. If our Tender is accepted, we will obtain the guarantee of a bank in a sum of equivalent to percent of the Contract Price for the due performance of the Contract, in the form prescribed by..( Procuring entity). 4. We agree to abide by this Tender for a period of [number] days from the date fixed for tender opening of the Instructions to tenderers, and it shall remain binding upon us and may be accepted at any time before the expiration of that period. 5. This Tender, together with your written acceptance thereof and your notification of award, shall constitute a Contract, between us. Subject to signing of the Contract by the parties. 6. We understand that you are not bound to accept the lowest or any tender you may receive. Dated this day of 20 [signature] [in the capacity of] Duly authorized to sign tender for an on behalf of 63

8.2 CONFIDENTIAL BUSINESS QUESTIONNAIRE FORM You are requested to give the particulars indicated in Part 1; either Part 2(a), 2(b) or 2 (c) whichever applied to your type of business; and Part 3. You are advised that it is a serious offence to give false information on this form. Part 1 General 1.1 Business Name.. 1.2 Location of Business Premises... 1.3 Plot No Street/Road.... Postal Address.. Tel No.. Fax. E mail. 1.4 Nature of Business,.. 1.5 Registration Certificate No. 1.6 Maximum Value of Business which you can handle at any one time Kshs. 1.7 Name of your Bankers.. Branch Part 2 (a) Sole Proprietor 2a.1 Your Name in Full.. Age.. 2a.2 Nationality Country of Origin. Citizenship Details Part 2 (b) Partnership 2b.1 Given details of Partners as follows: 2b.2 Name Nationality Citizenship Details Shares 1. 2 3.. 64

4.. Part 2 (c ) Registered Company 2c.1 Private or Public. 2c.2 State the Nominal and Issued Capital of Company- Nominal Kshs. Issued Kshs. 2c.3 Given details of all Directors as follows Name Nationality Citizenship Details Shares 1.. 2... 3. 4. 5. Part 3 Eligibility Status 3.1 Are you related to an Employee, Committee Member or Board Member of Kenya Revenue Authority? Yes No 3.2 If answer in 3.1 is YES give the relationship..... 3.3 Does an Employee, Committee Member, Board Member of Kenya Revenue Authority sit in the Board of Directors or Management of your Organization, Subsidiaries or Joint Ventures? Yes No 3.4 If answer in 3.3 above is YES give details....... 3.5 Has your Organization, Subsidiary Joint Venture or Sub-contractor been involved in the past directly or indirectly with a firm or any of its affiliates that have been engaged by Kenya Revenue Authority to provide consulting services for preparation of design, specifications and other documents to be used for procurement of the goods under this invitation? Yes No 3.6 If answer in 3.5 above is YES give details. 65

...... 3.7 Are you under a declaration of ineligibility for corrupt and fraudulent practices? YES No 3.8 If answer in 3.7 above is YES give details:...... 3.9 Have you offered or given anything of value to influence the procurement process? Yes No 3.10 If answer in 3.9 above is YES give details..... I DECLARE that the information given on this form is correct to the best of my knowledge and belief. Date.. Signature of Candidate.. If a Kenya Citizen, indicate under Citizenship Details whether by Birth, Naturalization or registration. 66

8.3 TENDER SECURITY FORM Whereas. [name of the tenderer] (hereinafter called the tenderer ) has submitted its tender dated. [date of submission of tender] for the supply, installation and commissioning of [name and/or description of the equipment] (hereinafter called the Tender ).. KNOW ALL PEOPLE by these presents that WE of. having our registered office at (hereinafter called the Bank ), are bound unto.. [name of Procuring entity} (hereinafter called the Procuring entity ) in the sum of.. for which payment well and truly to be made to the said Procuring entity, the Bank binds itself, its successors, and assigns by these presents. Sealed with the Common Seal of the said Bank this day of 20. THE CONDITIONS of this obligation are:- 1. If the tenderer withdraws its Tender during the period of tender validity specified by the tenderer on the Tender Form; or 2. If the tenderer, having been notified of the acceptance of its Tender by the Procuring entity during the period of tender validity: (a) fails or refuses to execute the Contract Form, if required; or (b) fails or refuses to furnish the performance security in accordance with the Instructions to tenderers; We undertake to pay to the Procuring entity up to the above amount upon receipt of its first written demand, without the Procuring entity having to substantiate its demand, provided that in its demand the Procuring entity will note that the amount claimed by it is due to it, owing to the occurrence of one or both of the two conditions, specifying the occurred condition or conditions. This tender guarantee will remain in force up to and including thirty (30) days after the period of tender validity, and any demand in respect thereof should reach the Bank not later than the above date. [signature of the bank] (Amend accordingly if provided by Insurance Company) 67

8.4 CONTRACT FORM THIS AGREEMENT made the day of 20 between [name of Procurement entity) of.. [country of Procurement entity] (hereinafter called the Procuring entity) of the one part and.. [name of tenderer] of.. [city and country of tenderer] (hereinafter called the tenderer ) of the other part; WHEREAS the Procuring entity invited tenders for certain works] and has accepted a tender by the tenderer for the supply of those works in the sum of [contract price in words and figures] (hereinafter called the Contract Price). NOW THIS AGREEMENT WITNESSETH AS FOLLOWS: 1. In this Agreement words and expressions shall have the same meanings as are respectively assigned to them in the Conditions of Contract referred to: 2. The following documents shall be deemed to form and be read and construed as part of this Agreement viz: (a) the Tender Form and the Price Schedule submitted by the tenderer (b) the Schedule of Requirements (c ) the Technical Specifications (d) the General Conditions of Contract (e) the Special Conditions of contract; and (f) the Procuring entity s Notification of Award 3. In consideration of the payments to be made by the Procuring entity to the tenderer as hereinafter mentioned, the tender hereby covenants with the Procuring entity to provide the goods and to remedy defects therein in conformity in all respects with the provisions of the Contract 4. The Procuring entity hereby covenants to pay the tenderer in consideration of the provisions of the goods and the remedying of defects therein, the Contract Price or such other sum as may become payable under the provisions of the Contract at the times and in the manner prescribed by the contract. IN WITNESS whereof the parties hereto have caused this Agreement to be executed in accordance with their respective laws the day and year first above written. Signed, sealed, delivered by the (for the Procuring entity Signed, sealed, delivered by the (for the tenderer in the presence of (Amend accordingly if provided by Insurance Company) 68

8.5 PERFORMANCE SECURITY FORM To Kenya Revenue Authority WHEREAS [name of tenderer] (hereinafter called the tenderer ) has undertaken, in pursuance of Contract No. [reference number of the contract] dated 20 to supply [description of goods] (hereinafter called the Contract ). AND WHEREAS it has been stipulated by you in the said Contract that the tenderer shall furnish you with a bank guarantee by a reputable bank for the sum specified therein as security for compliance with the Tenderer s performance obligations in accordance with the Contract. AND WHEREAS we have agreed to give the tenderer a guarantee: THEREFORE WE hereby affirm that we are Guarantors and responsible to you, on behalf of the tenderer, up to a total of. [amount of the guarantee in words and figure] and we undertake to pay you, upon your first written demand declaring the tenderer to be in default under the Contract and without cavil or argument, any sum or sums within the limits of.. [amount of guarantee] as aforesaid, without you needing to prove or to show grounds or reasons for your demand or the sum specified therein. This guarantee is valid until the day of 20 Signed and seal of the Guarantors [name of bank or financial institution] [address] [date] 69

8.6 BANK GUARANTEE FOR ADVANCE PAYMENT FORM To Kenya Revenue Authority [name of tender].. Gentlemen and/or Ladies: In accordance with the payment provision included in the Special Conditions of Contract, which amends the General Conditions of Contract to provide for advance payment,. [name and address of tenderer](hereinafter called the tenderer ) shall deposit with the Procuring entity a bank guarantee to guarantee its proper and faithful performance under the said Clause of the Contract in an amount of. [Amount of guarantee in figures and words]. We, the. [bank or financial institutions], as instructed by the tenderer, agree unconditionally and irrevocably to guarantee as primary obligator and not as surety merely, the payment to the Procuring entity on its first demand without whatsoever right of objection on our part and without its first claim to the tenderer, in the amount not exceeding [amount of guarantee in figures and words] We further agree that no change or addition to or other modification of the terms of the Contract to be performed there-under or of any of the Contract documents which may be made between the Procuring entity and the tenderer, shall in any way release us from any liability under this guarantee, and we hereby waive notice of any such change, addition, or modification. This guarantee shall remain valid in full effect from the date of the advance payment received by the tenderer under the Contract until [date]. Yours truly, Signature and seal of the Guarantors [name of bank or financial institution] [address] [date] 70

8.7 MANUFACTURER S AUTHORIZATION FORM To Kenya Revenue Authority WHEREAS [name of the manufacturer] who are established and reputable manufacturers of.. [name and/or description of the goods] having factories at [address of factory] do hereby authorize [name and address of Agent] to submit a tender, and subsequently negotiate and sign the Contract with you against tender No.. [reference of the Tender] for the above goods manufactured by us. We hereby extend our full guarantee and warranty as per the General Conditions of Contract for the goods offered for supply by the above firm against this Invitation for Tenders. manufacturer] [signature for and on behalf of Note: This letter of authority should be on the letterhead of the Manufacturer and should be signed by a person competent. 71

LETTER OF NOTIFICATION OF AWARD Kenya Revenue Authority P.O Box 48240 00100, Nairobi,. To: RE: Tender No. Tender Name This is to notify that the contract/s stated below under the above mentioned tender have been awarded to you. 1. Please acknowledge receipt of this Letter of Notification signifying your Acceptance. 2. The Contract/contracts shall be signed by the parties within 30 days of the date of this letter but not earlier than 14 days from the date of the letter. 3. You may contact the officer(s) whose particulars appear below on the subject matter of this Letter of Notification of Award. Deputy commissioner, Procurement & Supplies Services, Haile Selassie Avenue, Times Tower, 25 th Floor Telephone: +254-020-2817022 Facsimile: +254-020-215809 FOR: Commissioner-General 72