Provision of a Regional Risk Management System

Notice Information

Get alerts for notices like these

Notice Title

Notice Description

Hywel Dda University Health Board (HDUHB) and Swansea Bay University Health Board (SBUHB) are undertaking a market engagement exercise for suppliers interested in delivering a Risk Management System solution. The purpose of the market engagement event is to gather greater insight into market capacity and capability and the potential risk management solution options. This market engagement will also help the Health Boards to refine their solution requirements and budgetary costs ahead of any potential procurement. The Health Boards currently use a risk system alongside various other tools to support risk management activities. The current contract is approaching its end, prompting the need to re-procure a risk solution. HDUHB and SBUHB are therefore seeking to understand the market's ability to provide an enterprise level risk management solution capable of supporting risk management across each organisation. Date: 8th July 2026 Location: Virtual (Microsoft Teams) Spaces will be issued on a first come, first served basis between 09:00 - 15:00.

Planning Information

Interested suppliers are invited to attend a virtual market engagement event to support the Health Boards in developing their understanding of available solutions. Each supplier will be allocated a 45-minute session. Suppliers are expected to present for up to 25 minutes, followed by a 20-minute question and answer session. The total duration of each session will not exceed the allocated 45 minutes. The supplier engagement event will be held via Microsoft Teams. Places will be allocated on a first-come, first-served basis. To request a slot, please contact Josh.Wood@wales.nhs.uk. Representatives from the Risk and Assurance Teams of both Health Boards will be in attendance, alongside colleagues from Procurement. Presentation Expectations Suppliers are free to structure their presentations as they see fit. However, the Health Boards request that the following areas (1–5) are covered during the presentation, with areas (6–7) provided either within the session or as supplementary information. Areas for Consideration 1. Solution Overview • Description of the proposed solution, including key features and functionality • Examples of typical NHS or public sector deployments 2. Alignment to Requirements • High-level overview of how the solution aligns with the capabilities and outcomes outlined in supporting document, Solution Overview Requirements. • Any key assumptions, dependencies, or constraints 3. Implementation Approach • Approach to delivery, including discovery, configuration, and testing • Data migration • Training and onboarding • Go-live support and indicative timelines 4. Reporting and Analytics • Standard reports and dashboards included within the solution • Details on options for customised reporting and analytics 5. Indicative Costs • High-level cost information, including: o Licensing o Implementation o Training o Ongoing support and maintenance Cost ranges are acceptable at this stage 6. Security and Assurance (supplementary) • Approach to access control, audit, hosting, and system resilience • Relevant certifications and assurance (e.g. ISO standards, DSPT) 7. Support Model (supplementary) • Service desk availability and support hours • Incident management and response • Change and configuration support • Release and update approach Suppliers are encouraged to use practical examples, case studies, and demonstrations where appropriate. All presentations should be delivered within the allocated time, as multiple supplier sessions will be scheduled throughout the engagement event. Additional Information: To protect the integrity of any potential future procurement process, the Health Boards wish to make the following clear to interested suppliers: • This supplier engagement exercise is not part of a formal procurement process. Its purpose is to help the Health Boards understand market interest and capability, and to inform the development of requirements, cost estimates, and potential procurement routes. • The Health Boards will not be liable for any costs incurred by suppliers in preparing responses or attending engagement activities. • As this is not a formal procurement exercise, supplier responses will not be formally evaluated or scored. Notes of discussions may be taken, and sessions may be recorded for internal reference. • Participation in this engagement does not confer any advantage in any future procurement process, nor does it guarantee that a procurement will take place. • Please note that the details and dates within this notice maybe subject to change. Appendix A - Provision of a Risk Management System Solution Overview Requirements Purpose At this stage, the Health Boards are seeking high-level information on solutions that may support: • An enterprise solution to manage risk workflows, including linkage, escalation, associated tools and reporting, • Strategic risk management related to the Health Boards Board Assurance Framework, • General corporate and operational risk management, • Potential inclusion of project risk management, including tools for financial and schedule risk management and modelling, • A clear journey of recording and monitoring risks and what supporting information could be captured in the system, • Dashboard and formal reporting including integration with local business intelligence solutions, • The ability to tailor processes, • Consideration of additional functionality such as planning/scheduling tools and messaging/alert tools. The above is not a specification and does not represent a confirmed scope for any future procurement. High-level system requirements Both Health Boards operates in a highly regulated healthcare environment and require strong governance, assurance and transparency across strategic corporate, operational/service delivery, information, data protection and major projects risks. The Health Boards are looking for solutions to be in place to support consistent identification, evaluation, ownership, treatment, tracking and reporting of risks, both in a corporate, operational, strategic (including the Board Assurance Framework) and potentially project environment. The solution should enable standardised processes and reporting while remaining flexible enough and customisable to support different organisational structures, and provide reliable, auditable reporting for internal governance and external assurance needs. The Health Boards current timeline anticipates implementation by March/April 2027 and go live by no later than November 2027. Core Risk Management system requirements: • Risk identification: an intuitive process for staff to raise and record risks in line with Health Board policy, • Risk register management: create, update, review, escalate and close risks with clear ownership, version history and audit trail, • Consistent scoring: configurable likelihood/impact matrices, risk appetite/tolerance, inherent vs residual risk, and clear scoring rules, • Controls and actions: record existing controls, planned actions, action owners, due dates, evidence/attachments and progress tracking, • Review workflow: configurable review cycles, reminders, approvals, and escalation triggers (e.g., overdue review, score increase, appetite breach), • Linking and relationships: relate risks to objectives, committees, corporate, operational and strategic risks and potentially programmes/projects, • Reporting and dashboards: real-time views by operational structure, theme, owner, score, trend, and assurance level; reports exportable in flexible file formats as well the option for risk leads to develop customisable dashboards for their own use, • Trend and insight: scoring history, heatmaps, movement (improving/worsening), and key themes to support assurance narratives, • Search and usability: strong search and filters and the availability of standard and customisable reporting templates. Other system requirements • Information governance and cyber security: role-based access control, audit logging, secure data storage and transmission, aligned to NHS/Wales information governance expectations (Welsh Health Circular 25/2017), Cyber Security requirements (CE+) and ISO Standards (ISO's 27001), • Hosting model: preference for a modern hosted (SaaS) solution with clear resilience, backup and disaster recovery, • Accessibility: an intuitive user experience with accessibility features appropriate for a diverse workforce, • Configurability: administrators can update matrices, forms, workflows, lists and reporting views without supplier development work, • Data quality and audit: validation rules, mandatory fields where needed, change history and clear audit trails, • Interoperability: API and/or integration options (e.g., identity management/SSO and other governance/quality tools where applicable), • Performance and scalability: responsive performance for Health Board-wide use and growth over time. • Defined and tested business continuity plans and response times for dealing with issues. Intended Functional Outcomes of the System: • One source of truth for risks, reducing duplication and improving confidence in reporting, • Clear accountability through defined risk owners, action owners, review dates and evidence of oversight, • Improved governance flow from team/service registers through reporting to corporate and Board assurance, • Early warning and escalation when risk levels increase, reviews are overdue, controls are weak, or actions are delayed, • Stronger assurance narratives via trend information, control effectiveness tracking, and consistent reporting, • Efficiency through reduced manual collation and self-service dashboards for different audiences, • Automation for reporting, including draw-down of risk registers for committee and Board papers.

Notice Details

Get alerts for notices like these

Publication & Lifecycle

Open Contracting ID: ocds-h6vhtk-06bbe9
Publication Source: Find A Tender Service
Latest Notice: https://www.find-tender.service.gov.uk/Notice/059313-2026
Current Stage: Planning
All Stages: Planning

Procurement Classification

Notice Type: UK2 - Preliminary Market Engagement Notice
Procurement Type: Standard
Procurement Category: Services
Procurement Method: Not Specified
Procurement Method Details: Not specified
Tender Suitability: SME
Awardee Scale: Not specified

Common Procurement Vocabulary (CPV)

CPV Divisions

48 - Software package and information systems

72 - IT services: consulting, software development, Internet and support

CPV Codes

48000000 - Software package and information systems

72000000 - IT services: consulting, software development, Internet and support

Notice Value(s)

Tender Value: £400,000 £100K-£500K
Lots Value: Not specified
Awards Value: Not specified
Contracts Value: Not specified

Notice Dates

Publication Date: 24 Jun 2026Today
Submission Deadline: Not specified
Future Notice Date: 29 Jul 20262 months to go
Award Date: Not specified
Contract Period: 31 Mar 2027 - 30 Nov 2032 Over 5 years
Recurrence: Not specified

Notice Status

Tender Status: Planning
Lots Status: Planning
Awards Status: Not Specified
Contracts Status: Not Specified

Buyer & Supplier

Get alerts for notices like these

Contracting Authority (Buyer)

Main Buyer

HYWEL DDA UNIVERSITY HEALTH BOARD

Additional Buyers

NHS WALES SHARED SERVICES PARTNERSHIP (HOSTED BY VELINDRE UNIVERSITY NHS TRUST)

SWANSEA BAY UNIVERSITY HEALTH BOARD

Contact Name

Available with D3 Tenders Premium →

Contact Email

Available with D3 Tenders Premium →

Contact Phone

Available with D3 Tenders Premium →

Buyer Location

Locality: CARMARTHEN
Postcode: SA31 3BT
Post Town: Swansea
Country: Wales
Major Region (ITL 1): TLL Wales
Basic Region (ITL 2): TLL5 South East Wales
Small Region (ITL 3): TLL51 Central Valleys and Bridgend
Delivery Location: TLL14 South West Wales, TLL17 Bridgend and Neath Port Talbot, TLL18 Swansea
Local Authority: Rhondda Cynon Taf
Electoral Ward: Taff's Well
Westminster Constituency: Cardiff North

Further Information

Notice Documents

https://www.find-tender.service.gov.uk/Notice/059313-2026
24th June 2026 - Preliminary market engagement notice on Find a Tender

Notice URLs

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

{
    "tag": [
        "compiled"
    ],
    "id": "ocds-h6vhtk-06bbe9-2026-06-24T11:24:14+01:00",
    "date": "2026-06-24T11:24:14+01:00",
    "ocid": "ocds-h6vhtk-06bbe9",
    "initiationType": "tender",
    "parties": [
        {
            "id": "GB-PPON-PNPY-2728-GCWW",
            "name": "Hywel Dda University Health Board",
            "identifier": {
                "scheme": "GB-PPON",
                "id": "PNPY-2728-GCWW"
            },
            "address": {
                "streetAddress": "Corporate Offices, Second Floor, Block C, Government Buildings, Picton Terrace",
                "locality": "Carmarthen",
                "postalCode": "SA31 3BT",
                "country": "GB",
                "countryName": "United Kingdom",
                "region": "UKL14"
            },
            "contactPoint": {
                "name": "Josh Wood",
                "email": "josh.wood@wales.nhs.uk"
            },
            "roles": [
                "buyer"
            ],
            "details": {
                "url": "http://nwssp.nhs.wales/ourservices/procurement-services/",
                "classifications": [
                    {
                        "id": "publicAuthorityCentralGovernment",
                        "scheme": "UK_CA_TYPE",
                        "description": "Public authority - central government"
                    },
                    {
                        "id": "GB-WLS",
                        "scheme": "UK_CA_DEVOLVED_REGULATIONS",
                        "description": "Welsh devolved regulations apply"
                    }
                ]
            }
        },
        {
            "id": "GB-PPON-PQDY-1678-DHXN",
            "name": "Swansea Bay University Health Board",
            "identifier": {
                "scheme": "GB-PPON",
                "id": "PQDY-1678-DHXN"
            },
            "address": {
                "streetAddress": "1 Talbot Gateway, Baglan Energy Park, Baglan",
                "locality": "Port Talbot",
                "postalCode": "SA12 7BR",
                "country": "GB",
                "countryName": "United Kingdom",
                "region": "UKL17"
            },
            "contactPoint": {
                "name": "Josh Wood",
                "email": "josh.wood@wales.nhs.uk"
            },
            "roles": [
                "buyer"
            ],
            "details": {
                "classifications": [
                    {
                        "id": "publicAuthorityCentralGovernment",
                        "scheme": "UK_CA_TYPE",
                        "description": "Public authority - central government"
                    },
                    {
                        "id": "GB-WLS",
                        "scheme": "UK_CA_DEVOLVED_REGULATIONS",
                        "description": "Welsh devolved regulations apply"
                    }
                ]
            }
        },
        {
            "id": "GB-PPON-PXWV-6492-CGMN",
            "name": "NHS Wales Shared Services Partnership (hosted by Velindre University NHS Trust)",
            "identifier": {
                "scheme": "GB-PPON",
                "id": "PXWV-6492-CGMN"
            },
            "address": {
                "streetAddress": "4-5 Charnwood Court, Heol Billingsley, Parc Nantgarw",
                "locality": "Cardiff",
                "postalCode": "CF15 7QZ",
                "country": "GB",
                "countryName": "United Kingdom",
                "region": "UKL15"
            },
            "contactPoint": {
                "name": "Josh Wood",
                "email": "josh.wood@wales.nhs.uk"
            },
            "roles": [
                "procuringEntity"
            ],
            "roleDetails": "Management of the procurement process from planning through to award and supporting with contract management.",
            "details": {
                "url": "http://nwssp.nhs.wales"
            }
        }
    ],
    "buyer": {
        "id": "GB-PPON-PNPY-2728-GCWW",
        "name": "Hywel Dda University Health Board"
    },
    "planning": {
        "milestones": [
            {
                "id": "engagement",
                "type": "engagement",
                "description": "Interested suppliers are invited to attend a virtual market engagement event to support the Health Boards in developing their understanding of available solutions. Each supplier will be allocated a 45-minute session. Suppliers are expected to present for up to 25 minutes, followed by a 20-minute question and answer session. The total duration of each session will not exceed the allocated 45 minutes. The supplier engagement event will be held via Microsoft Teams. Places will be allocated on a first-come, first-served basis. To request a slot, please contact Josh.Wood@wales.nhs.uk. Representatives from the Risk and Assurance Teams of both Health Boards will be in attendance, alongside colleagues from Procurement. Presentation Expectations Suppliers are free to structure their presentations as they see fit. However, the Health Boards request that the following areas (1-5) are covered during the presentation, with areas (6-7) provided either within the session or as supplementary information. Areas for Consideration 1. Solution Overview * Description of the proposed solution, including key features and functionality * Examples of typical NHS or public sector deployments 2. Alignment to Requirements * High-level overview of how the solution aligns with the capabilities and outcomes outlined in supporting document, Solution Overview Requirements. * Any key assumptions, dependencies, or constraints 3. Implementation Approach * Approach to delivery, including discovery, configuration, and testing * Data migration * Training and onboarding * Go-live support and indicative timelines 4. Reporting and Analytics * Standard reports and dashboards included within the solution * Details on options for customised reporting and analytics 5. Indicative Costs * High-level cost information, including: o Licensing o Implementation o Training o Ongoing support and maintenance Cost ranges are acceptable at this stage 6. Security and Assurance (supplementary) * Approach to access control, audit, hosting, and system resilience * Relevant certifications and assurance (e.g. ISO standards, DSPT) 7. Support Model (supplementary) * Service desk availability and support hours * Incident management and response * Change and configuration support * Release and update approach Suppliers are encouraged to use practical examples, case studies, and demonstrations where appropriate. All presentations should be delivered within the allocated time, as multiple supplier sessions will be scheduled throughout the engagement event. Additional Information: To protect the integrity of any potential future procurement process, the Health Boards wish to make the following clear to interested suppliers: * This supplier engagement exercise is not part of a formal procurement process. Its purpose is to help the Health Boards understand market interest and capability, and to inform the development of requirements, cost estimates, and potential procurement routes. * The Health Boards will not be liable for any costs incurred by suppliers in preparing responses or attending engagement activities. * As this is not a formal procurement exercise, supplier responses will not be formally evaluated or scored. Notes of discussions may be taken, and sessions may be recorded for internal reference. * Participation in this engagement does not confer any advantage in any future procurement process, nor does it guarantee that a procurement will take place. * Please note that the details and dates within this notice maybe subject to change. Appendix A - Provision of a Risk Management System Solution Overview Requirements Purpose At this stage, the Health Boards are seeking high-level information on solutions that may support: * An enterprise solution to manage risk workflows, including linkage, escalation, associated tools and reporting, * Strategic risk management related to the Health Boards Board Assurance Framework, * General corporate and operational risk management, * Potential inclusion of project risk management, including tools for financial and schedule risk management and modelling, * A clear journey of recording and monitoring risks and what supporting information could be captured in the system, * Dashboard and formal reporting including integration with local business intelligence solutions, * The ability to tailor processes, * Consideration of additional functionality such as planning/scheduling tools and messaging/alert tools. The above is not a specification and does not represent a confirmed scope for any future procurement. High-level system requirements Both Health Boards operates in a highly regulated healthcare environment and require strong governance, assurance and transparency across strategic corporate, operational/service delivery, information, data protection and major projects risks. The Health Boards are looking for solutions to be in place to support consistent identification, evaluation, ownership, treatment, tracking and reporting of risks, both in a corporate, operational, strategic (including the Board Assurance Framework) and potentially project environment. The solution should enable standardised processes and reporting while remaining flexible enough and customisable to support different organisational structures, and provide reliable, auditable reporting for internal governance and external assurance needs. The Health Boards current timeline anticipates implementation by March/April 2027 and go live by no later than November 2027. Core Risk Management system requirements: * Risk identification: an intuitive process for staff to raise and record risks in line with Health Board policy, * Risk register management: create, update, review, escalate and close risks with clear ownership, version history and audit trail, * Consistent scoring: configurable likelihood/impact matrices, risk appetite/tolerance, inherent vs residual risk, and clear scoring rules, * Controls and actions: record existing controls, planned actions, action owners, due dates, evidence/attachments and progress tracking, * Review workflow: configurable review cycles, reminders, approvals, and escalation triggers (e.g., overdue review, score increase, appetite breach), * Linking and relationships: relate risks to objectives, committees, corporate, operational and strategic risks and potentially programmes/projects, * Reporting and dashboards: real-time views by operational structure, theme, owner, score, trend, and assurance level; reports exportable in flexible file formats as well the option for risk leads to develop customisable dashboards for their own use, * Trend and insight: scoring history, heatmaps, movement (improving/worsening), and key themes to support assurance narratives, * Search and usability: strong search and filters and the availability of standard and customisable reporting templates. Other system requirements * Information governance and cyber security: role-based access control, audit logging, secure data storage and transmission, aligned to NHS/Wales information governance expectations (Welsh Health Circular 25/2017), Cyber Security requirements (CE+) and ISO Standards (ISO's 27001), * Hosting model: preference for a modern hosted (SaaS) solution with clear resilience, backup and disaster recovery, * Accessibility: an intuitive user experience with accessibility features appropriate for a diverse workforce, * Configurability: administrators can update matrices, forms, workflows, lists and reporting views without supplier development work, * Data quality and audit: validation rules, mandatory fields where needed, change history and clear audit trails, * Interoperability: API and/or integration options (e.g., identity management/SSO and other governance/quality tools where applicable), * Performance and scalability: responsive performance for Health Board-wide use and growth over time. * Defined and tested business continuity plans and response times for dealing with issues. Intended Functional Outcomes of the System: * One source of truth for risks, reducing duplication and improving confidence in reporting, * Clear accountability through defined risk owners, action owners, review dates and evidence of oversight, * Improved governance flow from team/service registers through reporting to corporate and Board assurance, * Early warning and escalation when risk levels increase, reviews are overdue, controls are weak, or actions are delayed, * Stronger assurance narratives via trend information, control effectiveness tracking, and consistent reporting, * Efficiency through reduced manual collation and self-service dashboards for different audiences, * Automation for reporting, including draw-down of risk registers for committee and Board papers.",
                "dueDate": "2026-07-08T23:59:59+01:00",
                "status": "scheduled"
            }
        ],
        "documents": [
            {
                "id": "059313-2026",
                "documentType": "marketEngagementNotice",
                "noticeType": "UK2",
                "description": "Preliminary market engagement notice on Find a Tender",
                "url": "https://www.find-tender.service.gov.uk/Notice/059313-2026",
                "datePublished": "2026-06-24T11:24:14+01:00",
                "format": "text/html"
            }
        ]
    },
    "tender": {
        "id": "P0402 - HDDA-FTS-63433",
        "legalBasis": {
            "id": "2023/54",
            "scheme": "UKPGA",
            "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents"
        },
        "title": "Provision of a Regional Risk Management System",
        "description": "Hywel Dda University Health Board (HDUHB) and Swansea Bay University Health Board (SBUHB) are undertaking a market engagement exercise for suppliers interested in delivering a Risk Management System solution. The purpose of the market engagement event is to gather greater insight into market capacity and capability and the potential risk management solution options. This market engagement will also help the Health Boards to refine their solution requirements and budgetary costs ahead of any potential procurement. The Health Boards currently use a risk system alongside various other tools to support risk management activities. The current contract is approaching its end, prompting the need to re-procure a risk solution. HDUHB and SBUHB are therefore seeking to understand the market's ability to provide an enterprise level risk management solution capable of supporting risk management across each organisation. Date: 8th July 2026 Location: Virtual (Microsoft Teams) Spaces will be issued on a first come, first served basis between 09:00 - 15:00.",
        "items": [
            {
                "id": "1",
                "additionalClassifications": [
                    {
                        "scheme": "CPV",
                        "id": "48000000",
                        "description": "Software package and information systems"
                    },
                    {
                        "scheme": "CPV",
                        "id": "72000000",
                        "description": "IT services: consulting, software development, Internet and support"
                    }
                ],
                "deliveryAddresses": [
                    {
                        "region": "UKL14",
                        "country": "GB",
                        "countryName": "United Kingdom"
                    },
                    {
                        "region": "UKL18",
                        "country": "GB",
                        "countryName": "United Kingdom"
                    },
                    {
                        "region": "UKL17",
                        "country": "GB",
                        "countryName": "United Kingdom"
                    }
                ],
                "relatedLot": "1"
            }
        ],
        "value": {
            "amountGross": 480000,
            "amount": 400000,
            "currency": "GBP"
        },
        "mainProcurementCategory": "services",
        "aboveThreshold": true,
        "lots": [
            {
                "id": "1",
                "suitability": {
                    "sme": true
                },
                "contractPeriod": {
                    "startDate": "2027-04-01T00:00:00+01:00",
                    "endDate": "2032-11-30T23:59:59+00:00",
                    "maxExtentDate": "2037-11-30T23:59:59+00:00"
                },
                "hasRenewal": true,
                "status": "planning"
            }
        ],
        "communication": {
            "futureNoticeDate": "2026-07-29T23:59:59+01:00"
        },
        "status": "planning"
    },
    "language": "en"
}