---
title: "Risk, Audit and Compliance Solution"
ocid: "ocds-h6vhtk-043685"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-043685"
markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-043685.md"
json_url: "https://d3tenders.com/contract/ocds-h6vhtk-043685.json"
source: "Find A Tender Service"
current_stage: "Award"
buyer: "FINANCIAL CONDUCT AUTHORITY"
published: "2024-10-16"
---

# Risk, Audit and Compliance Solution

Buyer: FINANCIAL CONDUCT AUTHORITY  
Current stage: Award  
OCID: ocds-h6vhtk-043685

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-043685)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-043685.json)

## Summary

The Financial Conduct Authority (FCA) has completed the procurement process for a "Risk, Audit and Compliance Solution" in the IT software package category. The contract was awarded to CoreStream for £565,550 GBP on 23rd September 2024. The procurement followed an open procedure and involved a tender process initially opening on 1st February 2024 with a deadline of 4th March 2024. The contract involves implementing a Risk, Internal Audit, and Compliance Solution for the FCA and the Payment Systems Regulator (PSR) for three years starting from 1st September 2024, with the possibility of two further extensions of 12 months each, totaling a maximum term of five years. The primary delivery location is at the FCA headquarters at 12 Endeavour Square, London (region UKI4).

This tender provides significant opportunities for IT software businesses specialising in Governance, Risk and Compliance (GRC) solutions. Companies offering commercial off-the-shelf (COTS), software as a service (SaaS) platforms, which can be configured for risk management, internal audit processes, and policy compliance will find this contract particularly suited to their offerings. The project will support the FCA and PSR in further embedding their Risk Management Frameworks, enhancing risk maturity, and enabling better decision-making. This presents considerable growth potential for businesses adept at delivering comprehensive risk, audit, and compliance solutions with capabilities for key risk indicator management, policy standardisation, and real-time data analytics.

## Notice

The FCA is establishing a contractual mechanism to implement a Risk, Internal Audit and Compliance Solution to the FCA for a period of three years starting from 1 September 2024 with an option to extend by two further periods of 12 months each (maximum term 5 years).

### Lot Information

Lot 1

The FCA is establishing a contractual mechanism to implement a Risk, Internal Audit and Compliance Solution to the FCA for a period of three years starting from 1 September 2024 with an option to extend by two further periods of 12 months each (maximum term 5 years).
As a fully independent subsidiary of the FCA, the PSR operates to a shared service agreement, but each retains full data segregation. Any proposed solution will be required to maintain this segregation.
The system will support the further embedding of the Risk Management Frameworks that are operated by the FCA and PSR respectively, enabling greater levels of risk maturity across both organisations and ensuring efficient and effective risk-conscious decision making and prioritisation. 
Risk Management plays an essential role in helping to deliver on our Strategy and statutory and operational objectives. It does this by helping to ensure we are operating in an effective and efficient risk-based manner in identifying and delivering the timely interventions to appropriately identify, prevent, mitigate, manage, influence and report on actual and potential Risks of Harm. 
The current risk system is a commercial off the shelf (COTS), software as a service (SaaS) platform. This has been configured to support, as examples, the FCA's risk of harm and own risk taxonomies and scoring methodologies, to automate aspects of the FCA's Risk and Control Self-Assessment (RCSA) process; Risk Event Management process; risk acceptance and various risk and assurance reviews that are conducted by 2LOD. Additionally, it includes a small number of cross-cutting Risks of Harm. 
The current Internal Audit (IA) system is used as a workflow tool to manage the activities associated with internal audits, including findings and actions. This is also a COTS SaaS, with a component hosted on desktop.
Both systems are functionally similar platforms and classified as 'Governance, Risk and Compliance' software tools. Moving to a single platform for all risk and audit information will support the consolidation of our IT estate.
A unified platform is envisaged to benefit day to day users, providing a clear view of the risks and controls they manage, linking the outcomes of IA reviews to wider risk management activities. In addition, this would provide stakeholders with an improved view of risk exposures and resultant mitigations by connecting the data to enable more effective and efficient decision making.
The system will be required to support the FCA's roadmap for critical risk management tools and processes and must therefore be able to support existing (and new) capabilities that have not previously been automated, such as Compliance (i.e., policy management and the implementation of a standardised control library) and Key Risk Indicator management. 
We anticipate the system will provide access to real time risk and audit data, providing a high degree of flexibility in the ability to analyse and report on that data on an individual and aggregated risk basis to identify and monitor trends over time. For example, linkages across various records and metrics on a one-to-one, one-to-many and/or one-to-all basis.
The system must be implemented with minimal disruption to current processes and business operations. The supplier will demonstrate a robust approach to significant change and issue resolution, working cohesively with the FCA Product Group to support and independently configure the product.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Find A Tender Service |
| Latest notice | https://www.find-tender.service.gov.uk/Notice/033456-2024 |
| Notice type | Tender Notice |
| Procurement type | Standard |
| Procurement category | Goods |
| Procurement method | Open |
| Procurement method details | Open procedure |
| Tender suitability | Not specified |
| Awardee scale | Large |
| All stages | Tender, Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 16 Oct 2024 |
| Submission deadline | 4 Mar 2024 |
| Future notice date | Not specified |
| Award date | 22 Sep 2024 |
| Contract period | 31 Aug 2024 - 31 Aug 2029 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £3,500,000 |
| Lots value | £3,500,000 |
| Awards value | Not specified |
| Contracts value | £565,550 |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Cancelled |
| Awards status | Active |
| Contracts status | Active |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | FINANCIAL CONDUCT AUTHORITY |
| Locality | LONDON |
| Post town | East London |
| Postcode | E20 1JN |
| Country | England |
| ITL 1 | TLI London |
| ITL 2 | TLI4 Inner London - East |
| ITL 3 | TLI41 Hackney and Newham |
| Local authority | Newham |
| Electoral ward | Stratford Olympic Park |
| Westminster constituency | Stratford and Bow |
| Delivery location | TLI4 Inner London - East |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | CORESTREAM |

## CPV Codes

### Divisions

- 48 - Software package and information systems

### Codes

- 48517000 - IT software package

## Release History

- 16 Oct 2024 at 16:19 - Award - Award Notice - https://www.find-tender.service.gov.uk/Notice/033456-2024
- 5 Feb 2024 at 13:37 - TenderUpdate - Tender Notice - https://www.find-tender.service.gov.uk/Notice/003694-2024
- 5 Feb 2024 at 08:52 - TenderUpdate - Tender Notice - https://www.find-tender.service.gov.uk/Notice/003621-2024
- 1 Feb 2024 at 16:45 - Tender - Tender Notice - https://www.find-tender.service.gov.uk/Notice/003431-2024

## Notice URLs

- http://www.fca.org.uk
- https://atamis-fca.my.salesforce.com/
- https://atamis-fca.my.site.com/s/Welcome
- https://atamis-fca.my.site.com/s/WelcomeThe

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-043685. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-043685.json.