Offers will be evaluated against the following criteria:
• Functional capability
• Security, privacy and data governance
• Integration capability
• Implementation approach and methodology
• Supplier capability and experience
• Cost and value for money

Mandatory criteria include:
• Compliance with QITC framework and contract terms
• Compliance with UniSQ security, privacy, and data hosting requirements
• Demonstrated identity and bank validation capability
• Proven integration with PeopleSoft Financials
• Disclosure of hosting model and data residency

Question:
Greetings,

We are Software Escrow Service providers.

The documentation is silent on whether software escrow services are required for this solution.

Have software escrow services been considered?

Have software escrow services been rejected?

Given the cost of software escrow services is modest, typically less than $1000 per annum, what process will be followed when selecting a software escrow provider?

Thank you

Software Escrow Guardians

Answered on 23/Jun/2026 12:15 PM:


Question 1 - Have software escrow services been considered?

Answer 1 – No.

Question 2 - Have software escrow services been rejected?

Answer 2 – No.

Question 3 - Given the cost of software escrow services is modest (typically less than $1,000 per annum), what process will be followed when selecting a software escrow provider?

Answer 3 - Unable to determine at present. Awaiting submissions from ITO respondents.

Question:
Could you please clarify the scope of the banking validation requirement. What level of validation you expect (for example, bank account ownership verification, account detail matching, change-of-bank-detail controls and approvals, and any required integrations with your finance or ERP systems)

Would a third-party banking validation provider would be acceptable as part of the proposed solution? Are there any specific audit, governance, regulatory, or fraud-prevention standards the solution must meet?

Answered on 06/Jul/2026 01:41 PM:


Refer to addendum for response/s

Question:
Good afternoon,

I am seeking further clarification around the following questions:

What version of PeopleSoft Financials is UniSQ currently running, and how is it hosted (on-premise, Cloud, or managed service)?

• Are there existing integration patterns or middleware currently connecting to PeopleSoft that we must reuse or align with?

• Does the integration need to be strictly real-time, or are batch/near-real-time syncs acceptable for certain supplier lifecycle events?

• What is the approximate volume of active suppliers currently in PeopleSoft, and what is the estimated volume of the historical/inactive supplier database?

• Are there other hidden sources of supplier data (e.g., departmental spreadsheets, legacy procurement tools) outside of PeopleSoft that need to be ingested or consolidated?

• What are the key data quality issues UniSQ experiences most frequently today (e.g., formatting errors, missing ABNs, duplicate parent/child company records)?

• Does UniSQ have preferred or existing third-party vendors for ABN/ASIC lookup (like the ABR API) or Bank Account Verification (like Eftsure)?

• For international suppliers, what specific digital identity or banking validation standards/registries does UniSQ require compliance with?

• What specific regulatory or audit frameworks (e.g., TEQSA, Queensland public sector audit requirements) must the solution's audit trails and compliance dashboards align with?

• What is the expected volume of new supplier onboarding requests per month, and how many external supplier users are expected to access the portal concurrently?

• What language or localization requirements exist for the international supplier onboarding experience?

• How many internal UniSQ users (procurement officers, finance approvers, auditors) will require access to the backend system to review and approve supplier profiles?

Thank you

Answered on 06/Jul/2026 01:41 PM:


Refer to addendum for response/s

Question:
Please clarify whether the Australian hosting and legal jurisdiction requirements applies to every solution component and/ or supporting service? Or would it be applicable only to components and/ or support service housing personal worker information?

Answered on 06/Jul/2026 01:42 PM:


Refer to addendum for response/s

Question:
Clarification Questions for UniSQ

A. Process Ownership & Operating Model

1. Which function owns this process end-to-end at UniSQ - Accounts Payable, Procurement, or Finance shared services - and who are the executive sponsor and day-to-day process owner?

2. Solutions are designed differently depending on the centre of gravity. Is the primary objective payment integrity (verifying suppliers and bank details before payment, an AP-centric control), or full vendor-lifecycle management (qualification, contracting and ongoing management, a procurement-centric process) - or both, as one joined-up flow?

3. Who is accountable for supplier master data today, and which teams create new suppliers and approve changes? Are AP and Procurement working from a single supplier record, or separate records that must be reconciled?

4. Approximately how many active suppliers do you maintain, how many new onboardings and change requests occur annually, and what share are international versus domestic?

5. As part of the verification processes, do you need to process any documents, e.g. invoice, supplier letter, email, etc. If so, what would be the annual volume of documents? Please provide a list of different document types that would need to be processed.

B. Identity & Business Verification (KYB)

5. A valid ABN on an invoice confirms a business exists but not who you are dealing with - robust verification usually layers entity status, ownership and screening. What level of identity assurance do you require - entity existence and status (ABN/ACN via ABR, ASIC), ultimate beneficial ownership, and sanctions/watchlist screening - and should this be applied on a risk-based basis (e.g. greater scrutiny for new, international or high-value suppliers)?

6. We can either integrate your preferred data sources or propose a verification stack. Do you currently use, or prefer, specific authoritative data sources or providers for business verification, or should the supplier propose this as part of the solution?

7. International onboarding generally requires a different verification standard from domestic. For overseas suppliers, what verification do you expect - local registry checks, sanctions/PEP screening, and IBAN/SWIFT validation?

C. Bank Account & Payment Validation

8. The most effective control against payment-redirection fraud is confirming the account name matches the verified supplier (beneficiary/account-name verification), not just that the BSB and account number are well-formed. What level of bank validation do you require - format/BSB validation, account-ownership/name match (Confirmation of Payee), or both?

9. Vendor email compromise typically targets established suppliers through a fraudulent “updated bank details” request, so leading practice re-verifies on change and before pay runs. Should validation occur at onboarding only, or continuously - re-verifying whenever bank details change and prior to payment?

10. Do you have an incumbent bank-validation provider or banking integration we should design around, or is this capability expected within the proposed solution?

D. Master Data, Change Control & Integration

11. Data quality is most effective when enforced at the point of record creation rather than cleaned up afterwards. Do you want duplicate-matching and data standardisation applied at the point a supplier record is created, and what are your current pain points with duplicate or inaccurate supplier data?

12. Strong change control relies on segregation of duties and maker-checker approvals. What approval model and segregation-of-duties controls do you require for new suppliers and for supplier changes (e.g. maker-checker, finance sign-off thresholds)?

13. This determines our integration design and where the supplier record is mastered. For PeopleSoft: which version and modules are in scope (e.g. Financials 9.2 - Supplier/AP), is it on-premise or cloud, and what integration method do you prefer (REST/web services, Integration Broker, file-based)?

14. Should the solution be the system of record for supplier master data, or validate and feed PeopleSoft as the master - and what other systems must integrate (sourcing, e-invoicing, SSO/identity, banking)?

E. Security, Hosting, Compliance & Commercial

15. Public-sector and higher-education buyers usually have specific data-residency and assurance requirements. What are your hosting and data-residency requirements - must all data reside in Australia, is SaaS acceptable or is private-cloud/on-premise required, and which certifications do you expect (e.g. ISO 27001, IRAP/Essential Eight, SOC 2)?

16. Under the QITC framework, which contract type and modules do you intend to use (General or Comprehensive), will draft terms and security/privacy schedules be provided in the RFP pack, and do you have a preferred commercial model for evaluation (per supplier, per transaction, or platform subscription)?

Answered on 06/Jul/2026 01:42 PM:


Refer to addendum for response/s

Question:
Category Question

Unimarket 1) What is Unimarket — who is the vendor, is it a SaaS platform, and does it have a published API (REST/SOAP)? Is there a developer portal or integration documentation available?

2) What is the current Unimarket-to-PeopleSoft replication mechanism — API, flat file, or a vendor-supplied connector? Who manages it today — UniSQ IT, the Unimarket vendor, or a third party? Is the replication mechanism managed via Peoplesoft's Integration Broker?

3) Does validated supplier or payment data need to write back to Unimarket?

Middleware Does UniSQ have an existing integration middleware platform in use (e.g. MuleSoft, Azure Integration Services, or similar iPaaS)? Is there a preference from UniSQ's enterprise architecture team or restriction on the middleware to be used for Integration?

Integration Flows & Scope 1) Data volumetrics: ~30 new suppliers/month for onboarding is clear, but could we get an estimate of how many payment transactions per day ? Regarding the payment validation 'prior to every payment' requirement, Are there any specific response time requirements?

2) Can we get a list of currently active Integration Broker service operations?

3) Noted the expected contract commencement date is 1 September 2026 , is there an expected go-live date for the solution, expected implementation period following contract execution start? This info can help with integration timeline planning.

Answered on 06/Jul/2026 01:42 PM:


Refer to addendum for response/s