# Bid Compliance Audit — Borough of Ashfield ITT/2026/114 **Assumptions:** - "Days" in section 3.4/3.1 read as calendar days; no stated grace period exists for late or misdirected submissions. - The 29 October 2026 email submission is treated as the actual submission channel used, since no other transmission is stated. - "Sites from which the service is delivered" (5.3) is read to include both Manchester and Leeds, since the service desk and delivery model reference multi-site operation (Leeds is named only in BIDDER_EVIDENCE, not in DRAFT_RESPONSE). --- ## 1. REQUIREMENT EXTRACT | # | Clause | Quoted Text | Type | Scored Criterion | |---|--------|-------------|------|-------------------| | R1 | 3.1 | "Responses to Section 5 shall not exceed four sides of A4." | MANDATORY | — | | R2 | 3.2 | "The Form of Tender at Annex A shall be signed by a director and returned with the response." | MANDATORY | — | | R3 | 3.4 | "Tenders shall be submitted through the Council's e-tendering portal by 17:00 on 30 October 2026." | MANDATORY | — | | R4 | 5.1 | "The supplier shall provide a named account manager and shall maintain a service desk staffed 24 hours a day, 365 days a year." | MANDATORY (also evaluated under technical approach) | Technical approach | | R5 | 5.2 | "The supplier shall respond to Priority 1 incidents within 30 minutes and resolve them within 4 hours." | MANDATORY (also evaluated under technical approach) | Technical approach | | R6 | 5.3 | "The supplier shall hold ISO 27001 certification covering all sites from which the service is delivered." | MANDATORY | — | | R7 | 5.5 | "The supplier shall not subcontract any part of the service desk without the Council's prior written consent." | MANDATORY | — | Note: 5.4 is the scoring-weights clause itself, not a bidder obligation, so it is not numbered as a requirement. --- ## 2. COVERAGE MATRIX **R1 (page limit, 3.1):** No text in DRAFT_RESPONSE addresses page count. Classification: **UNVERIFIABLE** — page/side count cannot be determined from pasted text alone. **R2 (signed Form of Tender, 3.2):** No text in DRAFT_RESPONSE references the Form of Tender. BIDDER_EVIDENCE states "Form of Tender not yet signed." Classification: **MISSING** — required document not completed per bidder's own evidence. **R3 (portal submission by deadline, 3.4):** DRAFT_RESPONSE states: "Submitted by email to procurement@ashfield.gov.uk on 29 October 2026." Classification: **CONTRADICTED** — the RFP requires portal submission and explicitly states "Responses sent by email will not be evaluated"; the draft's own stated submission method directly conflicts with this mandatory channel requirement. **R4 (named account manager + 24/7/365 service desk, 5.1):** - Account manager: DRAFT_RESPONSE states: "Every client is assigned a named account manager who is their single point of contact for the life of the contract." BIDDER_EVIDENCE does not contradict this. Classification: **ANSWERED** (account manager element only). - 24/7/365 service desk: DRAFT_RESPONSE states: "We understand the importance of round-the-clock availability and the disruption an unattended service desk causes to a council of Ashfield's size. Our team is passionate about responsiveness." This restates the requirement's importance without committing to hours. BIDDER_EVIDENCE states: "34 staff and no overnight rota; service desk staffed 07:00-20:00 Monday to Friday." Classification: **CONTRADICTED** — evidence directly conflicts with the implied 24/7/365 claim; actual coverage is 65 hours/week, not 168. **R5 (P1 response 30 min / resolution 4 hrs, 5.2):** DRAFT_RESPONSE states: "Priority 1 incidents are acknowledged within 30 minutes of being raised. Our engineers work each Priority 1 through to closure, and the average time to resolution across our client base last year was 6 hours 20 minutes." Classification: **CONTRADICTED** — the 30-minute response element is answered, but the draft's own stated average resolution time (6h20) exceeds the mandatory 4-hour resolution requirement; this is a self-disclosed conflict with the clause, not merely an evidence gap. **R6 (ISO 27001, all delivery sites, 5.3):** DRAFT_RESPONSE states: "Northgate IT Services is an ISO 27001 certified company and applies the same controls across every engagement." BIDDER_EVIDENCE states: "ISO 27001 certified for the Manchester office only - the Leeds delivery site is outside the certificate scope." Classification: **CONTRADICTED** — draft claims blanket certification; evidence shows certificate scope excludes a delivery site. **R7 (no subcontracting without consent, 5.5):** DRAFT_RESPONSE states: "Out-of-hours cover is provided by our partner Helix Nightdesk, who handle calls received between 20:00 and 07:00 on our behalf." No text in DRAFT_RESPONSE or BIDDER_EVIDENCE states Council consent was obtained. BIDDER_EVIDENCE states: "subcontract agreement with Helix Nightdesk signed 2025" — an agreement date, not evidence of Council consent. Classification: **UNVERIFIABLE** — subcontracting is disclosed, but whether the Council's prior written consent was sought or granted cannot be determined from pasted text alone. --- ## 3. DISQUALIFIERS MANDATORY requirements classified MISSING or CONTRADICTED: 1. **R2 — Form of Tender (3.2):** "Tenders received without a signed Form of Tender will be rejected." Classified MISSING; bidder's own evidence confirms it is unsigned. 2. **R3 — Submission channel (3.4):** "Responses sent by email will not be evaluated." Classified CONTRADICTED; draft states email submission was used. 3. **R4 — 24/7/365 service desk (5.1):** No explicit rejection sanction stated in the RFP for this clause, but it is a "shall" obligation classified CONTRADICTED by evidence of 07:00-20:00 weekday-only coverage. 4. **R5 — 4-hour resolution (5.2):** No explicit rejection sanction stated, but it is a "shall" obligation classified CONTRADICTED by the draft's own disclosed 6h20 average. 5. **R6 — ISO 27001 all sites (5.3):** No explicit rejection sanction stated, but it is a "shall" obligation classified CONTRADICTED by evidence that Leeds is outside certificate scope. **Count: 5 disqualifying findings** (2 with explicit stated rejection sanctions — R2, R3; 3 mandatory "shall" clauses contradicted by evidence — R4, R5, R6). --- ## 4. SCORE-IMPACT RANKING R4 and R5 fall under technical approach (50% weight) and are also disqualifiers, but retain a score-impact estimate since they remain SCORED elements independent of the rejection risk. 1. **R4 — 24/7/365 service desk claim vs. evidence (technical approach, 50%).** Severity: **HIGH** — service desk coverage is a core, explicitly named element of the technical requirement (5.1), and the draft's vague restatement combined with contradicted evidence undermines a central technical claim. {EVI}{UNCONF} Estimated points at risk: a large share of the 50% technical weight, reasoned from this being one of only a few concrete operational commitments the evaluator can assess in the technical section. 2. **R5 — 4-hour resolution SLA vs. 6h20 average (technical approach, 50%).** Severity: **HIGH** — incident resolution time is a named, measurable technical commitment (5.2), and the draft self-discloses a figure that breaches the mandatory SLA. {EVI}{UNCONF} Estimated points at risk: substantial, on the same basis as R4 — this is one of the few quantifiable technical metrics in the response. 3. **R6 — ISO 27001 scope gap (not separately weighted, but underpins technical approach credibility).** Severity: **MEDIUM** — certification is referenced under Security within the technical narrative but is not the sole technical element; evaluators may weigh it as a supporting credibility factor rather than the central technical claim. {EVI}{UNCONF} Estimated points at risk: moderate, reasoned from certification typically functioning as a supporting/eligibility signal rather than the primary technical differentiator. 4. **Social value (20%) — apprenticeship commitment.** DRAFT_RESPONSE states two apprenticeships will be offered; no classification issue was found here (ANSWERED, not contradicted), so no score-impact estimate is warranted for this criterion. 5. **Price (30%).** No price information appears anywhere in RFP_TEXT, DRAFT_RESPONSE, or BIDDER_EVIDENCE. Severity: **HIGH** — price is entirely absent from the material provided, so no scoring signal exists at all for 30% of the total evaluation. {EVI}{UNCONF} This is flagged for completeness but is not a "gap" in an existing response — it reflects that no price content was submitted for audit. --- ## 5. CLAIMS WITHOUT EVIDENCE 1. **Claim:** "We understand the importance of round-the-clock availability and the disruption an unattended service desk causes to a council of Ashfield's size. Our team is passionate about responsiveness." — **OVERSTATED**. Evidence shows service desk staffed 07:00-20:00 Monday to Friday only, with no overnight rota. What would make it safe: either a corrected claim matching actual hours, or documented rota/staffing records showing genuine 24/7/365 coverage. Source to test it: internal staffing rota / HR shift records. 2. **Claim:** "Our engineers work each Priority 1 through to closure, and the average time to resolution across our client base last year was 6 hours 20 minutes." — **OVERSTATED** (relative to the 4-hour mandatory requirement, R5). What would make it safe: historical ticket data showing a true average at or under 4 hours, or a revised SLA commitment consistent with actual performance. Source to test it: incident/ticket management system export (e.g. ServiceNow, Zendesk reports) for the stated period. 3. **Claim:** "Northgate IT Services is an ISO 27001 certified company and applies the same controls across every engagement." — **OVERSTATED**. Evidence shows certification covers Manchester only; Leeds is outside scope. What would make it safe: an extended certificate covering Leeds, or a corrected claim limited to Manchester with a stated remediation plan for Leeds. Source to test it: the ISO 27001 certificate itself and its stated scope/site annex. 4. **Claim:** "Northgate IT Services has supported public sector clients since 2019." — **UNSUPPORTED**. BIDDER_EVIDENCE states "three public sector contracts since 2023," which does not confirm activity from 2019. What would make it safe: contract start dates or client references predating 2023. Source to test it: contract register or client reference list. 5. **Claim (implicit, via silence on consent):** Use of Helix Nightdesk as a subcontractor for out-of-hours cover is stated as fact without confirming Council consent was sought, against R7's "prior written consent" requirement. **UNSUPPORTED**. What would make it safe: written Council approval on file. Source to test it: correspondence/approval record with the Council's procurement team. --- ## 6. FIX ORDER 1. **Correct the service desk hours claim (R4).** Rewrite the "Service desk" section to state actual coverage (07:00-20:00 Mon-Fri) rather than implying 24/7/365, or add an overnight staffing plan. Depends on: a business decision on whether to actually resource 24/7/365 coverage before submission, or accept a reduced technical score for accurate disclosure. 2. **Correct or contextualize the resolution-time claim (R5).** Either revise the claim to reflect true performance or provide a credible plan showing how the 4-hour SLA will be met going forward (distinct from the historical 6h20 average). Depends on: operational commitment from the business, not just wording. 3. **Correct the ISO 27001 scope claim (R6).** State the certificate's actual scope (Manchester only) and, if Leeds work is included in this contract, disclose that gap plus any remediation timeline. Depends on: whether Leeds will be excluded from delivery, or a certification body engagement to extend scope — the latter cannot be completed before a 30 October deadline. 4. **Address subcontractor consent (R7).** Confirm in writing whether Council consent for Helix Nightdesk has been sought; if not, initiate that request immediately. Depends on: the Council's own response time, which the bidder does not control. **— past this point one person cannot finish alone —** 5. **Obtain a signed Form of Tender (R2).** Requires a director's physical or authorized digital signature. Depends on: director availability before the deadline. 6. **Resubmit via the correct channel (R3).** The response must be submitted through the e-tendering portal, not email, before 17:00 on 30 October 2026. Depends on: portal access/registration being in place and the corrected document package being ready in time. 7. **Confirm page count compliance (R1).** Requires the actual formatted document to count sides of A4. Depends on: final formatted output, not available from pasted text. --- ## 7. NOT CHECKED - **R1 (page limit):** Cannot verify actual page/side count from pasted text; requires the formatted submission document. - **Form of Tender content/signature (R2):** Cannot verify director identity, signature validity, or Annex A completion from text alone. - **Portal submission timestamp (R3):** Cannot verify actual portal upload time or confirm whether a portal submission exists in addition to the stated email; only the stated email transmission is visible. - **Council consent for subcontracting (R7):** Cannot verify from provided text whether written consent was requested or granted — only that a subcontract agreement exists. - **Full staffing rota detail:** BIDDER_EVIDENCE states "34 staff and no overnight rota" but underlying rota documents are not provided. - **Contract history detail (2019 claim):** Underlying contract register not provided; only the "since 2023" evidence statement is available. - **Price submission:** No pricing content was provided in any input field; cannot assess against the 30% price weighting beyond noting its absence.