They should be made to self-assess, and then audited anyway. The accuracy of their self-assessment should be part of the selection criteria.
I'd even take it a step further, when a contract worth 2 billion is awarded without even an attempt at validation of self compliance claims then the ones in control of the awarding process are also part of the, almost guaranteed, fraud.
The title is wrong. The 2b has nothing to do with the fraud. 2 completely different organizations with sperate IT systems.