Guidelines and Procedures on Acceptance of ICT Systems/Solutions to be Donated by a Third Party Developer/Provider to the BIR

July 29, 2022 REVENUE MEMORANDUM ORDER NO. 36-2022 SUBJECT : Guidelines and Procedures on the Acceptance of Information and Communications Technology (ICT) Systems/Solutions to be Donated by a Third Party Developer/Provider to the BIR TO : All Revenue Officials, Employees and Others Concerned I. OBJECTIVES This Order is issued to: 1. Prescribe the guidelines and procedures on the acceptance of ICT systems/solutions to be donated by third party developer/provider to the BIR. 2. Ensure that the proposals of third party developer/provider to develop an application system/solution are properly endorsed and signed/approved by the concerned BIR officials ( i.e. , concerned Process Owner and ISG counterpart) prior to the start of his/her/its work/engagement. II. SCOPE This Order covers the donation by third party developer/provider of ICT system/solution and its incidentals to the BIR. III. DEFINITION OF TERMS 1. Third Party Developer (TPD) means an individual or entity, local or international providers/developers, engaged in the development of software, application systems and other IT solutions. 2. Donated Application Systems (DAS) ICT system and its incidentals, ownership of which was turned over to BIR as a result of a Memorandum of Agreement (MOA) or a Memorandum of Understanding (MOU) with a TPD. IV. POLICIES AND GUIDELINES 1. Interested TPD shall tender a signed Letter of Intent (LOI), addressed to the Commissioner of Internal Revenue, Attention: The Deputy Commissioner of the concerned Process Owner (PO), signifying his/her/its intention to develop a system at no cost to the BIR. 2. The LOI shall include a Technical Proposal containing, among others, the statement of work including the following: a) Brief Introduction b) Purpose/Objective c) Functional Scope d) Technical Diagram e) Technical Specifications/Requirements ( i.e. , hardware and software to be used, security components, etc.) f) Work plan containing key activities and timelines. 3. The LOI and the technical proposal shall be assigned to the concerned PO. The assignment shall be made by the Deputy Commissioner of the concerned PO. 4. The PO shall coordinate with the concerned ISG Project Manager (ISG PM) in evaluating the proposal to ensure that it meets relevant functional and technical requirements of the Bureau, while addressing potential concerns on data privacy, security, interoperability (if necessary), among others. 5. The following documents shall be submitted by the TPD prior to the start of his/her/its work/engagement: aScITE a) Draft Memorandum of Agreement or Memorandum of Understanding (MOA or MOU) attached as Annexes "A" & "B" hereof b) Signed Non-Disclosure Agreement (NDA) attached as Annex "C" hereof c) Signed Acceptable Use Policy (AUP) attached as Annex "D" hereof The MOA or MOU shall contain a statement that the application system/solution and its components shall be donated to the BIR. 6. A project team may be created through a Revenue Special Order (RSO), if necessary, to oversee the project development and its implementation. 7. The Privacy Impact Assessment (PIA) Team of the BIR Data Privacy Committee shall conduct a PIA using the prescribed template (see Annex "E" hereof) at the start of the project to ensure inclusion of privacy protection, which may be considered throughout the development lifecycle of a system or program. 8. The application system development duration/engagement shall not exceed one (1) year. Failure to deliver on the agreed target date is a ground to terminate/suspend the MOA or MOU. 9. A progress report of the engagement shall be submitted by ISG PM to concerned Assistant Commissioner (ACIR) and Deputy Commissioner (DCIR). All changes to the agreed/approved scope and timelines shall be discussed and documented through a Change Request. 10. A system walkthrough for the developed application shall be conducted prior to acceptance testing. Likewise, briefing/demonstration of the new application system shall be conducted prior to the implementation of the system. 11. Application system/solution developed shall undergo acceptance testing following the procedures per RMO No. 24-2003 (Revised Guidelines and Procedures for Testing and Acceptance of In-house Developed and Outsourced Application System) to evaluate conformance to business and technical standards of BIR. 12. Migration of new application system/solution shall be done following the procedures prescribed in ISG Memorandum Order No. 2-2016 (Processing and Implementation of Migration Request) . 13. The PO/ISG PM shall ensure that budget for the other components of the system/solution ( i.e. , server, license/s, maintenance/sustainability), which are not covered by the MOA or MOU, is included in the Project Procurement Management Plan (PPMP) to sustain the application system/solution. 14. Delivery/availability of all resources required during development and testing shall be discussed with and agreed upon by both BIR and TPD. 15. The technical infrastructure requirements of the project ( i.e. , server, network requirements, etc.) shall be determined and discussed with the concerned ISG offices to ensure availability and readiness once the developed system is implemented/rolled out. 16. Since this is a donation, the TPD shall submit all system/technical documentations ( i.e. , source code, configuration, and other relevant documentations) to the BIR, and these shall become the property of the BIR. The concerned PO/ISG PM shall ensure that the final copies of project documentations are turned over to BIR. 17. A separate Deed of Donation (DOD) for the developed application system/solution shall be submitted following the procedures in processing DOD per Revenue Memorandum Order No. 15-2020 (Updated Procedures in the Acceptance of Property Donations to the Bureau of Internal Revenue Pursuant to Revenue Delegation Authority Order (RDAO) No. 4-2010, as Amended by RDAO No. 4-2019 dated July 31, 2019). 18. A Project Closure Report shall be prepared and submitted by PO/ISG PM to the IT Planning and Standards Division, Information Systems Development and Operations Service (ITPSD-ISDOS) in compliance with ISG Memorandum Order No. 1-2022 (Amending ISG Memorandum Order No. 2-2013 on the Preparation and Submission of Project Closure Report) . V. PROCEDURES 5.1 Third Party Developer (TPD) 5.1.1 Submit a signed Letter of Intent (LOI) and technical proposal. 5.1.2 Sign and return the NDA (please refer to Annex "C" hereof) and the AUP (please refer to Annex "D" hereof). 5.1.3 Discuss with the Process Owner (PO) and ISG Project Manager (ISG PM) the proposal/project requirements, work plan, and other details of the engagement. 5.1.4 Prepare and submit the MOA or MOU (attached as Annexes "A" and "B" hereof). 5.1.5 Develop the proposed application system/solution within the mutually agreed timelines. 5.1.6 Conduct a system walkthrough/briefing/demonstration. 5.1.7 Fix/resolve the issues raised by User Acceptance Team. 5.1.8 Perform migration activities and deployment of the application system to production in coordination with ISG PM. Ensure that key personnel are available to oversee the project after deployment to "fix/troubleshoot" issues that may arise after deployment to production. 5.1.9 Prepare and submit system documentations. 5.1.10 Prepare and submit a Deed of Donation (DOD). 5.1.11 Submit the Delivery Receipt or the List of Deliverables to PO which shall be received, signed and dated by the receiver. 5.1.12 Indicate in the Delivery Receipt or the List of Deliverables the quantity and cost (in Philippine peso) of the donated ICT systems/solutions broken down per specifications. 5.2 Concerned Deputy Commissioner (DCIR) of Process Owner 5.2.1 Receive the LOI and the technical proposal. 5.2.2 Assign the LOI and the technical proposal to the concerned PO. 5.2.3 Approve/Disapprove the proposal/endorsement letter. 5.2.4 Sign the MOA or the MOU (attached as Annexes "A" and "B" hereof). 5.3 Process Owner 5.3.1 Coordinate with the ISG PM in evaluating the LOI and technical proposal, as to applicability, relevance to BIR operations and completeness of documentation. If found favorable, recommend acceptance through an endorsement letter (attached as Annex "F" hereof) to be signed/approved by the concerned BIR Officials. 5.3.2 Inform the TPD of the approval/disapproval of the LOI. If approved, the following documents shall be prepared/reviewed prior to the start of the engagement: a) Non-Disclosure Agreement (attached as Annex "C" hereof) b) Acceptable Use Policy (attached as Annex "D" hereof) Otherwise, inform the TPD of the reason for the disapproval. 5.3.3 Review the MOA or the MOU, incorporate the comments of ISG, and forward to the Legal Service for further review and endorsement. 5.3.4 Identify users who will work with ISG counterpart in the User Acceptance Testing (UAT) following acceptance testing procedures per RMO No. 24-2003 (Revised Guidelines and Procedures for Testing and Acceptance of In-house Developed and Outsourced Application System). 5.3.5 Coordinate with the PIA Team on the conduct Privacy Impact Assessment (please refer to Annex "E" hereof) of the application/solution to be developed by the third party developer and prior to implementation. 5.3.6 Inform the TPD to submit the Deed of Donation (DOD) and final documentations and forward the same to the Legal Service for review and endorsement. 5.3.7 Follow the procedures in processing DOD per RMO No. 15-2020, and forward the DOD and its attachments to Administrative Service for review and recommendation. 5.3.8 Forward the DOD to the following offices for signature and approval: a. Above P12M Commissioner of Internal Revenue b. P12M and below Deputy Commissioner, Information Systems Group 5.3.9 Secure notarization of the DOD by a duly authorized Notary Public. 5.3.10 Provide a copy of the duly notarized DOD to each of the following offices: a. Information Systems Development & Operations Service b. Property Division c. Office of the Commissioner d. Accounting Division 5.3.11 Submit to Property Division the following documents: a. Delivery Receipt or List of Deliverables b. Original copy of Certificate/Proof of Ownership of the donated ICT system/solution for safekeeping. 5.3.12 Prepare Request for Inspection of the donated application. 5.4 ISG Project Manager 5.4.1 Evaluate the LOI and the technical proposal together with PO, as to applicability, relevance to BIR operations and completeness of documentation. If found favorable, recommend its acceptance. 5.4.2 Monitor system development and prepare progress status report. 5.4.3 Conduct UAT with functional users following acceptance testing procedures per RMO No. 24-2003 and, if the application has passed UAT, issue Ready for Use Memorandum. 5.4.4 Provide copy of final project documentations to the ISG Technical Library within one (1) month after completion of the engagement for future reference. 5.4.5 Prepare and submit approved Project Closure Report to ISG Technical Library. 5.5 DPA Privacy Impact Assessment Team 5.5.1 Conduct a PIA using the attached template (attached as Annex "E" hereof) for programs, systems and processes. 5.5.2 Submit the PIA report to Process Owner. 5.6 Legal Service 5.6.1 Review the MOA (please refer to Annex "A" hereof) or the MOU (please refer to Annex "B" hereof) and the Deed of Donation (DOD) pursuant to RMO No. 15-2020. 5.6.2 If there are review notes and observations thereon, return the MOA or the MOU and the DOD to the concerned office/Process Owner for compliance therewith. 5.6.3 If the terms and conditions of the MOA/MOU and DOD are legally proper and in order, recommend approval of the MOA/MOU and acceptance of the DOD, and forward the same to concerned office/Process Owner. 5.7 Administrative Service 5.7.1 Review and recommend the approval and signing of the DOD pursuant to RMO No. 15-2020. 5.8 Deputy Commissioner (DCIR) Information Systems Group (ISG) 5.8.1 Sign and approve DOD for IT-related system/solution with cost value of P12 million and below. Affix initial if the value is above P12 million. 5.9 Office of the Commissioner 5.9.1 Sign and approve DOD for IT-related system/solution with cost value above P12 million. 5.10 Property Division 5.10.1 Receive the original copy of Certificate/Proof of Ownership of donated ICT systems/solution. 5.10.2 Receive the authenticated copy of duly notarized Deed of Donation. 5.10.3 Receive the authenticated copy of Delivery Receipt or the List of Deliverables. 5.11 Accounting Division 5.11.1 Receive the authenticated copy of duly notarized Deed of Donation. 5.11.2 Record the cost of donated assets/application system/solution. The cost to be capitalized is its fair value or declared value as stated in the Deed of Donation or in any other relevant documents submitted by the Donor, including any directly attributable costs. VI. REPEALING CLAUSE This Order supersedes all issuances or portions thereof inconsistent herewith. VII. EFFECTIVITY This Order shall take effect immediately. HEITAD (SGD.) LILIA CATRIS GUILLERMO Commissioner of Internal Revenue ANNEX A Memorandum of Agreement ANNEX B Memorandum of Understanding ANNEX C Non-Disclosure Agreement n ANNEX D Acceptable Use Policy ANNEX E Privacy Impact Assessment Template ANNEX F Sample Endorsement Memo n Note from the Publisher: Copied verbatim from the official document.