Prescribes the Policies, Guidelines and Procedures on Enterprise Risk Management (ERM) in the Bureau of Internal Revenue (BIR)

March 20, 2023 REVENUE MEMORANDUM ORDER NO. 9-2023 SUBJECT : Prescribes the Policies, Guidelines and Procedures on Enterprise Risk Management (ERM) in the Bureau of Internal Revenue (BIR) TO : All Internal Revenue Officials and Employees I. BACKGROUND AND RATIONALE The establishment of a customized Enterprise Risk Management (ERM) Framework and Process was identified as a major program under the Strategic Objective "Strengthen Good Governance" of the BIR Strategic Plan of 2019-2023 and is included as one of the projects under the Enhancing Policies, Governance and Standards Pillar in the BIR Digital Transformation (DX) Program per Revenue Memorandum Order (RMO) No. 42-2022 dated September 23, 2022. Pursuant to the Rationalization Plan under E.O. No. 366 and Revenue Administrative Order (RAO) No. 2-2014 dated August 7, 2014 as amended by RAO No. 2-2018 dated July 6, 2018, the Management Division under the Planning and Management Service (PMS) is tasked to coordinate all the Risk Management (RM) efforts of the BIR. Consequently, the PMS thru the Management Division has been mandated to work on the establishment of the ERM Framework, Structure and Process in the BIR and oversee the implementation thereof. As such, this issuance shall introduce the end-to-end BIR ERM process which adopts a Risk Management Framework, Structure and Process compliant with ISO 31000:2018. This standard process of managing risks shall, likewise, be used across all offices of the Bureau. II. OBJECTIVES: This Order is issued to: 1. Establish the BIR's ERM Framework, Structure and Process; 2. Provide policies, and prescribe the guidelines and procedures on ERM to be observed by BIR offices nationwide; 3. Define the roles and responsibilities of offices, personnel and other concerned stakeholders involved in the management of risks by BIR offices; 4. Identify the Bureau's Enterprise Risks and develop the corresponding mitigation strategies to address/manage these risks; and 5. Prescribe the use of BIR Risk Information Sheet (BRisk InfoSheet) and the RM/ERM Manual, respectively. III. DEFINITION OF TERMS The following terms that appear in this order shall be defined as follows: 1. BIR Risk Information Sheet (BRisk InfoSheet) is a web-based tool that can be accessed and used by concerned BIR offices in the management and assessment of risks. It contains information, templates and references that pertain to risk and corresponding mitigation strategies. 2. Communication and Consultation The two-way process that involves the organization and its stakeholders sharing and receiving information about the management of risk. Discussions could be about risks, their nature, form, likelihood and significance, as well as whether or not risks are acceptable or should be treated, and what treatment options should be considered. 3. Consequence the outcome of an event affecting objectives. A single event can generate a range of consequences that can have both positive and negative effects on objectives. Initial consequences can also escalate through cascading and cumulative effects. 4. Context established by defining the external parameters ( i.e. , external stakeholders, its local, national and international environment, as well as any external factors that influence its objectives) and internal parameters ( i.e. , internal stakeholders, its approach to governance, its contractual relationships and its capabilities, culture and standards) that the organization must consider when they manage risk. 5. Control any measure or action that modifies or regulates risks. Controls include any policy, procedure, practice, process, technology, technique, method or device that modifies or regulates risk. Risk treatments become controls, or modify existing controls, once they are implemented. 6. Critical an activity relating to providing services in which disruption may have significant impact or influence on schedule, cost, safety, quality, environment and operating performance. 7. Enterprise Risk Management (ERM) a broader view and holistic approach to Risk Management, this is a plan-based strategy, method and process that can be used in identifying, assessing and mitigating the risks that may interfere and have adverse effects on an organization's operations and objectives; the term also refers to coordinated activities to direct and control an organization with regard to risk. 8. Event could be one occurrence, several occurrences, or even no-occurrence (when something doesn't actually happen that should have happened). It can also be a change in circumstances. Events always have causes and usually have consequences. Events without consequences are referred to as near-misses, near-hits, close-calls or incidents. 9. eRisk Register a web-based Risk Register wherein the organization records information about its identified risks. 10. Exposure the extent/level which an organization and/or a stakeholder is subject to an event. 11. Impact the severity of the most likely consequence of a particular risk occurrence; the impact or effect of the risk. 12. Likelihood the chance that something might happen. Likelihood can be defined, determined or measured objectively or subjectively and can be expressed either qualitatively or quantitatively (using mathematics). 13. Risk is the effect of uncertainty on objectives. Inherent Risk an assessed level of raw or untreated risk; that is, the natural level of risk inherent in a process or activity without doing anything to reduce the likelihood or mitigate the severity of a mishap, or the amount of risk before the application of the risk reduction effects of controls. Residual Risk the risk remaining after the risk is reduced, removed the source of the risk, modified the consequences, changed the probabilities, transferred the risk, or retained the risk, or the amount of risk that remains after additional controls are applied. 14. Risk Analysis the process that is used to understand the nature, sources and causes of the identified risks and to estimate the level of risk. It is also used to study impacts and consequences and to examine the controls that currently exist. 15. Risk Appetite the nature and exposure (extent/level of risks) the organization is willing to take and manage in pursuit of its strategic objectives. 16. Risk Assessment the overall process of risk identification, risk analysis and risk evaluation. 17. Risk Evaluation the process that is used to compare risk analysis results with risk criteria in order to determine whether or not a specified level of risk is acceptable or tolerable. 18. Risk Identification the process that involves finding, recognizing and describing the risks that could influence the achievement of objectives. It also includes the identification of possible causes and potential consequences. 19. Risk Management (RM) the identification, evaluation and prioritization of risks followed by the coordinated and economical application of resources to minimize, monitor and control the probability or impact of unfortunate events, or to maximize the realization of opportunities. 20. Risk Management Framework a set of components that support and sustain risk management throughout an organization. 21. Risk Management Process the systematic application of management policies, procedures and practices to a set of activities intended to establish the context, communicate and consult with stakeholders and identify, analyze, evaluate, treat, monitor, record, report and review risk. 22. Risk Matrix the matrix that is used during the risk assessment to define the level of risk by considering the category of likelihood or probability against the category of the consequence of impact or severity. 23. Risk Level the magnitude ( i.e. , Extreme, High, Medium and Low) of risks based on the combination of its likelihood or probability and impact or severity. The level of risks needs to be defined so that everyone is using the same terminology in the same way. 24. Risk Owner a person or entity that has been given authority to manage a particular risk and is accountable for doing so. 25. Risk Rating the product of the Level of Likelihood and Level of Impact of the risk. 26. Stakeholder a person or organization that can affect, be affected by, or perceive themselves to be affected by, a decision or activity. IV. POLICIES: The following policies shall govern ERM implementation in the Bureau: 1. All risk management activities shall be coordinated with the ERM Coordinator (Management Division) and Chief ERM Officer (ACIR, PMS); 2. Risks of the BIR shall be managed by the officials as identified in the "BIR ERM Organizational Structure" (Annex A). The concerned Deputy Commissioner (DCIR) of each Functional Group shall designate one (1) Assistant Commissioner (ACIR) as the Group's representative in the ERM Committee; 3. The Commissioner of Internal Revenue (CIR) shall designate an official who shall act as Risk Management Sponsor for the Office of the Commissioner (OCIR); 4. Issuance of the BIR Enterprise Risk Appetite Statement, which provides the nature and exposure of the risk that the BIR is willing to take in pursuit of its strategic objectives or goal/target, shall be the responsibility of MANCOM. Likewise, The ACIR/Regional Director (RD)/Revenue Data Center (RDC) Head as Service/Regional/RDC Level Risk Manager shall be responsible for the Risk Appetite Statement of the Service/Revenue Region (RR)/RDC; 5. The conduct of risk assessment and the development of corresponding mitigation strategies shall be done annually, or whenever deemed necessary, in all Services, RRs and RDCs of the BIR which shall be the responsibility of the concerned Service/Regional/RDC Level Risk Manager; 6. The risk assessment and the development of corresponding mitigation strategies shall be initiated by the Head Revenue Executive Assistant/Assistant Regional Director as RM Coordinator of the Service/RR; 7. The RDC Head shall perform dual function as RDC Level Risk Manager and RM Coordinator; 8. All identified risks of Divisions/RDOs/Units shall be consolidated and a shortlist of risks containing the top three (3) priority risks with recommended mitigation strategies of Division/RDO/Units as identified by the risk owners shall be submitted to the Service/Regional/RDC Level Risk Manager for the selection of the top five (5) priority risks. These top five (5) priority risks shall undergo similar process until they reach the RM sponsor for the top five (5) priority risks of the functional group; 9. The Service/Regional/RDC Level Risk Manager, RM Sponsor, ERM Committee and Executive Sponsor may include, as one of their top five (5) priority risks, other risks that must be given serious consideration which are not included in the shortlist of risks; 10. These identified risks and selected top three (3) priority risks, as well as the development and monitoring of the implementation of corresponding mitigation strategies shall be the responsibility of the head of office as Risk Owner while the top five (5) priority risks of the Services, RRs, and RDCs shall be the responsibility of the Service/Regional/RDC Level Risk Managers and for the Functional Group, it shall be the responsibility of the Risk Management Sponsors; 11. The BIR Enterprise Risks shall be announced thru a Memorandum signed by the CIR with the directive for concerned Risk Management Sponsors to develop mitigation strategies to address the Enterprise Risks; 12. The status of implementation of the proposed corresponding mitigation strategies of Enterprise Risks shall be monitored by the ERM Coordinator and Chief ERM Officer, in coordination with the respective Risk Management Sponsors; 13. An electronic BIR Risk Information Sheet (BRisk InfoSheet) shall be used to document all the information about risks and their management. This contains the following worksheet tabs: a. User Guide (Annex B) shows guidelines on how to use and accomplish each worksheet tab in BRisk InfoSheet; b. eRisk Register (Annex C) a tool where all the identified risks and all the relevant information will be recorded; c. Sign-off Sheet (Annexes D-1, D-2 and D-3) a document that shall be accomplished and signed by the Division Chief/Service, Regional and RDC Level Risk Managers/Risk Management Sponsor once the information in their eRisk Registers are final. This will also serve as their submission to their respective head of office; d. Consolidated Risks (Annex E) contains the consolidated risks and all its relevant information of all the offices under the Service/RR/RDC; e. Shortlist of Risks (Annex F) contains the list of risks that have been processed ( i.e. , redundancy) from the "Consolidated Risks" for the selection of Priority Risks of the Service/RR/RDC; f. Likelihood and Impact Table (Annex G) a 5-level grid table template for definition of the Likelihood and Impact Level of risks; g. Links of eRisk Registers (Annex H) contains the links of BRisk InfoSheet of offices under the Service/RR/RDC which can be viewed by their respective Risk Manager; h. Risk ID Guide (Annex I) a guide for offices in assigning Risk ID on their identified risks; and i. References (Annex J) contains list of references that can be used in managing risks namely Risk Matrix, Risk Response Guide, Risk Appetite Statement, Treatment Performance Measure and Risk Determining Criteria; 14. The "eRisk Register" format prescribed in this RMO shall be the standard Risk Register to be used, maintained and updated by the concerned offices in managing and recording pertinent information about their respective risks as indicated below: Risks Risk Owner Top three (3) priority risks and all the identified risks of the office Division Chiefs, Revenue District Officers and Unit Heads Top five (5) priority risks of the Service/RR/RDC ACIRs of Services, Regional Directors and RDC Heads Top five (5) priority risks of the functional group Deputy Commissioners and Designated Official for the OCIR BIR Enterprise Risks MANCOM* * Encoding of BIR Enterprise Risks in the eRisk Register shall be done by ERM Coordinator (Management Division) 15. An RM Manual containing the necessary information on the management of risks in various BIR offices shall be prepared, maintained and regularly updated by the respective Risk Managers for their exclusive use; 16. An ERM Manual containing the necessary information on the management of the Bureau's Enterprise Risks shall be prepared, maintained and regularly updated by the ERM Coordinator. The RM and ERM Manuals shall follow the format presented in the "RM Manual Template" (Annex K); 17. The management of risks in the BIR is adopted from International Organization for Standardization (ISO) 31000:2018 which shall serve as foundation of the BIR ERM, components of which are illustrated in Annex L; and 18. The "Enterprise Risk Management Process Flow" (Annex M) presenting the end-to-end process of managing risks as provided under Section V. GUIDELINES AND PROCEDURES of this RMO shall be adopted throughout the Bureau. V. GUIDELINES AND PROCEDURES A. Risk Assessment and Development of Mitigation Strategies 1. Risk Owners (Division/Revenue District Office/Unit) shall encode in the BRisk InfoSheet following the "User Guide" (Annex B), as follows: 1.1. Identify and encode in the "eRisk Register" (Annex C) the critical/main activities in the following documents: a. BIR Strategic Plan; b. BIR Priority Programs and Projects; c. Major Final Outputs (MFO) in the Office Performance Commitment and Review (OPCR); d. Calendar Year (CY) Operational Key Performance Indicators; and e. Work plans and Targets/Goals. 1.2. Identify the risk(s) for every critical activity using, but not limited to, the following risk-determining criteria that may possibly: a. Cause loss of or damage to assets; b. Taint the integrity of the Office; c. Hamper the concerned offices' ability to smoothly continue its operation; d. Expose the concerned office to lawsuits; and e. Cause injuries or loss of life. 1.3. Identify and encode in the "eRisk Register" the risks using either of the following risk statement formats: a. "if-then" presents the possible risk event or condition ("if") and the potential outcome or consequence/s ("then") Example: o If the current IT systems ( i.e. , eReg) fail to support the need for employees to process Taxpayers' (TPs) Certificate of Registration (COR) during this pandemic, then it might delay the processing and release of COR to TPs resulting to negative customer feedback and complaints. b. "condition-consequence" presents the factual statement of the existing condition (can also be considered as the current issue) which may lead to a possible outcome ("consequence") Example: o The office could not sustain enough workforce with the appropriate competencies for Client Support Section in the Revenue District Office, thus, the work may not be performed adequately by the remaining employees. This will lead to poor performance in their IPCR and that of the office's (OPCR) as a whole, further affecting the employees' morale and quality deliverables; and c. "because-event-consequence" presents the source ("because") of a fact or existing condition, an incident ("event") that may occur, and the resulting negative impact ("consequence") to a program objective Example: o Because of the current pandemic situation, some BIR officials/employees might get infected with COVID-19, and offices may impose lockdown, which may hinder the office from attaining its collection goal. 1.4. Determine and encode in the "eRisk Register" if there is/are existing/available control measure/s being used, or a workaround being applied, to address the identified risk; 1.5. Develop and encode the impact and likelihood definitions in the five (5) level grid "Impact and Likelihood Tables" (Annex G) which shall be used in the analysis and determination of the level of the identified risks. This is done by defining the specific criteria for each level of likelihood of occurrence, the probability of the risk happening and the impact of the effect of the risk on objectives using, but not limited to, the following categories: a. Collection associated with assigned revenue collection goal of the office; b. Operation related to the delivery of the service, business operations, implementation of processes/activities in the office; c. Integrity/Reputation concerned with probity, impartiality, fairness, honesty and truthfulness in all matters affecting the work and status of BIR personnel; 1 pertains to public's perception/impression and opinion on the image of BIR; d. Safety and Health all aspects of health and safety in the workplace for the protection and promotion of BIR employees' welfare; e. Compliance can either be regulatory or administrative which may be covered by relevant regulations by regulatory bodies, and guidelines as well as the actions and programs an organization sets in place to ensure compliance with internal policies, procedures and accepted behavior; 2 f. Legal pertains to legal matters founded on the Constitution and laws. May also include business contracts and agreements, assets and related litigation, matter related to intellectual property rights, patent, copyright, etc.; 3 established by or founded upon law or official or accepted rules; 4 and g. Information Technology computers, storage, networking and other physical devices, infrastructure and processes to create, process, store, secure and exchange all forms of electronic data. 5 1.6. Analyze and rate each risk using the Likelihood and Impact Definitions developed under V.A.1.5. of this RMO. Indicate the appropriate level of likelihood and impact by using the drop down button in the "eRisk Register." The following formula shall be used in computing the risk rating: Risk Rating = Likelihood Level X Impact Level 1.7. Prepare and encode in the "eRisk Register" the necessary risk treatment to be implemented in addressing the identified risks in line with the applicable mitigation strategy; identify the responsible office/personnel who shall plan, implement, monitor and report on the treatment of the identified risks and set the target date of completion; 1.8. Determine and encode in the "eRisk Register" the dependency in implementing the mitigation strategy to address the identified risks; 1.9. Determine and encode in the "eRisk Register" the method for monitoring and reviewing of the implementation of the mitigation strategy; update status of the implementation with date when it was updated and the opportunity the office may gain in addressing the risk; 1.10. Re-analyze the level of Likelihood and Impact of the risks after the implementation of mitigation strategy and reflect in the "eRisk Register" the risk score after treatment; 1.11. Compare the result of risk analysis under V.A.1.6. and V.A.1.10 of this RMO to determine the effectiveness of the implemented mitigation strategies. The Treatment Performance Measure which will be automatically reflected in the "eRisk Register" can be derived as follows: Residual Risk < Inherent Risk Effective Residual Risk = Inherent Risk Not Effective Residual Risk > Inherent Risk Generate New Risk If the Residual Risk is less than the Inherent Risk, then the implemented mitigation strategy is effective. The office may continue to implement the mitigation strategy. If the Residual Risk is the same or equal the Inherent Risk, then the implemented mitigation strategy is not effective. The office shall review and improve the mitigation strategies to fully address the risk. If the Residual Risk is greater than the Inherent Risk, then it may generate new risk. The office shall review and develop a much appropriate mitigation strategy to address the risk. 1.12. Accomplish the "Sign-off Sheet" (Annex D-1) once the Risk Assessment is completed and corresponding mitigation strategies are finalized. Email the Chief ERM Officer copy furnished ERM Coordinator informing them that the "eRisk Register" of the office is final. 2. RM Coordinator (Head Revenue Executive Assistant (HREA)/Assistant Regional Director (ARD)/RDC Head) shall: 2.1. Initiate the annual conduct of Risk Assessment and Development of Mitigation Strategies in the Service/RR/RDC, including all offices under its jurisdiction, in coordination with Chief ERM Officer and ERM Coordinator; 2.2. Review/evaluate the "eRisk Registers" of the Divisions/RDOs/Units under the Service/RR/RDC which can be accessed in the "Links of eRisk Registers" (Annex H); 2.3. Consolidate and encode in the "Consolidated Risks" (Annex E) all the identified risks with corresponding mitigation strategies of the offices under the Service/RR/RDC; 2.4. Process the consolidated risks of the offices under the Service/RR/RDC to come up with the "Shortlist of Risks" (Annex F). Indicate name of RM Coordinator and date submitted in "Shortlist of Risks"; 2.5. Indicate the selected top five (5) priority risks of the Service/RR/RDC, including all relevant information, in the "eRisk Register" for Service/RR/RDC; 2.6. Indicate the recommended additional mitigation strategies for the top five (5) priority risks submitted by the offices under the Service/RR/RDC to assist the Risk Owner; and 2.7. Indicate the status of implementation of the mitigation strategies as reported by Divisions/RDOs/Units concerned. 3. Risk Manager, Service/Regional/RDC Level (ACIR/RD/RDC Head) shall: 3.1. Issue the Risk Appetite Statement (written in "References," Annex J) of the Service/RR/RDC to serve as a guardrail that sets the limit and commitment on the level of exposure to a particular risk that the Service/RR/RDC, and all the offices under its jurisdiction, can tolerate. The Risk Appetite Statement can be a set of qualitative or quantitative statements; 3.2. Review and evaluate the "Shortlist of Risks" (Annex F) of the Divisions/RDOs/Units and Risks that must be given serious consideration may be added aside from those in the "Shortlist of Risks"; 3.3. Select and encode in the eRisk Register of the Service/RR/RDC the top five (5) priority risks of the Service/RR/RDC; 3.4. Issue a memorandum to the offices under the Service/RR/RDC, requiring the submission of proposed additional mitigation strategies for the selected top priority risks of the Service/RR/RDC, to assist the Risk Owner; 3.5. Encode in the "eRisk Register" of the Service/RR/RDC additional recommended mitigation strategies; 3.6. Accomplish the "Sign-off Sheet" (Annex D-2) once the top five (5) priority risks are finalized. Email the Chief ERM Officer copy furnished ERM Coordinator informing them that the "eRisk Register" of the office is final; and 3.7. Monitor the status of implementation of mitigation strategies and submit a status report to the Risk Management Sponsor having jurisdiction over the Service/RR/RDC by reflecting in the "Status and Date" Column of the "eRisk Register" for the Service/RR/RDC. 4. Risk Management Sponsor (Deputy Commissioner of the Functional Group and Designated Official for the OCIR) shall: 4.1. Review and evaluate the "Shortlist of Risks" (Annex F) of the Services/Regions/RDCs and select the top five (5) priority risks of the Functional Group/OCIR. Risks that must be given serious consideration may be added aside from those in the "Shortlist of Risks"; 4.2. Encode the top five (5) priority risks in the "eRisk Register" of the Functional Group/OCIR; 4.3. Accomplish the "Sign-off Sheet" (Annex D-3) once the top five (5) priority risks are finalized. Email the Chief ERM Officer, copy furnished the ERM Coordinator, informing them that the "eRisk Register" of the office is final. B. Selection of Enterprise Risks and Development of Additional Mitigation Strategies 1. ERM Coordinator (Management Division) shall: 1.1. Access, consolidate and process the top five (5) priority risks and mitigation strategies in the "eRisk Registers" of the Services/RRs/RDCs and of the Functional Groups and submit to the ERM Committee; 1.2. Organize ERM Committee cross-functional meetings, as needed, and perform administrative/secretariat functions during the execution of ERM-related activities; 1.3. Prepare a Memorandum for signature of the Commissioner, announcing the approved Enterprise Risks and those requiring Bureau offices to submit proposed additional mitigation strategies, if any, on the approved Enterprise Risks; 1.4. Encode the ten (10) Enterprise Risks approved by the ERM Executive Sponsor in the "eRisk Register" for BIR; and 1.5. Consolidate the submitted mitigation strategies for Enterprise Risks from concerned offices and encode these in the "eRisk Register" for BIR. 2. Risk Manager, Service/Regional/RDC Level (ACIR/RR/RDC Head) shall: 2.1. Issue a Memorandum to the offices under the Service/RR/RDC, requiring the submission of proposed additional mitigation strategies for the Enterprise Risks of BIR; 2.2. Review, evaluate and approve the additional mitigation strategies for Enterprise Risks of BIR submitted by the offices under their jurisdiction; and 2.3. Submit to the concerned Risk Management Sponsor the additional mitigation strategies for the Enterprise Risks. 3. ERM Committee (ACIR, Planning and Management Service/Chief ERM Officer and representative ACIRs from each of the Functional Groups) shall: 3.1. Convene cross-functional meetings to discuss dependencies and action points on the risks raised by Risk Owners; 3.2. Review and evaluate, in collaboration with the members of the ERM Committee, the lists of top five (5) priority risks from the Functional Groups; 3.3. Recommend and endorse to Executive Sponsor the ten (10) Enterprise Risks selected by the ERM Committee; 3.4. Access and review/evaluate, in collaboration with the ERM Committee, the recommended mitigation strategies from the Functional Groups; and 3.5. Endorse to Executive Sponsor the additional mitigation strategies for review and approval. 4. Executive Sponsor (MANCOM) shall: 4.1. Review and evaluate the top ten (10) Enterprise Risks recommended and endorsed by the ERM Committee; 4.2. Approve the final list of the Enterprise Risks to be encoded in the "eRisk Register" for BIR Enterprise Risks and issue memorandum announcing the same; 4.3. Review and evaluate the recommended mitigation strategies to address the Enterprise Risks endorsed by the ERM Committee; 4.4. Select which among the proposed/recommended mitigation strategies shall be implemented to address the approved Enterprise Risks; 4.5. Approve the Memorandum to be issued by the Commissioner relative to the announcement of BIR Enterprise Risks with the corresponding mitigation strategies to be implemented; and 4.6. Provide policy directions and/or suggestions on the ERM implementation and final "eRisk Register" for BIR Enterprise Risks, if necessary. VI. REPORTORIAL REQUIREMENTS The Summary of Reports to be prepared for RM/ERM shall be as follows: Report Submitted By Submitted To Due Date Status Report on Implemented Mitigation Strategies for identified risks Divisions/RDOs/ Units ACIR/RD/RDC Heads concerned Copy furnished MD through PMS 5th day of the month after the end of each quarter Status Report on Implemented Mitigation Strategies for approved Enterprise Risks ACIRs/RDs/RDC Heads DCIR concerned Copy furnished MD through PMS 10th day of the month after the end of each quarter Evaluation on the Effectiveness of Implemented Mitigation Strategies for approved Enterprise Risks Management Division CIR/ACIR, PMS 15th day of the month after the end of each semester/and calendar year Status Reports shall be reflected in the eRisk Register by the concerned head of office. VII. TRANSITORY PROVISION ISO Certified Regional Offices, currently undergoing their surveillance audit may still use the existing format of their Risk Register per Memorandum of the Commissioner dated April 6, 2018 re: Quality Management Manual Version 2018 until they get their ISO Re-certification. However, they are required to use the new Risk Register format prescribed under this RMO immediately after their re-certification. Thus, all information in their existing Risk Register shall be transferred to the new Risk Register to standardize the format across all Bureau offices. VIII. REPEALING CLAUSE All revenue issuances or portions thereof which are inconsistent herewith are hereby amended, modified or revoked accordingly. IX. EFFECTIVITY This Order takes effect immediately. (SGD.) ROMEO D. LUMAGUI, JR. Commissioner of Internal Revenue ANNEX A BIR Enterprise Risk Management Organizational Structure ANNEX B User Guide How to Fill-out eRisk Register? The eRisk Register is a record of information about the identified risks, such as its nature, level, the person responsible, the results of Risk Analysis, and the Risk Treatment, among others. Although no one can anticipate when a risk will happen, a Risk Register is necessary to respond quickly before risks become real problems and affect BIR. This is also important for stakeholders to know the status of the identified risks in relation to the risk treatment adopted. In filling out the columns in the eRisk Register, Risk owners shall observe the following guidelines: RISK ID Indicate the Service or Revenue Region Number, then the Division/RDO number followed by the Section and a four-digit number which starts with 0001. Each identified risk shall be assigned this unique alphanumeric number. DATE IDENTIFIED Indicate the date when the risk is identified. Usually, it is when the risk assessment was conducted. ACTIVITY PROCESS Indicate the brief description of the offices identified critical/main activity process based on the following documents: a. BIR Strategic Plan b. BIR Priority Programs and Projects c. Major Final Outputs (MFO) in the OPCR d. CY Operational Key Performance Indicators; and e. Statement of Functions in the RAO f. Work plans and Targets/Goals EVENT Indicate the trigger which is the uncertainty that if it occurs may adversely affect the achievement of the objective of the corresponding activity process. An event can have one or more occurrences, and can have several causes and several consequences. It can also be something that is expected which does not happen, or something that is not expected which does happen. Identify the risk of every critical activity and list it in the Risk Register using the following risk-determining criteria: a. May possibly cause loss or damage to assets; b. May possibly taint the integrity of the Office; c. May possibly hamper the concerned office's ability to smoothly continue its operation; d. May possibly expose the concerned office to lawsuits; and e. May possibly cause injuries or loss of life. CAUSE Specify the source, reason or condition for the identified event to happen. This answers why something could go wrong. It is here that we consider what needs to be done to prevent it. CONSEQUENCE What is the outcome of an event affecting objectives? This can be certain or uncertain and can have positive or negative direct or indirect effects on objectives. It can be expressed qualitatively or quantitatively. EXISTING CONTROLS IN PLACE Determine if there is an existing control measure. Indicate or enumerate control measures being used/applied or the workaround. (If none, the risk is considered as an inherent risk. However, if there are control measures applied, the risk is considered as residual risk.) LEVEL OF LIKELIHOOD Indicate the risk level corresponding to the description of the probability of the identified risk occurrence before implementing any controls or mitigation in the created Likelihood Definition Table. This can be done by assessing the probability and defining the likelihood of the occurrence (number of possible incidences) and the probability (using percentage) of the risk happening. LEVEL OF IMPACT Indicate the risk level corresponding to the description of anticipated adverse effect on the objective in the created Impact Definition Table. This can be done by assessing the specific criteria for each level of the impact or severity of the effect of the risk on objectives using, but not limited to, the following risk categories: a. Collection; b. Operation; c. Integrity/Reputation; d. Safety and Health; e. Compliance; f. Legal; and g. Information Technology. RISK RATING Indicate the product the level of impact and the level of likelihood. Computed using the following formula: Risk Rating = Level of likelihood X Level of Impact MITIGATION STRATEGY Indicate the specific plan of action/s to address the identified risk. RESPONSIBLE OFFICE/PERSONNEL Indicate the "Risk Owner." The person/office assumes the accountability and authority to manage a risk. Specify the duration of the risk treatment in the "Expected Completion Date." EXPECTED COMPLETION DATE Indicate the expected date of completion when the mitigation strategy shall be completed. DEPENDENCY Indicate the other office/s where the processes/activities are dependent on or connected to. Also, indicate/explain the dependencies (action to needed from dependency office) in mitigating the risk and inform these offices to include in their respective Risk Register/s the processes/activities which are interrelated to their own processes/activities. Indicate "None" if there are no dependencies. RISK MONITORING REVIEW Identify the method of Risk Monitoring and Review, the status of each risk and the notes/comments or opportunity which could be adapted to ensure the success of the risk treatment. " Method " Provide the methods for monitoring the implementation of risk treatment. ( i.e. , Monthly, Quarterly, Semi-Annually or Annually). " Status " Indicate the updates on the status of implementation of risk treatment. " Opportunity " Indicate the possible result when the risk is addressed. RISK SCORE AFTER TREATMENT These columns shall be filled-out only after the implementation of Mitigation Strategy. The level of remaining risk after implementing the risk treatment is assessed and by the new level of impact is multiplied by level of likelihood using Impact Definition Table and Likelihood Definition Tables. The effectiveness, adequacy or reasonability of the treatment implemented must be considered as well. TREATMENT PERFORMANCE MEASURE Automatically reflects if the risk treatment is effective, ineffective or no effect. a. Effective: Difference between Risk Level after treatment and the initial Risk Level is positive. b. Ineffective: Difference between Risk Level after treatment and the initial Risk Level is negative. c. No Effect: Risk Level after treatment and initial Risk Level is the same. Worksheet Tabs A. BRisk InfoSheet for Divisions, RDOs and Units 1. Sign off Sheet Indicate the names of the identified Risk owner, who prepared the Risk Register and approving official of the Risk Register which shall be electronically signed and submitted thru SharePoint to the office concerned, copy furnished Management Division thru Planning and Management Service. 2. Likelihood and Impact Definition Tables Indicate the description of each level of the likelihood/probability of the risk to happen and the impact/severity of the effect on objectives once the risk has occurred. Prepared as per items 8 and 9 of this Risk Register Fill-out Guide and used in the analysis and computation of the Risk Rating. 3. Risk ID Guide The Risk ID Guide shows the acronyms of the offices that will be used to indicate the Service, Revenue Region Number or RDC, then the Division/RDO number/Unit followed by the Section and a digit number. 4. References Reflect the Service/Regional Risk Appetite; Treatment Performance Measure and Risk Determining Criteria which shall serve as a reference in filling out the Risk Register. The Risk Matrix shows the matrix that is used during the risk assessment to define the level of risk by considering the category of likelihood or probability against the category of the consequence of impact or severity. The Risk Response Guide shows possible actions and/or considerations that the risk owners must take in developing the corresponding mitigation strategies per risk category. B. BRisk InfoSheet for Services, Regions and RDCs 1. Sign off Sheet Indicate the names of the identified Risk owner, who prepared the Risk Register and approving official of the Risk Register which shall be electronically signed and submitted thru SharePoint to the office concerned copy furnished Management Division thru Planning and Management Service. 2. Consolidated Risks Reflect the risks of all the Divisions/RDOs/Units under the jurisdiction of the Service/RR/RDC. 3. Shortlist of Risk Reflect list of risks that have been processed ( i.e. , redundancy) from the "Consolidated Risks" for the selection of Priority Risks of the Service/RR/RDC. 4. Links of eRisk Register Contains the links of BRisk InfoSheet of Divisions/RDOs/Units which can be viewed by their respective Risk Manager, RM Coordinator and RM Champion. 5. Risk ID Guide The Risk ID Guide shows the acronyms of the offices that will be used to indicate the Service, Revenue Region Number or RDC, then the Division/RDO number/Unit followed by the Section and a digit number. 6. References Reflect the Service/Regional Risk Appetite; Treatment Performance Measure and Risk Determining Criteria which shall serve as a reference in filling out the Risk Register. The Risk Matrix shows the matrix that is used during the risk assessment to define the level of risk by considering the category of likelihood or probability against the category of the consequence of impact or severity. The Risk Response Guide shows possible actions and/or considerations that the risk owners must take in developing the corresponding mitigation strategies per risk category. Need help? Contact Us: Email us at [emailprotected] or Call us at (02) 8926-76-56 ANNEX C eRisk Register ANNEX D-1 Sign-off Sheet ANNEX D-2 Sign-off Sheet ANNEX D-3 Sign-off Sheet ANNEX E Consolidated Risks ANNEX F Shortlist of Risks ANNEX G Likelihood and Impact Definition Table ANNEX H Links of eRisk Registers ANNEX I Risk ID Guide ANNEX J References ANNEX K Risk Management/Enterprise Risk Management Manual ANNEX L BIR Enterprise Risk Management Structure ANNEX M Enterprise Risk Management Process Flow Footnotes 1. Key Issues, United Nations Office on Drugs and Crime , https://www.unodc.org/e4j/en/integrity-ethics/module-13/key-issues.html (Accessed on October 16, 2022). 2. 'What is Compliance: Everything you need to know,' PowerDMS by NEOGOV , https://www.powerdms.com/policy-learning-center/what-is-compliance-everything-you-need-to-know (Accessed on October 16, 2022). 3. Barad, S.B., 'Legal Risks,' Finance Management , https://efinancemanagement.com/investment-decisions/legal-risks (Accessed on October 16, 2022). 4. 'Legal,' Vocabulary.com , https://www.vocabulary.com/dictionary/legal (Accessed on October 16, 2022). 5. 'Information Technology,' TechTarget SerachDataCenter , https://www.techtarget.com/searchdatacenter/definition/IT (Accessed on October 16, 2022).