RMO No. 9-2023 — Prescribes the policies, guidelines and procedures on Enterprise Risk Management (ERM) in the BIR Digest | Full Text | Annex A | Annex B | Annex C | Annex D1 to D3 | Annex E | Annex F | Annex G | Annex H | Annex I | Annex J | Annex K | Annex L | Annex M

BUREAU OF INTERNAL REVENUE REPUBLIC OF THE PHILIPPINES DEPARTMENT OF FINANCE National Office Building Quezon City BUREAU OF INTERNAL REVENUE" IRECORDS MGT. DIVISION N aTeTYYN T2: 30 p.m MAR 2 0 2023 V Met U

March 20, 2023

REVENUE MEMORANDUM ORDER NO.9-2023

SUBJECT Prescribes the Policies, Guidelines and Procedures on Enterprise Risk Management

(ERM) in the Bureau of Internal Revenue (BIR)

TO All internal Revenue Officials and Employees

1. BACKGROUND AND RATIONALE

Process was identified as a major program under the Strategic Objective "Strengthen Good Program per Revenue Memorandum Order (RMO) No. 42-2022 dated September 23, 2022 Governance" of the BIR Strategic Plan of 2019-2023 and is included as one of the projects under the Enhancing Policies, Governance and Standards Pillar in the BIR Digital Transformation (DX) The establishment of a customized Enterprise Risk Management (ERM) Framework and

Process in the BiR and oversee the implementation thereof. Management Division under the Planning and Management Service (PMS) is tasked to coordinate all the Risk Management (RM) efforts of the BIR. Consequently, the PMS thru the Management Division has been mandated to work on the establishment of the ERM Framework, Structure and (RAO) No. 2-2014 dated August 7, 2014 as amended by RAO No. 2-2018 dated July 6, 2018, the Pursuant to the Rationalization Plan under E.0. No. 366 and Revenue Administrative Order

Management Framework, Structure and Process compliant with IS0 31000:2018. This standard process of managing risks shall, likewise, be used across all offices of the Bureau. As such, this issuance shall introduce the end-to-end BIR ERM process which adopts a Risk

H. OBJECTIVES:

This Order is issued to:

1 Establish the BIR's ERM Framework, Structure and Process; 2 Provide policies, and prescribe the guidelines and procedures on ERM to be observed by BIR

offices nationwide: 3 Define the roles and responsibilities of offices, personnel and other concerned stakeholders

involved in the management of risks by BiR offices; A Identify the Bureau's Enterprise Risks and develop the corresponding mitigation strategies to

5 Prescribe the use of BIR Risk Information Sheet (BRisk InfoSheet) and the RM/ERM Manual, address/manage these risks; and

respectively.

1

IUI. DEFINITION OF TERMS

The following terms that appear in this Order shall be defined as follows:

1. BiR Risk Information Sheet (BRisk InfoSheet) -- is a web-based tool that can be accessed and

used by concerned BIR offices in the management and assessment of risks. It contains information, templates and references that pertain to risk and corresponding mitigation strategies.

2 Communication and Consultation -- The two-way process that involves the organization and

its stakeholders sharing and receiving information about the management of risk. Discussions could be about risks, their nature, form, likelihood and significance, as well as whether or not risks are acceptable or shouid be treated, and what treatment options should be considered.

3. Consequence -- the outcome of an event affecting objectives. A single event can generate a range of consequences that can have both positive and negative effects on objectives. Initiai

consequences can also escalate through cascading and cumulative effects.

4. Context --established by defining the external parameters (i.e., external stakeholders, its local) national and international environment, as well as any external factors that influence its objectives) and internal parameters (i.e., internal stakeholders, its approach to governance,

must consider when they manage risk. its contractual relationships and its capabilities, culture and standards) that the organization

5. Control -- any measure or action that modifies or regulates risks. Controls include any policy, procedure, practice, process, technology, technique, method or device that modifies or regulates risk. Risk treatments become controls, or modify existing controls, once they are

implemented.

6. Critical -- an activity reiating to providing services in which disruption may have significant

impact or influence on schedule, cost, safety, quality, environment and operating performance.

7. Enterprise Risk Management (ERM) -- a broader view and holistic approach to Risk Management, this is a plan-based strategy, method and process that can be used in

direct and control an organization with regard to risk. identifying, assessing and mitigating the risks that may interfere and have adverse effects on an organization's operations and objectives; the term also refers to coordinated activities to

8. Event -- could be one occurrence, several occurrences, or even no-occurrence (when

something doesn't actually happen that should have happened). It can also be a change in circumstances. Events always have causes and usually have consequences. Events without consequences are referred to as near-misses, near-hits, close-calls or incidents.

9.eRisk Register a web-based Risk Register wherein the organization records information

about its identified risks.

Source: IS0 31000:2018 Plain English Definitions, Praxiom, https://www.praxiom.com/iso-310 77

2 BUREAU OF INTERNAL REVENUE AKTR 1a:30 p.m MAR 2 0 2023

RECORDS MGT. DIVIS(ON MuaO

10. Exposure -- the extent/level which an organization and/or a stakeholder is subject to an event.

11. Impact --the severity of the most likely consequence of a particular risk occurrence; the impact or effect of the risk.

12. Likelihood -- the chance that something might happen. Likelihood can be defined, determined or measured objectively or subjectively and can be expressed either qualitatively or quantitatively (using mathematics).

13. Risk - is the effect of uncertainty on objectives.

Inherent Risk -- an assessed level of raw or untreated risk; that is, the natural level of risk

the severity of a mishap, or the amount of risk before the application of the risk reduction inherent in a process or activity without doing anything to reduce the likelihood or mitigate

effects of controls

risk, or the amount of risk that remains after additional controls are applied. Residual Risk - the risk remaining after the risk is reduced, removed the source of the risk, modified the consequences, changed the probabilities, transferred the risk, or retained the

14. Risk Analysis - the process that is used to understand the nature, sources and causes of the identified risks and to estimate the level of risk. It is also used to study impacts and consequences and to examine the controls that currently exist.

15. Risk Appetite -- the nature and exposure (extent/level of risks) the organization is willing to take and manage in pursuit of its strategic objectives.

16. Risk Assessment - the overall process of risk identification, risk analysis and risk evaluation.

17. Risk Evaluation -- the process that is used to compare risk analysis results with risk criteria in order to determine whether or not a specified level of risk is acceptable or tolerable.

18. Risk Identification -- the process that involves finding, recognizing and describing the risks that could influence the achievement of objectives. It also includes the identification of possible

causes and potential consequences.

19. Risk Management (RM) - the identification, evaluation and prioritization of risks followed by the coordinated and economical application of resources to minimize, monitor and control the probability or impact of unfortunate events, or to maximize the realization of opportunities.

20. Risk Management Framework -- a set of components that support and sustain risk management throughout an organization.

21. Risk Management Process -- the systematic application of management policies, procedures

and practices to a set of activities intended to establish the context, communicate and consult with stakeholders and identify, analyze, evaluate, treat, monitor, record, report and review risk.

Source: ISO 31000:2018 Plain English Definitions, Praxiom, htt: onMarch 8,2022}

3 BUREAU OF INTERNAL REVENUE RNTTYYN la: 30 p.m MAR 2 0 20Z3

uUJt RECORDS MGT. DIVISION

22. Risk Matrix - the matrix that is used during the risk assessment to define the level of risk by

considering the category of likelihood or probability against the category of the consequence of impact or severity.

23. Risk Level - the magnitude (i.e. Extreme, High, Medium and Low) of risks based on the

combination of its likelihood or probability and impact or severity. The levet of risks needs to be defined so that everyone is using the same terminology in the same way.

24. Risk Owner -- a person or entity that has been given authority to manage a particular risk and

is accountable for doing so.

25. Risk Rating -- the product of the Level of Likelihood and Level of Impact of the risk.

26. Stakeholder -- a person or organization that can affect, be affected by, or perceive themselves

to be affected by, a decision or activity.

IV. POLICIES:

The following policies shall govern ERM implementation in the Bureau:

1 All risk management activities shall be coordinated with the ERM Coordinator (Management

Division) and Chief ERM Officer (ACIR, PMS);

2. Risks of the BIR shall be managed by the officials as identified in the "BIR ERM Organizational Structure" (Annex A). The ( concerned Deputy Commissioner (DCIR) of each Functional Group

shall designate one (1) Assistant Commissioner (ACIR) as the Group's representative in the ERM Committee;

3. The Commissioner of Internal Revenue (CIR) shall designate an official who shall act as Risk

Management Sponsor for the Office of the Commissioner (OCIR);

4. Issuance of the BIR Enterprise Risk Appetite Statement, which provides the nature and

exposure of the risk that the BIR is willing to take in pursuit of its strategic objectives or goal/target, shall be the responsibility of MANCOM. Likewise, The ACIR/Regional Director (RD)/ Revenue Data Center (RDC) Head as Service/Regional/RDC Level Risk Manager shall be responsible for the Risk Appetite Statement of the Service/Revenue Region (RR)/RDC;

5. The conduct of risk assessment and the development of corresponding mitigation strategies shall be done annually, or whenever deemed necessary, in all Services, RRs and RDCs of the

BIR which shall be the responsibility of the concerned Service/Regional/RDC Level Risk Manager;

6. The risk assessment and the development of corresponding mitigation strategies shall be initiated by the Head Revenue Executive Assistant/Assistant Regional Director as RM Coordinator of the Service/RR;

7. The RDC Head shall perform dual function as RDC Level Risk Manager and RM Coordinator

BUREAU OF INTERNAL REVENUE nnttyr ia: 30 p.m MAR 2'0 2023

uc RECORDS MGT. DIVISION

8. All identified risks of Divisions/RDOs/Units shall be consolidated and a shortlist of risks

containing the top three (3) priority risks with recommended mitigation strategies of Division/RDO/Units as identified by the risk owners shall be submitted to the Service/Regional/RDC Level Risk Manager for the selection of the top five (5) priority risks. These top five (5) priority risks shall undergo similar process until they reach the RM sponsor for the top five (5) priority risks of the functional group;

9.The Service/Regional/RDC Level Risk Manager, RM Sponsor, ERM Committee and Executive

Sponsor may include, as one of their top five (5) priority risks, other risks that must be given serious consideration which are not included in the shortlist of risks;

10. These identified risks and selected top three (3) priority risks, as well as the development and

monitoring of the implementation of corresponding mitigation strategies shall be the responsibility of the head of office as Risk Owner while the top five (5) priority risks of the Services, RRs, and RDCs shall be the responsibitity of the Service/Regional/RDC Level Riskl Managers and for the Functional Group, it shall be the responsibility of the Risk Management Sponsors;

11. The BiR Enterprise Risks shall be announced thru a Memorandum signed by the CiR with the

directive for concerned Risk Management Sponsors to develop mitigation strategies to address the Enterprise Risks;

12. The status of implementation of the proposed corresponding mitigation strategies of

Enterprise Risks shall be monitored by the ERM Coordinator and Chief ERM Officer, in coordination with the respective Risk Management Sponsors;

13. An electronic BIR Risk Information Sheet (BRisk InfoSheet) shall be used to document all the

information about risks and their management. This contains the following worksheet tabs:

a. User Guide (Annex B) - shows guidelines on how to use and accomplish each worksheet

b. eRisk Register (Annex C) -- a tool where all the identified risks and all the relevant tab in BRisk InfoSheet;

c. Sign-off Sheet (Annex D-1, D-2 and D-3) - a document that shall be accomplished and information will be recorded;

signed by the Division Chief/Service, Regional and RDC Level Risk Managers/Risk Management Sponsor once the information in their eRisk Registers are final. This will also

d. Consolidated Risks (Annex E) -- contains the consolidated risks and all its relevant serve as their submission to their respective head of office;

information of all the offices under the Service/RR/RDC; e. Shortlist of Risks (Annex F) -- contains the list of risks that have been processed (i.e. redundancy) from the "Consolidated Risks" for the selection of Priority Risks of the

f. Likelihood and Impact Table (Annex G) - a 5-level grid tabie template for definition of the Service/RR/RDC;

Likelihood and Impact Level of risks; g. Links of eRisk Registers (Annex H) -- contains the links of BRisk InfoSheet of offices under

the Service/RR/RDC which can be viewed by their respective Risk Manager h. Risk ID Guide (Annex I) - a guide for offices in assigning Risk ID on their identified risks;

i. References (Annex J) - contains list of references that can be used in managing risks and

namely Risk Matrix, Risk Response Guide, Risk Appetite Statement, Treatment Performance Measure and Risk Determining Criteria;

5 BUREAU OF INTERNAL REVENUE NNTYTY (a:30 p.m MAR 2 0 ZU23

RECORDS MGT. DIVISION wJ

14. The "eRisk Register" format prescribed in this RMO shall be the standard Risk Register to be

used, maintained and updated by the concerned offices in managing and recording pertinent information about their respective risks as indicated below:

Risks ... Risk Owner Top three (3) priority risks and all the ) identified risks of the office Division Chiefs, Revenue District Officers and Unit Heads Top five (5) priority risks of the ] 4 Top five (5) priority risks of the functional group Service/RR/RDC BIR Enterprise Risks Deputy Commissioners and Designated Official ACIRs of Services, Regional Directors and RDC for the OCIR MANCOM* Heads

* Encoding of BIR Enterprise Risks in the eRisk Register shail be done by ERM Coordinator

(Management Division)

15. An RM Manual containing the necessary information on the management of risks in various

BiR offices shall be prepared, maintained and regularly updated by the respective Risk Managers for their exclusive use;

16. An ERM Manual containing the necessary information on the management of the Bureau's Enterprise Risks shall be prepared, maintained and regularly updated by the ERM Coordinator The RM and ERM Manuals shall follow the format presented in the "RM Manual Template"

{Annex K};

17. The management of risks in the BIR is adopted from International Organization for

Standardization (IS0) 31000:2018 which shall serve as foundation of the BIR ERM, components of which are illustrated in Annex L; and

18. The "Enterprise Risk Management Process Flow" (Annex M) presenting the end-to-end procesS of managing risks as provided under Section V. GUIDELINES AND PROCEDURES of this

RMO shall be adopted throughout the Bureau.

V. GUIDELINES AND PROCEDURES

A. Risk Assessment and Development of Mitigation Strategies

1. Risk Owners (Division/Revenue District Office/Unit) shall encode in the BRisk InfoSheet

following the "User Guide" (Annex B), as follows:

1.1. Identify and encode in the "eRisk Register" (Annex C) the critical/main activities in the

following documents:

c. Major Final Outputs (MFO) in the Office Performance Commitment and Review a. BIR Strategic Plan; b. BiR Priority Programs and Projects;

d. Calendar Year (CY) Operational Key Performance Indicators; and (OPCR)

e. Work plans and Targets/Goals;

6 BUrEAU OF TN NNhLn MAR 2 0 2023 a:30 p.m k "AL REVENUE

RECORDS MGT. DIVISION CCY

1.2.: Identify the risk(s) for every critical activity using, but not limited to, the following risk-

determining criteria that may possibly:

a. Cause loss of or damage to assets; b. Taint the integrity of the Office; c. Hamper the concerned offices' ability to smoothly continue its operation; d. Expose the concerned office to lawsuits; and e. Cause injuries or loss of life;

1.3. Identify and encode in the "eRisk Register" the risks using either of the following risk

statement formats:

a. "if-then" outcome or consequence/s ("then") presents the possible risk event or condition ("if") and the potential

o If the current IT systems (i.e., eReg) fail to support the need for employees Example:

to process Taxpayers' (TPs) Certificate of Registration (COR) during this pandemic, then it might delay the processing and release of COR to TPs resulting to negative customer feedback and complaints;

b. "condition -- consequence condition (can also be considered as the current issue) which may lead to a possible presents the factual statement of the existing

outcome ("consequence")

o The office could not sustain enough workforce with the appropriate Example:

competencies for Client Support Section in the Revenue District Office, thus, the work may not be performed adequately by the remaining employees. This will lead to poor performance in their IPCR and that of the office's (OPCR) as a whole, further affecting the employees' morale and quality deliverables; and

"because -- event -- consequence" presents the source ("because") of a fact or existing condition, an incident ("event") that may occur, and the resulting negative impact ("consequence") to a program objective

Example: o Because of the current pandemic situation, some BIR officials/ employees

might get infected with Covid-19, and offices may impose lockdown, which may hinder the office from attaining its collection goal.

1.4. Determine and encode in the "eRisk Register" if there is/are existing/available control

measure/s being used, or a workaround being applied, to address the identified risk;

1.5. Develop and encode the impact and fikelihood definitions in the five (5) level grid

"Impact and Likelihood Tables" (Annex G) which shall be used in the analysis and determination of the level of the identified risks. This is done by defining the specific criteria for each level of likelihood of occurrence, the probability of the risk happening and the impact of the effect of the risk on objectives using, but not timited to, the following categories:

BUREAU OF INTERNAL REVENUE

Nnttty

1a: 30 p.m MAR 2'0 2023'

uJuJe RECORDS MGT. DIVISION

a. Collection -- associated with assigned revenue collection goal of the office: b. Operation - related to the delivery of the service, business operations,

implementation of processes/activities in the office: c. Integrity/Reputation --concerned with probity, impartiality, fairness, honesty and

truthfulness in all matters affecting the work and status of BiR personnel?; pertains to public's perception/impression and opinion on the image of BIR; d. Safety and Health -- all aspects of health and safety in the workplace for the

protection and promotion of BIR employees' welfare; e Compliance -- can either be regulatory or administrative which may be covered by.

relevant regulations by regulatory bodies, and guidelines as well as the actions and programs an organization sets in place to ensure compliance with internal policies, procedures and accepted behavior2: f. Legal -- pertains to legal matters founded on the Constitution and laws. May also

include business contracts and agreements, assets and related litigation, matter related to intellectual property rights, patent, copyright, etc.3; established by or

g. Information Technology - computers, storage, networking and other physical exchange all forms of electronic datas. devices, infrastructure and processes to create, process, store, secure and founded upon law or official or accepted rules4; and

1.6. Analyze and rate each risk using the Likelihood and Impact Definitions developed

under V.A.1.5. of this RMO. Indicate the appropriate level of likelihood and impact by using the drop down button in the "eRisk Register". The following formula shall be used in computing the risk rating:

Risk Rating = Likelihood Level X Impact Level

1.7. Prepare and encode in the "eRisk Register" the necessary risk treatment to be implemented in addressing the identified risks in line with the applicable mitigation

strategy; identify the responsible office/personnel who shall plan, implement monitor and report on the treatment of the identified risks and set the target date of completion:

1.8. Determine and encode in.the "eRisk Register" the dependency in implementing the mitigation strategy to address the identified risks;

1.9. Determine and encode in the "eRisk Register" the method for monitoring and

reviewing of the implementation of the mitigation strategy; update status of the implementation with date when it was updated and the opportunity the office may gain in addressing the risk;

1.10. Re-analyze the level of Likelihood and Impact of the risks after the implementation of

mitigation strategy and reflect in the "eRisk Register" the risk score after treatment;

Key Issues, United Nations Office on Drugs and Crime, https://w org/e4/en/integritv-ethics/uod dbnOctoberie 2022 What is Complian ue ed-to-k 2 ithing vot Arc sed on October 16, 2022) erDMS by NEOGOV, https://wv /policy-learning-center/what-is-complianc

5 rInformation Technology, TechTarget SerachDataCenter, https://www.techtarget.com/searchdatacenter/definition/IT (Accessed on October 16, 2022) 3orad, S.B., Legal Risks', Finance Management, https://efinancemanagement.com/investment-deci egal", Vocabu(ary.com, https://www.vocabulary.com/dictionary/legal (Accessed on October 16, 2022) tisions/legal-risks (Accessed on October 16, 2022)

8 [BUREAU OF INTERNAL REVENUE N.ANYTYN ia:30pm MAR 2'0 2023

JJ RECORDS MGT. DIVISION

1.11. Compare the result of risk analysis under V.A.1.6. and V.A.1.10 of this RM0 to

determine the effectiveness of the impiemented mitigation strategies. The Treatment Performance Measure which will be automatically reflected in the "eRisk Register" can be derived as follows:

Residual Risk < Inherent Risk Effective

If the Residual Risk is less than the Inherent Risk, then the implemented mitigation Residual Risk > Inherent Risk Residual Risk = Inherent Risk Generate New Risk Not Effective

strategy is effective. The office may continue to implement the mitigation strategy.

If the Residual Risk is the same or equal the Inherent Risk, then the implemented mitigation strategy is not effective. The office shall review and improve the mitigation strategies to fully address the risk.

The office shall review and develop a much appropriate mitigation strategy to address If the Residual Risk is greater than the inherent Risk, then it may generate new risk.

the risk.

1.12. Accomplish the "Sign-off Sheet" (Annex D-1) once the Risk Assessment is completed

and corresponding mitigation strategies are finalized. Email the Chief ERM Officer copy furnished ERM Coordinator informing them that the "eRisk Register" of the office is final;

2. RM Coordinator (Head Revenue Executive Assistant (HREA)/Assistant Regional Director (ARD)/RDC Head) shall

2.1. Initiate the annual conduct of Risk Assessment and Development of Mitigation

Strategies in the Service/RR/RDC, including all offices under its jurisdiction, in coordinatjon with Chief ERM Officer and ERM Coordinator;

2.2. Review/evaluate the "eRisk Registers" of the Divisions/RDOs/Units under the Service/RR/RDC which can be accessed in the "Links of eRisk Registers" (Annex H);

2.3. Consolidate and encode in the "Consolidated Risks" (Annex E) all the identified risks with corresponding mitigation strategies of the offices under the Service/RR/RDC;

2.4. Process the consolidated risks of the offices under the Service/RR/RDC to come up

with the "Shortlist of Risks" (Annex F). Indicate name of RM Coordinator and date submitted in "Shortlist of Risks";

2.5. Indicate the selected top five (5) priority risks of the Service/RR/RDC, including al relevant information, in the "eRisk Register" for Service/RR/RDC;

2.6. Indicate the recommended additional mitigation strategies for the top five (5) priority

risks submitted by the offices under the Service/RR/RDC to assist the Risk Owner; and

2.7. Indicate the status of implementation of the mitigation strategies as reported by

Divisions/RDOs/Units concerned.

9 BUREAU OF INTERNAL REVENUE CaYY ja:30 pm MAR 2 0 2023l

RECORDS MGT. DIVISION gyGI

3. Risk Manager, Service/Regionai/RDC Level (ACIR/RD/RDC Head) shall:

3.1. tssue the Risk Appetite Statement (written in "References", Annex J) of the

Service/RR/RDC to serve as a guardrail that sets the limit and commitment on the levei of exposure to a particular risk that the Service/RR/RDC, and all the offices under its jurisdiction, can tolerate. The Risk Appetite Statement can be a set of qualitative or quantitative statements;

3.2. Review and evaluate the "Shortlist of Risks" (Annex F) of the Divisions/RDOs/Units and Risks that must be given serious consideration may be added aside from those in the

"Shortlist of Risks";

3.3. Select and encode in the eRisk Register of the Service/RR/RDC the top five (5) priority risks of the Service/RR/RDC.

3.4. Issue a memorandum to the offices under the Service/RR/RDC, requiring the

submission of proposed additional mitigation strategies for the selected top priority risks of the Service/RR/RDC, to assist the Risk Owner;

3.5. Encode in the "eRisk Register" of the Service/RR/RDC additional recommended

mitigation strategies;

3.6. Accomplish the "Sign-off Sheet" (Annex D-2) once the top five (5) priority risks are finalized. Email the Chief ERM Officer copy furnished ERM Coordinator informing them

that the "eRisk Register" of the office is final; and

3.7. Monitor the status of implementation of mitigation strategies and submit a status

report to the Risk Management Sponsor having jurisdiction over the Service/RR/RDC by reflecting in the "Status and Date" Column of the "eRisk Register" for the Service/RR/RDC.

4. Risk Management Sponsor (Deputy Commissioner of the Functional Group and Designated Official for the OCiR) shall:

4.1. Review and evaluate the "Shortlist of Risks" (Annex F) of the Services/Regions/RDCs and select the top five (5) priority risks of the Functional Group/OCIR. Risks that must

be given serious consideration may be added aside from those in the "Shortlist of Risks".

4.2. Encode the top five (5) priority risks in the "eRisk Register" of the Functional

Group/OCIR;

4.3. Accomplish the "Sign-off Sheet" (Annex D-3) once the top five (5) priority risks are them that the "eRisk Register" of the office is final. finalized. Email the Chief ERM Officer, copy furnished the ERM Coordinator, informing

BUREAU OF INTERNAL REVENUE Dntty Ia:30 p.m MAR 2 0 2023 10 RECORDS MGT. DIVISION Uu

B. Selection of Enterprise Risks and Development of Additional Mitigation Strategies

1. ERM Coordinator (Management Division) shall:

1.1. Access, consolidate and process the top five (5) priority risks and mitigation strategies

in the "eRisk Registers" of the Services/RRs/RDCs and of the Functional Groups and submit to the ERM Committee;

1.2. Organize ERM Committee cross-functional meetings, as needed, and perform administrative/secretariat functions during the execution of ERM-related activities;

1.3. Prepare a Memorandum for signature of the Commissioner, announcing the approved

Enterprise Risks and those requiring Bureau offices to submit proposed additiona! mitigation strategies, if any, on the approved Enterprise Risks;

1.4. Encode the ten (10) Enterprise Risks approved by the ERM Executive Sponsor in the "eRisk Register" for BIR; and

1.5. Consolidate the submitted mitigation strategies for Enterprise Risks from concerned offices and encode these in the "eRisk Register" for BIR.

2. Risk Manager, Service/Regionai/RDC Level (ACIR/RR/RDC Head) shail:

2.1. Issue a Memorandum to the offices under the Service/RR/RDC, requiring the

submission of proposed additional mitigation strategies for the Enterprise Risks of BIR;

2.2. Review, evaluate and approve the additional mitigation strategies for Enterprise Risks

of BiR submitted by the offices under their jurisdiction; and

2.3. Submit to the concerned Risk Management Sponsor the additionai mitigation

Strategies for the Enterprise Risks.

3. ERM Committee (ACIR, Planning and Management Service/Chief ERM Officer and representative ACIRs from each of the Functional Groups) shall:

3.1. Convene cross-functional meetings to discuss dependencies and action points on the risks raised by Risk Owners;

3.2. Review and evaluate, in collaboration with the members of the ERM Committee, the lists of top five (5) priority risks from the Functional Groups;

3.3. Recommend and endorse to Executive Sponsor the ten (10) Enterprise Risks selected

by the ERM Committee;

3.4. Access and review/evaiuate, in collaboration with the ERM Committee, the

recommended mitigation strategies from the Functional Groups; and

3.5. Endorse to Executive Sponsor the additional mitigation strategies for review and

approval.

11 BUREAU OF INTERNAL REVENUE NnntTyN a:20P.m.K MAR 2 0 20239

RECORDS MGT.DIVISION jUIVTUI

4. Executive Sponsor (MANCOM) shall:

4.1..Review and evaluate the top ten (10) Enterprise Risks recommended and endorsed by

the ERM Committee;

4.2. Approve the final list of the Enterprise Risks to be encoded in the "eRisk Register" for

BIR Enterprise Risks and issue memorandum announcing the same;

4.3. Review and evaluate the recommended mitigation strategies to address the

Enterprise Risks endorsed by the ERM Committee;

4.4. Select which among the proposed/recommended mitigation strategies shall be

implemented to address the approved Enterprise Risks;

4.5. Approve the Memorandum to be issued by the Commissioner relative to the

announcement of BIR Enterprise Risks with the corresponding mitigation strategies to be implemented; and

4.6. Provide policy directions and/or suggestions on the ERM implementation and final

"eRisk Register" for BIR Enterprise Risks, if necessary.

VI. REPORTORIAL REQUIREMENTS

The Summary of Reports to be prepared for RM/ERM shall be as follows:

Report Submitted By Submitted To Due Date

Status Report on Strategies for identified Implemented Mitigation risks Divisions/RDOs/ Units MD through PMS Heads concerned Copy furnished ACIR/RD/RDC 5th day of the month after the end of each quarter

Risks Enterprise Risks Evaluation on the Effec- Mitigation Strategies for approved Enterprise Status Report on Implemented Mitigation Strategies for approved tiveness of Implemented ACIRs/RDs/RDC Management Division Heads MD through PMS DC!R concerned Copy furnished CIR/ACIR, PMS 10th month after the end of each quarter 15 th month after the end of each semester/ and calendar year day of"the dayof the

Status Reports shall be reflected in the eRisk Register by the concerned head of office.

BUREAU OF INTERNAL REVENUE Y NKT

12 RECORDS MGY.DIVISION ma R:30 0m MAR 2 0 2023

VI. TRANSITORY PROVISION

ISO Certified Regional Offices, currently undergoing their surveillance 'audit may still use the existing format of their Risk Register per Memorandum of the Commissioner dated April 6, 2018 re: Quality Management Manual Version 2018 until they get their IS0 Re-certification However, they are required to use the new Risk Register format prescribed under this RMO immediately after their re-certification. Thus, all information in their existing Risk Register shall be transferred to the new Risk Register to standardize the format across all Bureau offices.

VIII. REPEAUING CLAUSE

All revenue issuances or portions thereof which are inconsistent herewith are hereby amended, modified or revoked accordingly.

IX.EFFECTIVITY

This Order takes effect immediately.

D. LUMAGUI O sioner of Internal Revenue

005036

B-2

BUREAU OF INTERNALREVENUE Ia: 30 pm MAR 2 0 2023 NTYtyN

RECORDS MGT. DIVISION M

13