RMO No. 03-2018 — Prescribes the policies and procedures for the use of Computer-Assisted Audit Tools and Techniques (CAATTs) laboratories, and Key Performance Indicators (KPIs) and reporting requirements for CAATTs usage Digest | Full Text | Annex A-A1 | Annex B | Annex C

REPUBLIC OF THE PHILIPPINES DEPARTMENT OF FINANCE BUREAU OF INTERNAL REVENUE Quezon City January 4, 2018 REVENUE MEMORANDUM ORDER NO. 3-2018 SUBJECT: Prescribing the Use of Computer Assisted Audit Tools and Techniques (CAATTs) Laboratories, Procedures, Key Performance Indicators (KPIs) and Reporting Requirements TO : All Revenue Officials, Employees and Others Concerned I. OBJECTIVES This Revenue Memorandum Order is issued to: 1. Provide policies and procedures for the use of CAATTs Laboratories in the BIR Offices for efficient and expedient process of completing an audit; 2. Enhance audit capabilities and technical skills of tax auditors by providing Revenue Officers (ROs) with minimum standard procedures for data analysis and calculation using CAATTs; 3. Increase revenue collection through proper utilization and analysis of data from internal and external sources; 4. Adopt Key Performance Indicators (KPIs) for CAATTs usage; and 5. Prescribe reporting requirements. II. ORGANIZATION AND FUNCTIONS OF CAATTs LABORATORY A. The CAATTs Laboratories All CAATTs laboratories of the Bureau shall have standard procedures for utilization. Each laboratory shall be housed in a highly secured area where laboratory personnel with authorized access shall be allowed to enter and make use of. A Manager, Assistant Manager, Datamart Administrator, Technical and Administrative Support shall compose the CAATTs Laboratory Team. They are responsible for the management and administration of the laboratory. B. Functions and Responsibilities of the CAATTs Laboratory Team Manager � Large Taxpayers Service (LTS) Officer/Assistant Regional Director (ARD) - Oversee the operation of the CAATTs Laboratory;

- Conduct regular meetings with the other team members for compliance with rules and regulations in the use of the laboratory and for the resolution of issues and problems; - Report to the Assistant Commissioner (ACIR), Assessment Service, for regional office laboratories, accomplishments, issues and problems related to the laboratory and to the ACIR-LTS for the National Office (NO) Laboratory; - Coordinate with the concerned offices for the logistic needs and resolution of issues/problems for the laboratory; - Ensure the adequacy of the administrative requirements for the laboratory. Assistant Manager - Information System Group (ISG) Officer/ Regional Data Center (RDC) Head - Implement the set-up of standardized and prescribed audit software; - Ensure that the ROs who will use the facility are properly trained or coached by CAATTs Experts; - Monitor the maintenance of Information Technology (IT) database, as well as hardware within the laboratory, and ensure that they are always available and accessible to authorized ROs; - Manage the technical and administrative requirements of the CAATTs Laboratory, specifically the maintenance and support of the IT facilities; - Supervise the full time Datamart Administrator; - Monitor and ensure the maintenance of records within the laboratory. Datamart Administrator - Attend training on the use of generalized audit software; - Handle the systems administration requirements of the CAATTs Laboratory; - Maintain data files of taxpayers covered by a special project, or regular audit activity assigned to a particular investigating office; - Manage the movement of data files into their respective sub-file folders and group in taxpayer's folder and finally to the respective CAATTs Laboratory laptop station for data analysis and interrogation; - Upload electronic files obtained from taxpayers with Computerized Accounting Systems (CAS) or components thereof such as general ledger, electronic journals, transaction files and other auditable files to the workstations of the ROs concerned for interrogation upon approval of the request to upload; - Transmit processed files to respective email addresses of ROs; - Ensure that the technical requirements of the CAATTs Laboratory are addressed, including the reporting of technical issues to the RDC Helpdesk; - Manage the activities in the laboratory, such as trainings, coaching, etc.; - Raise to the Assistant Manager issues and problems regarding the use of the laboratory.

Technical Support Staff - Handle the security and network requirements of the CAATTs Laboratory; - Maintain the mandatory user log/work log system (electronic logbook) to record all data analysis/data interrogation conducted at the CAATTs Laboratory; - Elevate to the Administrator the technical requirements of the CAATTs Laboratory; - Resolve/elevate, if necessary, all technical issues encountered in the CAATTs Laboratory. Administrative Support Staff - Maintain manual records of attendance and other administrative files within the laboratory; - Receive and transmit non-electronic documents from and to concerned offices; - Ensure the cleanliness of the laboratory; - Submit required reports to the administrator. III. POLICIES AND GUIDELINES 1. The CAATTs Laboratory will be equipped with a Datamart which shall contain, among others, information electronically submitted by taxpayers as extracted from the BIR Database such as: a. Summary List of Sales (SLS) b. Summary List of Purchases (SLP) c. Summary List of Importations d. Monthly Alpha list of Payees (MAP) e. Summary Alpha list of Withholding Agents of Income Payments Subject to Tax (SAWT) f. Alpha list of Payees subjected to Final Withholding Tax (Reported under BIR Form 2306) g. BIR Forms 1604 CF and 1604 E including schedules h. eSales Report i. TIN Masterfile (of Individual and Non Individual) to be extracted every January and July of the current year with the following details: 1) TIN + Branch Code 2) Individual or Non-Individual Tag 3) Registered Name (i) Individual � Last Name, First Name, Middle Name (ii) Non-Individual � Registered Name, Business Name and Trade Name 4) VAT Registered or Percentage Tax Registered 5) Information as to waiver of exemption (for individual taxpayer) j. All other electronic files maintained by the taxpayers required for submission.

2. Only the lead RO or Group Supervisor (GS) designated on the Electronic Letter of Authority (eLA) can request the above information from the CAATTs Laboratory. 3. The concerned RO or GS shall use the CAATTs Data Request/Action Form (Annex "A") and submit the duly accomplished form for approval to the Manager of the laboratory. For the Revenue District Office (RDO) based CAATTs Laboratory, the Revenue District Officer shall approve the said request. The following should be indicated on the Data Request/Action Form: a. Project name (if applicable); b. Name of taxpayer; c. Details of the eLA issued to the taxpayer; and d. Names of the ROs assigned to the case. 4. Likewise, the RO/GS shall request to upload all other electronic files (transaction files) from the CAS maintained by the taxpayer by proper accomplishment of CAATTs Request to Upload Taxpayer Data Form (Annex "A-1"). 5. All eLAs covering any audit of computerized accounting records or any modules thereof (Payroll Systems, Inventory Systems, Point of Sales (POS), etc.), including those electronic files obtained from Mission Orders (MOs) and Tax Verification Notices (TVNs), should undergo data analysis/data interrogation procedures to be performed in the laboratory. 6. Data analysis/data interrogation should be performed within five (5) working days from the determination/submission of complete data files in the laboratory with the help of the administrator. It is understood that the lead RO and/or GS of the case shall perform the data analysis/data interrogation with the help of the Datamart Administrator. 7. Data analysis/data interrogation results and corresponding tables created shall be submitted/transmitted by the CAATTs Datamart Administrator via BIR electronic mail within ten (10) working days from commencement of data analysis/data interrogation for consolidation with the audit findings derived by the eLA-designated ROs from other audit techniques and methods. All emailed results/files shall be secured with passwords. 8. Result of data analysis/data interrogation obtained and done at the CAATTs Laboratory shall always form part of the audit report of the eLA-designated ROs together with the original routed and signed copy of the Data Request/Action Form. 9. A separate result log of every data analysis/data interrogation (processed files) shall be uploaded to the Datamart Server by the Administrator and shall be emailed as well to the requesting RO, copy furnished the GS. 10. As a security precaution, only one (1) laptop in the CAATTs Laboratory shall be given internet access to download patches while all the laptops shall be networked for monitoring. Download function or authority from the CAATTs Datamart shall be available only to the CAATTs Datamart Administrator and

data extracted from the BIR File Transfer Protocol (FTP) Server shall be "read- only". 11. All data analysis is required to be done only within the CAATTs Laboratory by authorized users. CAATTs laptops with pre-loaded Generalized Audit Software (GAS) and other audit tools are not allowed to be taken outside the CAATTS Laboratory. Likewise, personal or other BIR issued laptops/desktop not assigned at the CAATTs Laboratory shall not be brought inside the CAATTs Laboratory. 12. All electronic files submitted by the taxpayers under audit, as well as all processed files, graphs and tables resulting from data analysis, must be uploaded to the Datamart Server as audit files in separate folders for future reference. The following precautions should be observed: a. Only authorized persons should have access to the audit files. b. Subsequent access to the audit files should be strictly monitored and stiffer penalties should be imposed on unauthorized access (e.g. dismissal from service), as specified in the Revised Code of Conduct. c. The ROs who would like to view the previous audit files of a particular taxpayer under current audit shall seek the approval from the ACIR-LTS/Assistant Regional Director. The scripts developed and utilized in the previous investigations may be used by the current tax auditor. 13. For guidance, Annex "B" attached in this Order shows the entire process flow of data transmission. 14. On-site computer audit of taxpayer's CAS shall be performed by the eLA- designated RO. However, assistance may be sought from the other ROs who are CAATTs experts including the Datamart Administrator, upon written request by eLA-designated ROs through their respective ACIR/Assistant Regional Directors. 15. Result of the on-site computer audit of taxpayer's CAS shall always form part of the audit report of the eLA-designated RO. 16. The RO will only be assigned with the same CAATTs Laboratory computer all throughout his/her stay in the Revenue Region. In case the workstation is not in service, a replacement shall be provided. 17. All ROs are required to have Active Directory Accounts prior to using the CAATTs Laboratory. 18. All ROs who will utilize the CAATTs Laboratory shall be required to register in the electronic logbook prior to using the laboratory. 19. All outputs, working papers, schedules and other tables generated from the facilities will be secured with passwords before turning them over to the RO by BIR email facility only. 20. Universal Serial Bus (USB) ports and Secure Digital (SD) slots are disabled to secure incoming and outgoing files. The Administrator, upon written approval of the Assistant Manager, may enable these ports/slots when voluminous files

cannot be transmitted by email. A log shall be prepared by the CAATTs Administrator on the lists of eLA designated ROs who were provided with the copy of the output/results for security and control purposes. 21. Outputs, working papers, graphs, tables and schedules generated from the use of the facilities will be summarized in a CAATTs Compliance Report (Annex "C"). The form details the results of the outputs with numeric values indicated therein. It shall be filled out by the RO, signed by the Datamart Administrator and shall form part of the case docket. 22. All IT related issues and concerns reported/logged in BIR Service Desk shall be addressed by the respective RDC technical support. 23. The Datamart Administrator shall be notified in advance in case there will be maintenance works of IT Equipment. IV. DATA EXTRACTION, UPLOADING AND DATA CONVERSION PROCEDURE 1. All Requests for Data (to be extracted from the ITS and Data Warehouse Servers) as enumerated in item III.1 hereof, submitted by the eLA-designated RO shall be in writing addressed to the Manager (Assistant Regional Director), who shall transmit the request to the DCIR, Information Systems Group for approval/disapproval. In turn, said request shall be forwarded to the ACIR, Information System Development & Operations Service (ISDOS), Attention: Chief, Data Warehousing and Systems Operations Division (DWSOD), for generation of the requested data. 2. The DWSOD shall: a. extract and generate the data requested; b. upload/copy the data to the CAATTs Satellite FTP Server; c. advise the requester and concerned Datamart Administrator that the pertinent data have been uploaded to the CAATTs Satellite FTP Server; and d. notify the requester and the respective Datamart Administrator of any issue or concern regarding the data request. In case the requested data are not available in the Data Warehouse Server, the Chief, DWSOD shall deny the request through an email to the requester cc: the Datamart Administrator. 3. The Datamart Administrator shall retrieve/copy the requested file from the FTP Server to the CAATTs Server. As for electronic data obtained from the taxpayer (during the on-site audit), as well as the hard copy of returns (scanned image and converted to electronic version), the Datamart Administrator shall upload the said files to the CAATTs server following the standard procedures. 4. Log-in account and password to the designated CAATTs workstation, where the requestor will retrieve the data to be interrogated and analyzed, shall be created by the Datamart Administrator.

5. All raw electronic files in various file formats obtained from the taxpayers shall be converted into auditable files using the GAS. 6. The field names of the files taken from the taxpayers' CAS should not be changed. V. DATA ANALYSIS/DATA INTERROGATION PROCEDURES The ROs who will apply CAATTs in audit have to perform data analysis/interrogation on transaction files submitted by taxpayers with the following objectives using the corresponding commands below: 1. Verify data integrity � (Acquire general information on the data.) a. Count b. Total c. Verify d. Statistics 2. Perform data survey � (Identify abnormalities in the resulting table.) a. Statistics b. Profile c. Age d. Cross Tabulate 3. Check the order � (Test the records for sequential order.) a. Sequence 4. Check for the completeness of the data � (Verify presence of all records in a sequence.) a. Gaps 5. Verify the uniqueness � (Determine whether records have been included more than once and whether a particular field contains unique values.) a. Duplicates 6. Verify records concentration � (Determine how many records and how much value is concentrated by time period, value range, or other record identifiers such as location codes.) a. Stratify b. Classify c. Summarize 7. Re-order-data (Change the order of the data in the current table or in a new table containing the same data.) a. Sort b. Index 8. Determine multi-file associations a. Extract/Append

b. Joint c. Relations 9. Perform statistical sampling (Draw samples from data populations and estimate the magnitude of errors.) a. Sample b. Size c. Evaluate The applicable procedures in the CAATTs Manual (Revenue Audit Memorandum Order No. 1-2008), until such time that the said manual is revised, shall be used as guidelines for this purpose. Data request for the production of transaction files and other electronic files from taxpayers using Computerized Accounting System shall be guided by Revenue Regulations No. 16-2006 (Submission by Taxpayers of Electronic Books of Accounts and Other Accounting Records in the Course of a Tax Audit/Investigation). VI. TRANSMISSION PROCEDURE FOR INTERROGATED/ ANALYZED DATA 1. Datamart Administrator shall copy all output generated (e.g. CAATTs Compliance Report, Audit Report, Raw Data, Processed/Analyzed Data, Script in a folder using the eLA Number as the folder name) by the ROs to the CAATTs repository server. 2. The files/results shall be password protected. 3. The Datamart Administrator shall notify the recipient of the password thru mobile phone (indicated in the request � Annex A or Annex A-1). 4. The Datamart Administrator shall prepare and submit listings and/or statistics of emailed interrogated data on a weekly basis. VII. KEY PERFORMANCE INDICATORS (KPIs) KPI Formula 1. Number of eLA cases reported with Number of eLA cases reported CAATTs application against number with CAATTs application of eLA cases handled with Number of eLA cases handled approved/registered CAS with approved/registered CAS 2. Number of eLA cases with Number of eLA cases reported with CAATTs application reported CAATTs application reported within within 180 days against number of 180 days eLA cases reported with CAATTs Number of eLA cases reported with application CAATTs application 3. Total number of RO's visits Number of RO's visits registered in reported in the CAATTs the Logbook Laboratory against the number of Number of eLA or Mission Order eLA issued for the year. issued

4. Total Amount Collected from Amount Collected on eLA cases reported CAATTs audit against reported with CAATTs application Total Amount of Voluntary Amount of Voluntary Tax Payments Payments of Taxpayers under made by TPs under CAATTs audit CAATTs audit VIII. REPORTING REQUIREMENTS 1. All ROs conducting audit/investigation of taxpayers using CAS or modules thereof are required to accomplish and comply with all the reporting requirements under existing Revenue Audit Memorandum Orders. 2. The administrator shall submit the following quarterly reports to the Manager (LTS Officer/Assistant Regional Director, copy furnished the ACIR, Assessment Service): a. List of ROs/GS users with inclusive dates of usage of the laboratory and the time spent; and b. Number of eLAs per lead RO where CAATTs was utilized with the List of eLAs covered. 3. The GS shall report to the Division Chief (LTS)/Revenue District Officer, copy furnished the ACIR-LTS/Regional Director and ACIR, Assessment Service, a list of eLAs where CAATTs was used and where audit was completed with the turnaround time to complete the audit, i.e., counting from the date of eLA issuance to the date of submission of report. For your information and strict compliance. (Original Signed) CAESAR R. DULAY Commissioner of Internal Revenue I-1