## Appendix 1  Identifying Mission-Critical Functions (tnmea2020001)

## Source details

**Canonical URL:** [Appendix 1  Identifying Mission-Critical Functions (tnmea2020001)](https://www.imf.org/-/media/files/publications/tnm/2020/tnmea2020001.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/tnm/2020/tnmea2020001.pdf.md)
- [Structured JSON version](/-/media/files/publications/tnm/2020/tnmea2020001.pdf.json)

---

### I. Business Continuity Plan (BCP) defined
- Purpose
  - Ensure continued tax administration operations in the event of major disruptions.
  - This note: inform planning discussions around the specific scenario of an epidemic (or pandemic); not intended as a general-purpose continuity plan.
- Common BCP components
  - A crisis management organization.
  - Processes for identifying and escalating responses to crisis events.
  - Action plans for preserving critical functions.
  - Systems to maintain BCP operational readiness when not in use.
- Types of potential disruptions
  - Internal (e.g., computer systems failure), External (e.g., earthquakes, infectious disease).
  - Localized (one or a few tax offices) or national (entire operations).
- Observations and recommendation
  - COVID-19 experience: tax agencies with a documented BCP are better positioned to respond to a crisis.
  - Recommendation: tax agencies are strongly encouraged to invest time and resources in designing a comprehensive BCP.

### II. Key considerations of a BCP for an epidemic
- Definition and drivers
  - Epidemic: infectious disease affecting a large number of people within a community; can grow into a pandemic if it spreads over multiple countries.
  - Likelihood of severe infectious disease events has increased (global travel, urbanization, land use changes, environmental exploitation).
- Health and economic impacts (as presented)
  - COVID-19 pandemic, as of October 2020: over 35 million cases and more than 1 million deaths worldwide.
  - IMF projected global growth at –4.9 percent, 1.9 percentage points below its April 2020 forecast.
  - 2021 global growth is projected at 5.4 percent.
  - Overall: 2021 GDP some 6½ percentage points lower than pre-COVID-19 projections of January 2020.
  - Adverse impact on low-income households particularly acute; imperils progress in reducing extreme poverty since the 1990s.
- Important challenges for tax administrations during an epidemic
  - Disruption of social and business functions; closures of businesses, schools, institutions.
  - Significant reductions in staff available for work due to illness or outbreak-related factors.
  - Requirement for remote performance of functions (including from home).
  - Changes in tax and social policy, requiring new procedures, staffing, training, IT enhancements.
  - Crisis conditions may persist for at least 1 month, with possibility of subsequent infection waves.
- Typical BCP objectives for a severe infectious disease
  - Maintain most critical operational and support functions at acceptable performance levels.
  - Protect health and safety of staff and visitors.
  - Enable temporary replacement of unavailable management and staff.
  - Protect facilities, records, and other assets.
  - Contribute to whole-of-government epidemic responses.

### III. Organizational arrangements and Crisis Management Organization Framework (BOX 1)
- Typical structure
  - Commissioner; Crisis Management Team (CMT); Local implementation teams; Internal audit unit.
- CMT roles and operational points
  - CMT must have authority to act and make crisis-related decisions on behalf of the tax administration.
  - Authorities may be stipulated in legislation, administrative orders, or other legal instruments.
  - Larger administrations may have permanent business continuity management teams to assist CMT.
- Crisis management organization and roles (details)
  - Commissioner: approves BCP, secures budget, conducts maintenance, testing, annual audits.
  - CMT: leader, deputy, members, secretariat; assumes command on activation; members should designate alternates.
  - Tax Offices/Call Center: implement and monitor local action plans.
  - Internal Audit: conduct regular audits of BCP, report to Commissioner, play key role in post-deployment reviews.
  - CMT Secretariat: coordinates meetings, communications, logs agreed actions.

- Activation and triage matrix (incident classification — four levels)
  - Level 0. Sudden, passing events; minimal impact; local handling. Infectious disease example: significant increase in seasonal viruses at one location.
  - Level 1. Shorter duration events; limited impact; some coordination. Infectious disease example: significant increase in seasonal viruses in a few locations.
  - Level 2. Extended duration events; impacts multiple business lines and tax offices; wide senior coordination. Infectious disease example: significant increase nationally or initial outbreak of a novel virus in one/few locations.
  - Level 3. Extended duration events; major impact on critical functions; whole-of-agency/government coordination. Infectious disease example: national outbreak of a novel virus.
- Response principles and typical CMT sequence of events
  - Severity and potential impact prompt escalated responses; Level 1–3 may require CMT activation.
  - Epidemic will almost always involve top management and BCP deployment.
  - Typical sequence: NOTIFICATION (Director Risk Management briefs leadership) → ACTIVATION (CMT Leader decides to activate) → CMT MEETINGS (phone/web/on-site) → IMPLEMENTATION TEAMS deploy action plans → CMT MEMBERS review and decide on action plans for Mission-Critical Functions, Health/Safety, Workforce Deployment, IT, Facilities and Security, Communications.
  - CMT Leader: overall BCP implementation responsibility; CMT Secretariat: coordinates meetings/communication/logs.

### Action plans — overview and six typical areas
- Purpose: assure CMT and stakeholders that a crisis can be mitigated and managed.
- Prepared in advance with sufficient detail; prescriptiveness depends on management strength.
- Six typical areas: Mission-critical functions; Health and safety; Workforce deployment; Information technology; Facilities; Communications.

### A. Action Plan for Mission-Critical Functions
- Four-step planning process
  - Step 1. Identify full set of functions and work processes.
  - Step 2. Rank functions/processes by criticality.
  - Step 3. Identify vulnerabilities of most critical functions for the scenario.
  - Step 4. Reengineer functions/processes so they can continue effectively until disruption abates.
- Classification guidance
  - Mission-Critical Functions: activities directly related to collecting and accounting for tax revenue; failure has immediate, negative, serious impact on revenues, taxpayers, and/or staff.
  - Essential Support Functions: must be performed to achieve mission-critical functions; facilitative, important and urgent but not core by themselves.
- Examples (TABLE 1)
  - MISSION-CRITICAL FUNCTIONS: Registration; Tax Declaration Filing and Processing; Tax Payment and Processing; Tax Accounting; Refunds.
  - ESSENTIAL SUPPORT FUNCTIONS: Human Resources; Information Systems, Internet, Email; Office Facilities; Call Center; Data Exchange.
- Common vulnerabilities and treatments (TABLE 2)
  - Physical presence dependency → Reengineer to perform remotely or avoid face-to-face interactions (enhance e-tax services, drop-boxes, increase call center resources, suspend face-to-face verification).
  - Paper-based operations → Reengineer to enable fully paperless operation (allow scanned/photo submissions via email).
  - Workforce vulnerabilities → Prepare workforce redeployment plan (cancel leave, approve overtime, hire temporary staff, reallocate non-critical staff).
  - Information systems vulnerabilities → Confirm disaster recovery, database failover, telecoms failover, capacity to scale up IT, backup/recovery; maintain manual processing capabilities.
  - Dependency on external organizations → Encourage partner BCPs compatible with tax administration’s BCP; implement redundant connectivity; establish two working-level points of contact between each partner organization and at least one tax administration IT staff member.

### B. Health and Safety Support Plan
- Priority: protect staff and visitors via graduated health responses aligned to epidemic phases, developed with health authorities.
- High-level 3-phase plan (TABLE 3)
  - Phase 1 — Pre-Outbreak
    - ALERT LEVEL: Normal seasonal cases; No novel infectious disease reported.
    - HEALTH RESPONSES: Staff awareness; replenish health supplies to minimum stock; prepare list of medical supply distributors and service-level agreements.
  - Phase 2 — Outbreak
    - ALERT LEVEL: Significant increase in seasonal cases; and/or Some cases of novel infectious disease in country.
    - HEALTH RESPONSES: Additional information on intranet/social media; social distancing; temperature scanning; intensified cleaning; secure budget for medical supplies; initiate quarantine procedures; report infected staff to health ministry.
  - Phase 3 — Epidemic Alert
    - ALERT LEVEL: Large clusters among general population; and/or Clusters of novel disease among general population.
    - HEALTH RESPONSES: Continue Phase 2 responses plus hotline/direct emails, staff safety kits, remote work/shifts for selected staff, consider closing tax offices.
- Underpinning policies/procedures should cover
  - Medical supplies procurement/distribution requirements by stage.
  - Infection reporting: online report including last day in office, tax office locations visited, close contacts in 48 hours prior to diagnosis.
  - High Risk and Mission Critical Staff: procedures for identifying and requiring remote work for highly vulnerable or mission-critical without replacement.
  - Isolation and quarantining: obligations and procedures for isolating (in the office) and quarantining (outside the office) suspected/confirmed infected staff.

### C. Workforce Deployment Support Plan
- Objectives: ensure adequate workforce for critical functions through planning on acceptable performance levels, reassignment potential, and remote duty capabilities.
- Key elements
  - Identification of minimal staffing levels and contingencies (current staffing numbers, minimum required, temporary filling options: reassignments, cancellation of holidays/leave, overtime, temporary workers, contractors).
  - Workforce roster specifying departments and positions for temporary reassignment.
  - Cross-training provisions, including remote electronic training.
  - Rules of succession: delegation of authorities, conditions for succession, notification methods; reference rules in BCP.
- Remote work policy elements and preconditions
  - Staff agreement to remote work policy as non-negotiable.
  - Mandate to report time and maintain communications (online time reporting, case management, virtual meetings).
  - Consent to monitoring by management, internal audit, and IT; no expectation of privacy on government-issued equipment.
  - Protect government records/data: computer cable locks, multifactor authentication, data and device encryption.
  - Use government equipment for official business only; prohibit family/entertainment use.
  - Notification of penalties and sanctions for breaches, specifying relevant legislation and potential criminal or civil actions.

### D. Information Technology Support Plan
- Primary objective: ensure uninterrupted availability of core processing systems, electronic taxpayer services, and IT elements of mission-critical and essential support functions; enable secure remote work.
- Typical actions
  - Maintain Essential Support Functions: enhanced measures to guarantee secure availability; report disruptions to CMT Leader without delay.
  - Confirm Emergency Procedures and Core Operations: ensure approved emergency IT procedures, failover techniques, backups configured for epidemic scenario; analyze critical procedures and single points of failure; initiate emergency procurements.
  - Deploy Remote Work Capabilities: deploy devices and services required for secure work-from-home; report progress to CMT Team Leader.
  - Redeploy IT Staff and Confirm Assignments: transition most IT staff to remote while ensuring core responsibilities covered.
  - Deliver Priority Systems Development: establish a team to implement reengineered processes; relax change controls for low-risk interventions; reconcile BCP requirements with current conditions.
  - Secure Information and Assets in Closing Facilities: manage shutdown, storage, and security of devices and information; account for end-user and back-office assets.

### E. Facilities Support Plan and Protocols for Opening/Reopening and Closing Facilities (BOX 2)
- Objective: ensure safety and integrity of facilities; operate open facilities safely and decommission/secure closed facilities.
- CMT should recommend which facilities to close/keep open, considering government policies, travel restrictions, stay-at-home orders, absenteeism.
- Open/Reopened Facilities (key measures)
  - Temperature scanning, social distancing, disinfecting hand washes, mandatory masks.
  - Maintain visitor lists to support contact tracing.
  - Post signage on social distancing, mask wearing, hand washing.
  - Acquire/distribute masks, gloves, sanitizers.
  - Enhanced infrastructure controls (protective barriers, air filtering), intensified cleaning.
  - Reassign/reconfigure workspaces and common areas for distancing.
  - Procedures to safely return staff to pre-crisis operations; ensure staff informed of new safety responsibilities.
- Closed Facilities (key measures)
  - Decommission and maintain infrastructure/equipment.
  - Security arrangements in coordination with local police; regular security tours.
  - Instructions for staff to safeguard sensitive information/documents.
  - Full inventory of computer equipment; fully shutdown PCs and wireless devices per IT instruction.
  - Remove trash and arrange cleaning at reduced service levels; cancel/reschedule deliveries or services.

### Communications Support Plan
- Purpose: convey relevant information to the right people in a timely manner through best channels; tailor internal and external communications.
- For each audience specify delivery method and responsible person/team for drafting, approval, and delivery.
- Internal communications
  - CMT ensures managers and staff are kept up to date.
  - Provide managers with CMT meeting summaries and information packages with FAQs.
  - Staff information covers health/safety, work procedure changes, HR policies (leave, remote work), and crisis-relevant issues.
  - Channels: Intranet postings, emails/SMS, recorded telephone information, dedicated email accounts for questions.
- External communications
  - Keep government leaders, taxpayers, preparers, industry associations, banks, suppliers, and key service providers informed.
  - Channels: private meetings, press conferences, press communications, external website updates, social media.
  - Content, timing and distribution of critical messages agreed by CMT Leader, often with Commissioner.

### VI. Maintenance and Testing
- BCP endorsement and ownership
  - BCP should be endorsed and approved by the Commissioner.
  - Assign a senior official responsibility for maintaining the plan; store plan in central repository accessible during an emergency.
- Review and testing requirements
  - Maintain and test BCP via periodic reviews and simulations.
  - At minimum, BCP should be reviewed and amended annually.
    - Substantive updates: identify changes to mission-critical and essential support functions and revise action/support plans.
    - Administrative updates: update names and contacts for CMT members and organizational/staff changes.
  - Schedule a regular exercise (typically in annual work plans) based on a realistic scenario with clear objectives; ensure exercise does not disrupt operations.
  - Produce formal post-exercise report with outcomes and recommendations for senior management review and follow-up.

### Appendix 1 — Key steps and criteria for identifying mission-critical functions
- Purpose: ensure mission-critical functions continue at acceptable performance levels during a major disruption.
- Step 1. Prepare comprehensive list of functions and work processes (examples: registration, returns processing, tax payment processing, audit, IT, HR).
- Step 2. Select “top-down” or “bottom-up” approach
  - Top-down: evaluate each function first (normally less than 30 functions).
  - Bottom-up: infer mission-critical functions from underlying work processes (may require evaluation of 300–400 work processes). Recommendation: bottom-up for analytical rigor if time and information allow.
- Step 3. Select criteria (use no more than three–five criteria; quantitative preferred)
  - Representative criteria:
    - Tax revenue impact: estimated amount of tax revenue deferred or lost as a percentage of the annual revenue target (or forecast) resulting from a one-month disruption.
    - Taxpayer impact: estimated percentage of staff that normally use the function/process and would be affected by a one-month disruption.
    - Tax administration staff impact: percentage of staff that normally use the work process and would be affected by a one-month disruption.
- Step 4. Apply criteria using an assessment matrix (impact of a one-month disruption) and map impact ratings to criticality
  - Impact rating levels and criticality mapping (Table 4):
    - 1. Extreme — More than 10% (Tax Revenue Impact); More than 30% (Taxpayers’ Impact); More than 30% (Staff Impact) — Mission-Critical
    - 2. Major — 5 –10% (Tax Revenue Impact); 20–30% (Taxpayers’ Impact); 20–30% (Staff Impact) — Mission-Critical
    - 3. Moderate — 1– 4% (Tax Revenue Impact); 10 –20% (Taxpayers’ Impact); 10 –20% (Staff Impact) — Important
    - 4. Minor — Less than 1% (Tax Revenue Impact); Less than 10% (Taxpayers’ Impact); Less than 10% (Staff Impact) — Non-Critical
    - 5. None — No revenue loss; No taxpayers are affected; No staff are affected — Non-Critical
  - Top-down rule: function is mission-critical if disruption rated “major” or “severe” for any criterion.
  - Bottom-up rule: function is mission-critical if any underlying process is rated “major” or “severe” for any criterion.
  - Two-stage analysis: mechanical preliminary list followed by senior management review and validation.
- Step 5. Detailed analysis of work processes for mission-critical functions
  - Determine Maximum Acceptable Outage (MAO) measured in days or weeks; MAO is point when disruption causes an “unacceptable” impact.
  - Assess impact over intervals: 1–2 days, 3–5 days, 6–16 days, 16–30 days, > 30 days.
  - Use assessment criteria in Table 5 and Table 6; MAO occurs when impact reaches “major” or “severe” (whichever occurs first).
    - Table 5 (Function-Level Impact Assessment: scores): Extreme — 5; Major — 4; Moderate — 3; Minor — 2; None — 1.
    - Table 6 (High-Level Objectives Impact Assessment: scores): Extreme — threatens political and tax administration viability — 5; Major — significant impact on core operations — 4; Moderate — major impact on short-term operations — 3; Minor — inconvenient — 2; None — 1.
  - Recovery Time Objective (RTO): set no later than the day before the MAO. Example: if MAO occurs after 5 days, RTO should be no later than the 4th day.
- Illustrative example from Table 7 (sample mission-critical functions)
  - Registration — Submission of registration application — Impact Level 3 — MAO/RTO: 4 4 5 5 3 days 2 days
  - Filing — Filing of return — Impact Level 3 — MAO/RTO: 4 4 5 5 3 days 2 days
  - Payment — Providing right amount payable — Impact Level 3 — MAO/RTO: 4 4 5 5 3 days 2 days
  - Revenue Reporting — Impact Level 1 2 3 4 5 — MAO/RTO: 1 6 days 15 days
  - Refund claim data entry — Impact Level 1 2 3 4 5 — MAO/RTO: 1 6 days 15 days

### Appendix 2 — Elements of an Information Technology Support Plan
- Maintain Essential Support Functions
  - Implement enhanced measures guaranteeing secure availability of identified essential support functions.
  - Report planned, anticipated or actual service disruptions to the CMT Leader without delay.
  - Implement crisis action plans for email, connectivity, and data exchange.
  - Confirm disaster recovery plan, database failover procedures, backup and recovery procedures, telecommunications failover configuration, alternate tax payment procedures.
  - Confirm epidemic service desk procedures and sufficient staff to support remote work.
  - Identify and closely monitor key equipment without backup; implement emergency procurements.
- Coordinate with Key Partners
  - Alert key partners of BCP activation; confirm service provider expectations and data center operations; coordinate partner dialogue.
- Deploy Remote Work Capabilities
  - Confirm back-office management services, information security controls, infrastructure security controls, internal audit systems and tools, VPN hardware appliances.
  - Notify staff of remote work transition; distribute remote work and security policies; notify laptop users of enhanced monitoring and VPN procedures.
  - Unlock and deploy laptops for out-of-office use; activate BCP Internet subscriptions; enable remote timekeeping; identify additional resources (e.g., laptops); implement emergency procurements.
- Redeploy IT Staff and Confirm Assignments
  - Transition most IT staff to a remote configuration while ensuring core IT responsibilities are clear; direct non-essential IT staff to work from home; confirm rotating data center/site visit schedules.
- Deliver Priority Systems Development
  - Designate reengineering team leader; determine systems changes; rapidly implement easy, low-risk changes; plan and fully test medium- and high-risk changes.
- Secure Information and Assets in Closing Facilities
  - Full equipment inventory; direct staff to centrally backup files on a server; disable wireless transmission devices; physically secure devices with sensitive or classified information.

*Source: tnmea2020001 - Technical Notes and Manuals 001 | 2020*

### Appendix 1  Identifying Mission-Critical Functions                                                                 19

### Appendix 1  Identifying Mission-Critical Functions

### I. BUSINESS CONTINUITY PLAN DEFINED
- A business continuity plan (BCP) is an important planning tool that ensures continued tax administration operations in the event of major disruptions.
- Common components of BCPs:
  - A crisis management organization.
  - A set of processes for identifying and escalating responses to crisis events.
  - Action plans for preserving the tax administration’s critical functions.
  - Systems for maintaining the BCP’s operational readiness when not in use.
- Types of potential disruptions:
  - Internal (e.g., computer systems failure).
  - External (e.g., earthquakes, infectious disease).
  - Localized (affecting one or a few tax offices) or national (affecting the tax administration’s entire operations).
- Observations:
  - The COVID-19 pandemic shows tax agencies with a documented BCP are better positioned to respond to a crisis.
  - Some BCP aspects for epidemics are applicable to other disruptions (for example, remote work capability relevant for earthquakes, fire, or flood).
- Purpose and scope of this note:
  - To inform planning discussions around the specific scenario of an epidemic (or pandemic).
  - Not intended as a general-purpose continuity plan.
- Recommendation:
  - Tax agencies are strongly encouraged to invest time and resources in designing a comprehensive BCP; full-fledged BCPs take time to develop and implement but provide readiness to respond quickly and systematically and avoid ad hoc responses.

### II. KEY CONSIDERATIONS OF A BCP FOR AN EPIDEMIC
- What is an epidemic and why plan:
  - An epidemic is an infectious disease that affects a large number of people within a particular community; it can grow into a pandemic if it spreads over multiple countries.
  - Epidemics and pandemics are collectively referred to here as an epidemic.
  - Evidence suggests the likelihood of severe infectious disease events has increased due to increased global travel and integration, growing urbanization, changes in land use, and greater exploitation of the environment.
  - Governments prioritize mitigating health and non-health impacts of infectious diseases, including safeguarding delivery of essential government services such as tax administration.
- Health and economic impacts (as presented):
  - COVID-19 pandemic, as of October 2020, resulted in over 35 million cases and more than 1 million deaths worldwide.
  - IMF projected global growth at –4.9 percent, 1.9 percentage points below its April 2020 forecast at the outset of the pandemic.
  - In 2021 global growth is projected at 5.4 percent.
  - Overall, this would leave 2021 GDP some 6½ percentage points lower than in the pre-COVID-19 projections of January 2020.
  - The adverse impact on low-income households is particularly acute, imperiling the significant progress made in reducing extreme poverty since the 1990s.
- Important challenges for tax administrations during an epidemic:
  - Disruption of normal social and business functions, including closures of businesses, schools, and other institutions.
  - Significant reductions in the number of tax administration staff available for work due to illness or other factors related to an outbreak.
  - A requirement for some or all of the tax administration’s functions to be performed remotely (i.e., at an alternate workplace, including from home).
  - Changes in tax and social policy, requiring new tax administration procedures, staffing, training and enhancements to information systems.
  - The potential for crisis conditions to persist for at least 1 month, with the possibility of subsequent infection waves.
- Typical objectives of a BCP for a severe infectious disease:
  - Maintain the operation of the tax administration’s most critical operational and support functions at an acceptable performance level.
  - Protect the health and safety of tax administration staff and visitors.
  - Enable the temporary replacement of tax administration management and staff in the event that they are unavailable or otherwise incapable of performing their duties.
  - Protect the tax administration’s essential facilities, records, and other assets.
  - Contribute to whole-of-government responses to an epvidemic.

### III. ORGANIZATIONAL ARRANGEMENTS
- Typical organizational structure for administering a BCP (as described):
  - Commissioner.
  - Crisis Management Team (CMT).
  - Local implementation teams.
  - Internal audit unit.
- Key operational points:
  - The structure is defined in the BCP and made operational upon BCP activation, most often in response to a crisis.
  - The CMT should have the authority to act and make decisions on crisis-related issues on behalf of the tax administration.
  - Depending on legal practices, authorities may be stipulated in legislation, administrative orders, or other legal instruments.
- Larger tax administrations:
  - May have dedicated business continuity management teams established on a permanent basis.
  - These teams assist an activated CMT in triaging incidents and deploying business continuity action plans.
  - They provide additional support throughout a crisis by assisting in post-crisis debriefings, testing exercises, updating and maintaining BCP components.

*Appendix 1  Identifying Mission-Critical Functions — Technical Notes and Manuals 001 | 2020*

### BOX 1. Crisis Management Organization Framework

### BOX 1. Crisis Management Organization Framework

### Crisis management organization and roles
- Commissioner
  - Approves the BCP and ensures its operational readiness, including by securing adequate budget resources, conducting maintenance, testing activities, and certifying annual audits.
- Crisis Management Team (CMT)
  - Comprises a leader, deputy leader, several members, and a secretariat.
  - Some tax agencies include all department heads; others restrict membership to department directors with implementation roles.
  - Recommendation: restrict full-time members but invite other officials as needed.
  - All team members should designate an alternate member.
  - Once activated, the CMT assumes command and control, reviews contingency action plans, decides on adjustments, issues implementation instructions, monitors implementation, identifies and decides on emerging issues, maintains communications with staff and external stakeholders, and decides when to return to business as usual.
- Tax Offices, Call Center, Other Facilities
  - Implement and monitor business continuity action plans in their jurisdictions.
  - Implementation may be by special teams or existing local management.
- Internal Audit
  - Conducts regular audits of the BCP, including organization and management arrangements, action plans, budget arrangements, maintenance and testing practices.
  - Plays a key role in post-deployment reviews, particularly accounting for budgetary resources used during the crisis.
  - Audit results are reported to the Commissioner.
- CMT Secretariat
  - Provides administrative support: coordinates meetings, arranges communications, maintains logs of agreed actions.

### Activation and deployment (triage matrix and decision process)
- Typical incident classification scheme (four levels):
  - Level 0. Sudden, passing events. Minimal potential to impact business lines or tax offices. Requires little coordination. For an infectious disease, could correspond to a significant increase in seasonal viruses at one location within the country.
  - Level 1. Shorter duration events. Impacts limited number of business lines and few tax offices. Requires some coordination. For infectious diseases, could involve a significant increase in seasonal viruses in a few locations.
  - Level 2. Extended duration events. Impacts multiple business lines and tax offices. Requires wide coordination at senior levels. For an infectious disease, could correspond to a significant increase in seasonal viruses on a national scale or the initial outbreak of a novel virus in one or a few locations.
  - Level 3. Extended duration events. Major impact on a tax agency’s critical functions. Requires whole-of-tax agency and / or whole-of-government coordination. For an infectious disease, could involve a national outbreak of a novel virus.
- Response principles
  - Severity, patterns, and potential impacts prompt escalated responses, which may include BCP deployment.
  - Level 0 incidents are normally addressed through standard operational procedures at the local level.
  - Level 1-3 incidents may require activation of the CMT; leadership and membership vary by severity (from a deputy commissioner to a department director or other senior staff).
  - An epidemic will almost always lead to direct engagement of top management and BCP deployment.
- Typical sequence of events and CMT responsibilities (Figure 1 highlights)
  - NOTIFICATION: Director Risk Management Department notifies and briefs Commissioner and Deputy Commissioner of epidemic/pandemic based on information from Ministry of Health, State Emergency Commission, or other sources.
  - ACTIVATION: CMT Leader:
    - (1) decides whether to activate the Crisis Management Team;
    - (2) instructs the Secretariat to establish the CMT; and
    - (3) notifies Commissioner of CMT activation.
  - CMT MEETINGS:
    - Meetings may be by phone, web conference, on-site or a combination as directed by the CMT Leader.
    - Each CMT member to bring a copy of the BCP to meetings.
  - IMPLEMENTATION TEAMS: Tax Offices, Call Center, Other Facilities implement BCP Action Plans.
  - CMT MEMBERS review, modify, deploy BCP Action Plans for:
    - Mission-Critical Functions
    - Health/Safety
    - Workforce Deployment
    - Information Technology
    - Facilities and Security
    - Communications
  - CMT LEADER: overall responsibility for BCP implementation: lead CMT meetings, sign agenda, decides on deploying BCP Action Plans, oversee all BCP activities.
  - CMT SECRETARIAT: coordinates meetings, arranges communications, maintains logs of agreed actions.

### Action plans — overview
- Purpose: provide assurance to CMT and stakeholders that a crisis can be actively mitigated and managed.
- Action plans should be prepared in advance with sufficient detail; level of prescriptiveness depends on management and governance strength.
- Action plans for an epidemic scenario typically cover six areas:
  - Mission-critical functions
  - Health and safety
  - Workforce deployment
  - Information technology
  - Facilities
  - Communications

### A. Action Plan for Mission-Critical Functions
- Four-step planning process:
  - Step 1. Identify the tax agency’s full set of functions and work processes.
  - Step 2. Rank the functions and processes according to their criticality.
  - Step 3. Identify vulnerabilities of the most critical functions and processes based on the specific scenario the BCP will address (including an epidemic).
  - Step 4. Reengineer the functions and processes so that they can continue to be performed effectively until the disruption has abated.
- Classification guidance:
  - Mission-Critical Functions: activities directly related to collecting and accounting for tax revenue; failure would have an immediate, negative, and serious impact on tax revenues, taxpayers and/or tax administration staff.
  - Essential Support Functions: must be performed to achieve mission-critical functions; facilitative activities that are important and urgent but do not deliver the core mission by themselves.
- Examples (TABLE 1)
  - MISSION-CRITICAL FUNCTIONS: Registration; Tax Declaration Filing and Processing; Tax Payment and Processing; Tax Accounting; Refunds.
  - ESSENTIAL SUPPORT FUNCTIONS: Human Resources; Information Systems, Internet, Email; Office Facilities; Call Center; Data Exchange.
- Steps 3 and 4: determine vulnerabilities and design treatments
  - Common vulnerabilities and treatments (TABLE 2):
    - Physical presence dependency
      - Treatment: Reengineer to perform remotely or avoid face-to-face interactions (e.g., enhance e-tax services, create drop-boxes, increase call center resources, temporarily suspend face-to-face verification).
    - Paper-based operations
      - Treatment: Reengineer to enable fully paperless operation (e.g., allow scanned/photo submissions via email).
    - Workforce vulnerabilities
      - Treatment: Prepare workforce redeployment plan (e.g., cancel leave, approve overtime, hire temporary staff, reallocate non-critical staff).
    - Information systems vulnerabilities
      - Treatment: Confirm disaster recovery plans, database failover procedures, telecommunications failover configuration, capacity to scale-up IT capacity, backup/recovery procedures; maintain manual processing capabilities.
    - Dependency on external organizations
      - Treatment: Encourage partner BCPs compatible with tax administration’s BCP, implement redundant connectivity, establish two working-level points of contact between each partner organization and at least one tax administration IT staff member.

### B. Health and Safety Support Plan
- Priority: protect all staff and visitors from infectious disease via a graduated set of health responses aligned to epidemic phases, developed with health authorities.
- High-level 3-phase plan (TABLE 3):
  - Phase 1 — Pre-Outbreak
    - ALERT LEVEL: Normal number of seasonal infectious disease cases; No cases of novel infectious disease reported.
    - HEALTH RESPONSES:
      - Maintain staff awareness of seasonal infectious diseases, their symptoms and effects, and types of preventions.
      - Replenish health supplies at the minimum stock level.
      - Prepare a list of medical supplies distributors and arrange service-level agreements.
  - Phase 2 — Outbreak
    - ALERT LEVEL: Significant Increase in the number of seasonal infectious disease cases; and/or, Some cases of novel infectious disease identified in the country.
    - HEALTH RESPONSES:
      - Provide additional information on tax agency intranet and social media.
      - Implement social distancing and temperature scanning practices.
      - Intensify cleaning/disinfecting offices.
      - Determine additional medical supplies needed, secure budgetary funds, activate accelerated procurement.
      - Initiate quarantine procedures.
      - Report infected staff to health ministry.
  - Phase 3 — Epidemic Alert
    - ALERT LEVEL: Large cluster(s) of seasonal infectious diseases among the general population; and/or, Clusters of novel infectious disease reported among general population.
    - HEALTH RESPONSES:
      - Continue Phase 2 responses and:
      - Create hotline and direct emails with updates on the infectious disease.
      - Provide staff with safety kit.
      - Allow remote work for selected staff and/or permit office staff to work in shifts.
      - Consider closing tax offices.
- Underpinning policies and procedures should cover:
  - Medical supplies and equipment procurement and distribution requirements at different stages.
  - Infection reporting: staff tested positive and/or symptomatic must complete an on-line report including last day in office, tax office locations visited, and close contacts in the 48 hours prior to diagnosis.
  - High Risk and Mission Critical Staff: procedures for identifying and requiring remote work for those highly vulnerable or mission-critical without replacement.
  - Isolation and Quarantining: obligations and procedures for isolating (in the office) and quarantining (outside the office) suspected or confirmed infected staff.

### C. Workforce Deployment Support Plan
- Objectives: ensure adequate workforce to perform critical functions via advance planning on acceptable performance levels, reassignment potential, and remote duty capabilities.
- Key elements:
  - Identification of minimal staffing levels and contingencies if staffing falls below those levels (current staffing numbers, minimum required, plan for temporary filling via reassignments, cancellation of holidays and leave, overtime, temporary workers, contractors).
  - Development and maintenance of a workforce roster specifying departments and positions for temporary reassignment.
  - Provisions for cross-training of staff between functions, including remote electronic training.
  - Rules of succession if key staff become unavailable: delegation of authorities based on position or title, conditions for succession, method of notification; reference rules in BCP.
- Remote work preconditions and typical policy elements:
  - Staff agreement to a remote work policy as a non-negotiable requirement.
  - Mandate to report time and maintain communications with managers and co-workers (online time reporting, case management systems, virtual meetings).
  - Consent to monitoring by management, internal audit, and IT personnel; no expectation of privacy when using government-issued equipment.
  - Protect government records and data against unauthorized disclosure and access (computer cable locks, multifactor authentication, data and device encryption).
  - Use of government equipment for official business only; prohibit use by family or for entertainment.
  - Notification of penalties and sanctions for breach, specifying relevant legislation and potential criminal or civil actions.

### D. Information Technology Support Plan
- Primary objective: ensure uninterrupted availability of core processing systems, electronic taxpayer services, and IT elements of mission-critical and essential support functions; enable remote work securely.
- Typical actions:
  - Maintain Essential Support Functions: implement enhanced measures guaranteeing secure availability of identified essential support functions; report service disruptions to the CMT Leader without delay.
  - Confirm Emergency Procedures and Core Operations: ensure approved emergency IT procedures, failover techniques, and backups for core IT operations are in-place and configured for an epidemic scenario; analyze critical procedures and identify single points of failure; initiate emergency procurements.
  - Deploy Remote Work Capabilities: deploy devices and electronic services required for secure work-from-home capabilities and report progress to the CMT Team Leader.
  - Redeploy IT Staff and Confirm Assignments: transition most IT staff to a remote configuration while ensuring core IT responsibilities are clear and sufficient resources exist to support the remote workforce.
  - Deliver Priority Systems Development: establish a team to implement reengineered business processes and policy measures; relax change controls for low-risk interventions; reconcile BCP action plan requirements with current conditions.
  - Secure Information and Assets in Closing Facilities: manage shutdown, storage and security of devices and information during the crisis, accounting for end-user and back-office assets.

### E. Facilities Support Plan
- Objective: ensure safety and integrity of facilities during an epidemic; operate open facilities safely and decommission/secure closed facilities.
- CMT should recommend to the Commissioner which facilities to close or keep open, considering government-wide policies, travel restrictions, stay-at-home orders, and employee absenteeism rates.
- Protocols for open, reopening, and temporarily closed facilities should be prepared and reviewed as the epidemic unfolds.

*Source: tnmea2020001 - BOX 1. Crisis Management Organization Framework*

### BOX 2. Protocols for Opening/Reopening and Closing Facilities

### BOX 2. Protocols for Opening/Reopening and Closing Facilities

### Open/Reopened Facilities
- Implement restrictions for staff and visitor access, including temperature scanning, social distancing, use of disinfecting hand washes, and mandatory wearing of masks.
- Maintain a list of visitors to each facility that can be used to support contact tracing.
- Print and post signage at entrances and general use areas on social distancing, mask wearing, hand washing, and other practices.
- Acquire and distribute equipment, including masks, gloves, sanitizers.
- Implement enhanced infrastructure controls, including protective barriers and air filtering systems.
- Intensify cleaning procedures.
- Reassign/reconfigure workspaces and common areas for social distancing.
- Determine the procedures to safely return staff to pre-crisis operations (including those listed above).
- Ensure staff returning to the office are informed of new safety responsibilities.

### Closed Facilities
- Decommission and maintain physical infrastructure and equipment.
- Put in place appropriate security arrangements, in coordination with local police, maintain security systems, conduct regular security tours.
- Issue instructions for staff to safeguard all sensitive information and documents.
- Perform a full inventory of computer equipment, fully shutdown all PCs and wireless transmission devices, shutdown other IT equipment based on explicit instruction from the IT department.
- Remove trash and arrange cleaning at reduced service levels.
- Cancel or reschedule deliveries or services.

### Communications Support Plan
- Purpose: Convey relevant information to the right people in a timely manner and through the best channel; tailored for internal and external communications strategies.
- For each targeted audience, specify (1) how information is to be delivered and (2) the person or team responsible for drafting, approving, and delivering messages.

Internal Communications
- The CMT is typically tasked with ensuring that managers and staff are kept up to date on the epidemic.
- Provide managers with summaries of CMT meetings and information packages containing key information and answers to anticipated staff questions.
- Staff information typically covers health and safety issues, changes in work procedures, human resource management policies (including leave and remote work policies), and other crisis-relevant issues.
- Common internal channels:
  - Posting statements and frequently asked questions (FAQs) on an Intranet.
  - Sending emails or SMS messages directly to employees.
  - Establishing a telephone number with recorded information that employees can call.
  - Setting up an email account for employees to direct questions to.

External Communications
- Keep external stakeholders informed: key government leaders and agencies, taxpayers and tax return preparers, industry and service associations, banks, suppliers and key service providers.
- Delivery channels: private meetings, press conferences, sending communications to the press / media, posting information on the tax administration’s external website, posting updates on social media.
- The content, timing and distribution of critical messages are to be agreed by the CMT Leader, often in consultation with the Commissioner.

### VI. Maintenance and Testing
- The BCP should be endorsed and approved by the Commissioner.
- Assign an appropriately senior official responsibility for maintaining the plan; store the plan in a central repository accessible during an emergency.
- Requirement to maintain and test the BCP via periodic reviews and simulations.
- At a minimum, the BCP should be reviewed and amended annually.
  - Substantive updates: identify changes to mission-critical and essential support functions (by reapplying the Appendix 1 methodology) and revise action and support plans.
  - Administrative updates: update names and contact information for CMT members and account for organizational/staff changes.
- Schedule a regular exercise (typically included in annual work plans), based on a realistic scenario with clearly defined purposes and objectives; ensure exercise does not disrupt actual operations.
- Produce a formal post-exercise report with outcomes and recommendations for senior management review and follow-up action.

### APPENDIX 1. Identifying Mission-Critical Functions — Key Steps and Criteria
- Purpose: Ensure mission-critical functions continue at acceptable performance levels during a major disruptive event.

Step 1. Prepare a comprehensive list of functions and work processes.
- Functions examples: registration, returns processing, tax payment processing, audit, information technology, human resources.
- Work process example for registration: submission of a registration application, review of applications, proof of identity, issuance of a certificate.
- Categorize into operational (e.g., registration, tax returns filing and processing, audit) and support (e.g., human resources, information systems, finance).

Step 2. Select a “top-down” or “bottom-up” approach.
- Top-down: evaluate each function first, then analyze work processes only for functions identified as mission-critical; fewer items to evaluate (normally less than 30 functions).
- Bottom-up: infer mission-critical functions from analysis of underlying work processes; more rigorous but may require evaluation of 300–400 work processes.
- Recommendation: strong argument in favor of the bottom-up approach for analytical rigor, subject to available time and information.

Step 3. Select criteria for evaluating the functions and/or work processes.
- Use no more than three-five criteria; criteria should reflect balanced perspectives (tax administration, taxpayers, staff); quantitative criteria preferred.
- Representative criteria:
  - Tax revenue impact: the estimated amount of tax revenue deferred or lost as a percentage of the annual revenue target (or forecast) resulting from a one-month disruption in its availability.
  - Taxpayer impact: the estimated percentage of staff that normally use the function/process and would be affected by a one-month disruption in its availability.
  - Tax administration staff impact: the percentage of staff that normally use the work process and would be affected by a one-month disruption in its availability.

Step 4. Apply the criteria using an assessment matrix (impact of a one-month disruption) and map impact ratings to criticality.
- Impact rating levels and criticality mapping (as presented in Table 4):
  - 1. Extreme — More than 10% (Tax Revenue Impact); More than 30% (Taxpayers’ Impact); More than 30% (Staff Impact) — Mission-Critical
  - 2. Major — 5 –10% (Tax Revenue Impact); 20–30% (Taxpayers’ Impact); 20–30% (Staff Impact) — Mission-Critical
  - 3. Moderate — 1– 4% (Tax Revenue Impact); 10 –20% (Taxpayers’ Impact); 10 –20% (Staff Impact) — Important
  - 4. Minor — Less than 1% (Tax Revenue Impact); Less than 10% (Taxpayers’ Impact); Less than 10% (Staff Impact) — Non-Critical
  - 5. None — No revenue loss; No taxpayers are affected; No staff are affected — Non-Critical
- Under top-down: a function is mission-critical if disruption impact is rated “major” or “severe” for any criterion.
- Under bottom-up: a function is mission-critical if any underlying process is rated “major” or “severe” for any criterion.
- Two-stage analysis: produce a preliminary list mechanically, then review and validate with senior management to finalize the list.

Step 5. Perform a detailed analysis of the work processes for mission-critical functions.
- Determine Maximum Acceptable Outage (MAO) measured in days or weeks; MAO is the point at which disruption causes an “unacceptable” impact.
- Assess impact over intervals (e.g., 1-2 days, 3-5 days, 6-16 days, 16-30 days, > 30 days).
- Use assessment criteria in Table 5 and Table 6; MAO occurs when impact reaches “major” or “severe” (whichever occurs first).
  - Table 5 (Function-Level Impact Assessment: scores):
    - Extreme — The function will completely fail — 5
    - Major — Very high negative impact on delivering the function — 4
    - Moderate — Significant negative impact on delivering the function — 3
    - Minor — Minimal impact on delivering the function — 2
    - None — No impact on the function — 1
  - Table 6 (High-Level Objectives Impact Assessment: scores):
    - Extreme — Threatens political and tax administration viability — 5
    - Major — Significant impact on core tax administration operations — 4
    - Moderate — Major impact on short-term tax administration operations — 3
    - Minor — Inconvenient but no substantive impact on operations — 2
    - None — No impact — 1
- Recovery Time Objective (RTO): set no later than the day before the MAO. Example: if MAO occurs after 5 days, RTO should be set at no later than the 4th day.

Example (illustrative MAO and RTO from Table 7)
- For the sample mission-critical functions (Registration, Filing, Payment, Revenue Accounting, Refunds), individual work processes are assigned Impact Level scores and MAO/RTO intervals.
  - Example entries (as shown):
    - Registration — Submission of registration application — Impact Level 3 — MAO/RTO: 4 4 5 5 3 days 2 days
    - Filing — Filing of return — Impact Level 3 — MAO/RTO: 4 4 5 5 3 days 2 days
    - Payment — Providing right amount payable — Impact Level 3 — MAO/RTO: 4 4 5 5 3 days 2 days
    - Revenue Reporting — Impact Level 1 2 3 4 5 — MAO/RTO: 1 6 days 15 days
    - Refund claim data entry — Impact Level 1 2 3 4 5 — MAO/RTO: 1 6 days 15 days
  - (Table 7 presents detailed per-process impact scores and MAO/RTO day thresholds across intervals 1–2 DAYS, 3–5 DAYS, 6–15 DAYS, 16–30 DAYS, > 30 DAYS.)

### APPENDIX 2. Elements of an Information Technology Support Plan
Maintain Essential Support Functions
- Implement enhanced measures that guarantee the secure availability of identified essential support functions.
- Report planned, anticipated or actual service disruptions to the CMT Leader without delay.
- Implement crisis action plans for (1) email; (2) connectivity; (3) and data exchange.
- Confirm disaster recovery plan.
- Confirm database failover procedures.
- Confirm backup and recovery procedures.
- Confirm telecommunications failover configuration.
- Confirm alternate tax payment procedures.
- Confirm epidemic service desk procedures, including sufficient staff to support remote work.
- Confirm core IT operations procedures (maintenance of servers, databases, networks).
- Identify and closely monitor key equipment without backup.
- Implement emergency procurements.

Coordinate with Key Partners
- Alert key partners of BCP activation.
- Confirm service provider expectations.
- Confirm data center operations.
- Coordinate partner dialogue.

Deploy Remote Work Capabilities
- Confirm back-office management services.
- Confirm information security controls.
- Confirm infrastructure security controls.
- Confirm internal audit systems and tools.
- Confirm VPN hardware appliances.
- Notify staff of remote work transition.
- Distribute remote work and security policies.
- Notify staff assigned laptops of enhanced monitoring.
- Distribute service desk contact information.
- Unlock and deploy laptops for out of office use.
- Activate BCP Internet subscriptions.
- Inform laptop users of VPN connection procedures.
- Confirm VPN staff connectivity.
- Enable staff remote timekeeping capabilities.
- Identify additional resource requirements (e.g., laptops).
- Implement emergency procurements.

Redeploy IT Staff and Confirm Assignments
- Direct most IT staff to transition into a remote configuration while ensuring that responsibilities for core IT operations are clear.
- Direct non-essential IT staff to work from home.
- Confirm staff assignments for core operations.
- Confirm rotating data center and site visit schedules.
- Coordinate local office IT support personnel.

Deliver Priority Systems Development
- Designate a reengineering team leader.
- Determine systems changes based on current conditions.
- Rapidly implement easy, low-risk changes.
- Plan and fully test medium- and high-risk changes.

Secure Information and Assets in Closing Facilities
- Perform a full equipment inventory (i.e., PCs, laptops, etc.).
- Direct staff to centrally backup files on a server.
- Disable all wireless transmission devices (e.g., WIFI routers).
- Physically secure devices with sensitive or classified information.

*Source: BOX 2. Protocols for Opening/Reopening and Closing Facilities — Technical Notes and Manuals 001 | 2020*

---


_Source: https://www.imf.org/-/media/files/publications/tnm/2020/tnmea2020001.pdf_