Public financeGazette notice

Gazette Notice No. 12835 of 2025

The Commission on Revenue Allocation issues standards and guidelines for integrated county revenue management systems across all 47 County Governments.

Official PDF · 0.5 MB

Whole issue, from Kenya Law. This notice starts on printed page 6151.

AI-extractedAgreement between models, not verified accuracy.

Items 32

Legislation notice 1
Link

Issuing authority
Commission on Revenue Allocation (Issues the Standards and Guidelines and serves as their custodian.)
Body
National Treasury (Consulted institution; lead implementing agency and system custodian responsible for development, hosting, integration, core administration and ownership of the ICRMS platform.), Council of Governors (Consulted in issuing the Standards and Guidelines.), Office of the Auditor-General (Consulted institution responsible for financial, compliance and performance audits of ICRMS.), Office of the Controller of Budget (Consulted institution responsible for budget implementation oversight and revenue performance monitoring.), ICT Authority (Consulted in issuing the Standards and Guidelines.), County Governments (All 47 County Governments; retain local operational administrative rights and ownership and custodianship of their revenue data.), National Government (National Government agencies fall within the application of the Standards and Guidelines.), KRA (Named among systems with which integration is an objective.), Business Registration Service (Named for integration with ICRMS.), NTSA (Named among systems with which integration is an objective.), Ministry of ICT and the Digital Economy (Verifies compliance with KGEA and KNIF and conducts cybersecurity assessments.), Project Implementation Unit (County Governments must establish a Project Implementation Unit or Technical Working Group to oversee county-level implementation.), Technical Working Group (Alternative to a Project Implementation Unit for county-level implementation oversight.), Parliament (Receives budget implementation reports and statutory audit reports.), County Assemblies (Receive budget implementation reports and statutory audit reports.)
Office
County Executive Committee Member responsible for Finance (Approves ICRMS-generated revenue reports accessed by the Office of the Controller of Budget.)
Instrument
Standards and Guidelines on the Integrated County Revenue Management System (ICRMS)
Purpose
Establish a uniform, secure, interoperable, and accountable framework for the design, procurement, deployment, operation, and oversight of Integrated County Revenue Management Systems across all 47 County Governments.
Supersession
These Standards and Guidelines supersedes any other guidelines issued in regard to revenue management systems.
Institutional scope
All 47 County Governments; National government agencies; Intergovernmental bodies; Private sector vendors, contractors, and service providers; Development partners supporting digital revenue reforms.
Functional scope
Planning, budgeting, and needs assessment; procurement and contracting; system development, acquisition, or customisation; deployment, data migration, and integration; operation, maintenance, and user management; audit, reporting, and continuous improvement.
Legislative framework
1. Public Finance Management (PFM) Act, 2012; 2. County Governments Act, 2012; 3. Public Procurement and Asset Disposal Act (PPADA), 2015; 4. Data Protection Act, 2019; 5. Intergovernmental Relations Act, 2012.
Minimum requirements
Functional capabilities (Annex 1); Technical specifications (Annex 2); Procurement, compliance, and audit tools (Annexes 3–4); Operational frameworks including risk management, data migration, change management, and reporting (Annexes 5–12).
Technical standards
Architecture, hardware, software, security, integration, disaster recovery, and data governance.
Functional standards
Revenue registration, assessment and billing, payment processing, debt management, reporting, self-service portals, alerts, and audit trails.
System ownership
Ownership of the ICRMS platform, including core infrastructure and vendor contracts, shall vest in the National Treasury.
County administration
Each County Government shall retain exclusive operational administrative rights over its local instance, including user management, system configuration, data access, and revenue reporting.
Data ownership
Each County Government shall retain full ownership and custodianship of its own revenue data and any other party shall only access the data after approval from the county government.
Reporting
County Governments shall submit quarterly system compliance and performance reports to the PFM institutions.
Establishment 2
Link

Body
Joint Governance Committee (Section 9.5.1 provides that a Joint Governance Committee shall be established.), National Treasury (Co-chair.), Council of Governors (Co-chair.), Commission on Revenue Allocation (To be represented on the Committee.), ICT Authority (To be represented on the Committee.), Office of the Controller of Budget (To be represented on the Committee.), Office of the Auditor-General (To be represented on the Committee.), County Governments (To be represented on the Committee.)
Mandate
The Committee shall oversee policy decisions, system upgrades, vendor performance, and provide strategic guidance on the ongoing development of ICRMS.
Public finance notice 3
Link

System
Integrated County Revenue Management System (System covered by the Standards and Guidelines.)
Body
County Governments (All 47 County Governments; implementation and sustainability require their coordinated participation.), KRA (Named in the objective for seamless integration.), BRS (Named in the objective for seamless integration.), NTSA (Named in the objective for seamless integration.)
Integration system
IFMIS, SCOA, IPRS, GIS
Legislative framework 3
Public Procurement and Asset Disposal Act (PPADA), 2015: Ensures competitive, transparent procurement of ICT systems.
Legislative framework 4
Data Protection Act, 2019: Governs lawful processing, storage, and protection of personal and financial data.
Legislative framework 5
Intergovernmental Relations Act, 2012: Facilitates co-ordination between national and county governments.
General objective
To establish a standardised, secure, and interoperable revenue management framework that enhances Own Source Revenue mobilisation, ensures prudent public financial management, and upholds the principles of equity, transparency, and accountability.
Specific objective 1
Standardise functional and technical specifications for ICRMS across all counties.
Specific objective 2
Improve OSR performance through automation, reconciliation, and enforcement.
Specific objective 3
Ensure compliance with the Constitution, PFM Act, PPADA Act, and Data Protection Act.
Specific objective 4
Enable seamless integration with IFMIS, SCOA, IPRS, KRA, BRS, NTSA, and GIS systems.
Specific objective 5
Safeguard data integrity, confidentiality, and availability.
Specific objective 6
Strengthen transparency and auditability through digital logs and reporting.
Specific objective 7
Build institutional capacity for sustainable system management.
Specific objective 8
Promote shared services and joint procurement to reduce costs.
Specific objective 9
Preserve county autonomy in system administration and revenue decision-making.
Specific objective 10
Promote fiscal prudence, reduce leakages, and support equitable development.
Institutional scope 1
All 47 County Governments
Institutional scope 2
National government agencies
Institutional scope 3
Intergovernmental bodies
Institutional scope 4
Private sector vendors, contractors, and service providers.
Institutional scope 5
Development partners supporting digital revenue reforms.
Functional scope
The Standards and Guidelines covers the full lifecycle of ICRMS, including:
Functional scope 1
Planning, budgeting, and needs assessment;
Functional scope 2
Procurement and contracting;
Functional scope 3
System development, acquisition, or customisation;
Functional scope 4
Deployment, data migration, and integration;
Functional scope 5
Operation, maintenance, and user management;
Functional scope 6
Audit, reporting, and continuous improvement.
Guiding principles
All ICRMS implementations shall adhere to the following principles:
Guiding principle 1
Constitutionalism and Rule of Law: Compliance with the Constitution and all applicable laws and legislations .
Guiding principle 2
Accessibility to all: Equal access to revenue services for all ratepayers, including marginalised groups .
Guiding principle 3
Accountability and Transparency: Full traceability of transactions and decisions.
Guiding principle 4
Data Integrity and Protection: Compliance with the Data Protection Act, 2019.
Guiding principle 5
Interoperability and Standardisation: Use of open APIs and national standards.
Guiding principle 6
County Autonomy: Counties retain administrative control over local system functions.
Guiding principle 7
Collaboration: Encouragement of shared infrastructure and joint initiatives.
Guiding principle 8
Accessibility: Systems must be accessible via web, mobile, and USSD, and compliant with disability standards.
Guiding principle 9
Efficiency: Systems must minimise costs and maximise revenue collection.
Roles and responsibilities
The successful implementation and sustainability of the Integrated County Revenue Management System (ICRMS) requires coordinated participation by County Governments, constitutional commissions, and national institutions. The following roles and responsibilities shall guide execution, oversight, and compliance.
Public finance notice 4
Link

Body
County Governments (Responsibilities under section 7.1.), Commission on Revenue Allocation (Responsibilities under section 7.2.), National Treasury (Responsibilities under section 7.3.), Ministry of ICT and the Digital Economy (Responsibilities under section 7.4.), Office of the Controller of Budget (Responsibilities under section 7.5.), Project Implementation Unit (County-level implementation oversight unit to be established as an alternative to a Technical Working Group.), Technical Working Group (County-level implementation oversight group to be established as an alternative to a Project Implementation Unit.), monitoring and evaluation Unit (Unit to be established by the County to ensure the ICMRS efficiency.), PFM Institutions (Recipients of compliance and performance reports and advisory notes.), Business Registration Service (Named in the National Treasury's system integration responsibilities.), Parliament (Recipient of quarterly and annual budget implementation reports.)
Office
County Executive Committee Member responsible for Finance (Approves revenue reports accessible to the Office of the Controller of Budget.)
Assembly
County Assemblies (Recipients of quarterly and annual budget implementation reports.)
System
Integrated County Revenue Management System (System governed by the responsibilities.), IFMIS (Named for integration with ICRMS.), Integrated Population Registration System (Named for integration with ICRMS.)
Framework
Standard Chart of Accounts (Named for integration with ICRMS.), Kenya Government Enterprise Architecture (System compliance to be verified by the Ministry.), Kenya National Interoperability Framework (System compliance to be verified by the Ministry.)
Section 7 1
County Governments SHALL:
Section 7 1 item 1
Have full operational and administrative control over its local instance of the Integrated County Revenue Management System (ICRMS), including user management, system configuration, and workflow customisation for its revenue processes.
Section 7 1 item 2
Be responsible for the day-to-day operation and management of the system, including data entry, transaction monitoring, user support, and system maintenance at the county level.
Section 7 1 item 3
Provide and maintain the last-mile ICT infrastructure necessary to support system functionality within its jurisdiction, including connectivity, power backup, equipment, and related support services.
Section 7 1 item 4
Ensure full compliance with the Public Finance Management Act, 2012, and any other applicable law governing financial management, including the timely generation and submission of revenue performance reports to relevant institutions.
Section 7 1 item 5
Ensure that all bank accounts receiving county revenue are integrated with the ICRMS to enable real-time reconciliation, transparency, and effective monitoring of revenue inflows.
Section 7 1 item 6
Establish a Project Implementation Unit (PIU) or Technical Working Group to oversee system implementation at the county level.
Section 7 1 item 7
Coordinate and Conduct training and build internal technical capacity at the county level.
Section 7 1 item 8
The County to establish a monitoring and evaluation Unit to ensure the ICMRS efficiency.
Section 7 1 item 9
Submit quarterly system compliance and performance reports to the PFM institutions.
Section 7 1 item 10
Conduct periodic internal audits of the ICRMS, including audit trail verification, system usage controls, and reconciliation processes, in line with the internal audit framework established under the PFM Act and county legislation.
Section 7 2
Commission on Revenue Allocation (CRA) SHALL:
Section 7 2 item 1
Serve as the Standards and Guidelines custodian of the Integrated County Revenue Management System (ICRMS), providing strategic guidance, technical advice, and intergovernmental co-ordination, in accordance with Article 216(2), 216(3)(a) and (b), and Article 203(1)(e) and (i) of the Constitution.
Section 7 2 item 2
Develop and periodically review the Standards and Guidelines governing the implementation, functionality, and reporting requirements of ICRMS.
Section 7 2 item 3
Provide technical support to County Governments and relevant institutions on matters related to ICRMS deployment, integration, and continuous improvement.
Section 7 2 item 4
Analyze Own Source Revenue (OSR) performance reports generated from ICRMS platforms and issue advisory notes to the County Governments ,PFM Institutions, , and intergovernmental bodies.
Section 7 2 item 5
Undertake independent assessments to evaluate the performance, effectiveness, and operational efficiency of ICRMS platforms deployed across counties, and recommend corrective or enhancement measures as necessary.
Section 7 3 item 1
Develop and gazette regulations to guide the implementation, standardization, and oversight of Integrated County Revenue Management Systems (ICRMS), in accordance with its mandate under the Public Finance Management Act, 2012.
Section 7 3 item 2
Coordinate the design, development, and implementation of a centralized ICRMS platform for County Governments, ensuring functional completeness, scalability, and alignment with these standard and guidelines on ICRMS
Section 7 3 item 3
Bear the cost of core system development and infrastructure for ICRMS platform, including licensing, hosting, and national-level support components
Section 7 3 item 4
Oversee the integration of ICRMS with national financial and identity systems, including IFMIS, Standard Chart of Accounts (SCOA), Business Registration Service (BRS), Integrated Population Registration System (IPRS), and any other relevant government platforms.
Section 7 3 item 5
Initiate and operationalize intergovernmental framework agreements with participating County Governments to govern the deployment, financing, ownership, and operational responsibilities for shared ICRMS platforms
Section 7 4 item 1
Verify system compliance with the Kenya Government Enterprise Architecture (KGEA) and the Kenya National Interoperability Framework (KNIF), as developed and issued under the Ministry’s mandate for ICT standards and infrastructure co-ordination.
Section 7 4 item 2
Conduct cybersecurity assessments of ICRMS platforms to ensure conformance with national cybersecurity standards, including data protection, access controls, and system resilience requirements.
Section 7 5 item 1
Exercise oversight over the implementation of County Government budgets in accordance with Article 228(4) and (6) of the Constitution and Section 9 of the Controller of Budget Act, 2016, with specific reference to Own Source Revenue (OSR) collection and reporting through the Integrated County Revenue Management System (ICRMS).
Section 7 5 item 2
Have secure, read-only access to ICRMS-generated revenue reports approved by the County Executive Committee Member responsible for Finance, for the purpose of monitoring revenue performance, verifying budget execution, and advising on fund releases.
Section 7 5 item 3
Analyze ICRMS data to assess whether actual revenue collection aligns with budget projections, and to identify any shortfalls, variances, or inconsistencies that may affect budget implementation and fiscal planning.
Section 7 5 item 4
Prepare and submit quarterly and annual reports to Parliament and County Assemblies on the status of budget implementation across counties, incorporating findings derived from ICRMS revenue data.
Public finance notice 5
Link

Body
Office of the Auditor-General (Audit and oversight duties under section 7.6.), County Governments (County Governments whose ICRMS platforms are subject to audit.)
System
Integrated County Revenue Management System
Report recipient
County Assemblies, Parliament, CRA, CoB
Clause 7 6 1
Access and audit the Integrated County Revenue Management System (ICRMS) in all County Governments to verify that revenue collected, receipted, reported, and managed through the system complies with the Public Finance Management Act, 2012, and related regulations.
Clause 7 6 2
Undertake regular financial, compliance, and performance audits of ICRMS platforms pursuant to Article 229 of the Constitution and the Public Audit Act, 2015.
Clause 7 6 3
Assess the adequacy of internal controls, system configurations, audit trails, and reconciliation mechanisms embedded within the ICRMS, to determine whether the system safeguards revenue integrity and accountability.
Clause 7 6 4
Issue statutory audit reports and management letters detailing findings, risks, and recommendations for corrective action, and submit such reports to County Assemblies, Parliament, CRA, CoB, and other oversight bodies as required.
Clause 7 6 5
Follow up on the implementation of audit recommendations by County Governments or national implementing agencies, and track remedial measures to close audit queries, enhance controls, and prevent recurrence of identified weaknesses.
Legislation notice 6
Link

System
Integrated County Revenue Management System (System subject to the technical, functional and governance requirements.)
Body
National Treasury (Lead implementing agency, system custodian and platform owner.), County Governments (System adopters retaining local administrative rights and ownership and custodianship of their revenue data.), BRS (Named among national systems with which the National Treasury coordinates linkages.)
Linked system
IFMIS, SCOA, IPRS
Clause 8 1
All ICRMS must meet minimum technical requirements in:
Clause 8 1 1
Architecture, hardware, software, security, integration, disaster recovery, and data governance.
Clause 8 2
All ICRMS must include: Revenue registration, assessment and billing, payment processing, debt management, reporting, self-service portals, alerts, and audit trails.
Clause 9
The Integrated County Revenue Management System (ICRMS) shall operate as a unified, centrally coordinated platform, developed and maintained under the leadership of the National Treasury and adopted by all 47 County Governments through formal intergovernmental arrangements. This governance framework shall be guided by the principles of intergovernmental co-operation, fiscal accountability, and mutual administrative responsibility, as envisaged under Article 6(2) of the Constitution, the Intergovernmental Relations Act, 2012, and section 12(e) of the Public Finance Management Act, 2012.
Clause 9 1 1
The National Treasury shall serve as the lead implementing agency and system custodian, responsible for the development, hosting, integration, and core administration of the ICRMS platform. It shall also coordinate linkages with national systems such as IFMIS, SCOA, BRS, and IPRS, and oversee technical service providers.
Clause 9 2 1
County Governments will adopt the system through an Intergovernmental Framework Agreements with the National Treasury to be agreed upon by the parties.
Clause 9 3 1
Ownership of the ICRMS platform, including core infrastructure and vendor contracts, shall vest in the National Treasury.
Clause 9 3 2
Each County Government shall retain exclusive operational administrative rights over its local instance, including user management, system configuration, data access, and revenue reporting.
Clause 9 4 1
The ICRMS platform shall fully comply with all provisions of these Standards and Guidelines, including the functional requirements outlined in Annex 1, technical standards in Annex 2, and service-level provisions in Annex 6.
Clause 9 4 2
No deviation from these standards shall be permitted unless formally reviewed and approved through the governance structure established herein.
Clause 9 6 1
Each County Government shall retain full ownership and custodianship of its own revenue data and any other party shall only access the data after approval from the county government.
Clause 9 6 2
The platform shall comply with the Data Protection Act, 2019, and applicable national cybersecurity standards.
Clause 9 7 1
County Governments shall establish internal administrative structures to manage user roles, provide frontline support, and escalate system issues.
Clause 9 7 2
The National Treasury shall operate a national helpdesk and coordinate change management, capacity building, and periodic training for county users
Clause 10
The procurement, development, and deployment of the ICRMS shall be governed by the following provisions:
Establishment 7
Link

Body
Joint Governance Committee (Joint Governance Committee to be established.), CRA (To be represented on the Committee.), ICTA (To be represented on the Committee.), CoB (To be represented on the Committee.), Office of the Auditor-General (To be represented on the Committee.), County Governments (To be represented on the Committee.)
Co chair
National Treasury, Council of Governors
Clause 9 5 1
A Joint Governance Committee shall be established, co-chaired by the National Treasury and the Council of Governors, with representation from CRA, ICTA, CoB, OAG, and County Governments.
Clause 9 5 2
The Committee shall oversee policy decisions, system upgrades, vendor performance, and provide strategic guidance on the ongoing development of ICRMS.
Public finance notice 8
Link

Body
National Treasury (Lead implementing agency), County Governments (Platform adoption and local deployment)
System
Integrated County Revenue Management System
Integrated system
IFMIS, SCOA, BRS, IPRS
Provision 10 1
The National Treasury shall be the lead implementing agency and shall undertake the procurement, design, customisation, and national-level deployment of the ICRMS in accordance with the Public Procurement and Asset Disposal Act, 2015, the Public Finance Management Act, 2012, and applicable ICT standards.
Provision 10 2
The ICRMS platform shall be acquired or developed as a shared system, with modular capabilities that allow county-level configuration, autonomy in operations, and independent access to reporting and user management tools.
Provision 10 3
County Governments shall adopt the platform by entering into a formal Intergovernmental Framework Agreement with the National Treasury, detailing governance, roles, financial obligations (where applicable), data rights, and service-level expectations.
Provision 10 4
The procurement of third-party components, hosting, and core infrastructure shall be managed centrally by the National Treasury, including vendor contracting, software licensing, support services, and integration with national systems such as IFMIS, SCOA, BRS, and IPRS.
Provision 10 5
County Governments shall be responsible for financing and executing their respective local deployment activities, including hardware provisioning, staff training, onboarding, change management, and localised support infrastructure.
Provision 10 6
All components of the system including development, configuration, and rollout must conform to the functional specifications (Annex 1), technical standards (Annex 2), and SLA requirements (Annex 6) set out in these Standards and Guidelines . No customisation or divergence from the approved architecture shall be permitted outside the provisions of the agreed governance framework.
Provision 10 7
All contracts and implementation arrangements shall include explicit provisions for data protection, source code escrow, knowledge transfer, and system sustainability to ensure long-term performance and institutional ownership.
Provision 10 8
Counties and National Treasury shall develop and approve a Change Management Plan (Annex 9) prior to go-live, addressing stakeholder engagement, process redesign, and resistance mitigation.
Provision 10 9
All development must follow open standards and avoid vendor lock-in.
Implementation framework
The process will entail preparation by the multi-agency, acquisition of the ICRMS by the National treasury, Commissioning and system implementation.
Coordination mechanisms
Effective co-ordination of the ICRMS platform shall be ensured through structured multi-level committees and technical units that promote intergovernmental collaboration, operational oversight, and accountability. The following co-ordination mechanisms shall be established:
Establishment 9
Link

Body
National ICRMS Steering Committee (National ICRMS Steering Committee), National ICRMS Technical Committee (National ICRMS Technical Committee)
Co chair
National Treasury (Both committees; technical representatives for the National ICRMS Technical Committee), Commission on Revenue Allocation (Both committees; technical representatives for the National ICRMS Technical Committee)
Member
Council of Governors (Steering Committee; technical reps on Technical Committee), Office of the Controller of Budget (Named in the representation paragraph for both committees and in the Steering Committee membership cell), Office of the Auditor-General (Named in the representation paragraph for both committees and in the Steering Committee membership cell), ICT Authority (Both committees)
Office
County Executive Committee (CEC) Members for Finance (Selected members named in the representation paragraph for both committees and in the Steering Committee membership cell), County ICT Directors (Technical Committee membership)
System
Integrated County Revenue Management System (Subject of committee governance)
Provision 11 1 1
The governance of the centralized Integrated County Revenue Management System (ICRMS) shall be anchored in two interlinked committees: the National ICRMS Steering Committee and the National ICRMS Technical Committee. Both shall be co-chaired by the National Treasury and the Commission on Revenue Allocation (CRA), with representation from the Council of Governors (CoG), the Office of the Controller of Budget (CoB), the Office of the Auditor-General (OAG), the ICT Authority (ICTA), and selected County Executive Committee (CEC) Members for Finance.
Establishment 10
Link

Body
County ICRMS Committee (A committee in each County Government)
Appointing authority
County Governments (Each County Government shall establish a County ICRMS Committee)
Office
County Executive Committee (CEC) Members for Finance (CEC Member for Finance, chair)
Provision 11 1 2
Each County Government shall establish a County ICRMS Committee, chaired by the CEC Member for Finance, with membership from ICT, internal audit, legal, revenue, and planning departments.
Provision 11 1 3
The committee shall oversee local deployment, ensure cross-departmental co-ordination, approve system customisations, and escalate policy issues to the national level.
Establishment 11
Link

Body
Project Implementation Units (At both national and county levels)
Provision 11 1 5
Dedicated Project Implementation Units shall be established at both national and county levels:
Public finance notice 12
Link

Body
National PIU (National implementation coordination), National Treasury (Central development, coordination, financing and monitoring), County PIU (County implementation coordination), County Governments (Local deployment budgeting, monitoring and compliance reporting), Office of the Auditor-General (Annual system audits), County Internal Audit departments (Annual system audits in conjunction with the Office of the Auditor-General), Commission on Revenue Allocation (Recipient of quarterly compliance reports and periodic assessor of system efficacy and efficiency)
System
Integrated County Revenue Management System
National piu duties
11.1.5.1. The National PIU, domiciled at the National Treasury, shall coordinate vendor engagement, configuration, helpdesk services, national training, integration testing, and release management.
County piu duties
11.1.5.2. Each County PIU shall coordinate local infrastructure setup, user training, change management, and day-to-day liaison with the National PIU during rollout and support phases
Financing framework
The Integrated County Revenue Management System (ICRMS) shall be centrally developed and coordinated by the National Treasury. The financing structure shall be guided by the Public Finance Management Act, 2012, and uphold the principles of sustainability, transparency, and value for money.
National financing
11.3.1 The National Treasury shall finance the core platform development, infrastructure, licensing, hosting, and national-level support services.
County financing
11.3.2 Each County Government shall budget for its respective local deployment costs, including equipment, internet connectivity, training, onboarding, and change management.
Cost sharing
11.3.3 Cost-sharing obligations, where applicable, shall be defined and agreed upon in the Intergovernmental Framework Agreement signed between the National Treasury and County Governments.
Financial commitments
11.3.4 All financial commitments shall be reflected in approved budgets and implemented in accordance with the Public Finance Management Act, 2012.
Risk framework
1. Counties shall adopt the Risk Management Framework (Annex 5) to identify, assess, mitigate, and monitor risks.
Key risks
2. Key risks: Prolonged System breakdown, Data loss, vendor lock-in, user resistance, privacy breaches.
Data migration
11.4.1. All data migration shall follow the Data Migration and Cutover Plan (Annex 8) to ensure accuracy, integrity, and minimal disruption.
Monitoring purpose
12.1. Purpose: To ensure accountability, continuous improvement, and compliance with Standards and Guidelines.
Accuracy principle
1. Accuracy: Data must be factual and verifiable.
Timeliness principle
2. Timeliness: Reports submitted on schedule.
Transparency principle
3. Transparency: Findings accessible to authorised stakeholders.
Consistency principle
4. Consistency: Standardised formats across counties.
Actionability principle
5. Actionability: Findings used for corrective action.
Monitoring framework
12.3. A robust monitoring mechanism shall be instituted to ensure the proper functioning, compliance, and continual enhancement of the centralized ICRMS platform.
Continuous monitoring
12.3.1 Continuous System Monitoring: The County, in collaboration with the National Treasury, shall conduct daily system checks to ensure real-time system integrity, data accuracy, uptime, and incident management.
Compliance reporting
12.3.2 Strategic Compliance Reporting: The County shall submit quarterly compliance reports using the Risk and Compliance Reporting Template (Annex 5) to CRA, National Treasury, and other oversight agencies.
Annual audits
12.3.3 Annual System Audits: The Office of the Auditor-General (OAG), in conjunction with County Internal Audit departments, shall conduct annual audits of ICRMS to evaluate system controls, financial accuracy, legal compliance, and data governance.
Performance assessment
12.3.4 Performance Assessment by CRA: In alignment with its constitutional mandate under Article 216(2) (to advise on financial management), the Commission on Revenue Allocation (CRA) shall periodically assess the efficacy and efficiency of ICRMS deployment and usage across counties
Targeted audits
12.3.5 Targeted Compliance Audits: Periodic compliance audits shall utilize the standardised Compliance Audit Checklist (Annex 4) to evaluate alignment with functional requirements, technical standards, data governance, and service-level commitments.
Performance indicators
12.4. The performance of the ICRMS shall be monitored and evaluated using the following minimum Key Performance Indicators (KPIs). These indicators shall guide service-level agreements (SLAs), compliance audits, and overall system performance assessments.
System uptime
12.4.1 System Uptime: The system shall maintain a minimum uptime of 99.5% on a monthly basis, excluding scheduled maintenance windows.
Legislation notice 13
Link

Issuing authority
Commission on Revenue Allocation (Compliance enforcement and review of the Standards and Guidelines.), Chairperson, Commission on Revenue Allocation
Body
National Treasury (Subject to compliance requirements and involved in issuing formal Compliance Notices.), Council of Governors (Co-ordination in issuing formal Compliance Notices.), Intergovernmental Budget and Economic Council (Receives escalated matters concerning persistent or recurrent breaches.)
Integration platform
IFMIS, SCOA, BRS, IPRS
Integration compliance
12.4.2 Integration Compliance: The system shall comply with all mandatory integration requirements, including seamless interoperability with IFMIS, SCOA, BRS, IPRS, and other designated national platforms.
Ledger auto reconciliations
12.4.3 Customer Ledger Auto-Reconciliations: All transactions processed by the system shall automatically post to the customer and transaction ledgers, with no manual interventions required, ensuring reconciliation accuracy and auditability.
User satisfaction index
12.4.4 User Satisfaction Index: User feedback shall be periodically measured through structured surveys, with a minimum target satisfaction index of 80% across system usability, responsiveness, and support services.
Security incidents
12.4.5 Security Incidents: The system shall maintain zero tolerance for unresolved critical security incidents, with all reported incidents addressed within defined SLA timelines, and continuous monitoring for vulnerabilities.
Reporting capability
12.4.6 Reporting Capability: The system shall demonstrate the ability to generate all mandatory statutory, financial, audit, and management reports in real-time or near real-time, in accordance with formats prescribed in these Guidelines.
Transaction processing capacity
12.4.7 Transaction Processing Capacity: The system shall process a minimum of 2,000,000 transactions per second (TPS), ensuring scalability to handle peak demand across all 47 counties without performance degradation
Compliance enforcement
12.5. Compliance Enforcement; 12.5.1 Notice and Corrective Action: In the event of material non-compliance with these Standards and Guidelines by a County Government or the National Treasury:
Compliance notice
12.5.2 The Commission, in co-ordination with the National Treasury and Council of Governors shall issue a formal Compliance Notice, specifying the breach and a mandatory 90-day remediation period.
Remedial plan
12.5.3 The entity in breach shall submit a written Remedial Plan, monitored by CRA, to restore compliance within the allotted timeframe.
Escalation condition
12.5.4 Escalation for Continued Non-Compliance: If the breach persists or is recurrent:
Escalation procedure
12.5.4.1 CRA shall escalate the matter to the Intergovernmental Budget and Economic Council (IBEC) as per procedures in the Intergovernmental Relations Act.
Support suspension
12.5.4.2 Access to support or updates may be temporarily suspended for non-compliant counties, subject to agreed terms.
Dispute resolution
12.5.5 Dispute Resolution; 12.5.5.1 Dispute resolutions shall be conducted as per the intergovernmental relations Act
Compliance documentation
12.5.6 Documentation and Transparency; 12.5.6.1 All compliance actions, resolutions, and outcomes shall be documented and shared with relevant oversight bodies.
Compliance transparency
12.5.6.2 CRA may publish anonymized compliance summaries to promote transparency and peer accountability
Review interval
13. Review, Amendment and Effective Date; 13.1. These Standards and Guidelines shall be reviewed every three (3) years by the Commission on Revenue Allocation in consultation with the relevant stakeholders.
Early review trigger
13.2. An early review may be triggered by: 1. Major legal or constitutional changes;
Early review trigger
13.2. 2. Technological advancements;
Early review trigger
13.2. 3. Persistent non-compliance or systemic failures.
Review process
13.3. The review process shall include: 1. Stakeholder consultations;
Review process
13.3. 2. Technical validation;
Revised guidelines publication
13.4. Revised guidelines shall be gazetted as a statutory notice.
Effective
13.5. These Standards and Guidelines takes effect immediately upon gazettement.
Annexes
14. Annexes: Note: All annexes are binding and form an integral part of these Standards and Guidelines .
Legislation notice 14
Link

Purpose
This annex specifies the minimum functional requirements for the Integrated County Revenue Management System (ICRMS) to ensure that deployments are compliant, interoperable, and support the complete revenue lifecycle from source registration to reporting and audit.
Scope
These requirements apply to all ICRMS deployments, whether county-specific or part of a national centralized system, and must be adhered to in procurement, development, implementation, commissioning, and operation.
Public finance notice 15
Link

Purpose
This annex outlines the minimum technical specifications and compliance requirements for the ICRMS to ensure security, scalability, interoperability, and operational performance across county governments.
Scope
Applies to all ICRMS implementations, whether developed in-house, procured commercially, or provided as part of a centralized national platform, and must be adhered to during procurement, implementation, commissioning, and operation.
Specify technical requirements 16
Link

Standards body
Open Web Application Security Project (OWASP ASVS compliance)
Integration body
BRS (Integration with BRS), NTSA (Integration with NTSA)
Specify technical requirements 17
Link

Type
Specify technical requirements
Specify technical requirements 18
Link

Requirements
TR.44–TR.47
Set procurement evaluation criteria 19
Link

Body
Procurement Evaluation Committees (Procurement and compliance evaluation matrix applies.), Commissioning Teams (Procurement and compliance evaluation matrix applies.), Oversight/Audit Teams (Procurement and compliance evaluation matrix applies.), BRS (Named in the integration and interoperability criterion.), NTSA (Named in the integration and interoperability criterion.)
Purpose
To provide a standard evaluation matrix for uniform, transparent, and objective assessment of ICRMS proposals during procurement, commissioning, and compliance reviews.
Scope
Applies to Procurement Evaluation Committees, Commissioning Teams, and Oversight/Audit Teams.
Specify compliance audit scope 20
Link

Body
County Governments (Operating the ICRMS; compliance audit tool applies.), National Implementing Agencies (Operating the ICRMS; compliance audit tool applies.), Internal Audit (User of the compliance audit tool.), CRA (User of the compliance audit tool.), National Treasury (User of the compliance audit tool.)
Office
Auditor-General (User of the compliance audit tool.)
Purpose
Structured compliance checklist for commissioning, post-implementation, annual audits, and spot checks.
Scope
Applicable to all County Governments and National Implementing Agencies operating the ICRMS; used by Internal Audit, CRA, National Treasury, Auditor-General, and QA consultants.
Compliance audit checklist 21
Link

Registry
BRS (Central registry linked to BRS.)
Public finance notice 22
Link

Purpose
Establish a standard approach for identifying, assessing, mitigating, and monitoring risks during the lifecycle of the ICRMS.
Scope
Applies to county ICRMS operations, national central deployments, and third-party service providers.
Sets out risk register 23
Link

Risk categories
Business Continuity; Vendor Management; GIS and Field Ops
Sets out sample service level agreement 24
Link

Purpose
Defines performance standards, responsibilities, and remedies for the provision, operation, and support of the ICRMS by the Vendor to the Client.
Scope of services
Hosting and infrastructure (if applicable); application maintenance; integration maintenance; security management; DR/BCP; helpdesk and incident management; training and documentation updates.
Reporting and review
Monthly service performance reports; quarterly review meetings for SLA performance and continuous improvement.
Public finance notice 25
Link

Escalation contact
Service Desk / Helpdesk Officer (1. Service Desk / Helpdesk Officer), Vendor Support Manager (2. Vendor Support Manager), Vendor CTO / Senior Management (3. Vendor CTO / Senior Management), Client ICRMS Steering Committee (4. Client ICRMS Steering Committee)
Stakeholder consulted
The National Treasury and Economic Planning (National Government Agencies), Ministry of ICT and Digital Economy (National Government Agencies), Ministry of ICT (National Government Agencies), Office of the Controller of Budget (National Government Agencies), Office of the Auditor-General (National Government Agencies), Commission on Revenue Allocation (National Government Agencies), County Executive Committees for Finance and ICT (County Governments), County Treasuries (County Governments), County Assemblies’ Finance Committees (County Governments), County Revenue Boards/Directorates (County Governments), Council of Governors (Intergovernmental Bodies), Intergovernmental Budget and Economic Council (Intergovernmental Bodies), World Bank (Development Partners and Civil Society), UNDP (Development Partners and Civil Society), GIZ (Development Partners and Civil Society), USAID (Development Partners and Civil Society)
Document
Integrated County Revenue Management System (ICRMS) Standards and Guidelines
Penalty limit
Cumulative penalties in a quarter shall not exceed 25% of the quarterly service fee. Persistent non-compliance may trigger contract termination.
Escalation path
1. Service Desk / Helpdesk Officer 2. Vendor Support Manager 3. Vendor CTO / Senior Management 4. Client ICRMS Steering Committee
Change management
All system changes must be approved by the Client and tested in a staging environment before production deployment.
Termination exit management
Upon termination, Vendor shall provide latest system backup in open format, updated documentation, transfer of source code/configurations (as per contract), and knowledge transfer to Client or replacement vendor.
Consultation purpose
This annex documents the stakeholder engagement process undertaken in the formulation of the Integrated County Revenue Management System (ICRMS) Standards and Guidelines, in compliance with Article 10 and Article 232 of the Constitution of Kenya and applicable public participation laws.
Consultation scope
The consultation record covers identification of relevant stakeholders, engagement methods used, key issues raised, and how they were addressed in the final Guidelines.
Stakeholder groups consulted
1. National Government Agencies: The National Treasury and Economic Planning; Ministry of ICT and Digital Economy; Ministry of ICT; Office of the Controller of Budget; Office of the Auditor-General; Commission on Revenue Allocation 2. County Governments: County Executive Committees for Finance and ICT; County Treasuries; County Assemblies’ Finance Committees; County Revenue Boards/Directorates 3. Intergovernmental Bodies: Council of Governors (CoG); Intergovernmental Budget and Economic Council (IBEC) 4. Development Partners and Civil Society: World Bank; UNDP; GIZ; USAID; civil society organisations advocating for transparency and good governance 5. Private Sector: ICRMS solution providers and integrators; banking and payment service providers; telecommunications companies 6. General Public: Taxpayers; business associations; resident associations; traders
Supporting evidence checklist
[ ] Stakeholders notices and invitations issued [ ] Draft guidelines circulated for comment [ ] Attendance registers for all meetings [ ] Minutes and recordings of consultations [ ] Written submissions from stakeholders [ ] Feedback matrix linking comments to guideline changes
Data migration cutover purpose
This annex provides a structured framework to ensure safe, accurate, and efficient migration of data from legacy revenue management systems and/or manual records into the ICRMS, with minimal disruption to service delivery and no loss of data integrity.
Public finance notice 26
Link

Body
County Governments (County Governments deploying ICRMS), National Implementing Agencies (National Implementing Agencies deploying ICRMS), County ICT Unit (Co-ordinate migration; validate technical tools; manage backups and environments.), County Finance/Revenue Dept (Validate SCOA mappings; verify ledger and transaction accuracy.), Vendor Migration Team (Provide migration tools; execute migration and cutover; resolve issues.), Audit/QA Team (Independently verify migration quality and compliance.), Commission on Revenue Allocation (Offer Technical Capacity Assistance)
Office
Data Protection Officer (Ensure compliance with privacy laws during migration.), Project Manager (Oversee migration timeline, scope, and resources.)
Scope
Applies to all County Governments and National Implementing Agencies deploying ICRMS, including migration from legacy systems (e.g., LAIFOMS and earlier RMS), transition from manual registers, and consolidation of multiple systems into ICRMS.
Migration principle 1
Accuracy: Migrated data must match verified source data exactly.
Migration principle 2
Completeness: All relevant historical and current records must be migrated.
Migration principle 3
Integrity: Relationships between records (e.g., customer-ledger-transactions) must be preserved.
Migration principle 4
Compliance: Data must comply with SCOA coding, Data Protection Act, and statutory retention rules.
Migration principle 5
Auditability: Every migration step must be logged and documented.
Migration principle 6
Minimal Downtime: Cutover must be planned to avoid prolonged service interruptions.
Public finance notice 27
Link

Body
TNT (Responsibility for System Overview, Functional User Training and Technical/Admin Training.), CG (Responsibility for Technical/Admin Training.)
Purpose
This annex outlines the structured approach for managing organisational change, stakeholder adoption, and capacity building during the transition to the ICRMS.
Communication guideline 1
Pre-Go-Live: Weekly updates, FAQs, early demos.
Communication guideline 2
Go-Live: Daily updates, escalation contacts, public notices.
Communication guideline 3
Post-Go-Live: Success stories, usage stats, surveys.
Adoption success criterion 1
User login frequency and transaction volumes.
Adoption success criterion 2
Helpdesk ticket trends and resolution times.
Adoption success criterion 3
Compliance with new processes and decommissioning of manual systems within 3 months.
Public finance notice 28
Link

System
ICRMS
Adoption success criterion 4
≥90% of targeted users trained; ≥80% competency scores post-training.
Adoption success criterion 5
≥80% stakeholder satisfaction in surveys; adoption metrics meet projections.
Reports catalogue purpose
This annex defines the minimum set of reports that the ICRMS must produce to meet statutory, operational, management, analytical, and transparency requirements.
Public finance notice 29
Link

Owner
County Government (Data Owner; legal ownership of ICRMS data within its jurisdiction.), National Implementing Agency (Central System-National Treasury) (Ownership of central repository and inter-county integration data; oversight inspections.)
Technical custodian
ICT Unit (Technical custodian of databases, backups, and recovery operations.)
Records custodian
Revenue Department (Custodian of taxpayer and transaction records; enforces SCOA compliance.)
Office
Data Protection Officer (Ensures compliance with data protection laws and privacy policies.)
Auditor
Internal Audit (Verifies governance controls and data accuracy; conducts Annual Data and Records Governance Audit.)
Oversight body
CRA (Oversight inspections.)
System
ICRMS (System whose data and records are governed by Annex 11.)
Purpose
Establish the rules, responsibilities, and standards for secure, accurate, and compliant management of all data and records within the ICRMS, ensuring transparency, accountability, and long-term integrity.
Scope
Covers all data captured, processed, stored, or transmitted by the ICRMS including taxpayer and revenue records, SCOA-coded transactions, audit logs and configuration changes, backups, archives, and purged records.
Retention
1. Retention: Financial, transactional, and audit data retained for at least 7 years.
Archiving
2. Archiving: Inactive records archived after 2 years but retrievable for audit.
Purging
3. Purging: Allowed only after retention period, with multi-level authorisation and audit logging.
Backup
4. Backup: Daily full + hourly incremental; quarterly restore tests (TR. 36).
Access review
1. Quarterly review of user access rights; immediate revocation after role change or exit.
Security testing
2. Annual penetration testing; quarterly vulnerability scans.
Log review
3. Review logs for suspicious activity and investigate anomalies.
Compliance monitoring
1. Annual Data and Records Governance Audit by Internal Audit; CRA/National Treasury oversight inspections.
Governance indicators
2. Key Governance Indicators (KGIs): % records with complete SCOA mapping; % records meeting accuracy benchmarks; unauthorised access incidents; backup and restore success rates.
Standardise definitions 30
Link

Purpose
Standardises the definitions and abbreviations used throughout the Standards and Guidelines to ensure clarity, accuracy, and uniform interpretation.
Defines acronyms 31
Link

Body
County Executive Committee, Council of Governors, Commission on Revenue Allocation, Intergovernmental Budget and Economic Council, Kenya Revenue Authority, National Transport and Safety Authority, Office of the Controller of Budget
Public finance notice 32
Link

Issuing authority
Commission on Revenue Allocation
Body
County Governments, National Government (National Government implementing entities)
Office
Chairperson, Commission on Revenue Allocation, Ag. Commission Secretary/Chief Executive Officer
Instrument
Annexes to the Integrated County Revenue Management System (ICRMS) Standards and Guidelines
Approval date
8 September 2025
Action
Reviewed and approved for publication and implementation
Purpose
To promote prudent use of public resources, ensure value for money, and enhance revenue generation and management across all County Governments and National Government implementing entities.

Schedule 351 rows

Rows 1 to 200 of 351.

11.1.1 National ICRMS Committees
Committee	Membership	Mandate	Key Responsibilities
National ICRMS Steering Committee	- Co-Chairs: National Treasury and CRA - Members: CoG, CoB, OAG, ICTA, selected CECs Finance	Strategic and policy-level oversight of the centralized ICRMS	1. Provide strategic leadership and direction for ICRMS implementation. 2. Approve major policy directives, system enhancements, and rollout schedules. 3. Resolve policy-level disputes and foster intergovernmental consensus. 4. Endorse intergovernmental framework agreements and service level arrangements. 5. Guide sustainability, compliance, and accountability in line with the Constitution and PFM Act, 2012.
National ICRMS Technical Committee	- Co-Chairs: National Treasury and CRA (technical representatives) - Members: ICTA, CoG technical reps, County ICT Directors, system vendors (as needed)	Technical and operational oversight in support of the Steering Committee	1. Coordinate system design, configuration, and integration with IFMIS, SCOA, BRS, IPRS. 2. Develop and enforce technical and functional standards. 3. Evaluate system changes, upgrades, and vendor deliverables. 4. Monitor performance, manage incidents, and track KPIs. 5. Support capacity building, training, and technical support. 6. Advise the Steering Committee on risks, innovations, and emerging issues.

INTEGRATED COUNTY REVENUE MANAGEMENT SYSTEM (ICRMS) STANDARDS AND GUIDELINES
Annex No.	Title
Annex 1:	Minimum Functional Requirements Checklist for the ICRMS
Annex 2:	Minimum Technical Requirements Checklist for the ICRMS
Annex 3:	Procurement and Compliance Evaluation Matrix
Annex 4:	Compliance Audit Tool for the ICRMS
Annex 5:	Risk Management Framework for the ICRMS
Annex 6:	Sample Service Level Agreement (SLA) for the ICRMS
Annex 7:	Stakeholder Consultation Record
Annex 8:	Data Migration and Cutover Plan
Annex 9:	Change Management and Training Plan
Annex 10:	Standard Reports Catalogue
Annex 11:	Data and Records Governance
Annex 12:	Glossary and Acronyms

Functional Requirements
Ref No.	Functional Area	Requirement Description	Priority	Test Procedure	Evidence Required
FR.1	Registry and Identity Management	Maintain a central register of taxpayers/ratepayers/businesses with National ID, KRA PIN, and BRS Number; support many-to-many relationships (entity↔revenue streams, parcels, accounts) and scale to ≥1M records.	M	Create/update/search sample records; merge duplicates; run API query.	Screenshots; search logs; API spec.
FR.2	Registry and Identity Management	Link a single entity to multiple revenue streams (land rates, SBP, parking, market fees, etc.).	M	Link ≥3 streams to one taxpayer; generate consolidated account.	Consolidated account report.
FR.3	Registry and Identity Management	Store and retrieve supporting documents (ID, licences, plans) against each profile.	M	Upload and retrieve documents for sample record.	Document logs.
FR.4	Registry and Identity Management	Detect and flag duplicate accounts for review; merge with audit trail.	M	Create duplicate entries; system flags; merge.	Duplicate detection report.
FR.5	Registry and Identity Management	Maintain full history of all interactions (applications, inspections, bills, payments, licences).	M	Open sample record; review history.	History log export.
FR.6	Registry and Identity Management	Maintain individual customer/ratepayer ledgers showing all transactions, running balances, and aging, in addition to system journals.	M	View sample ledger; verify accuracy against transactions.	Ledger report.
FR.7	Registry and Identity Management	Maintain full transaction ledgers for each revenue stream with SCOA coding.	M	Generate stream ledger report; verify SCOA mapping.	Transaction ledger export.
FR.8	Registry and Identity Management	Search registry by multiple criteria (name, ID, PIN, location, status).	M	Run multi-criteria search; verify results.	Search results screenshot.
FR.9	Registry and Identity Management	Bulk import/export registry data (CSV/Excel) with validation.	M	Import test file; review validation logs.	Import/export logs.
FR.10	Revenue Source and Tariff Management	Configure revenue streams as per Finance Act, Tariff and Pricing Policy, or Schedules.	M	Load tariff schedule; check application.	Tariff configuration logs.
FR.11	Revenue Source and Tariff Management	Add new revenue streams without vendor intervention; set tariffs, SCOA codes, and parameters.	M	Create a new stream; generate bill.	Stream creation log.
FR.12	Revenue Source and Tariff Management	Rule-based engine to compute fees, penalties, interest; maintain version history with effective/expiry dates, reason codes, and audit trail of changes.	M	Configure 10+ tariffs; simulate bulk changes; show version history.	Config guide; change log.
FR.13	Revenue Source and Tariff Management	Upload multiple tariffs in bulk from Finance Bill or Tariff Policy, including zone-based rates.	M	Import bulk tariff file; verif in system.	Import log; tariff list.
FR.14	Revenue Source and Tariff Management	Map all revenue items to Standard Chart of Accounts codes; enforce mapping before billing.	M	Attempt unmapped billing system blocks.	SCOA mapping report.
FR.15	Revenue Source and Tariff Management	Maintain register of county-owned assets tied to revenue streams (markets, buildings, equipment).	M	Add asset; link to revenu stream.	Asset register export.
FR.16	Revenue Source and Tariff Management	Geo-reference revenue sources for spatial planning and enforcement; support shapefiles/GeoJSON import, layer-based queries, and spatial analytics.	S	Map sample sources; view o GIS layer.	GIS map screenshot; integration doc.
FR.17	Revenue Source and Tariff Management	Configure billing frequencies per stream (daily, monthly, annually, seasonal).	M	Change billing cycle; generat bills.	Billing config logs.
FR.18	Revenue Source and Tariff Management	Apply penalties/interest automatically; approve waivers/exemptions with thresholds, reason codes, and document attachments; enforce maker-checker.	M	Process penalty and waive check audit trail.	Waiver workflow log.
FR.19	Revenue Source and Tariff Management	Categorize streams (by ward, market, category) and set revenue targets.	S	Assign targets; ru performance report.	Target allocation file.
FR.20	Applications, Billing, Payments, Receipting	End-to-end workflow from application → inspection → billing → payment → licence/permit.	M	Apply for service; follow t licence issue.	Workflow screenshots.
FR.21	Applications, Billing, Payments, Receipting	Customizable checklists for each service; enforce before billing.	M	Configure checklist; subm application.	Checklist config export.
FR.22	Applications, Billing, Payments, Receipting	Auto-flag accounts for renewal; send reminders via SMS/email/USSD.	M	Simulate renewal period; sen reminder.	Reminder logs.
FR.23	Applications, Billing, Payments, Receipting	Accept payments via mobile money, EFT, cards, USSD, agency banking; support offline queueing with sync; handle reversals/chargebacks.	M	Process payments via eac channel; simulate offline sync	Payment logs.
FR.24	Applications, Billing, Payments, Receipting	Issue receipts instantly; send confirmation to payer.	M	Complete payment; chec confirmation.	Receipt copy; SMS/email log.
FR.25	Applications, Billing, Payments, Receipting	Match daily collections with bank/wallet statements (T+1); maintain exception worklists and closure SLAs (≤1% unresolved after T+3).	M	Import bank file; auto-match review exceptions.	Reconciliation report.
FR.26	Applications, Billing, Payments, Receipting	Process refunds and reversals with approval workflow and audit trail.	M	Initiate reversal; check logs.	Reversal log.
FR.27	Applications, Billing, Payments, Receipting	Support partial payments, overpayments (credit wallets), and split payments.	S	Test each case; verif balances.	Payment allocation report.
FR.28	Applications, Billing, Payments, Receipting	Generate invoices (PDF + e-bill); unique payment refs; mass billing; re-billing with traceability; batch ≥100k invoices in <30 mins.	M	Run batch test; verify lineage	Batch report; runbook.
FR.29	Debt Management and Enforcement	Generate aging reports (30/60/90/180+ days), by stream/ward.	M	Produce report for sampl data.	Aging report.
FR.30	Debt Management and Enforcement	Create installment plans; monitor compliance.	M	Set plan; test missed paymen alert.	Payment plan report.
FR.31	Debt Management and Enforcement	Automated reminders (SMS/email/app), dunning workflow with escalation.	M	Trigger reminders; check log	Reminder logs.
FR.32	Debt Management and Enforcement	Case management; field assignment; GPS/time-stamped actions; outcome tracking; ≥90% cases geo-stamped.	S	Issue e-ticket; inspect GP logs.	Enforcement logs; field app demo.
FR.33	Debt Management and Enforcement	Restrict repeat offenders; allow policy-based exemptions.	S	Add/remove from list; verif block.	Blacklist log.
FR.34	User, Collector and Agent Management	Register revenue staff; assign roles per organogram.	M	Add staff; assign role.	Staff registry export.
FR.35	User, Collector and Agent Management	Assign collectors to sources/targets; monitor performance.	M	Allocate targets; review report.	Target assignment log.
FR.36	User, Collector and Agent Management	Register/manage external collection agents; assign roles and targets.	S	Add agent; set target; check report.	Agent assignment log.
FR.37	User, Collector and Agent Management	Real-time staff/agent performance metrics.	S	Display live dashboard.	Dashboard screenshot.
FR.38	Self-Service and Access Channels	Allow taxpayers to access accounts, bills, payments, receipts, applications, support tickets; OTP login; WCAG accessibility compliance.	M	Log in; complete payment; verify accessibility.	Portal transaction log; test scripts.
FR.39	Self-Service and Access Channels	Enable low-bandwidth access via USSD for key services.	S	Dial USSD; complete task.	USSD session log.
FR.40	Self-Service and Access Channels	Provide officer app (assess, inspect, enforce) and taxpayer app (pay, view, renew); offline-first with sync conflict handling.	S	Demo apps; test offline sync.	App demos; device policy.
FR.41	Self-Service and Access Channels	Ensure compliance with accessibility standards; multilingual support (EN/SWA).	S	Switch language; view accessibility tools.	Accessibility settings log.
FR.42	Configuration, Period Close and Reporting	Update rates, cycles, penalties without coding changes; support multi-language and geo parameters (wards, streams, holidays).	M	Change rate; apply in bill.	Config change log.
FR.43	Configuration, Period Close and Reporting	Perform daily ledger posting, reconciliation, and reporting with system lock; support authorised re-opens.	M	Run EoD; attempt back-dated entry.	EoD report; lock log.
FR.44	Configuration, Period Close and Reporting	Period lock, roll forward balances, age debt, generate monthly reports.	M	Run EoM; check ledgers/reports.	EoM reports.
FR.45	Configuration, Period Close and Reporting	Close fiscal year, carry forward arrears/balances, archive year-specific parameters and tariffs.	M	Run EoY; verify opening balances.	EoY close report.
FR.46	Configuration, Period Close and Reporting	Generate statutory, management, and ad-hoc reports (≥30 standard reports); ad-hoc builder; export CSV/XLSX/JSON.	M	Run sample reports; export.	Report catalogue; samples.
FR.47	Configuration, Period Close and Reporting	Produce SCOA-coded exports compatible with IFMIS.	M	Export sample; import to IFMIS test.	Export file; IFMIS log.
FR.48	Configuration, Period Close and Reporting	Generate maps and spatial reports for mapped revenue sources.	S	Run GIS query.	GIS map screenshot.
FR.49	Configuration, Period Close and Reporting	Produce logs of all sensitive actions/configuration changes; tamper-evident hash; role-based retrieval; retain ≥7 years.	M	Generate audit report; verify hash.	Audit log export.
FR.50	Configuration, Period Close and Reporting	Provide REST/JSON APIs (OAuth2/OpenID), webhooks, API throttling and versioning; API uptime ≥99%, p95 latency ≤2s.	M	Review API docs; run test calls.	API documentation; monitoring screenshots.

Technical Requirements Table
Ref No.	Technical Area	Requirement Description	Priority	Test Procedure	Evidence Required
TR.1	System Architecture and Hosting	Adopt modular/service-oriented or microservices architecture; include stateless APIs and message queue for asynchronous jobs; support independent upgrades; scale to ≥200% projected volumes over 5 years; define auto-scaling thresholds.	M	Review architecture diagrams; simulate load test.	Architecture doc; load test results.
TR.2	System Architecture and Hosting	Support on-premises, GoK-approved data center, compliant local cloud, or hybrid; conduct security and Total Cost of Ownership (TCO) assessment for chosen deployment.	M	Inspect hosting setup; review assessment.	Hosting certificate; TCO/security report.
TR.3	System Architecture and Hosting	For centralized deployments: provide logical data segregation, per-county encryption keys, and per- tenant admin roles.	M	Inspect multi-tenancy config; run segregation tests.	Multi-tenancy config report.
TR.4	System Architecture and Hosting	Achieve ≥99.5% uptime per quarter; include failover mechanisms and load balancing.	M	Review monitoring logs; conduct failover test.	Uptime report; failover log.
TR.5	System Architecture and Hosting	Provide separate dev, test, training, and production environments; enable controlled promotion of configurations.	M	Inspect environment structure.	Environment config report.
TR.6	Infrastructure	Use enterprise-grade redundant infrastructure; NVMe/SAN storage for DB; TLS termination at load balancer.	M	Inspect hardware specs; test TLS.	Infra inventory; TLS config log.
TR.7	Infrastructure	On-premises setups to have UPS, generator backup, controlled access, CCTV, and environmental monitoring.	M	Inspect facilities; review monitoring.	Facility inspection report.
TR.8	Infrastructure	Automated, encrypted backups (daily full + hourly incrementals); quarterly restore tests.	M	Review backup config; perform restore.	Backup log; restore report.
TR.9	Software Stack and Development Practices	Use supported Long-Term Support (LTS) operating systems; relational database with ACID compliance; implement read replicas for analytics workloads.	M	Review OS/DB versions; verify replica configuration.	OS/DB version list; replica status report.
TR.10	Software Stack and Development Practices	Implement CI/CD pipeline; perform SAST(Static Application Security Testing) and DAST(Dynamic Application Security Testing); maintain artifact repository; adopt Infrastructure as Code (IaC).	M	Review DevSecOps configuration; check automated test reports.	CI/CD configuration docs; SAST/DAST reports.
TR.11	Software Stack and Development Practices	Maintain centralized logging (ELK or equivalent), performance metrics, and APM traces; define and configure alert thresholds.	M	Inspect logging setup; trigger alerts to validate thresholds.	Logging configuration; sample alert records.
TR.12	Software Stack and Development Practices	Ensure compliance with Government Enterprise Architecture (GEA), Government Interoperability Framework (GIF), and OWASP ASVS(Open Web Application Security Project / Application Security Verification Standard.)	M	Review compliance checklist and test results.	Compliance certification or signed checklist.
TR.13	Integration and Interoperability	Provide secure APIs/files for two-way integration with IFMIS; enforce Standard Chart of Accounts (SCOA) mapping on all transactions.	M	Generate SCOA-coded export; perform IFMIS import in test environment.	SCOA export file; IFMIS import log; mapping validation.
TR.14	Integration and Interoperability	Integrate with IPRS, BRS, NTSA, HMIS, and GIS platforms; use REST/JSON APIs with OAuth2/OpenID; apply mutual TLS (mTLS) for sensitive transactions.	M	Conduct API test calls; inspect secure connection configurations.	API test logs; API documentation; connection configs.
TR.15	Integration and Interoperability	Support integration with bank host-to-host, ISO 20022/8583 messaging where applicable, and mobile money APIs; ensure automated reconciliation.	M	Process test transactions across all financial rails; validate reconciliation outputs.	Payment logs; reconciliation reports; integration certificates.
TR.16	Integration and Interoperability	Provide documented, version-controlled APIs; enforce versioning (e.g., /v1); apply rate limits; ensure ≥99% API uptime and p95 latency ≤2s.	M	Inspect API documentation; run uptime and latency tests.	API monitoring reports; API portal screenshots.
TR.17	Integration and Interoperability	Provide sandbox credentials, Swagger/OpenAPI docs, sample payloads, error catalog, and integration test cases for all mandatory integrations.	M	Review artefact package; run sample integration tests.	Artefact inventory; integration test logs.
TR.18	Security and Privacy	Implement RBAC and ABAC to enforce least-privilege, segregation of duties, and maker-checker controls.	M	Review role/attribute matrix; simulate access; verify maker-checker.	Role/attribute config; access logs.
TR.19	Security and Privacy	Require MFA for privileged/admin accounts; support SSO(Single Sign-On) using SAML (Security Assertion Markup Language) and OIDC (OpenID Connect)	M	Attempt admin login to verify MFA; test SSO login.	MFA screenshots; SSO setup logs.
TR.20	Security and Privacy	Encrypt data in transit (TLS 1.2+) and at rest (AES-256); rotate keys regularly.	M	Inspect encryption configuration; review key rotation logs.	Security config; key rotation schedule.
TR.21	Security and Privacy	Conduct quarterly vulnerability scans and annual penetration tests; remediate critical vulnerabilities ≤30 days; high ≤60 days.	M	Review scan results and pen test reports; confirm remediation timelines.	Scan reports; pen test; remediation logs.
TR.22	Security and Privacy	Conduct DPIA(Data Protection Impact Assessment) for all modules; implement consent/notice mechanisms; embed privacy-by-design.	M	Inspect DPIA docs; test consent capture in workflows.	DPIA reports; consent logs.
TR.23	Security and Privacy	Maintain registry of authorized devices; enforce session timeouts and concurrent login limits; provide remote wipe.	M	Simulate lost device and perform remote wipe; review session logs.	Device registry; remote wipe report.
TR.24	Security and Privacy	Enable anti-tamper protections; log and alert on suspicious activities/config changes.	M	Attempt unauthorized alteration; review tamper logs.	Tamper protection config; tamper log export.
TR.25	Performance and Resilience	Process at least 1,200 transactions per second (TPS) across all channels during peak.	S	Perform load testing with simulated peak volumes.	Load test results; benchmark report.
TR.26	Performance and Resilience	Complete key transactions (billing, payment posting, receipting) within ≤2 seconds under normal load.	M	Time transactions during testing; verify thresholds.	Transaction timing logs.
TR.27	Performance and Resilience	Provide offline operation for core functions (billing, receipting, enforcement) with secure store-and-forward synchronization.	M	Simulate offline activity and sync; confirm data integrity.	Offline transaction logs; sync report.
TR.28	Performance and Resilience	Make GIS layers accessible offline on enforcement devices; synchronize updates when online.	S	Load and navigate offline GIS map; sync updates.	Offline GIS logs; sync confirmation.
TR.29	E-Enforcement and Field Operations	Integrate with mobile/POS devices for issuing enforcement notices, tickets, penalties with GPS/time-stamping.	M	Issue test e-ticket via device; verify GPS/time stamp.	Enforcement case log; GPS data report.
TR.30	E-Enforcement and Field Operations	Capture photographic, video, and document evidence linked to case records.	M	Upload test evidence to a case file; confirm linkage.	Case file with media.
TR.31	E-Enforcement and Field Operations	Provide configurable workflows for enforcement actions, assignment, escalation, and SLA tracking.	M	Execute sample workflow; verify SLA alerts.	Workflow config; SLA log.
TR.32	E-Enforcement and Field Operations	Enable export/API integration with external judicial systems for escalation to court or recovery agencies.	S	Export sample enforcement case; verify data receipt.	Export log; receiving system confirmation.
TR.33	Disaster Recovery and Business Continuity	Maintain in-country DR site with Recovery Point Objective(RPO) ≤15 minutes and Recovery Time Objective (RTO)≤2 hours.	M	Review DR architecture; conduct failover test.	DR documentation; failover logs.
TR.34	Disaster Recovery and Business Continuity	Conduct bi-annual DR drills; document failover/fallback with success criteria.	M	Execute DR drill; review results.	DR drill report; recovery metrics.
TR.35	Disaster Recovery and Business Continuity	Maintain BCP with manual fallback procedures, communication tree, and stakeholder notification templates.	M	Review BCP; simulate communication process.	Approved BCP; simulation report.
TR.36	Disaster Recovery and Business Continuity	Automated daily full backups and hourly incrementals; quarterly restore tests.	M	Inspect backup logs; perform test restoration.	Backup logs; restore verification.
TR.37	Disaster Recovery and Business Continuity	Automatic failover for critical services; quarterly failover tests.	M	Simulate outage and trigger failover; measure downtime.	Failover test results; monitoring logs.
TR.38	Reporting and Analytics	Reporting engine with ≥30 standard reports and ad-hoc builder; export to PDF, CSV, XLSX, JSON.	M	Generate sample reports; test exports.	Report catalogue; files.
TR.39	Reporting and Analytics	Configurable real-time dashboards showing revenue performance, targets, arrears, trends; data matches reports.	M	Compare dashboard metrics to reports.	Dashboard screenshots; comparison logs.
TR.40	Reporting and Analytics	Forecasting tools to project revenue trends and arrears recovery based on historical data.	S	Run forecast analysis on test data; verify model accuracy.	Forecast report; analytics configuration.
TR.41	Configuration and Extensibility	Allow rates, penalties, waivers, workflows, and forms via parameters; audit configuration changes.	M	Update parameters; verify change logs.	Config change log; settings.
TR.42	Configuration and Extensibility	Support English and Kiswahili interfaces and multiple currency formats.	S	Switch language; test currency display.	Language/currency settings logs.
TR.43	Configuration and Extensibility	Add new revenue streams with tariffs, SCOA codes, workflows, and reporting templates without vendor intervention.	M	Add new stream in test; verify.	Stream creation log; billing test.
TR.44	Data Management	Implement validation rules to prevent incomplete/invalid data; enforce mandatory fields.	M	Attempt to save invalid data; review errors.	Validation error log; config.
TR.45	Data Management	Provide migration tools including mapping, cleansing, trial loads, and reconciliation.	M	Perform trial migration; reconcile data.	Migration plan; reconciliation report.
TR.46	Data Management	Archive inactive records per retention; purge only after multi-level authorisation and audit logging.	M	Archive and purge samples in test.	Archive/purge logs; authorizations.
TR.47	Documentation and Handover	Deliver system design dossier, data model and dictionary, API docs, configuration runbooks, SOPs, admin/user manuals, test reports, training materials, and an escrow package (source code, build scripts).	M	Review documentation set for completeness and compliance.	Documentation inventory; escrow confirmation.

Procurement and Compliance Evaluation Matrix Table
Evaluation Area	Criteria	Linked FR/TR	Weight (%)	Scoring Method
Preliminary Evaluation	Submission of mandatory documents (bid security, tax compliance, signed forms, eligibility requirements).	N/A	Pass/Fail	All must be provided to proceed.
Functional Requirements Compliance	Meets all Mandatory FR items in Annex 1.	FR.1–FR.50	25%	Pass/Fail for mandatory; optional scored proportionally (0–1 per item).
Functional Requirements Compliance	Meets Optional/Should Have FR items.	FR.16, FR.19, FR.27, FR.30, FR.31, FR.33, FR.35, FR.39, FR.40, FR.42, FR.48	5%	Weighted score by optional items implemented.
Technical Requirements Compliance	Meets all Mandatory TR items in Annex 2.	TR.1–TR.47 (Mandatory)	25%	Pass/Fail for mandatory; points for exceeding minimum specs.
Technical Requirements Compliance	Meets Optional/Should Have TR items.	TR.25, TR.28, TR.32, TR.40, TR.42	5%	Weighted score by optional items implemented.
Integration and Interoperability	Successful integration with IFMIS, SCOA, IPRS, BRS, GIS, HMIS, NTSA, payment channels.	FR.14, FR.47, TR.13–TR.17	5%	Live/sandbox test evidence; error-free transactions.
Security and Compliance	Meets security, privacy, and data protection requirements; passes vulnerability and penetration testing.	TR.18–TR.24, TR.20–TR.22	5%	Review audit logs, security reports, test results.
Performance and Resilience	Meets throughput, uptime, offline capability, DR/BCP benchmarks.	TR.1, TR.4, TR.25–TR.28, TR.33–TR.37	5%	Load tests, DR drill reports, offline simulation.
Implementation Approach and Plan	Methodology, migration plan, training, change management, post-go-live support.	TR.45, TR.47, FR.42–FR.45	10%	Review project plan, timelines, resource allocation.
Vendor Experience and Capacity	ICRMS deployments in ≥3 counties; references; local technical team.	N/A	5%	Reference checks, team CVs.
Total Cost of Ownership (TCO)	5-year TCO including licences, hosting, maintenance, upgrades, training.	N/A	5%	Evaluate detailed cost breakdown.
Risk and Exit Strategy	Data portability, escrow, exit/migration plan, SLA commitments.	TR.47, FR.11, FR.49	5%	Review SLA, escrow agreement, exit plan.

Compliance Audit Checklist Table
Ref No.	Audit Area	Compliance Standard	Linked FR/TR	Test Procedure	Evidence Required
A4.1	Registry and Identity Management	Central registry linked to National ID, KRA PIN, BRS; supports many-to-many relationships; ≥1M record capacity.	FR.1	Inspect registry; search and link records; run API query.	Screenshots; API logs.
A4.2	Registry and Identity Management	Customer and transaction ledgers with SCOA coding in place.	FR.6, FR.7	View ledgers; verify SCOA mapping.	Ledger reports; SCOA export.
A4.3	Revenue Source and Tariff Management	All streams configured per Finance Act/Tariff Policy; version history maintained.	FR.10, FR.12	Compare system tariffs to legal schedule; review change logs.	Tariff config logs.
A4.4	Revenue Source and Tariff Management	SCOA mapping enforced for all billable items.	FR.14, TR.13	Attempt unmapped billing; confirm block.	SCOA mapping report.
A4.5	Applications, Billing, Payments	Batch billing capacity (≥100k in <30 mins) met; re-billing maintains lineage.	FR.28	Run batch; review logs.	Batch run logs.
A4.6	Applications, Billing, Payments	All mandatory payment channels active; offline queue and sync functional; reversals tracked.	FR.23, TR.27	Process payments; simulate offline mode.	Payment logs.
A4.7	Applications, Billing, Payments	Receipts issued instantly; confirmation sent to payer.	FR.24	Complete payment; verify receipt/SMS.	Receipt copy; SMS log.
A4.8	Applications, Billing, Payments	Daily T+1 reconciliation; ≤1% unresolved after T+3.	FR.25	Inspect recon reports; check closure rates.	Reconciliation logs.
A4.9	Debt Management and Enforcement	Aging reports generated; dunning workflow active.	FR.29, FR.31	Run arrears report; check reminders.	Aging report; reminder log.
A4.10	Debt Management and Enforcement	GPS/time-stamped enforcement actions logged; ≥90% geo-stamped.	FR.32, TR.29	Issue e-ticket; verify GPS logs.	Enforcement logs.
A4.11	Debt Management and Enforcement	Evidence capture linked to case files.	TR.30	Upload sample evidence to case; confirm.	Case file with media.
A4.12	Security and Privacy	Roles and attributes correctly configured; maker-checker in place.	TR.18	Review role matrix; simulate access.	Role config report.
A4.13	Security and Privacy	MFA enforced for privileged accounts; TLS 1.2+/AES-256 encryption active.	TR.19, TR.20	Test MFA; inspect encryption setup.	MFA logs; encryption config.
A4.14	Security and Privacy	Quarterly scans; annual pen test; critical vulns fixed ≤30 days.	TR.21	Review reports; confirm remediation dates.	Security reports.
A4.15	Security and Privacy	DPIAs completed; consent capture mechanisms functional.	TR.22	Inspect DPIA; test consent prompts.	DPIA docs; consent logs.
A4.16	Performance and Resilience	≥1,200 TPS at peak; ≤2s transaction response time.	TR.25, TR.26	Run performance test; measure response.	Load test reports.
A4.17	Performance and Resilience	Offline billing, receipting, enforcement operational; sync works.	TR.27	Simulate offline ops; sync data.	Offline logs.
A4.18	Disaster Recovery and BCP	DR site operational; RPO ≤15m; RTO ≤2h; 2 drills/year.	TR.33, TR.34	Inspect DR site; review drill reports.	DR drill report.
A4.19	Disaster Recovery and BCP	Daily full + hourly incremental backups; quarterly restores successful.	TR.36	Check backup jobs; perform restore.	Backup and restore logs.
A4.20	Disaster Recovery and BCP	Automatic failover tested quarterly; meets uptime SLA.	TR.37	Simulate outage; verify failover.	Failover logs.
A4.21	Reporting and	≥30 standard reports; ad-hoc builder; all export formats	FR.46,	Generate reports; test	Report catalogue.
	Analytics	functional.	TR.38	exports.
A4.22	Reporting and Analytics	Real-time dashboards match report data.	TR.39	Compare dashboard vs. reports.	Dashboard screenshot; comparison log.
A4.23	Configuration and Extensibility	Rates, penalties, waivers, workflows updated via parameters; changes logged.	TR.41	Update config; review change logs.	Config logs.
4.24	Configuration and Extensibility	New streams added without vendor; fully functional.	TR.43	Create new stream; test billing and reporting.	Stream creation log.
A4.25	Documentation and Handover	All required documentation and escrow package delivered.	TR.47	Inspect documentation inventory.	Documentation list; escrow confirmation.

ICRMS Risk Register and Management Matrix
Risk ID	Risk Category	Risk Description	Potential Impact	Likelihood (L/M/H)	Severity (L/M/H)	Risk Owner	Mitigation Measures	Contingency / Response Plan	Key Risk Indicator (KRI)
R1	Technical – Infrastructure	System downtime due to hardware failure or hosting outage.	Revenue loss; public dissatisfaction.	M	H	ICT Unit / Vendor	Redundant infrastructure; HA design; monitoring.	Activate DR site; failover within RTO ≤2h.	Uptime %; MTTR.
R2	Technical – Application	Bugs/defects disrupt billing, payments, reconciliation.	Delayed collections; inaccurate data.	M	H	ICT Unit / Vendor	QA/UAT before updates; DevSecOps pipeline with rollback.	Revert to last stable version; patch within SLA.	Defect density; time to patch.
R3	Security	Data breach or unauthorised access to taxpayer data.	Legal penalties; reputational damage.	M	H	ICT/Security Officer	Role-based access control (RBAC) and attribute-based access control (ABAC); MFA; encryption; security audits.	Incident response; notify regulators and affected parties.	Security incidents; failed logins.
R4	Integration	Failure of integration with IFMIS, SCOA, payment channels, or registries.	Delayed reporting; revenue posting errors.	M	H	ICT/Finance/Vendor	Integration testing; API monitoring; SLAs.	Manual upload; escalate to partner.	API success rate; recon variance.
R5	Data Management	Loss/corruption of financial records.	Loss of accountability; compliance breach.	L	H	ICT/Vendor	Encrypted backups; quarterly restore tests.	Restore from backup; forensic analysis.	Backup success rate; restore success.
R6	Operational – Collection	Fraudulent collection/diversion by staff/agents.	Revenue leakage; legal action.	M	H	Revenue Dept / Internal Audit	Cashless collections; recon controls; monitoring.	Suspend accounts; initiate audit.	Collector performance variance.
R7	Operational – Enforcement	Delay/failure in enforcement due to technical/logistical issues.	Drop in compliance; revenue shortfall.	M	M	Enforcement/ICT	E-enforcement devices; SLA monitoring.	Escalate cases; manual logs.	Enforcement completion rate.
R8	Change Management	User resistance to system/process changes.	Low adoption; parallel manual processes.	M	M	HR/Change Lead	Training; sensitisation; support channels.	Coaching; leadership escalation.	Adoption rate; helpdesk tickets.
R9	Regulatory	Non-compliance with Data Protection, PFM, procurement laws.	Fines; legal sanctions; halted operations.	L	H	Legal/Compliance	Compliance reviews; legal vetting.	Suspend risky processes; remediate.	Audit findings count.
R10	Business Continuity	Disaster (fire, flood, cyberattack) disrupts operations.	Extended downtime; loss of revenue.	L	H	ICT/DR Lead	DR site; BCP drills; environmental controls.	Activate BCP; failover to DR.	BCP drill success; recovery time.
R11	Vendor Management	Vendor insolvency/disputes/poor performance.	Delays; loss of support.	M	M	Procurement/ICT/Legal	SLAs; escrow for source; alternate vendor readiness.	Activate escrow; alternate vendor.	SLA breach rate.
R12	GIS and Field Ops	Inaccurate GIS mapping or field data capture failures.	Poor targeting; incomplete asset register.	M	M	GIS/ICT	GPS audits; offline GIS maps; training.	Manual validation; re-map.	% verified GIS assets.

Section 3: Performance Metrics
Service Area	Metric	Target	Linked FR/TR
System Availability	Uptime per quarter	≥99.5%	TR.4
Incident Response	Acknowledge Priority 1 (Critical) incidents	≤15 minutes	TR.18, TR.19
Incident Resolution	Restore service (Critical)	≤2 hours workaround; ≤8 hours full fix	TR.18, TR.19
Reconciliation Accuracy	Daily reconciliation completion	100% T+1; ≤1% unresolved after T+3	FR.25
Integration Availability	Success rate for mandatory integrations	≥99%	TR.13–TR.17
Security Compliance	Vulnerability remediation	Critical ≤30 days; High ≤60 days	TR.21
Backup and Restore	Quarterly restore test success rate	100%	TR.36
DR Drill Success	Meet RPO/RTO targets	RPO ≤15m; RTO ≤2h	TR.33, TR.34
Training Delivery	Completion of agreed training plan	100% attendance and evaluation	TR.47
Documentation Updates	Updated within	5 working days after change	TR.47

Section 4: Priority Levels and Resolution Targets
Priority	Definition	Response Time	Resolution Target
P1 – Critical	Complete outage; core revenue functions unavailable.	≤15 min	Workaround ≤2 hrs; Full fix ≤8 hrs
P2 – High	Major function degraded; workaround available.	≤30 min	Full fix ≤24 hrs
P3 – Medium	Minor function affected; low business impact.	≤2 hrs	Full fix ≤5 days
P4 – Low	Cosmetic/UI issue; no business impact.	≤4 hrs	Fix in next planned release

Section 6: Penalties and Service Credits
Breach	Penalty / Service Credit
Uptime below 99.5%	5% of monthly service fee per 0.5% shortfall
Missed Critical issue resolution time	10% of monthly service fee per incident
Missed DR RPO/RTO targets	15% of monthly service fee per failed test
Failure to remediate critical vulnerability in time	10% of monthly service fee per breach

Section 4: Migration Phases and Activities
Phase	Activity	Description	Linked FR/TR	Deliverable
Pre-Migration Assessment	Data Inventory	Identify all existing data sources and repositories.	TR.45	Data inventory report
Pre-Migration Assessment	Data Mapping	Map each data element from source to ICRMS target field, ensuring SCOA mapping.	FR.14; TR.13	Data mapping matrix
Pre-Migration Assessment	Data Cleansing	Remove duplicates, fix inconsistencies, complete missing data.	FR.4; TR.44	Cleansed dataset
Pre-Migration Assessment	Migration Tool Setup	Configure vendor-supplied migration utilities and scripts.	TR.45	Tool setup log
Pre-Migration Assessment	Migration Plan Approval	Secure sign-off for migration scope, schedule, and responsibilities.	TR.47	Approved migration plan
Trial Migration	Trial Load	Perform migration in a test/staging environment.	TR.45	Trial migration logs
Trial Migration	Reconciliation	Compare trial migrated data to source records; verify ledgers and balances.	FR.6; FR.7	Reconciliation report
Trial Migration	User Verification	Departmental review and sign-off of trial data.	FR.1–FR.3	User sign-off forms
Cutover Preparation	Freeze Changes	Halt non-critical changes to source data during migration window.	TR.5	Change freeze notice
Cutover Preparation	Final Backup	Take full backup of source systems pre-migration.	TR.36	Backup confirmation log
Cutover Preparation	Communication	Notify stakeholders of cutover date, downtime, and contingency plan.	TR.35	Communication plan
Final Migration and Go-Live	Final Load	Load final dataset into production ICRMS.	TR.45	Final migration log
Final Migration and Go-Live	Validation	Run validation checks and sample reports post-load.	FR.43–FR.47	Validation checklist
Final Migration and Go-Live	Cutover Execution	Switch operations to ICRMS and decommission legacy entry points.	TR.35	Cutover report
Post-Go-Live Support	Hypercare Period	Provide dedicated vendor/on-site support for defined period.	TR.47	Support logs
Post-Go-Live Support	Parallel Reconciliation	Compare ICRMS vs legacy data for a defined period.	FR.25	Reconciliation reports
Post-Go-Live Support	Final Sign-off	Formal acceptance of migrated data.	TR.47	Acceptance certificate

Section 5: Roles and Responsibilities
Role	Responsibility
County ICT Unit	Co-ordinate migration; validate technical tools; manage backups and environments.
County Finance/Revenue Dept	Validate SCOA mappings; verify ledger and transaction accuracy.
Vendor Migration Team	Provide migration tools; execute migration and cutover; resolve issues.
Data Protection Officer	Ensure compliance with privacy laws during migration.

Everyone named

Signed by 2	CPA MARY WANYONYI CHEBUKATI, Chairperson, Commission on Revenue Allocation · ROBLE NUNO, Ag. Commission Secretary/Chief Executive Officer
Bodies 45	National Treasury · Council of Governors · Office of the Auditor-General · Office of the Controller of Budget · ICT Authority · County Governments · National Government · KRA · Business Registration Service · NTSA · Ministry of ICT and the Digital Economy · Project Implementation Unit · Technical Working Group · Parliament · County Assemblies · Joint Governance Committee · Commission on Revenue Allocation · BRS · monitoring and evaluation Unit · PFM Institutions · CRA · ICTA · CoB · National ICRMS Steering Committee · and 21 more
Stakeholders consulted 16	The National Treasury and Economic Planning · Ministry of ICT and Digital Economy · Ministry of ICT · Office of the Controller of Budget · Office of the Auditor-General · Commission on Revenue Allocation · County Executive Committees for Finance and ICT · County Treasuries · County Assemblies’ Finance Committees · County Revenue Boards/Directorates · Council of Governors · Intergovernmental Budget and Economic Council · World Bank · UNDP · GIZ · USAID
Systems 4	Integrated County Revenue Management System · IFMIS · Integrated Population Registration System · ICRMS
Integration systems 4	IFMIS · SCOA · IPRS · GIS
Report recipients 4	County Assemblies · Parliament · CRA · CoB
Integrated systems 4	IFMIS · SCOA · BRS · IPRS
Members 4	Council of Governors · Office of the Controller of Budget · Office of the Auditor-General · ICT Authority
Integration platforms 4	IFMIS · SCOA · BRS · IPRS
Frameworks 3	Standard Chart of Accounts · Kenya Government Enterprise Architecture · Kenya National Interoperability Framework
Linked systems 3	IFMIS · SCOA · IPRS
Co chairs 3	National Treasury · Council of Governors · Commission on Revenue Allocation
Offices 3	Auditor-General · Chairperson, Commission on Revenue Allocation · Ag. Commission Secretary/Chief Executive Officer
Escalation contacts 3	Service Desk / Helpdesk Officer · Vendor CTO / Senior Management · Client ICRMS Steering Committee
Integration bodies 2	BRS · NTSA
Issuing authority	Commission on Revenue Allocation
Assembly	County Assemblies
Appointing authority	County Governments
Standards body	Open Web Application Security Project
Registry	BRS
Owner	National Implementing Agency (Central System-National Treasury)
Technical custodian	ICT Unit
Records custodian	Revenue Department
Auditor	Internal Audit
Oversight body	CRA
Also named 7	County Executive Committee Member responsible for Finance · County Executive Committee (CEC) Members for Finance · County ICT Directors · Vendor Support Manager · Data Protection Officer · Project Manager · County Government
Law 9	Constitution of Kenya · Public Finance Management Act · County Governments Act · Public Procurement and Asset Disposal Act · Data Protection Act · Intergovernmental Relations Act · Controller of Budget Act · Public Audit Act · Finance Act

Pages for private people, including the deceased and petitioners, are public, but we ask search engines not to list them.

Corrections 0

Corrected by: No corrigendum in the issues we hold.
Cites: Annex 2, Annex 1, Annex 6, Intergovernmental Framework Agreement, Risk Management Framework (Annex 5), Data Migration and Cutover Plan (Annex 8), Risk and Compliance Reporting Template (Annex 5), Compliance Audit Checklist (Annex 4), Finance Act, Tariff and Pricing Policy, Data Protection Act

Cite

Kenya Gazette Notice No. 12835 of 2025, Vol. CXXVII No. 191, 9 September 2025, p. 6151.

Permalink funua.com/notices/2025/12835/.

About this data

Source: Official PDF of Vol. CXXVII No. 191, from Kenya Law
Extracted by: AI models
Model audit: An independent model agreed with 98 to 99% of compared values for land and succession notices, 97% overall. Agreement between models, not verified accuracy.
Review flag: None on this notice

Suggest a correction Report a privacy concern

Filed under: Public finance, 2025 · September 2025 · Vol. CXXVII No. 191

Gazette Notice No. 12835 of 2025

Items 32

Legislation notice 1

Establishment 2

Public finance notice 3

Public finance notice 4

Public finance notice 5

Legislation notice 6

Establishment 7

Public finance notice 8

Establishment 9

Establishment 10

Establishment 11

Public finance notice 12

Legislation notice 13

Legislation notice 14

Public finance notice 15

Specify technical requirements 16

Specify technical requirements 17

Specify technical requirements 18

Set procurement evaluation criteria 19

Specify compliance audit scope 20

Compliance audit checklist 21

Public finance notice 22

Sets out risk register 23

Sets out sample service level agreement 24

Public finance notice 25

Public finance notice 26

Public finance notice 27

Public finance notice 28

Public finance notice 29

Standardise definitions 30

Defines acronyms 31

Public finance notice 32

Schedule 351 rows

Everyone named

Corrections 0

Cite

About this data