SIXTY-FIFTH WORLD HEALTH ASSEMBLY Provisional agenda item 17.2
A65/33 13 April 2012
Report of the Internal Auditor
1. The Office of Internal Oversight Services transmits herewith its annual report for the calendar year 2011 for the information of the World Health Assembly. 2. Rule XII of the Financial Rules – Internal Audit – establishes the mandate of the Office of Internal Oversight Services. Paragraph 112.3(e) of Rule XII requires the Office to submit a summary annual report to the Director-General on its activities, their orientation and scope, and on the implementation status of recommendations. It also states that this report shall be submitted to the Health Assembly, together with any comments deemed necessary. 3. The Office provides independent and objective assurance and advisory services, designed to add value to improve the Organization’s operations. Using a systematic and disciplined approach, it helps the Organization accomplish its objectives by evaluating and improving the effectiveness of processes for risk management, control and governance. It is responsible for conducting investigations of alleged wrongdoing and it implements the Organization’s independent evaluation function. The Office is authorized full, free and prompt access to all records, property, personnel, operations and functions within the Organization which, in its opinion, are relevant to the subject matter under review. No limitation was placed on the scope of the work of the Office during 2011.
SCOPE OF WORK 4. The Office views risk as the possibility of an event occurring that will influence the achievement of objectives. It assesses risk in terms of degree of impact and likelihood of occurrence. Methodical consideration of risk guides the Office’s prioritization of activities and provides a basis for work planning. 5. The scope of work of the Office is to evaluate whether the framework of processes for risk management, control and governance, as designed and implemented by the Organization’s management, are adequate and functioning in a manner so as to achieve WHO’s goals. The Office assessed whether (a) risks were identified, evaluated and mitigated; (b) financial, managerial and operating information was accurate, reliable and timely; (c) staff actions complied with WHO’s regulations, rules, policies, standards and procedures; (d) resources were used efficiently and protected adequately; (e) programmes, plans and objectives were achieved; and (f) the control process fostered quality and continuous improvement. 6. At the conclusion of each assignment, the Office prepared a detailed report and made recommendations to management that were designed to help manage risk, maintain controls and ensure effective governance within the Secretariat. Crucial issues identified during each assignment
A65/33
have been summarized in this report. Annex 1 lists the reports issued by the Officer under its 2011 plan of work, along with information on the status of implementation as at 6 March 2012.
MANAGEMENT OF THE OFFICE 7. The Office conducts its work in accordance with the International Standards for the Professional Practice of Internal Auditing promulgated by the Institute of Internal Auditors and adopted for use throughout the United Nations system. 8. The Office reports directly to the Director-General. In response to the concerns expressed by Member States, the External Auditor and the Independent Expert Oversight Advisory Committee, a two-phase plan to strengthen the Office has been approved by the Director-General. As part of this plan, a Junior Professional Officer joined the Office in early 2012, which now includes 12 professional and 2 general services staff. The plan further includes the recruitment in 2012 of two additional auditors and one investigator, and of three auditors and one assistant in 2013. 9. Available human resources are assigned in accordance with the priorities of the Office. High-risk situations developing unpredictably may divert human resources away from initial priorities. Accordingly, the Office prioritizes scheduled work and then adjusts the schedule in order to compensate for any unexpected assignments. The Office also provides support to other entities (e.g. UNAIDS, UNITAID and some partnerships) on a reimbursable cost basis. 10. The budget of the Office is distributed among human resources, travel, consultancies and operating supplies, with a view to fulfilling the terms of reference of the Office. During 2011, the Office was able to undertake all its activity expenses with the available funding, as a result of the introduction of efficiency measures, in particular to reduce travel costs. The introduction of desk reviews that were conducted from headquarters, using information in the Global Management System and supporting documentation uploaded in the Records Management System, and that thus avoided travel to the field, also contributed to the efficiency efforts. These ways of working will be further expanded with the recruitment of two additional professionals in 2012. 11. The Office maintains regular contact with the Organization’s External Auditor in order to coordinate audit work and to avoid overlap in coverage. The Office provides the External Auditor with a copy of all internal audit reports. The Office, in addition to providing copies of internal audit reports to the Independent Expert Oversight Advisory Committee, attends the formal Committee meetings and maintains an open dialogue with the Committee members to implement their guidance and recommendations.
AUDITS Operational audits 12. The objective of operational audits is to assess the risk and control processes in the finance and administration areas with respect to integrity of financial and managerial information; efficiency and economy in the use of resources; compliance with WHO regulations, policies and procedures; and safeguarding of assets. 13. Duty travel. This audit, which was initially part of the 2010 plan of work, had to be deferred in view of other priority assignments. The audit revealed that effective internal controls have not been implemented either to mitigate the risks associated with the creation and approval of travel requests
2
A65/33
and travel claims or to support the recovery of payments due to the Organization. The audit identified significant examples of non-compliance and of non-application of controls in a number of areas, including: incomplete supporting documentation; inadequate exception reporting; failure of supervisory mechanisms; processing errors relating to travel requests and travel claims; non-implementation or inconsistencies in the implementation of the WHO travel policy in the Global Management System; efficiency measures not adequately monitored; lack of systematic management of recovery of payments due to the Organization, with insufficiently clear allocation of responsibility for timely resolution. As a consequence of such weaknesses in the controls, there is a potential for fraud not being detected in a timely manner. 14. Employee payable and receivable (“personal accounts”). This audit was originally part of the Office’s plan of work for 2010 but was deferred due to other priority assignments. The objective was to review the main internal controls in place to mitigate financial and administrative risks related to personal accounts. The audit found that the Organization did not know with certainty all the amounts due by or due to each employee at a point in time. Although the Global Management System was implemented in 2008, the report available in the system for personal accounts was found to be inadequate for reconciling, ageing and clearing purposes, since it did not provide details per employee and did not capture all the financial transactions relating to employees. The Global Service Centre has established manual procedures based on Excel spreadsheets that are incomplete and are prone to error. As a result, there is a risk that staff members leave the Organization without settling all their debts, exposing the Organization to financial loss, and that accounting processing errors remain undetected. Furthermore, personal accounts amounting to approximately US$ 3.5 million in absolute value relating to current and ex-employees had not been reconciled as at the end of March 2011. Finally, the combination of delays in clearing reconciled accounts and the priority assigned to following up on personal accounts of active staff led to an increase of outstanding amounts relating to former staff. Following issuance of the audit report, a specific action plan has been implemented by the Secretariat to address these issues urgently. 15. Review of the internal control environment at the Regional Office for Europe after introduction of the Global Management System. The audit found that the key risks in the administration and finance areas were largely recognized and mitigated as evidenced by the satisfactory operation of 114 out of the 150 controls reviewed. However, in some areas, mitigation was achieved through reliance on legacy systems and manual controls that are to be superseded by the planned internal control framework in the Global Management System environment. Therefore, actual implementation and consistency with relevant Global Management System control procedures require improvement. In particular, the existing manual controls in all the units of the Department of Administration and Finance should be reviewed for redundancy. If operating effectively, the controls in the internal control framework are likely to result in a more efficient control environment for processes supported by the Global Management System. The audit also highlighted that segregation of duties should be reviewed following recent organizational changes, to ensure an adequate segregation of duties between the operational and compliance activities of the budget functions. 16. Pre-implementation review of the General Management Cluster Standard Operating Procedures. The objective of the review was to assess the current status of the preparation of the cluster Standard Operating Procedures; review the adequacy of the development process (initiation, preparation, document control and tracking, review and approval, document dissemination and access); identify lessons learnt; and make general recommendations on the overall consistency of the approach and integrity of crucial internal control mechanisms. The review noted that the preparation of Standard Operating Procedures for several departments in the General Management Cluster is currently “work in progress” and that this major initiative will require the allocation of significant resources in order to be completed in a timely manner. The review concluded that further efforts are 3
A65/33
needed to strengthen the process used in the development of Standard Operating Procedures as there is a lack of overall consistency both in the approach to the format and content, as well as to the incorporation of crucial internal control mechanisms based on identified risks. The review recommended that the Cluster appoint an overall team leader to coordinate the preparation of Standard Operating Procedures; agree on the overall methodology to identify the high-risk areas where Standard Operating Procedures should be developed as a priority, to ensure that resources are allocated to the highest risks and that related crucial internal controls are integrated; establish a time frame with priorities; agree on the standard approach to the preparation (format, content and level of detail required); establish quality review and approval mechanisms, including formal tracking and dissemination systems; provide access to relevant staff; and establish a mechanism to ensure maintainability. 17. Leave and absence records. The Office tested recorded leave, however it was unable to obtain a satisfactory level of assurance that measures were effective to detect leave that was not recorded. This remains the most significant risk related to leave for the Organization since there is no system in place to record the presence of staff. Testing of leave and absence entitlements indicates that the calculation of leave taken with manual controls (e.g. flexi-time) have generated errors which have not been detected by the reviews currently performed by leave administrators and/or supervisors. This has led to inaccurate leave balances. Also, an analysis of reporting in the Global Management System indicates that the approval process is not performed in a timely manner and that the system allowed, in an alarming number of instances (2134 cases), self-approval of leave transactions. Staff should not be able to approve their own leave, and post facto monitoring of this requires improvement. It was also noted that the disciplinary action for non-compliance with WHO Regulations and Rules, which is prescribed in the eManual and the Staff Rules, has not been put in place. 18. Country Office, Port Moresby, Papua New Guinea. The audit found that a number of major risks in the areas of reliability and integrity of financial and operational information, compliance and safeguarding of assets, have not been fully mitigated, and that controls need to be further strengthened. In particular, the audit identified the need to improve the integrity of financial information in the imprest accounting. Timely follow-up of activities related to Agreements for Performance of Work and enhancement of the monitoring of Direct Financial Cooperation are required. Stricter compliance with WHO regulations on candidate screening, and procurement of goods and services, notably by ensuring the completeness of documentation to support procurement transactions of services and goods, is also required.
Operational audits using desk reviews 19. Operational audits can also be performed in the form of desk reviews carried out from headquarters (not involving travel to the site), using data that are available from the Global Management System and supporting documentation that has been uploaded to the Records Management System. 20. Country Office, Bishkek, Kyrgyzstan. The audit found that risks in the areas of compliance with WHO Regulations and Rules and integrity of managerial information have not been fully mitigated, and that controls need to be further strengthened. In particular, the audit identified the need to improve compliance with WHO Regulations and Rules on human resources, procurement and contractual services; and, in order to ensure completeness of documentation supporting procurement transactions for goods and services, the uploading of required documents in the Records Management System. The review also identified the need to improve segregation of duties in the area of procurement.
4
A65/33
21. Country Office, Dili, Democratic Republic of Timor-Leste. The audit found that risks in the areas of integrity of financial and managerial information and compliance with WHO regulations have not been fully mitigated, and that controls need to be urgently strengthened. In particular, the audit identified the need to ensure completeness of the documentation supporting procurement transactions for goods and services; and to improve compliance with WHO Regulations and Rules with regard to the competitive recruitment of individuals under Special Services Agreements, contractual services, travel and Direct Financial Cooperation. The audit also noted the need to reorganize the responsibilities in the administration and finance area to ensure adequate segregation of duties in relation to the functions of imprest processing, payments, and cash and cheque custodian; to review and update the eImprest reconciliations and the fixed assets in the Global Management System; and to provide training to staff in key administrative and financial areas. The audit recommended that the Regional Office enhance monitoring of the Country Office transactions; take note of significant recurrent non-compliance issues; and take steps to ensure that the Country Office achieve the required capacity to provide adequate operational support and accountability in the administration and finance area.
Integrated audits 22. The objective of integrated audits is to assess: the performance of WHO at country level in the achievement of results as stated in the country workplan; the contribution of WHO towards improving health outcomes in the country; and the operational capacity of the country office to support the achievement of results. 23. Country Office, New Delhi, India. The audit revealed that the Country Office was technically competent and well placed to contribute significantly to public health in India. However, it needs to address some residual risks which are negatively influencing WHO programme performance and causing institutional erosion. Firstly, there is an urgent need to review the relevance of the nature and modality of the WHO country presence in India. The Country Office should reflect on the mediumterm viability of the current modality of technical support, and question the emphasis on routine support and the value for money for WHO in the allocation of its resources. Secondly, at programmatic level, WHO should review its strategic positioning with the Ministry of Health and Child Welfare; integrate the National Polio Support Programme under the umbrella of the Country Office; identify which programmes are the priority for support to be provided by WHO regional or global levels; and place greater emphasis on achieving sustainable results for the beneficiaries. Thirdly, at the operational level, WHO should: improve communication and collaboration among technical programmes and with the administrative core team of the Country Office, with respect to implementation processes; identify solutions to acquire office space appropriate to the size of the work force; reduce transaction costs for Agreements for Performance of Work and Direct Financial Cooperation; identify an exit strategy for the provision of routine salary/office support to the Ministry of Health and Family Welfare; and bring fellowships under the control of WHO. 24. Country Office, Harare, Zimbabwe. The audit considered the Country Office to be performing efficiently during the humanitarian crisis, despite limited funding. The Country Office added value to the work of its partners through the brokerage role and technical advice it provided during the crisis. The Country Office now needs to provide enhanced technical advice and leadership during the recovery and transition phases in the country, despite being involved in WHO’s financial crisis. The funding gap for 2010–2011 was close to 50% and is affecting the implementation of the Country Cooperation Strategy and workplan, country presence and staff morale, and WHO’s visibility and commitments with the Ministry of Health and Child Welfare and other stakeholders. Despite the above challenges, the Country Office has contributed to the achievement of results at the beneficiary level in some crucial areas, including national health policy development; institutional strengthening; 5
A65/33
transfer of know-how to the national health authority, and its implementation, after initial support by WHO; and support to evaluation-led policy development. From a risk perspective, the Country Office needs to improve compliance in some high-risk areas, including the ethical review committee; management and follow-up of direct financial cooperation; fuel management; quality control and documentation of procurement processes; and segregation of duties in finance, inventory and supply. These risk areas have been discussed with the Country Office staff who have started implementing improvement measures. 25. Country Office, Beijing, China. The audit noted examples of excellent technical support to China, involving input from all three levels of the Organization, such as for health reform, influenza surveillance and pandemic response, as well as essential medicines. The audit also found no significant gaps between the support provided by the Country Office and that expected from national counterparts, with the exception of a need for increased support in the area of noncommunicable diseases. External interviewees expressed the opinion that WHO’s continued presence in the country was required. The audit concurs with this view; however, the Country Office needs to reassess its strategic position and the role of WHO and future modalities for cooperation. Unmitigated risks impacting programme delivery need to be addressed, including the use of assessed contributions for higher level strategic activities; insufficient technical support in the area of noncommunicable diseases; financial vulnerability of key posts to implement the Country Cooperation Strategy support for priority areas; and the fact that research supported by the Country Office is not systematically reviewed by an ethics review committee. In addition, the Country Office should improve timely follow-up on donor-funded projects, and develop resource mobilization and knowledge management strategies. Overall, the Country Office has an adequate operational capacity to support programme implementation; however, there are deficiencies in compliance with WHO regulations that need to be urgently addressed in the areas of Agreements for Performance of Work, Direct Financial Cooperation and eImprest reconciliations. 26. Country Office, Luanda, Angola. The Country Office is performing well in a challenging and complex environment, with a network of 18 sub-offices, and considerable infrastructure, communications and logistics issues, and despite limited funding. By reorienting WHO’s work in Angola towards polio eradication, the Country Office has positioned itself to provide a global public good as a priority. The Country Office supports other areas subject to the limited resources available, and through mobilizing partners for the implementation of the underfunded components of the workplan. The audit recommended administrative and programmatic rationalization of the available resources, by reconsidering the administrative structure, and by exploring outsourcing options for the services that are project-based. Immediate attention is required to ensure compliance with WHO Financial Regulations and Financial Rules in the management and follow-up of direct financial cooperation; signatories and registration of bank accounts; documentation of procurement processes; and appropriate segregation of duties in finance, inventory and supply areas. Finally, a more systematic approach to knowledge management and advocacy, and to resource mobilization, is required.
Performance audits 27. Roll Back Malaria Partnership Secretariat. The objective of this audit, at the request of the Secretariat, was to review procedures relating to the Partnership for compliance with WHO Regulations and Rules, and to identify potential areas of improvement in related processes. The audit concluded that the Partnership processed transactions in accordance with WHO Regulations and Rules. Process improvements were identified in the areas of grants and contracts with regard to the adequacy and completeness of supporting documentation. There is a need for enhanced monitoring of the completeness and timeliness of reports submitted by grantees and contractors. 6
A65/33
28. The objective of performance audits is to assess – under the principles of results-based management – the audit area’s achievement of the Office-Specific Expected Results and its contribution to the Organization-Wide Expected Results. Performance audits adopt a risk-based approach to review the organizational setting and the management processes, and focus on the identification of constraints that potentially limit the achievement of the workplan. For each of the risks identified, tests are performed to assess the effectiveness of existing mechanisms and controls to manage these risks. 29. Department of Food Safety and Zoonoses. The audit found that the Department has been successful in setting up global technical programmes to support Member States in lowering the burden of foodborne and zoonotic disease, and has established a good reputation in the area of food safety. The Department has instituted external collaboration mechanisms in the form of various scientific, technical, and expert advisory groups, to provide scientific advice, risk assessments, and policy development for the international food safety community. Through the Codex Alimentarius Commission, the Department has set international food safety standards in close collaboration with the Food and Agriculture Organization and successfully promoted their implementation. For Member States, food safety is now more visible and has gained importance as a result of the adoption in 2010 by the World Health Assembly of resolution WHA63.3 on advancing food safety initiatives. The Department currently has a leading role in the area of food safety and zoonoses due to its unique function of addressing public health aspects. However, there are several risks that are not adequately mitigated and that threaten its current position, namely: the organizational structure, which is not conducive to collaborative support for project activities; the limited number of staff providing support at regional and country level; the absence of a resource mobilization and communication strategy during the financial crisis; and an insufficient level of formal collaboration with other units/departments working on food-safety-related issues within the Organization. The failure to address these risks could result in failure to meet the expectations raised through the global projects. This could jeopardize collaboration with external partners, thereby potentially harming WHO’s credibility. 30. Department of Violence and Injury Prevention and Disability. While this audit commended the Department for its communication efforts and its success in pinning activities to global initiatives and United Nations resolutions, it also found that the Department needed a longer-term strategy to ensure adequate coverage of all areas of activity. The audit noted a strong imbalance in the funding of the different units as a consequence of one donor’s exceptional contribution to road safety and concluded that there was a need to diversify funding sources. In terms of planning, greater integration of common requirements and tasks between units (in areas such as policy development, data surveillance, care and rehabilitation, and capacity-building) and reinforced coordination with other headquarters departments (including adolescent and child health, disability and ageing, transportation and the environment, disasters and disability) would benefit the Department. Workplan implementation was satisfactory with most delays attributed to administrative bottlenecks at the regional/country office level. The audit highlighted the need to build stronger country-level ownership of programmes earlier on during the preparation of project proposals and to engage more fully in the process of developing the country cooperation strategies. Finally, the training packages developed by the Department should be used more systematically to strengthen the technical competencies of country offices. 31. Special review of streptomycin procurement by the Global Drug Facility of the Stop TB Partnership. The objective of this special review was to determine whether procurement of streptomycin from 2009 to mid-2011 was performed according to WHO and Global Drug Facility secretariat policies and procedures. The review identified the streptomycin orders, based on the Global Drug Facility order management system data, and verified that the internal procedures to place orders 7
A65/33
through the procurement agents for the period May 2009 to April 2011 had been followed. The review found that the procurement of streptomycin had been an exception to the Global Drug Facility quality assurance policy at least since 2005. The Global Drug Facility had informed the previous supplier in April 2009 that its streptomycin was not eligible to participate in the forthcoming bidding round for a new long-term agreement, due to application of stricter quality assurance criteria. While the long-term agreement with the previous streptomycin supplier expired in December 2009, the Global Drug Facility did not, in a timely manner, renew it with an eligible drug supplier. The new long-term agreement with an eligible supplier for streptomycin started almost one year later, in December 2010. In the meanwhile, the ad hoc sourcing of streptomycin resulted in a payment of an additional 8% margin, totalling an additional cost of US$ 51 508 to the Global Drug Facility for orders placed between 1 July 2010 and 30 April 2011. In addition, after changing procurement agents, the Global Drug Facility issued cost guarantees for US$ 1 020 098 for direct procurement orders of streptomycin in which the Global Drug Facility was not a party. While these guarantees did not result in a loss for the Organization, they were outside the scope of the financial authority entrusted to the staff members of the Global Drug Facility. 32. Special review of the Tuberculosis/Highly Active Antiretroviral Therapy study by the Special Programme for Research and Training in Tropical Diseases. A management review of the activities associated with this study by the Special Programme for Research and Training in Tropical Diseases was carried out to review compliance with established rules and procedures, and assess any significant factors that may affect efficiency and effectiveness. The review found that the documentation provided evidenced general compliance with rules and procedures relating to contracting with individuals and institutions through Agreements for Performance of Work and Technical Services Agreements. However, there have been recurring issues of shortfalls in the achievement of targets for patient recruitments, which have given rise to a risk to the effectiveness of the study, particularly in view of other shorter studies that have attained positive indications. In view of this significant risk, there is a need for a technical review of the effectiveness of the business strategy and the resource requirements for the completion of the study.
EVALUATIONS 33. With a view to responding to the concerns raised by Member States regarding, inter alia, audit coverage of country offices, no centralized evaluations were carried out in 2011. The finalization of the Organization-wide Evaluation Policy has been integrated in the overall WHO reform process.
INVESTIGATIONS 34. In 2011, the Office received 30 complaints in relation to allegations of harassment or wrongdoing. Seven investigation reports were issued. Four cases were closed by a response memorandum and one was informally settled. Four other cases were closed because the formal written complaint was not provided or because they did not require investigation, and the remainder are either in progress or outstanding. The capacity to investigate allegations of wrongdoing or harassment will be further expanded with the recruitment of an additional professional in 2012. 35. At headquarters. The Office investigated an allegation of unauthorized access to electronic information considered confidential by WHO, from computers assigned to two headquarters staff members. The investigation identified evidence that unauthorized access to – and storage of – documents considered confidential by WHO had indeed occurred from the computers of the two staff members. Both cases (under separate reports) were referred to the Director-General to determine if misconduct had occurred and action has been subsequently taken.
8
A65/33
36. At a regional office. According to the WHO Staff Health Insurance Rules, medical expenses are reimbursed, except in particular cases, at 80% of their costs. The investigation found that a staff member had colluded with a dentist in that the latter overcharged his services to make the 80% part of the invoice actually correspond to 100% of the normal cost. In this way, the staff member insured could be fully reimbursed. The investigation also found that the medical invoices attached to the payment vouchers by the same staff member were misleading for the officers approving the payments, since they indicated that the patients had paid the remaining 20% directly to the dentist, which was actually not the case. The loss for the WHO Staff Health Insurance scheme was provisionally estimated at US$ 34 000. The Regional Office has started recovering the money due to the Organization by the insured staff members, and the Office has referred the matter to the Regional Director to determine if disciplinary action should be taken. 37. At a country office. The Office found that a staff member responsible for travel for the Country Office had received payments from colleagues for airline tickets relating to private trips without transferring the money to the travel agent. The money retained by the staff member for private purposes was estimated to be US$ 25 000. The staff member signed a statement in which he authorized WHO to deduct the sum (as determined by WHO) due to the travel agent from the amounts due to the staff member by the Organization. The Office referred the matter to the Regional Director to determine if disciplinary action should be taken. 38. At headquarters. The Office investigated a claim of harassment at headquarters by a general services staff member against a professional staff member. The Office did not find any of the allegations to be confirmed by witness or documentary evidence. In accordance with the procedures established in the new Policy on the Prevention of Harassment at WHO, the Director-General transmitted the investigation report to the Global Advisory Committee on formal complaints of harassment, which in turn, issued its recommendation on the case to the Director-General. 39. At headquarters. The Office investigated a claim of harassment at headquarters by a senior professional staff member against the staff member’s supervisor. The Office found room for improvement in the management style; however, the allegations could not be confirmed by witness or documentary evidence. Per the established procedures, the Director-General transmitted the investigation report to the Global Advisory Committee, which will in turn issue its recommendation on the case. 40. At headquarters. The Office investigated a claim of retaliation at headquarters by a senior professional staff member against this staff member’s supervisor. The staff member alleged that the supervisor had retaliated as the staff member had submitted a claim of harassment with the Headquarters Grievance Panel. The Office did not find any of the allegations of retaliation to be substantiated by witness or documentary evidence.
FOLLOW-UP ON PRIOR REPORTING ON OPERATIONAL RISKS FACING THE ORGANIZATION 41. In following up on the main operational risks faced by the Organization reported in the annual report presented to the Sixty-fourth World Health Assembly,1 the Office noted that while progress has been made at headquarters on all of the major operational improvement initiatives (i.e. development of the internal control framework, establishment of Standard Operating Procedures within the General
1
Document A64/28.
9
A65/33
Management cluster; expansion of the approach to strategic Enterprise Risk Management; and a review of the service delivery model for administrative services), these issues are still “works in progress”. Until these are completed and fully implemented, they will not yet yield the required improved accountability, effectiveness of internal controls and operational efficiencies for the Organization. The Office therefore strongly encourages continuation of efforts in these areas and will continue to monitor progress during 2012. 42. Furthermore, during its routine audit work in country offices, and in response to Member States’ requests for an update on compliance issues at these offices, the Office has identified the main recurring operational risks that the Organization faces, which are summarized as follows: • There is a need for significant improvement in compliance with WHO Regulations and Rules in the area of Agreements for Performance of Work to address : – non-respect of the delegation of authority limits for approval of agreements; – splitting of contracts to remain within local delegation of authority limits; – inadequate supporting documentation such as detailed budgets and adjudication reports (especially for sole providers); – a lack of timely monitoring of work progress against workplans and adherence to procedures on payment of instalments; and – non-respect of contract start and end dates in terms of actual performance of the work. • There is an unacceptable level of lack of compliance with rules and procedures in the procurement area. Audit findings disclosed a need for strengthening bidding procedures and reinforcing the segregation of duties in the functions of supplier selection, ordering and receipt of goods. In the area of Global Management System access rights, the functions of procurement requestor, receiver and workflow sole approver, were also found to be not adequately segregated. • There is a failure to follow up in a systematic manner on timely receipt of the technical and financial reports that are to be provided by the Ministries of Health under the Direct Financial Cooperation modality. There is also a general lack of systematic filing of supporting documentation for Direct Financial Cooperation transactions. • Unnecessary risks exist due to suboptimal use of electronic funds transfer as an alternative to payments to suppliers by cash or cheque. Weaknesses in the key supervisory role played by the Heads of country offices in the maintenance of petty cash has also led to poor record-keeping, and untimely reconciliations could encourage potential misuse. • eImprest accounts are not reconciled in a timely way and there is an unacceptable level of delay in clearing long-outstanding reconciling items. • Delays in receiving funding have impacted staffing decisions (i.e. delays in recruitment or contract extensions) and consequently have impacted the timeliness of programme implementation. Such delays also foster negative perceptions from donors of WHO’s ability to implement programmes efficiently.
10
A65/33
• There is a lack of appropriate and transparent documentation on staff selection processes, and a lack of completeness in the retention of such documents on file. • Security compliance is a general issue in most countries. The Office noted a lack of a plan to address the recommendations made by the United Nations Department of Security and Safety to improve compliance of country offices with Minimum Operating Security Standards and to monitor progress towards achieving full compliance as soon as possible. 43. In addition to the progress with the overall initiatives reported in paragraph 41, the Office considers that many of these country-level issues could be addressed through increased clarity and enforcement of responsibilities for key positions in those offices, an action that would strengthen the control environment. This step requires these key positions to be appropriately resourced so that they can implement and monitor controls effectively. Country office capacity should be reinforced through the establishment of improved procedures for the conduct, by the “compliance units” at the regional offices and the Global Service Centre, of “focused analysis” of transactions processed by country offices in high-risk areas. This should include an effective mechanism for reporting irregularities, supported by appropriate sanctions for non-compliance.
MONITORING THE IMPLEMENTATION OF AUDIT RECOMMENDATIONS 44. The Office monitors the implementation of all its audit recommendations to ensure that either action has been taken effectively by management or that senior management has accepted the risk of not taking action. Reporting on, and monitoring of, each individual audit recommendation has been improved by the recommendation-tracking database. The Office has categorized the audit recommendations made in 2011 by audit risk category and significance (see Annex 2). In addition, attention has been focused on monitoring the progress of implementation of high-priority recommendations for most open audits, i.e. those considered as being highly significant and requiring a relatively low level of effort to implement (see Annex 1). 45. In 2011, the Office received updates on progress of implementation of recommendations from the 2011 plan of work and prior years. In some cases, implementation has been reported to be completed; therefore, after review of the effectiveness of implementation, the Office has closed the audits (see Annex 3 (a)). The Office also reports that during 2011, it has not received updates on progress of implementation for eight audit reports, as mentioned in the attached list (see Annex 3 (b)).
ACTION BY THE HEALTH ASSEMBLY 46. The Health Assembly is invited to note the report.
11
ANNEX 1 STATUS OF OPEN AUDIT RECOMMENDATIONS Audits with open status as at 6 March 2012 Latest communication from auditee (a) No. of months since last response or report issuance No. of years since report issue Status Implementation rate compared to 1st response due date The Office of Internal Oversight Services analysis of open recommendations
Responsible Manager
Audit no. 07/735 07/757 07/758
Audit title Bank accounts of associations and other entities established by WHO staff at HQ Regional Office for Africa GSM Global Service Centre Control Readiness Assessment WHO Country Office, Pretoria, South Africa WHO’s collaboration with the private sector Alert And Response Operations, Epidemic and Pandemic Alert and Response Department at Headquarters Security in the Regions Global Insurance Coverage at Headquarters WHO Country Office, Islamabad, Pakistan Quality and Safety: Medicines Team, Essential Medicines and Pharmaceutical Policies Department Global Management System Access Tobacco Free Initiative Unit at the WHO Regional Office For South-East Asia Review of WHO’s approach to Comptrollership International Agency for Research on Cancer Management and oversight of the Staff Health Insurance Fund WHO Office for Southern Sudan, Juba
Quick wins not implemented (b) high priority (c),(d)
Number of recommendations not implemented (b) high significance (d)
Date of final report
Number of recs
In progress
Closed
Open
Comments
ADG/GMG RD/AFRO ADG/GMG
2007/05 2008/02 2008/01
4.8 4.1 4.1
2011/10 2010/10 2010/05
6 18 23
6 25 4
0 0 0
1 2 4
5 23 0
83% 92% 0%
not implemented (b) high significance(d) NA
NA NA NA Progress being assessed during follow-up audit in 2011 Currently under discussion to integrate into the Internal Control Framework OK
08/767 08/768 08/773
RD/AFRO ADG/GMG ADG/HSE
2008/05 2008/06 2008/08
3.8 3.7 3.5
2011/07 2010/05 2011/07
9 23 9
38 15 27
2 0 0
2 10 6
34 5 21
89% 33% 78%
2 NA 4
NA NA 1
08/778 08/779 08/780 09/797
ADG/GMG ADG/GMG RD/EMRO ADG/HSS
2008/11 2008/11 2008/11 2009/07
3.3 3.3 3.3 2.7
2011/12 2011/08 2011/11 2012/02*
3 7 5 1
24 45 48 37
0 45 0 0
6 0 13 6
18 0 35 31
75% 0% 73% 84%
4 18 3 5
NA 0 NA NA
09/801 09/803 09/805 09/807 09/808 09/813
ADG/GMG RD/SEARO ADG/GMG Director IARC ADG/GMG RD/EMRO
2009/06 2009/07 2009/07 2009/08 2009/09 2009/11
2.7 2.7 2.7 2.5 2.4 2.3
2011/09 2010/12 2011/11 2011/02 2011/08 2011/05
6 16 4 14 8 11
24 24 31 8 49 34
8 0 15 0 0 0
0 4 0 5 25 17
16 20 16 3 24 17
67% 83% 52% 38% 49% 50%
NA 0 NA 3 9 15
NA 0 NA 0 0
A65/33
NA
13
Latest communication from auditee (a)
No. of months since last response or report issuance
Implementation rate compared to 1st response due date
No. of years since report issue
Responsible Manager
Audit no. 09/814 09/817 09/818 09/819 09/820 10/824 10/829 10/830 10/832 10/835 10/837
Audit title Knowledge Management Strategy at WHO headquarters WHO Country Office, Lusaka, Zambia Management Support Programme Unit at the WHO Regional Office For Europe Review of controls over selected business processes at the GSC Regional Office for Africa Secretariat of the Global Drug Facility WHO Country Office, Tehran, Islamic Republic of Iran Records Management System for the Global Management System WHO Country Office, Abuja, Nigeria Integrated audit of WHO in Indonesia
Quick wins not implemented (b) high priority (c),(d)
Number of recommendations not implemented (b) high significance (d)
Date of final report
Number of recs
In progress
Closed
Open
14 Audits with open status as at 6 March 2012 Status The Office of Internal Oversight Services analysis of open recommendations Comments ADG/IER RD/AFRO RD/EURO ADG/GMG RD/AFRO ADG/HTM RD/EMRO ADG/GMG RD/AFRO RD/SEARO 2009/11 2010/03 2010/02 2009/12 2010/03 2010/11 2010/12 2010/08 2010/07 2010/08 2010/09 2.3 2.0 2.1 2.2 2.0 1.3 1.2 1.6 1.7 1.6 1.4 2012/02* 2011/07 2011/01 2011/12 2010/06 2011/11 2011/11 2012/01 2011/11 2012/01 Unresponded 1 9 15 4 22 5 4 3 4 2 18 11 26 25 62 46 50 44 20 58 38 4 0 0 0 26 1 39 5 1 0 0 4 9 3 15 11 30 0 26 7 1 8 0 2 23 10 25 15 11 13 12 57 30 0 18% 88% 40% 40% 33% 22% 30% 60% 98% 79% 0% 0 0 1 NA 30 31 13 4 1 6 2 0 0 1 NA NA 0 6 0 0 6 1 12 recommendations transferred to 10/846 and 10/847 Progress being assessed during follow-up audit in 2011 Review of the internal control environment at the RD/SEARO Regional Office for South-East Asia post GSM go-live WHO Country Office, Bamako, Mali WHO Country Office, Yangon, Myanmar Travel Employee Payables and Receivables (Personal Accounts) RD/AFRO RD/SEARO ADG/GMG ADG/GMG 10/842 10/845 10/846 10/847 2010/12 2011/01 2011/07 2011/07 1.2 1.1 0.6 0.6 2012/03* Unresponded 2011/10 2011/11 1 14 5 4 45 39 34 32 0 39 31 32 2 0 3 0 43 0 0 0 96% 0% 0% 0% 2 27 20 29 0 16 1 17 IOS has received a partial response to 3 HR recommendations Auditee response not yet due OK Auditee response currently under analysis OK 10/850 Performance audit of the Department of Nutrition ADG/NMH and Health Development at headquarters 2011/02 1.0 2011/12 3 25 25 0 0 0% 16 2
A65/33 Annex 1
Annex 1
Audits with open status as at 6 March 2012 Latest communication from auditee (a) No. of months since last response or report issuance No. of years since report issue
Status Implementation rate compared to 1st response due date
The Office of Internal Oversight Services analysis of open recommendations
Responsible Manager
Audit no. 11/852 11/856 11/858 11/859
Audit title Performance audit of the Department of Food Safety and Zoonoses at headquarters WHO Country Office, Bishkek, Kyrgyzstan
Quick wins not implemented (b) high priority (c),(d)
Number of recommendations not implemented (b) high significance (d)
Date of final report
Number of recs
In progress
Closed
Open
Comments
Audit reports issued during 2011 ADG/HSE RD/EURO 2011/05 2011/05 2011/06 2011/06 0.8 0.8 0.7 0.7 Unresponded 2012/02* 2011/12 2011/12 10 1 3 3 32 30 11 17 32 0 9 0 0 11 0 3 0 19 2 14 0% 63% 18% 82% 13 9 4 2 2 2 3 0 Auditee response not yet due OK
Review of the internal control environment at the RD/EURO Regional Office for Europe post-GSM go live Performance audit of the Department of Violence ADG/NMH and Injury Prevention and Disability at headquarters Integrated audit of WHO in India RD/SEARO Special Review of Streptomycin Procurement for ADG/HTM the Global Drug Facility Integrated audit of WHO in Zimbabwe Integrated audit of WHO in China RD/AFRO RD/WPRO
11/860 11/861 11/862 11/863 11/866 11/867
2011/07 2012/01 2011/09 2011/10 2011/09 2011/12
0.6 0.1 0.4 0.4 0.4 0.2
Unresponded Not due yet 2011/12 Not due yet Unresponded Not due yet
8 2 4 6 6 4
36 2 40 43 40 15
36 2 40 43 40 15
0 0 0 0 0 0
0 0 0 0 0 0
0% N/A 0% N/A 0% N/A
4 2 22 23 25 12
2 0 13 11 11 5
Auditee response not yet due OK Auditee response not yet due OK Auditee response not yet due OK Auditee response not yet due OK Auditee response not yet due OK Auditee response not yet due OK
WHO Country Office, Port Moresby, Papua New RD/WPRO Guinea Pre-Implementation review of the General Management Cluster Standard Operating Procedures ADG/GMG
11/869
ADG/IER Tuberculosis/Highly Active Antiretroviral Therapy (TB/HAART) Study of the Special Programme for Research and Training in Tropical Diseases (TDR) at HQ WHO Country Office, Dili, Democratic Republic RD/SEARO of Timor-Leste Inregrated audit of WHO in Angola Roll Back Malaria Partnership Secretariat RD/AFRO EXD/RBM
2011/09
0.4
2012/03*
1
1
1
0
0
0%
0
0
Auditee response not yet due OK
11/871 11/872 11/879 (a) (b) (c) (d)
2011/12 2012/02 2012/02
0.2 0.0 0.1
Not due yet Not due yet Not due yet TOTAL
3 1 2
53 32 26 1376
53 32 26 602
0 0 0 230
0 0 0 544
N/A N/A N/A
37 20 6
20 3 3
Auditee response not yet due OK Auditee response not yet due OK Auditee response not yet due OK
Response currently under consideration by the Office of Internal Oversight Services Not implemented, meaning either open or in progress. High priority, meaning high significance and low implementation effort (quick wins). NA: not applicable.
A65/33
15
A65/33
ANNEX 2 AUDIT RECOMMENDATIONS MADE IN 2011 BY AUDIT RISK CATEGORIES AND SIGNIFICANCE
Strategy and Planning Risk Management Collaboration Resource Mobilization Reliability of Financial Information Organization Human Resources Segregation of Duties Implementation Efficiency and Effectiveness Information, Communication and Monitoring Internal Control Compliance Safeguarding of Assets Global Management System Information and Communication Technology Security Significance - High Significance - Medium Significance - Low
0
50
100
150
Number of recommendations (n=469)
16
ANNEX 3 STATUS OF CLOSED AUDITS AND OPEN AUDITS FOR WHICH NO UPDATE WAS RECEIVED IN 2011 (a) Audit reports closed since 1 January 2011 Audit No. 05/697 06/727 07/753 08/784 09/792 09/795 09/796 09/804 09/806 10/826 10/831 10/836 Security at headquarters Enterprise Risk Management WHO Research Ethics Review Committee Education grants at WHO headquarters WHO Country Office, Nairobi, Kenya WHO Country Office, Niamey, Niger Tobacco Free Initiative at headquarters Health and Medical Services at headquarters WHO Country Office, Accra, Ghana UNAIDS Country Office in China WHO Office for the South Pacific, Suva, Fiji WHO Country Office, Ouagadougou, Burkina Faso Audit title Date of final report 06/2005 08/2006 01/2008 01/2009 05/2009 06/2009 06/2009 07/2009 08/2009 04/2010 06/2010 08/2010 Closing date 03/2011 01/2012 05/2011 05/2011 05/2011 03/2011 02/2011 12/2011 08/2011 01/2011 01/2011 08/2011
= = (b) = 17 07/757 07/758 08/768 09/803 09/820 10/837 10/845 11/852 11/860
Open audits for which no progress update was received during 2011 (as at 6 March 2012) Implementation Number of Quick wins rate recommendations not Latest Number of Date of communication Number of years since compared to first not implemented* implemented* In final report from auditee recommendations Open progress Closed report issue response due date high significance high priority** 02/2008 01/2008 06/2008 07/2009 03/2010 09/2010 01/2011 05/2011 07/2011 10/2010 05/2010 05/2010 12/2010 06/2010 Unresponded Unresponded Unresponded Unresponded 25 4 15 24 46 4 39 32 36 0 0 0 0 1 4 39 32 36 2 4 10 4 30 0 0 0 0 23 0 5 20 15 0 0 0 0 4.1 4.1 3.7 2.7 2.0 1.4 1.1 0.8 0.6 92% 0% 33% 83% 33% 0% 0% 0% 0% NA NA NA 0 30 2 27 13 4 NA NA NA 0 NA 1 16 2 2
Audit no.
Audit title Regional Office for Africa GSM Global Service Centre control readiness assessment WHO’s collaboration with the private sector Tobacco Free Initiative Unit at the WHO Regional Office For South-East Asia Regional Office for Africa Review of the internal control environment at the Regional Office for South-East Asia post GSM go-live WHO Country Office, Yangon, Myanmar Performance audit of the Department of Food Safety and Zoonoses at headquarters Integrated audit of WHO in India *
A65/33
Not implemented, meaning either open or in progress. ** High priority, meaning high significance and low implementation effort (quick wins).