WORLD HEALTH ORGANIZATION FIFTY-NINTH WORLD HEALTH ASSEMBLY Provisional agenda item 16.2 A59/32 24 April 2006
Report of the Internal Auditor INTRODUCTION 1. The Office of Internal Oversight Services transmits herewith its annual report for the calendar year 2005 for the information of the Health Assembly. 2. Rule XII of the Financial Rules – Internal Audit – establishes the mandate of the Office of Internal Oversight Services. Paragraph 112.3(e) of Rule XII requires the Office to submit a summary annual report to the Director-General on its activities, their orientation and scope, and on the implementation status of the recommendations made. The Financial Rules also state that this report shall be submitted to the Health Assembly, together with any comments deemed necessary. 3. The Office performs an independent, objective, assurance and advisory activity designed to add value to and improve the Organization’s operations. Using a systematic and disciplined approach, it helps the Organization to accomplish its objectives by evaluating and improving the effectiveness of processes for risk management, control, and governance. It is responsible for investigation of alleged irregular activity and it maintains the Organization’s programme-evaluation function. The Office is authorized full, free and prompt access to all records, property, personnel, operations and functions within the Organization which, in its opinion, are relevant to the subject matter under review. 4. Under an agreement with PAHO, the Office operates a joint internal audit activity based in Washington, DC, to provide oversight services covering both PAHO and the WHO Regional Office for the Americas. This report includes work related to PAHO and to the Regional Office.
PRIORITIES AND PRODUCTS 5. The Office views risk as the possibility of an event occurring that will influence the achievement of objectives. Risk is assessed in terms of degree of impact and likelihood of occurrence. Accordingly, a methodical risk assessment process guides the Office’s prioritization of activities and provides a basis for work planning during engagements. 6. Although certain oversight projects were limited to very precise objectives, the general scope of work was to evaluate whether the network of processes for risk management, control, and governance, as designed and implemented by the Organization’s management, was adequate and functioning in a manner to fulfil specific purposes. These were to ensure that: (a) risks were identified and managed; (b) financial, managerial, and operating information was accurate, reliable, and timely; (c) staff actions complied with WHO regulations, rules, policies, standards and procedures; (d) resources were acquired economically, used efficiently, and protected adequately; (e) programmes, plans, and
A59/32
objectives were achieved; and (f) the Organization’s control process fostered quality and continuous improvement. 7. At the conclusion of each assignment, the Office issued a detailed report and made recommendations to management that were designed to help manage risk, maintain effective controls and ensure effective governance within the Secretariat.
MANAGEMENT OF THE OFFICE 8. The Office reports directly to the Director-General and at year’s end had a professional staffing resource of nine auditor posts, two evaluator posts, one medical officer post and one Director’s post. 9. Available resources are assigned in accordance with priorities of the Office. High-risk situations involving investigation of irregular activity, which develop unpredictably, may divert such resources away from identified priorities. Accordingly, the Office prioritizes scheduled work, then adjusts the schedule in order to compensate for any unexpected assignments. 10. In addition to human resources, the Office incurs such costs as travel, consultants and operating supplies in order to fulfil its terms of reference. During 2005, sufficient funds were allocated to the Office to cover necessary expenses and no work was deferred because of lack of funding. 11. The Office maintains regular contact with the Organization’s External Auditor. Consultations were held during the year to coordinate audit work and to avoid overlap in coverage. The Office provides the External Auditor with a copy of all internal audit and evaluation reports.
AUDITS 12. In the opinion of the Office, the results of the audit work undertaken during 2005 indicate that overall, the processes for control, risk management and governance within WHO continue to provide reasonable assurance that significant shortcomings in the procedures that lead to achievement of the Organization’s objectives would be prevented or disclosed. 13. No limitations were placed on the scope of the work of the Office in the course of conducting its business; nor were there any significant unresolved differences of opinion between the Office and the Organization’s senior management in respect of acceptance of residual risk. 14. Major issues and areas of improvement that were identified during the audits undertaken in 2005 are described below, set out under the major groupings outlined in the Office’s plan of work.1
Regional and country offices 15. Office of the WHO Representative, Lilongwe. A performance audit disclosed that the plan of work of the Representative’s office was aligned with the country’s national health plan and the goals and priorities of WHO. However, programme delivery was overly focused on providing supplies, 1
See document EBPBAC1/3.
2
A59/32
equipment and direct implementation, and only 10% of the planned activities related to high-level policy advice. The audit noted a lack of reliable data for programme monitoring which contributed to a low rate of programme implementation. Lastly, the audit recommended that priority should be given to filling the position of Representative and finalizing the country cooperation strategy. 16. Office of the PAHO/WHO Representative, Quito. A review of the finance and administration transactions of the office revealed a weakness in demonstrating that value for money was obtained during procurement of goods and services. The value of contracts issued during the two-and-a-half year period prior to the audit was US$ 0.8 million, and there was a notable lack of compliance with procedural guidance in areas such as competitive quotes and submission of supporting budgets or estimates. The audit further reported that improper storage of computerized backup data created an unacceptable risk related to its recovery in the event of a disaster. 17. HIV/AIDS unit at PAHO/Regional Office for the Americas. The audit confirmed that progress had been made in the Region towards achieving the “3 by 5” target; however, it varied dramatically from one country to another and some priority countries continue to show low rates of treatment. The HIV/AIDS unit has been strengthened recently, but the audit identified continuing problems related to shortages of funding and noted the need for collaboration with partners, improved skills mix of the staff and sufficient administrative support. Lastly, the Revolving Fund for Strategic Public Health Supplies requires strengthening through information to stakeholders, resource mobilization and improved linkages to technical activities. 18. WHO Liaison Office, Sarajevo. The audit determined that the biennial collaborative agreement with Bosnia and Herzegovina is relevant to the public health needs of the country and is closely aligned with the priorities of WHO. The large budget increase from US$ 0.7 million in the biennium 2002-2003 to US$ 3.6 million in the biennium 2004-2005 was reviewed and found to have been the result of resources mobilized locally. Financial implementation in some instances was below 40% in the fourth quarter of the biennium 2004-2005 due in part to problems associated with operation of the programme monitoring system at the Regional Office. The work also disclosed that the national mechanism for stakeholder coordination was dysfunctional and noted duplication of activities and missed opportunities. 19. Office of the Caribbean Program Coordinator and PAHO/WHO Representative, Bridgetown. The results of the audit demonstrated a pervasive lack of compliance with procurement procedures over the past four years. During this period, approximately US$ 2.8 million worth of contracts and purchase orders were issued and compliance problems were evident with respect to requisitions, competitive bidding, adjudication reports and other procedural requirements. The audit highlighted the need to fill the supervisor position over the procurement area, to observe proper segregation of duties in the area of finance, and to enhance the security for computerized systems. 20. Regional Office for Africa. The audit sought to appraise progress on re-engineering the budget and finance function at the Regional Office, to confirm implementation of recommendations from past internal audit reports, and to review controls over selected financial and procurement activity. The Regional Office had not formalized an implementation plan, although the recommendations on re-engineering the budget and finance function were made approximately one year before the latest audit. Although some procedural guidance had been issued on past internal audit recommendations, the audit disclosed a low level of compliance; accordingly, implementation of the key recommendations cannot be characterized as effective. There were severe internal control deficiencies over procurement activity which led to financial losses for the Organization. Suitable suppliers were not identified, purchase orders were initiated without proper requests, and regulations regarding
3
A59/32
selection of both suppliers and bidding were regularly violated. Lack of budgetary control contributed to this situation as significant overexpenditure was not scrutinized. 21. Letters of agreement at PAHO/Regional Office for the Americas. These agreements are a key means of transferring funds during delivery of technical cooperation and their volume has increased from US$ 8.5 million in the biennium 2002-2003 to US$ 14.1 million at the end of the third quarter of the biennium 2004-2005. Testing disclosed a pervasive lack of compliance with established policies, and there was little evidence available to demonstrate that procedures were followed in order to ensure that activities were implemented as agreed. The work identified compliance issues relating to approvals, required budgets, reporting by the recipient, review of expenditures and inadequate records. Factors contributing to this situation were the lack of a process owner and weaknesses relating to information technology. 22. Travel at PAHO/Regional Office for the Americas. The audit assessed the effectiveness of PAHO’s procedures and controls over duty travel to ensure that it is conducted in compliance with policies and procedures with due regard for value for money. Compliance with policy and procedure was acceptable; there was, however, a need to enhance the information available to management for negotiating airline fares and monitoring expenditure. Recommendations were also made to reduce travel costs through advance planning and to strengthen financial controls. 23. Tsunami relief operations. The audit concentrated on confirming reasonableness of expenditure and reviewing programme accountability. In general, expenditures incurred for tsunami activities, for the donors selected for review, were reasonably within the range of the purpose for which the donation was designated. In Indonesia, good progress has been made towards achievement of results as outlined in the plan of work, and most activities have been completed. However, results achieved under the disease surveillance project, relating to assessments, cannot be correlated directly with the proposals, and therefore its relevance is not assured. Dedicated follow-up is required on the Restoration of Water and Sanitation Systems in the Disaster-Affected Area Project, where significant components of both its products remain outstanding. In the case of Sri Lanka, given the overall success of health efforts and satisfactory health indicators after the tsunami, the audit disclosed that the stated aims of the Flash Appeal for health had been achieved. However, deficiencies were found in respect of late provision of equipment, perceived inadequate quality of some experts provided by WHO, and the missed opportunity of strengthening the public-health laboratory network. 24. Regional Office for the Eastern Mediterranean. The objective of the audit was to assess whether risks associated with selected budget, finance and procurement functions were identified and properly managed through the internal control structure. The results of the work disclosed that controls require strengthening with respect to access rights to the computerized accounting system, payment methods and signatories, local cost-subsidy reporting, and account reconciliations. Controls over local procurement require strengthening in the areas of activity monitoring, bid procedures, headquarters approval for large purchases, segregation of duties, and nonexpendable inventory.
Headquarters 25. Secretariat of the Water Supply and Sanitation Collaborative Council. The activities of the Council fall outside WHO’s programme of work, and the Council is governed by a body independent of WHO. However, as the host organization, WHO bears ultimate responsibility for liabilities created by the Council. In early 2005, a technical partner of the Council claimed payment of charges valued at US$ 0.6 million for contractual services rendered during the period 2002-2004. There were no written contracts for the work, financial obligations had not been raised, and at the audit’s inception, the
4
A59/32
Council had insufficient funds to extinguish the claims. Further, the audit identified a situation of decreasing compliance with controls subsequent to an internal audit in 2001. Donor agreements were not cleared as required, contracts were submitted retroactively to the Contract Review Committee, and contract budget requirements were not enforced. 26. WHO headquarters travel claims. The object of the audit was to assess the controls and procedures over processing of duty-travel claims since the introduction of revised policies and procedures in late 2004, designed to assist the traveller and simplify processing. Although the new procedures have relieved staff of a personal financial burden for an extended period, the procedures have not been successful in streamlining administration of claims, and a backlog persists. Closely associated with travel claims were claims for incidental expenses, none of which had been settled since the introduction of the new policy. Further, the audit identified a weakness in supervisory review of travel claims, and noted that approval of travel authorizations and the associated claims was often delegated to support staff. Lastly, the report showed that WHO’s requirements for travel claims will only partially be met by the existing software connected with the global management system. 27. Governance review of the global management system project. The object of the audit was to review the governance structure of the global management system project, including application of the project methodology. The audit concluded that the project has achieved much. However, it will need much clearer and stronger governance in the near future to manage the effects of the arrival of the system’s integrator and resultant escalation of costs and effort. The audit recommended specific actions, including strengthening the project team, creating a unified project board, developing charters for governance groups, and ensuring accurate and timely dissemination of activity and budget information. 28. Staff security at headquarters. The audit appraised the efficiency and effectiveness of procedures employed by the Staff Security unit at headquarters to identify and mitigate major security risks related to staff. As a result of the sustained efforts of the unit, the level of security awareness, the ability to provide assistance during crises, and compliance with United Nations/WHO rules have improved significantly. However, the audit also noted the need for continued efforts to ensure compliance with security policies and procedures and, in particular, monitoring and reporting. The reporting structure in the regions does not always allow the unit to fulfil its mandate effectively, and a more structured security-risk assessment would help to ensure that resources are used optimally. 29. Department of Chronic Diseases and Health Promotion. The purpose of this programme performance audit was to appraise the Department’s achievement of its expected results. The audit determined that the Department had created a foundation for prevention and control of chronic noncommunicable diseases in an environment of funding shortages. However, the audit also identified the need to balance normative work with support for achieving results in regions and countries, and further noted issues related to staffing, administration, resource mobilization, interaction with other departments, and working with the private sector. It proved difficult to monitor the Department’s achievements in light of the overly general nature of its expected results, and work plans were approved only in the middle of the biennium, partly due to departmental reorganization, which affected programme implementation. 30. WHO Lyon Office for National Epidemic Preparedness and Response. The audit sought to assess the organizational structure and management practices of the Office within the context of achievement of the expected results. The lack of detailed plans and measurable expected results made it difficult to determine the accomplishments of the Office and a general deficiency in planning and monitoring was evident. There was a need to complete staffing and funding arrangements which will affect the long-term plan and expected results. Although the audit did not disclose major problems 5
A59/32
with administration in general, the areas of travel, communications and coordination with other units in the Department of Epidemic and Pandemic Alert and Response require attention.
EVALUATIONS 31. WHO, Yemen. The evaluation assessed WHO’s strategy for cooperation with, and its implementation in, Yemen, a country that has been characterized by institutional and security problems. Despite these challenges, WHO has been able to increase its technical capacity and credibility due to the arrival of additional professional staff and improved coordination of technical assistance. Administrative procedures have been improved, as have connectivity and access to information. However, there is a risk that increased technical capacity may be compromised if contracts for critical expertise cannot be extended due to shortage of funds. 32. WHO’s work has shown responsiveness to emerging priorities such as health sector reform, the initiation of the macroeconomics, and health process and leadership during disease outbreaks. The country cooperation strategy, in general, is aligned to the country’s needs and priorities and with WHO’s corporate strategy and global commitments. The programme in Yemen is moving away from routine implementation towards provision of generic and specific policy advice. However, the high number of areas of work (31 when reviewed) carries the risk of spreading limited human and financial resources too thinly. 33. WHO, Guyana. The evaluation assessed the Organization’s cooperation strategy and its programme implementation in Guyana during the past five years. The Guyana country team has been technically upgraded and contributed to high-profile interventions in 2005. The country cooperation strategy brought coherence to the country biennial plan of action and aligned the support from the regional office and headquarters. It also helped in mobilizing additional resources for child and adolescent health, communicable diseases, and health systems development. 34. The support that the Organization provided in response to the floods of 2005 and in the area of maternal and child health are examples that have raised considerably the visibility of WHO/PAHO. However, in other areas such as developing policies on human resources for health or a comprehensive health information system, the efforts of the Organization have not yielded positive results. The recent technical expansion of the country team has created increased expectations and therefore an appropriate level of resources should be ensured. 35. Child and Adolescent Health and Development. The evaluation assessed the work of WHO with national, bilateral and multilateral partners. The evaluation noted that due to combined efforts of Member States, Secretariat and partners, progress has been made in many countries in reducing infant and under-five mortality. While recognizing the importance of improving health systems, human resources for health and health service delivery, it was noted that unless current progress is accelerated, the related Millennium Development Goals will not be met in many countries. The successful emphasis placed by programme staff on joint planning, budgeting, implementation and monitoring across all levels of the Organization, with a focus on country level results, can serve as a model for other areas of work. The evaluation recognized the considerable achievements of the programme, while concluding that increased and re-oriented efforts in several programme areas, particularly adolescent health, were required. These include increasing WHO’s leadership role; reinforcing coordination within WHO and with external partners; expanding and intensifying efforts at country level; re-orienting research efforts to focus more on implementation issues; and further strengthening of monitoring and evaluation.
6
A59/32
36. Overall funding shortages affect the work of the programme, despite a marked increase in the regular budget from US$ 7.5 million in 2000-2001 to US$ 27.5 million in 2006-2007. There are indications that resource mobilization has accelerated during the biennium 2004-2005 after major shortfalls in extrabudgetary funds from 2000 to 2003, although the increase in specified funds is a matter for concern. Specified funds, often for clinical research activities, limits flexibility to achieve impact in countries. The evaluation noticed competition for resources within the area of work between the newborn, child and adolescent health programmes as a result of the shortage of funds.
INVESTIGATIONS 37. The volume of investigative activity during 2005 increased in comparison with the previous year. Certain follow-up work continues on cases from 2004, and a high-value fraud was investigated at a regional office. 38. A WHO liaison office. The investigation confirmed that US$ 9000 in currency held in the safe had been replaced with local currency of a nominal value. It further disclosed that the Organization suffered a loss of approximately US$ 3400 through a scheme of inflated invoices for workshops. The results of a disciplinary review are pending. 39. A WHO Representative’s office. The investigation disclosed that several airline tickets which had been issued free by the airline were billed, paid, and the money deposited in an unofficial cash fund used for WHO staff welfare activities. The results of a disciplinary review are pending. 40. A WHO regional office. The initial results of an investigation of local purchasing at a regional office which disclosed a loss of approximately US$ 275 000 were previously reported.1 Disciplinary action has now been taken by the Regional Director and the individual involved has been dismissed. At year end 2005, the Office of Internal Oversight Services had reviewed local purchasing at most other regional offices and had not found similar irregularities.
FOLLOW-UP AND IMPLEMENTATION 41. The Office monitors the status of all its recommendations to ensure that actions have been effectively implemented by management or that senior management has accepted the risk of not taking action. Although the Office is generally satisfied with the overall disposition of the significant audit recommendations, there is a backlog of audit recommendations pending implementation. The Annex to this document contains the status of reports issued from the 2005 plan of work, and includes information on closure. All recommendations from the 2004 plan of work and before have been reported as implemented, reviewed by the Office for effectiveness and the audits closed except as mentioned below. 42. Regional Office for Africa. The audit work reported in October 20052 confirmed that the issues raised in the audit report of October 20033 largely remained without substantive correction, although 1 2 3
See document EBPBAC3/3, paragraphs 10-14. See paragraph 20 and Annex. See document A57/19, paragraph 16.
7
A59/32
the Regional Office had issued a response to the audit. The Regional Office’s weaknesses with respect to the expenditure cycle represent a serious financial risk to the Organization and the length of time taken to respond to those weaknesses increases the Region’s exposure to financial and administrative risks. The audits will remain open until substantive progress is made on all the issues raised in the reports. 43. Regional Office for the Eastern Mediterranean. The audit report, issued in February 2004, discussed managerial issues for selected areas of work within the Division of Communicable Disease Control. A response was received late in 2005. However, a number of issues remain open due to a lack of substantive detail on how and when the recommendations will be implemented. Follow-up will continue. 44. Department of Essential Drugs and Medicines Policy. The audit report, issued in August 2004, discussed various issues,1 including the pre-qualification process for critical drugs, conflict of interest, support to national drug regulatory authorities, and registering of international nonproprietary names. Subsequently, the Department was divided into the Department of Medicines Policy and Standards and the Department of Technical Cooperation for Essential Drugs and Traditional Medicine. The audit recommendations remained valid. The Department of Technical Cooperation for Essential Drugs and Traditional Medicine responded to the audit but omitted information on specific actions taken to implement the recommendations. The Department of Medicines Policy and Standards replied stating that the recommendations were no longer relevant. Follow-up will continue as neither is an acceptable response. 45. Public Health and Rehabilitation Project for Eritrea. The report of the audit was issued in September 2004 and discussed various topics related to this project.2 A number of issues were addressed in a reply received approximately one year later. However, the audit remains open as a number of recommendations concerning project implementation, monitoring and evaluation have yet to be reported as implemented. Follow-up will continue. 46. Telephone expenses at headquarters. The audit report, issued in January 2005, discussed certain weaknesses in control over telephone-call expense and highlighted the likely losses realized by WHO.3 The majority of the issues has been dealt with and a new policy has recently been issued. However, individual accountability for past abuses has not yet received adequate attention. Recovery has been made for the specific cases of abuse identified during audit testing, but the likelihood of other significant non-reimbursement is high, and accordingly, this recommendation remains open pending further action. 47. UNICEF/UNDP/World Bank/WHO Special Programme for Research and Training in Tropical Diseases. The audit report highlighted the need to review resource mobilization, closure of projects and compliance with regulations.4 Although the report was issued in the first quarter of 2005, an implementation plan has not been received and reminders have remained unanswered. A response was recently sent to the Office and is undergoing analysis before closure of the audit can be agreed.
1 2 3 4
Referred to in document A58/25, paragraph 24. Referred to in document A58/25, paragraph 16. Referred to in document A58/25, paragraph 26. See document A58/25, paragraph 28.
8
A59/32
48. Office of the WHO Representative, Islamabad. A timely response to this performance audit1 was consolidated and forwarded by the Regional Office. The response is detailed and effectively covers most of the issues. However, specific details are lacking for some of the recommendations and, accordingly, the audit remains open while liaison continues with the Regional Office for closure.
ACTION BY THE HEALTH ASSEMBLY 49. The Health Assembly is invited to note the report.
1
See document A58/25, paragraph 23.
9
ANNEX A59/32 __________________________________________________________________________________________ 10
2005 AUDIT, INVESTIGATION AND EVALUATION REPORTS AND STATUS Report title Report date Closure date Comments
AUDITS Secretariat of the Water Supply and Sanitation Collaborative Council 15.04.2005 A negotiated settlement was signed in late 2005 and reportedly final payment on the contractual claims against the Council has been made. The Council has responded to the audit. However, the hosting arrangements have been transferred to UNICEF and are expected to be completed by 31 March 2006. Awaiting initial response. A new policy on incidental expenses was announced in late 2005 which appears to be designed, in part, to reduce the number of claims. 04.11.2005 The Regional Office provided a plan which showed that all the recommendations had been accepted and implemented. A new Representative has been appointed and the audit closed. The Representative responded positively to the recommendations and the audit was closed. A response was received shortly after issuance of the report which discussed future direction of the project with respect to the recommendations. Additional information is awaited as the project moves towards its goal. Awaiting initial response. Initial response recently received and undergoing evaluation. 23.09.2005 The Regional Office responded to, and agreed with, the recommendations in the report and the audit was closed. Awaiting initial response. Awaiting initial response.
WHO headquarters travel claims
05.07.2005
Office of the WHO Representative, Lilongwe
26.04.2005
Office of the PAHO/WHO Representative, Quito Governance review of the global management system project
17.06.2005 21.04.2005
08.02.2006
Staff Security unit at headquarters HIV/AIDS unit at PAHO/Regional Office for the Americas WHO Liaison Office, Sarajevo Office of the Caribbean Program Coordinator and PAHO/WHO Representative, Bridgetown Removals at headquarters
24.06.2005 26.08.2005 22.07.2005 06.09.2005 04.11.2005
Annex
Report title Regional Office for Africa
Report date 05.10.2005
Closure date
Comments The Regional Office presented a detailed plan for reengineering the budget and finance function, which showed structural changes, impact of the global management system and other changes specifically recommended. The reengineering plan is acceptable. However, it has not yet been implemented and other recommendations for strengthening internal control remain open. Awaiting initial response. An interim response has been received which indicates the action in progress to implement the audit recommendations. Awaiting initial response. Transmitted to the Executive Director, UNAIDS. Awaiting initial response. Awaiting initial response. Awaiting initial response.
Letters of Agreement at PAHO/Regional Office for the Americas Department of Chronic Diseases and Health Promotion Travel at PAHO/Regional Office for the Americas UNAIDS Information Centre WHO Lyon Office for National Epidemic Preparedness and Response Tsunami relief operations Regional Office for the Eastern Mediterranean
26.10.2005 15.11.2005 15.02.2006 25.10.2005 31.01.2006 24.02.2006 10.03.2006 EVALUATIONS
WHO, Yemen WHO, Guyana Child and Adolescent Health and Development
27.10.2005 07.03.2006 In draft INVESTIGATIONS
Investigation at a WHO regional office Investigation at a WHO liaison office Investigation at a WHO Representative’s office 11
23.03.2005 01.04.2005 24.05.2005
10.10.2005 Sub judice A59/32 Sub judice
A59/32
12 Report title Investigation at a WHO regional office Investigation at a WHO-related organization Report date 29.06.2005 24.11.2005 Closure date 31.12.2005 Sub judice Comments
= = = Annex