SIXTIETH WORLD HEALTH ASSEMBLY Provisional agenda item 16
A60/34 5 April 2007
Report of the Internal Auditor
INTRODUCTION 1. The Office of Internal Oversight Services transmits herewith its annual report for the calendar year 2006 for the information of the Health Assembly. 2. Rule XII of the Financial Rules – Internal Audit – establishes the mandate of the Office of Internal Oversight Services. Paragraph 112.3(e) of Rule XII requires the Office to submit a summary annual report to the Director-General on its activities, their orientation and scope, and on the implementation status of the recommendations made. The Financial Rules also state that this report shall be submitted to the Health Assembly, together with any comments deemed necessary. 3. The Office performs an independent, objective, assurance and advisory activity designed to add value to and improve the Organization’s operations. Using a systematic and disciplined approach, it helps the Organization to accomplish its objectives by evaluating and improving the effectiveness of processes for risk management, control and governance. It is responsible for investigation of alleged irregular activity and it implements the Organization’s programme evaluation function. The Office is authorized full, free and prompt access to all records, property, personnel, operations and functions within the Organization which, in its opinion, are relevant to the subject matter under review. No limitations were placed on the scope of the work of the Office in the course of conducting its business during 2006.
PRIORITIES AND PRODUCTS 4. The Office views risk as the possibility of an event occurring that will influence the achievement of objectives. Risk is assessed in terms of degree of impact and likelihood of occurrence. Methodical consideration of risk guides the Office’s prioritization of activities and provides a basis for work planning during engagements. 5. Although certain oversight projects were limited to very precise objectives, the general scope of work was to evaluate whether the network of processes for risk management, control, and governance, as designed and implemented by the Organization’s management, was adequate and functioning in a manner to fulfil specific purposes. These were to ensure that: (a) risks were identified, evaluated and managed; (b) financial, managerial and operating information was accurate, reliable and timely; (c) staff actions complied with WHO regulations, rules, policies, standards and procedures; (d) resources were acquired economically, used efficiently, and protected adequately; (e) programmes,
A60/34
plans and objectives were achieved; and (f) the Organization’s control process fostered quality and continuous improvement. 6. At the conclusion of each assignment, the Office issued a detailed report and made recommendations to management that were designed to help manage risk, maintain effective controls and ensure effective governance within the Secretariat.
MANAGEMENT OF THE OFFICE 7. The Office conducts its work in accordance with the International Standards for the Professional Practice of Internal Auditing promulgated by the Institute of Internal Auditors and adopted for use throughout the United Nations system. The Office completed an external quality assessment in 2006 as required by the Standards and was determined to be in compliance with them and the terms of reference of the Office. 8. The Office reports directly to the Director-General and at year’s end had a professional staffing resource of nine auditor posts, two evaluator posts, one medical officer post, one investigator post and one director’s post. 9. Available human resources are assigned in accordance with priorities of the Office. High-risk situations involving investigation of irregular activity, which develop unpredictably, may divert such resources away from identified priorities. Accordingly, the Office prioritizes scheduled work and adjusts the schedule in order to compensate for any unexpected assignments. 10. In addition to human resources, the Office incurs such costs as travel, consultants and operating supplies in order to fulfil its terms of reference. During 2006, sufficient funds were allocated to the Office to cover necessary expenses and no work was deferred because of lack of funding. 11. The Office maintains regular contact with the Organization’s External Auditor. Consultations were held during the year to coordinate audit work and to avoid overlap in coverage. The Office provides the External Auditor with a copy of all internal audit and evaluation reports.
AUDITS 12. In the opinion of the Office, the results of the audit work undertaken during 2006 indicate that in general, the processes for control and governance within WHO provide reasonable, but not absolute, assurance that significant shortcomings in the procedures that lead to achievement of the Organization’s objectives would be prevented or disclosed. However, periodic managerial review of controls and governance should be maintained to accommodate the changing profile of the Organization as a result of evolving business processes. 13. The Office is concerned at the lack of formalization with respect to risk management and considers that the lack of established processes for identification and evaluation of risks is not
2
A60/34
acceptable.1 Senior management has agreed to review critically the status of their efforts at risk management,2 and the Office will re-examine the issue in order to ensure strengthening of this area. 14. Major issues and areas for improvement that were identified during the audits undertaken in 2006 are described below, set out under the major groupings outlined in the Office’s plan of work.3
Regional and country offices 15. Office of the WHO Representative, Khartoum. A performance audit disclosed proper alignment between the plan of work of the Representative’s office, the country cooperation strategy and the national strategic health plan. Although extrabudgetary resources covered virtually all the expenditures of US$ 55 million in the biennium 2004–2005, over 90% of the funding was channelled to only three programmes: Emergency preparedness and response, Vaccine preventable diseases and immunization, and Malaria. The audit further found that 70% of the expected results were either not measurable or difficult to measure, and that only 60% of the indicators were measurable. The audit concluded that routine programme monitoring is fragmented and could be strengthened by the appointment of a programme management officer. A review of administrative staffing was also recommended in order to help address problems linked to the complex country situation and the potential effect of a change in the extrabudgetary-based funding pattern associated with only a few programmes. 16. Office of the WHO Representative, Baghdad – Iraq Trust Fund. The audit reviewed the financial and administrative aspects of the Organization’s activities in Iraq funded through the United Nations Development Group Iraq Trust Fund. The work completed under the Trust Fund is organized in seven clusters, of which WHO is the coordinator of the cluster for health and nutrition. The budget of the country office for the biennium 2004–2005 exceeded US$ 100 million, US$ 77 million of which was channelled to nine Trust Fund projects under WHO’s charge. In recognizing that the Representative has operated, and continues to operate in complicated, changing and difficult circumstances, the audit identified areas of opportunity for enhancing controls and compliance with donor and WHO requirements. Specifically, in order to ensure that control issues can be addressed effectively, there needs to be a clearer understanding between the Regional Office for the Eastern Mediterranean and the Representative on delegated authority and the roles and responsibilities actually exercised. Increased formalization of approvals and agreements, filling of vacant key administrative positions, and improved procurement and financial processes were also identified as requirements for mitigating inherent risk. 17. Office of the WHO Representative, Dakar. The audit focused on the basic internal controls that mitigate the risks associated with administering the Representative’s office and its related expenditures. Particular attention was paid to potential risk of fraud and additional verification steps were performed. The audit found significant weaknesses in the area of financial and administrative controls at the office, and noncompliance with WHO policies and levels of authority was pervasive. Because the post of Administrative Officer has long been vacant, there was inadequate segregation of duties, marked noncompliance with procedure, and in some cases missing documentation. The key responsibility for financial control and accountability rests with the Representative and this was not 1 2 3
See paragraph 28. See Annex. See document EBPBAC3/3.
3
A60/34
adequately demonstrated at the office. Although remedial steps had been initiated after a mission by the Regional Office in early 2006, it was too early to comment on the effectiveness of these measures. Overall, the results of the audit could not provide assurance that risks have been mitigated or that controls are effective; therefore the risk of fraud remains high. 18. Office of the WHO Representative, Monrovia. The audit focused on the basic internal controls that mitigate the risks associated with administering the Representative’s office and its related expenditures. It disclosed significant weaknesses in the area of financial and administrative controls. Cash given to staff for distribution in payment of local-cost activities was not controlled satisfactorily; there was a notable lack of compliance with WHO policies; duties within the procurement and the payment areas were not properly segregated; and there were significant expenditures charged against donor contributions that, although approved, did not relate to the projects to which they were charged. In general, the office did not demonstrate adequately the application of financial controls and required accountability. Overall, the results of the audit could not provide assurance that risks have been mitigated or that controls are effective; therefore the risk of fraud remains high. 19. Epidemic Alert and Response, Regional Office for Africa, Harare. The performance audit concluded that the unit has supported effectively countries in the Region in strengthening communicable-disease surveillance systems and in providing technical support during disease outbreaks. However, the audit also identified issues that need to be addressed, notably a severe shortage of funds, which affects performance of the unit and the achievement of expected results. The audit further disclosed the need for reorientation towards strategic medium-term planning and increased interaction with partners in order to mobilize resources for outbreak responses and other activities. The review noted weaknesses in unit administration, including integrated financial and technical monitoring, and reporting to donors. 20. Tobacco Free Initiative, WHO Regional Office for the Western Pacific. The performance audit concluded that the unit has an unambiguous strategy and well defined objectives, and that there is adequate alignment between the objectives of the WHO Framework Convention on Tobacco Control, the expected results of the programme, and the regional action plan. The emphasis shifted in 2006 towards technical support for individual countries, and the move from high-level policy work is accompanied by declining donor interest and a sharp drop in extrabudgetary donations. The audit identified a need to support financial and technical sustainability of tobacco control activities at country level. Globally, there is a need to clarify responsibilities, and communication and funding mechanisms between the secretariat of Conference of the Parties to the Convention and WHO, in order to avoid duplication of effort and competition for resources. 21. Office of the WHO Representative, Manila. The audit found that there is proper alignment between the work of the Representative’s office, the country cooperation strategy and the priorities of the national health plan. There is scope however for discussions with the Department of Health on increasing the involvement of additional stakeholders in WHO’s work. The implementation rate of the biennial plan of work increased from 84% in 2002–2003 to 97% in 2004–2005. However, because most indicators were not measurable, it is difficult to assess whether all expected results were achieved. Extrabudgetary resources now account for approximately 70% of the office’s funding, although more than 90% of them were specified for only five programmes. There are funding shortfalls for some priority programmes, particularly those related to health-sector development, which need to be addressed when developing a strategy for resource mobilization. The process for assessing performance at the end of the biennium needs to be strengthened, and additional training on results-based management needs to be provided to staff.
4
A60/34
22. Regional Office for Europe. The audit included two components: a review of controls in selected budget and finance areas and a limited review of information-technology security. The work indicated that controls need to be strengthened to ensure timely receipt and recording of field office financial transactions, more timely bank reconciliations, stronger system-access controls, and greater compliance with established policies and procedures. The audit also recommended that overall governance and management of information technology should be strengthened in order to help ensure the availability, integrity and confidentiality of electronically stored information. 23. Regional Office for Africa, Brazzaville. The Office conducted an on-site review at the Regional Office in order to determine the status of the issues raised in internal audit reports from 2003 and 2005, for which there are still significant outstanding audit recommendations. The objective of the update was to review progress and consider the potential impact of nonimplementation of the recommendations on areas of major risk. The review was not designed specifically to identify new areas of weakness, breakdowns in controls or transactional compliance issues. Although it is recognized that some actions initiated in 2006 are in progress, the current assessment indicates that until the administrative service of the Regional Office implements past recommendations more substantively, the situation in the budget and finance unit will continue to be weak in terms of the capability to monitor and address effectively significant risks.1
Headquarters 24. Roll Back Malaria. The review examined the internal controls that mitigated the risks associated with administering regular budget financial and extrabudgetary resources and expenditures incurred in connection with the Roll Back Malaria project,2 including the secretariat of the Roll Back Malaria Partnership. The audit found that unmitigated risks exist in the administrative and financial areas, and that control processes require improvement. These risks stemmed largely from ineffective monitoring of project expenditure, a lack of compliance with the provisions of donor agreements, and a low level of implementation of the Organization’s control procedures. Certain weaknesses were attributable to the lack of performance of the programme’s management unit, which was disbanded in early 2006. 25. Programme budget performance assessment. The work reviewed the process for preparation of the performance assessment of the Programme budget 2004–2005 in order to identify risks to the process related to reliability and validity of the information in the report. The audit recognized that the management of the process and the content of the report had improved during the biennium 2004–2005 in comparison with the previous biennium. However, the audit noted that the assessment process is a self-evaluation exercise and does not include a quality-assurance mechanism to guarantee the completeness and accuracy of the information in the report. It concluded that the report should be improved in order to ensure the validity and completeness of information and to increase the utility of the process so as to enhance organizational learning. 26. Control of Neglected Tropical Diseases. The audit focused on the performance of specific programmatic activity, including control of sleeping sickness, preventive chemotherapy to control worms in humans, and drug donations. It concluded that the work of the units involved has been effective and had contributed to achievement of the expected results for past biennium. The audit
1 2
See also paragraph 41. Roll Back Malaria preceded the current Global Malaria Programme established in February 2006.
5
A60/34
noted in particular the effective collaboration with internal and external partners, especially that related to establishing multiparty partnerships in order to mobilize drug donations and financial resources. However, the audit also pointed out the need to involve other WHO groups systematically at an early stage in the negotiations for drug donations. The audit recommended that financial controls should be strengthened and the situation monitored with respect to projects in the African Region, financed from extrabudgetary resources. 27. Health Action in Crisis. The audit reviewed the internal controls that mitigate the risks associated with administering funds at headquarters. The audit found that, in the context of requests for intensified support for Member States affected by crises, the department has made progress on mitigating associated risks. Nevertheless, further effort is required to finalize initiatives, enhance administrative controls over use of, and reporting on, donor contributions, and increase the degree of compliance with policies and procedures. The audit also concluded that although the department can exercise leadership, some issues identified would require strengthening of administrative capacity for crises at the different levels of the Organization. 28. Enterprise risk management. Building on a recommendation in the 2003 interim report of WHO’s External Auditor,1 the object of the work was to document the level of formalization with respect to risk management in the General Management cluster and to draw up a plan for a riskmanagement strategy. The audit revealed a gap in risk management in the cluster and confirmed the need to achieve a higher level of formalization for this area. The audit recommended that the cluster should implement measures to improve risk management and proposed a model implementation plan. 29. International Computing Centre certification on internal controls. The Office collaborated with the management of the Centre to prepare for certification on its internal controls relative to the delivery of information and communication technology services. The initial phase, which was completed during 2006, was necessary to identify a formal control framework relevant to the Centre, to analyse the Centre’s current control structure, and to conduct an analysis of the gap between the two. The results of the work, which was performed by external consultants, revealed that the control activities were implemented at a level that is in line with the industry average. The Centre’s management will submit the findings to the Management Committee, which will advise on the next steps to be followed. The Office will continue to collaborate with the Centre on this project.
EVALUATIONS 30. WHO, Madagascar. The evaluation determined that generally the office’s plan of work was aligned with the country cooperation strategy and national priorities, with some exceptions. The programmes Maternal, child and adolescent health and Making pregnancy safer are listed as priorities in the country cooperation strategy, but are poorly supported in the plan of work in proportion to the population that could benefit from such programmes. The host government stated that the areas of human resources for health development, environmental health, schistosomiasis control, and adolescent health required increased support. 31. The evaluation highlighted the need for improved joint planning with the Ministry of Health at the technical level and greater flexibility in the use of WHO funds in order to allow timely delivery of
1
See document A56/29, paragraphs 15–16.
6
A60/34
services. The assessment noted a financial implementation rate of 75% for the regular budget, which was below target, and the lack of a strategy to mobilize resources locally in order to implement the plan of work for 2006–2007. The work included recommendations to strengthen coordination with other organizations of the United Nations system, nongovernmental organizations, and local donors, so as to handle alignment issues within the current sector-wide approach and to review the capacity and competencies of administrative staff in the light of the increase in technical staff. 32. Selected aspects of Health and Environment. The evaluation assessed the achievement of objectives in selected areas in Occupational and Environmental Health and Water, Sanitation and Health. The department has achieved increased visibility for health and environment, as evidenced by international press coverage in 2006, which highlighted impacts of the environment on public health. The department is formulating a new strategy, fostering an approach that focuses on disease prevention and reduction of the burden of disease related to modifiable environmental determinants of health. 33. The evaluation found that the technical depth of certain programmes and products is widely recognized, and that the department is trying to focus on the application of guidelines and transformation of technical information into policies at all levels. In view of the effect of water, sanitation and indoor air on the burden of disease and their contribution to achieving all health-related Millennium Development Goals, adequate resources are a continuing concern. Recommendations include the drafting of a formal medium-term strategic plan; strengthening of resource mobilization; exploration of collaboration with other WHO groups that have an environmental component; and exploitation of opportunities to influence policy on environment and health outside the health sector that are created through monitoring of certain indicators related to the Millennium Development Goals. 34. WHO, Albania. The evaluation found that the country cooperation strategy captures most of the country’s needs in regard to the health status of the population, the health-system challenges, and particular health programmes. However, the strategy is considered as an internal document by the WHO office and was not drawn up in consultation with national and international partners. Its clarity and consistency also require improvement during the next revision. 35. The office’s expenditures of US$ 3.1 million in the biennium 2004–2005 were funded largely (over 90%) through extrabudgetary donations. Extrabudgetary resources are crucial for WHO’s operations, even to support the core presence, which makes the programmatic emphasis of WHO in Albania vulnerable to changing donor interests. Some WHO priorities remain unfunded. Nevertheless, implementation of the plan of work 2004–2005 was considered adequate within the context of the political situation during 2005. 36. The evaluation recommended increased financial and programmatic delegation of authority to the head of the office, an increased regular-budget allocation to support the core presence, and strengthened resource mobilization. It further recommended a review of the health-policy project, support of the Regional Office for response to cases of avian influenza in Albania, and the sustainability of the mental health programme.
INVESTIGATIONS 37. A WHO regional office. The investigation established that an officer and three clerical staff in the office disregarded rules and procedures for local purchasing. This resulted in an estimated loss of
7
A60/34
US$ 150 000 as items were procured at prices well in excess of those obtainable using WHO suppliers. A disciplinary review resulted in dismissal of three staff members, and reassignment and demotion of a fourth staff member. 38. Allegations by a staff committee of misconduct. The investigation attempted to examine any evidence available which supported certain allegations made by a staff committee. The severity of the allegations was eventually reduced by the staff committee. However, no evidence was ever provided or could be determined that would support the allegations of misconduct. 39. At headquarters. The investigation established that a staff member submitted a claim for reimbursement for educational expenses that had not been paid to the school and which was supported by a fake proof-of-payment document. The matter has been referred for determination of misconduct and action appropriate with that decision.
FOLLOW-UP AND IMPLEMENTATION 40. The Office monitors the status of all its recommendations to ensure either that actions have been implemented effectively by management or that senior management has accepted the risk of not taking action. The Office collaborated with management on tracking of audit recommendations,1 but notes that there is a backlog of audit recommendations pending implementation. The Annex contains the status of reports issued from the plan of work for 2006, and includes any information available on implementation. All recommendations from the plans of work for 2005 and earlier have been reported as implemented, reviewed by the Office for effectiveness and the audits closed, except as mentioned below. 41. Regional Office for Africa. Three reports which concern the Regional Office’s exposure to financial and administrative risks remain without substantive implementation of the recommendations: an internal audit report of October 2003;2 a consultancy report from 2004 on re-engineering the budget and finance function; and an internal audit report of October 2005.3 All have been previously reported as delinquent.4 The recent follow-up visit disclosed that the re-profiling of posts in the budget and finance area remains in progress and staffing levels are at approximately 55% of requirements.5 Controls over expenditure have not been strengthened effectively, and deficiencies in internal controls with respect to local purchasing have not been remedied. Recommendations for improved, transparent and comprehensive recruitment procedures remain pending. Monitoring and follow-up of violations of WHO rules and regulations with respect to obligation and certification of expenditure transactions continue to be inadequate. 42. Telephone expenses at headquarters. Although efforts to implement certain recommendations have been completed and recoveries made, the audit has been previously reported as being delinquent
1 2 3 4 5
Referred to in document EBPBAC5/INF.DOC./1. Referred to in document A57/19, paragraph 16. Referred to in document A59/32, paragraph 20. Referred to in document A59/32, paragraph 42. See paragraph 23.
8
A60/34
in its closure.1 The major issue outstanding concerns the need to address recovery of the cost of private mobile telephone calls. Follow-up will continue. 43. UNICEF/UNDP/World Bank/WHO Special Programme for Research and Training in Tropical Diseases. In early 2006, approximately one year after issuance of the audit report, the Office received information which indicated implementation of the recommendations.2 However, an on-site verification of implementation in late 2006 found that a substantial number of recommendations had not in fact been implemented. Accordingly, the outstanding recommendations were reiterated to the Programme and the audit will remain open pending further verification of implementation. 44. Office of the WHO Representative, Islamabad. As previously reported, the Office received a timely response.3 However, specific details supporting reported implementation which are required in order to close the audit were requested but have not been received. Follow-up will continue. 45. WHO headquarters travel claims. The audit report was issued in mid-2005 and discussed persistent problems with a backlog of travel claims and reimbursement of incidental expenses, weaknesses in supervisory review of travel claims, and potential problems connected with conversion to the global management system.4 Despite two follow-up requests, the Office has not received the initial response. Follow-up will continue. 46. Staff security unit at headquarters. The audit report was issued in mid-2005 and discussed the efficiency and effectiveness of procedures employed to identify and mitigate major security risks related to staff.5 The Office received a response approximately one year later which was not fully responsive to the issues raised, and accordingly, additional information has been requested. Follow-up will continue. 47. WHO Lyon Office for National Epidemic Preparedness and Response. Issued in early 2006, the audit discussed the need to establish detailed planning and measurable expected results, in order to complete staffing arrangements and improve administration.6 A response has been received. However, a number of issues raised in the report were not addressed sufficiently or were reported as being in progress and, accordingly, the audit remains open. Follow-up will continue. 48. Chronic Diseases and Health Promotion. The department issued a timely response to this performance audit and recommendations reportedly have been implemented.7 However, work continues on one remaining major recommendation concerning cross-cluster collaboration, and, accordingly, the audit remains open pending further action.
ACTION BY THE HEALTH ASSEMBLY 49. The Health Assembly is invited to note the report.
1 2 3
Referred to in document A59/32, paragraph 46. Referred to in document A59/32, paragraph 47. Referred to in document A59/32, paragraph 48. to in document A59/32, paragraph 26. Referred to in document A59/32, paragraph 46. Referred to in document A59/32, paragraph 28. Referred to in document A59/32, paragraph 30. Referred to in document A59/32, paragraph 29.
4 1Referred 5 6 7
9
10 Report title AUDITS Office of the WHO Representative, Khartoum Roll Back Malaria programme Office of the WHO Representative, Baghdad – Iraq Trust Fund Office of the WHO Representative, Dakar Office of the WHO Representative, Monrovia Programme Budget Performance Assessment Report Epidemic Alert and Response Unit, Regional Office for Africa, Harare Control of Neglected Tropical Diseases Department Health Action in Crisis Department Tobacco Free Initiative, WHO Regional Office for the Western Pacific
A60/34
ANNEX AUDIT, EVALUATION AND INVESTIGATION REPORTS AND STATUS, 2006
Report date
Closure date
Comments
26.07.2006 16.07.2006 21.08.2006 27.09.2006 22.11.2006 22.09.2006 09.08.2006
Awaiting initial response Awaiting initial response Awaiting initial response Awaiting initial response Awaiting initial response Awaiting initial response Initial response received. However, the implementation plan has been returned for more specific details that are responsive to the recommendations. Awaiting initial response. However, work has begun on issues relating to coordination among WHO units with respect to drug donations. Awaiting initial response Awaiting initial response
30.10.2006
01.12.2006 06.02.2007
11 Report title Enterprise risk management Report date 08.12.2006 Closure date Comments Response received which agrees with the importance of building risk management into managerial processes. Further recognized is the need to re-examine endeavours within the current risk management approach and to review critically the status of current efforts at improving risk management. Awaiting initial response Awaiting initial response Awaiting initial response Office of the WHO Representative, Manila Regional Office for Europe Regional Office for Africa EVALUATIONS WHO, Madagascar WHO, Albania Selected aspects of the Public Health and Environment Department INVESTIGATIONS A WHO regional office At headquarters Allegations of misconduct by a staff committee 14.03.2006 11.01.2007 26.06.2006 26.06.2006 05.02.2007 Three staff members dismissed and one staff member demoted and transferred. Sub judice Closed on issuance 16.06.2006 03.10.2006 01.02.2007 31.01.2007 09.02.2007 08.02.2007
Annex
= = = 11
A60/34