Sixty-sixth Regional Committee for Europe: Copenhagen, 12–15 September 2016: report on accountability and compliance at the WHO Regional Office for Europe

Report on accountability and compliance for the WHO Regional Office for Europe Working document REGIONAL COMMITTEE FOR EUROPE 66th SESSION Copenhagen, Denmark, 12–15 September 2016 © W H O W ORL D H E A LT H O RG A N I Z AT IO N R EG I ON A L O F F I C E FO R EU R O P E UN City, Marmorvej 51, DK-2100 Copenhagen Ø, Denmark Telephone: +45 45 33 70 00 Fax: +45 45 33 70 01 Email: eugovernance@who.int Web: http://www.euro.who.int/en/who-we-are/governance Regional Committee for Europe EUR/RC66/24 66th session Copenhagen, Denmark,12–15 September 2016 1 August 2016 160565 Provisional agenda item 5(m) ORIGINAL: ENGLISH Report on accountability and compliance at the WHO Regional Office for Europe This report presents information on WHO’s internal control framework, internal and external audits, and compliance and risk management mechanisms in place at the WHO Regional Office for Europe. EUR/RC66/24 page 2 Background 1. The WHO Regional Office for Europe is committed to improving compliance with WHO rules and regulations in the Regional Office, its country offices and its geographically dispersed offices. 2. The Executive Board, at a special session on WHO reform in November 2011, recommended strengthening the internal control framework of the Organization by linking it to the roles and responsibilities assigned to staff, with routine monitoring of management actions for compliance and breaches of compliance. An analogous recommendation came from the United Nations Joint Inspection Unit. 3. A revision of WHO’s Internal Control Framework, published in November 2013,1 strengthened WHO’s internal control system in response to risks to the Organization’s mandate and objectives. WHO considers internal control as a process, designed to provide reasonable assurance to WHO management regarding the achievement of objectives related to operations, reporting and compliance. 4. The internal control at the Regional Office consists of three lines of defence: (a) operational management; (b) functions providing advice on control issues; and (c) internal audit. 5. Compliance functions are an essential part of the second line of defence. Strengthening internal accountability and control 6. The implementation of the Internal Control Framework is taken very seriously in the Regional Office for Europe. The following measures are already in place. (a) The second line of defence was first implemented in 2011 with the establishment of a compliance team responsible for ensuring financial compliance and providing ex-post reviews to management. At the same time, the team plays an important role in training and advising staff on financial and administrative matters. (b) Verification of imprest returns are required from all country offices, including a monthly analysis of receipts and payments, and verification of bank and cash reconciliations. (c) Compliance checks for non-staff contracts were introduced. (d) Detailed management reports and financial compliance dashboards are produced on a regular basis – together they cover all areas of finance, human resources, programme implementation and procurement. (e) A management group consisting of directors and other senior-level staff was established with the objective to review the management reports and financial compliance dashboards in detail and identify follow-up actions. 1 Internal control framework. Geneva: World Health Organization, 2013 (http://www.who.int/about/ who_reform/who-internal-control-framework.pdf, accessed on 25 July 2016). EUR/RC66/24 page 3 (f) Extensive oversight reports are provided to the Standing Committee of the Regional Committee on a regular basis (five times per year); key issues are discussed with Member States on these occasions. (g) A responsibility matrix has been developed, which clearly spells out the division of labour and the resulting responsibilities between the Regional Office and the country offices and geographically dispersed offices. Providing assurance on internal controls at the Regional Office for Europe 7. The Regional Office for Europe employs the following mechanisms to assess the overall effectiveness of the Internal Control Framework: (a) the Manager’s Self-Assessment process, 2 whereby all managers with delegated authorities complete a self-assessment checklist, was implemented in the Regional Office in 2015 and is used to inform the Annual Letter of Representation; (b) the Annual Letter of Representation, from the Regional Director to the Director- General, provides assurance on the functioning of internal controls within the Regional Director’s management responsibilities, and was implemented in 2012; (c) internal audits; and (d) external audits. Internal audits 8. The internal audits adopt a risk-based approach using a risk-control matrix designed by the Office of Internal Oversight Services (IOS) at WHO headquarters to identify the main risks in the areas of administration and finance. The techniques applied by the IOS are standard audit techniques, including a combination of surveys of staff, fraud-risk self-assessment questionnaires, telephone interviews, data analyses and compliance checking of sample transactions and supporting documentation to assess operational effectiveness of key risks and the controls in place to mitigate those risks. 9. In the past four years, eight internal audits have been performed in the Region: seven in country offices [Tajikistan (2012), Turkey (2012), Belarus (2013), the Republic of Moldova (2013), Turkmenistan (2013), Uzbekistan (2013), Montenegro (2014)] and one in the Regional Office (2014). 10. The results of the eight internal audit assessments showed that the overall effectiveness of risk management and control processes in the administration and 2 The conclusion from the 2015 Manager’s Self-Assessment, after aggregating the data, was that the awareness of internal control is strong: on a scale from 1 to 4, the assessment control score was 3.68 and the functional control score was 3.78. Assessment control score is used to assess and monitor the overall status of internal control across a budget center, such as a division or country office. Functional control score is used to assess and monitor the status of internal control within a budget center across key functional areas, such as: planning and budgeting, human resources, security, procurement, travel, asset management, accounting and financial management. EUR/RC66/24 page 4 finance areas are partially satisfactory in three country offices and satisfactory in four. The Regional Office obtained a satisfactory assessment in the 2014 audit. 11. The internal audit assessments identified some key systemic issues which were promptly actioned. Similar issues were also identified by the compliance reviews performed by the compliance team. The key systemic issues are in the areas of procurement of services, information technology, recruitment of project personnel in country offices, and fixed assets. 12. All audit recommendations from past reviews were promptly followed up and implemented. The goal is to implement action on any issue identified during the review process within a maximum time frame of two years. This objective has been fully met. Major issues identified and the actions taken are presented in Table 1. Table 1. Actions taken following internal audits Issues identified Actions taken No competitive selection for procurement of services • pre-checks and post-checks by the Compliance Team introduced No externalization of back-up files • procedures developed • implementation in progress Internet connectivity problems • systematic review • advise on status and improvements Anomalies in the recruitment of project personnel in country offices • guidelines developed • clearance by the Regional Office introduced 13. The audit of the Regional Office also highlighted good practices that could be shared with other WHO regional offices: (a) monthly reports for the Executive Management Committee on achievement of results, budgeting, resources, salary financing situation, award management and compliance; and (b) communication structure with focal points in each technical unit and country office and regular meetings on finance, compliance and procurement issues that have a positive impact as a systemic feedback channel. External audits 14. The Commission on Audit of the Republic of the Philippines was appointed by the Sixty-fourth World Health Assembly in resolution WHA64.23, as the External Auditor of WHO covering the financial period from 2012 to 2015. The objective of the audit is to provide independent assurance to Member States, to increase transparency and accountability in the Organization, and to support the objectives of the Organization’s work through the external audit process. 15. During this financial period, two external audits were carried out in the Region: one in the country office of Turkey (2013) and one in the Regional Office (2013). EUR/RC66/24 page 5 16. The external audits focused on the process and transactions related to cash management, direct financial contribution (DFC), procurement of goods and contractual services, asset management, travel and programme management. The review involved performing procedures to establish the degree of reliance on internal controls. 17. Similar to the internal audits, the results of the external audits have not shown any major issues or breaches of the internal control framework. A number of recommendations were formulated. Major issues identified and the actions taken are presented in Table 2. Table 2. Actions taken following external audits Issues identified Actions taken Management of fixed assets • new guidelines developed • comprehensive checks performed Selection of suppliers for procurement of goods and services • internal controls were enhanced • new procurement strategy adopted at global level – implementation on-going High number of unplanned or last-minute travel • travel policy strengthened Recent developments 18. In further efforts to improve compliance, the Regional Office introduced several other initiatives to strengthen the internal controls: (a) key performance indicators (KPIs) setting compliance targets have been developed: the performance appraisals of senior management and heads of country offices are linked to the realization of these targets (implementation of this initiative will be piloted in 2016, with full implementation in 2017); (b) a new responsibility matrix for the Regional Office and for country offices was developed and is being rolled out; (c) administrative capacity in certain country offices is being strengthened; (d) the human resources unit took over the review and approval of non-staff contracts from the procurement unit for more effective control; (e) tenders are published on the Internet for increased transparency, as part of the implementation of a new procurement strategy in WHO; and (f) implementation of a risk register, in collaboration with the Compliance, Risk Management and Ethics Office (CRE) at WHO headquarters, is under way. = = =