SIXTY-SECOND WORLD HEALTH ASSEMBLY Provisional agenda item 17.2
A62/29 23 April 2009
Interim report of the External Auditor The Director-General has the honour to transmit to the Sixty-second World Health Assembly the interim report of the External Auditor on the World Health Organization for the financial period 2008–2009 (at Annex).
A62/29
ANNEX INTERIM REPORT OF THE EXTERNAL AUDITOR TO THE SIXTY-SECOND WORLD HEALTH ASSEMBLY: AUDIT OF THE WORLD HEALTH ORGANIZATION FOR THE FINANCIAL PERIOD 2008–2009
INTRODUCTION 1. The audit of the World Health Organization (WHO) was assigned to the Comptroller and Auditor-General of India for the financial periods 2008–2009 and 2010–2011 in terms of resolution WHA60.7. 2. The scope of the audit is in accordance with Regulation XIV of the Financial Regulations and the Additional Terms of Reference Governing the External Audit appended thereto. 3. The audit is conducted in accordance with the Common Auditing Standards of the Panel of External Auditors of the United Nations, the specialized agencies and the International Atomic Energy Agency. 4. This being my interim report to the Health Assembly, the audit procedures carried out were not oriented towards expressing an audit opinion on the interim financial statements included in the Unaudited Interim Financial Report for the year 2008. 5. I am continuing the practice of reporting on the interim period as this affords me the opportunity of bringing to the notice of the Health Assembly any significant findings arising from my audits on a yearly, rather than only on a biennial, basis. 6. Audits were conducted in the first year of the current financial period in the regional offices for Africa and the Western Pacific, along with two country offices, one in each region. In addition, an in-depth review was conducted on the working of the Global Service Centre in Malaysia which is responsible for processing administrative transactions in the areas of human resources, payroll, procurement and accounts payable. The Department of Information Technology and Telecommunications has offshored many of its services to the Global Service Centre. An audit on the Global Management System Data Conversion and Roll-out, involving an assessment of procedures adopted and implemented for Global Management System data conversion was also performed at headquarters in the interim period. Matters which have been previously reported to the Health Assembly have been followed up, where necessary. 7. In the second year of the financial period, the audit will be undertaken in the remaining regional offices and selected country offices, in addition to in-depth studies of some important aspects of the Organization’s working. An audit opinion will also be expressed on the financial statements for the financial period 2008–2009. 8. The working relationship with the Secretariat has been constructive and the audits performed at different levels and locations were facilitated by the excellent cooperation from the Secretariat as well as the regional and country office managements. Coordination with the Office of Internal Oversight has been continual and comprehensive. Professional reliance was placed, wherever necessary, on the work of internal oversight.
3
A62/29
Annex
9. Important findings arising from the audits performed were, after detailed discussions with the concerned managements, conveyed to them through Management Letters. The more significant of these findings, appropriately aggregated, have been incorporated in this report. 10. The Secretariat has accepted the recommendations made in the report and has assured me that action would be taken to address them.
FINANCIAL MATTERS 11. The overall effective budget for the biennium 2008–2009 stands at US$ 4227 million. Total income from voluntary contributions in the biennium 2006–2007 was reported as US$ 2933 million. During the first year of biennium 2008–2009, income from voluntary contributions of US$ 1111 million has been recorded. 12. Total revenue for 2008, including assessed contributions and financial income, was US$ 1769.7 million, while total operating expenses amounted to US$ 1735 million, resulting in a surplus of US$ 34.7 million for the period. 13. With the introduction of booking of expenditure on the delivery principle,1 expenditure is now expected to be more closely aligned with actual implementation. Income is being recorded on the basis of signed pledges. It is noted that amendments are being made to WHO’s Financial Regulations and Financial Rules primarily as a result of the Organization’s commitment to the implementation of the International Public Sector Accounting Standards, which are required to be in place by 2010.2 The changes include a shift to annual financial statements, introduction of full accrual accounting, a new method for recognizing fixed assets.
BUDGETARY CONTROL AND FUND UTILIZATION 14. The Financial Rules of the Organization stipulate that obligations are to be raised only for the purposes indicated on the related allotments and should not exceed the amounts available in the allotments. The allotment holders are responsible for adhering to the rule. Cases were noticed both in regional as well as country offices where allotments were exceeded, leading to negative balances. In a number of such cases in the Regional Office for Africa the negative balances were more than US$ 100 000 each. The practice of subsequently increasing the allotments to cover the negative balances can affect other planned activities. 15. Committed/earmarked expenditure of all the countries was below 50% of allotments in the Regional Office for Africa. Utilization too was less than 50% in most programmes due to the non-scheduling of activities. Some delay was attributed due to late journalization of expenditure or its non-reflection in the system. The implementation rate recorded in 20 out of 31 countries was as low as 30% in the Regional Office for the Western Pacific at the end of the first year of the biennium due to
The delivery principle reflects the new expenditure recognition policy in Financial Regulation 4.2, whereby obligations are charged to expenditure during the current financial period for goods and services which are contractually due to be delivered during that period. 2
1
See document A62/32.
4
Annex
A62/29
non-availability of financial data in the Global Management System. The regional managements’ efforts to have a mid-term review of workplans and prepare analytical reports are noted. 16. I recommend that the Organization ensure that periodical reviews are undertaken to ensure optimum utilization of allotment/award.
PROGRAMME MANAGEMENT 17. Results-based budgeting management, monitoring and evaluation has been introduced in WHO for the planning, implementation and monitoring of the programmes. The Regional Office for Africa had adopted the activity management system as a tool for programme management. The activity management system facilitated integrated management of the programme budget by linking the financial information in the regional office administration and finance information system to workplans. Presently, pending switchover to the Global Management System, monitoring was being done through a manually designed form to collect the relevant information which was not found to be up to date. Utilization of funds in accordance with the planned activities in a given time frame could thus not be ensured. 18. Mission reports are valuable components of WHO programmes and activities. They serve as a means of verification of achievements of targets and workplans. Processing of mission reports received and submission for internal circulation or to the countries concerned was found to be pending in the Regional Office for the Western Pacific. 19. I recommend that the guidelines on programme implementation be pursued so that the objectives can be achieved in a timely manner.
CASH, BANK ACCOUNTS AND IMPRESTS 20. The prescribed procedures in respect of custody and handling of cash and recording need to be strictly complied with. It was observed that in some cases in regional and country offices there were differences between physical balances and cash-book balances. Transactions in the cash book were not recorded as and when these were effected. Payments like salary advance, per diem, travel advances, staff health insurance claims and stipends were being made from the petty cash pending clearance of processing in the Global Management System in the Office of the WHO Representative in Lao People’s Democratic Republic. The cash books were not maintained separately, but formed part of the imprest accounts in the country office. Cash balance verification showed a difference representing the amount of advances given to the staff of the country office as travel advance pending processing in the Global Management System. It was explained that the amount would be replenished once the claims were received from the staff members. This practice was not in conformity with the prescribed procedures. 21. Regular bank reconciliations reduce risks significantly. Certain transactions were pending for settlement for more than 20 months and in some of the cases, cheques issued had become time barred in the Regional Office for Africa. Delay in timely preparation of bank reconciliation statements was noticed both in the regional offices for Africa and the Western Pacific. There were four inactive bank accounts in the Office of the WHO Representative in Nigeria, which have since been closed. Regional management’s efforts to establish control mechanisms are noted.
5
A62/29
Annex
22. Recording of transactions and replenishment of imprests depends on timely submission of imprest accounts returns by the country offices. There was delay in receipt of imprest accounts as well as corresponding delay in journalization in all the offices. This results in imprest expenditure remaining outside the accounts of WHO for long periods of time and hence affects the budget monitoring and control mechanism. Forty-five out of 51 countries/accounts in the Regional Office for Africa had a balance greater than the imprest ceiling limit. Routing of Direct Financial Cooperation contributions to Member countries through imprest accounts in the Regional Office for Africa resulted in imprest accounts exceeding their limits. Imprest balance available with imprest holders in the Regional Office for the Western Pacific was in excess of the imprest ceiling so as to enable country offices to optimize payments before the shift to the Global Management System. At the same time negative balance was indicated in five imprest accounts as funding transfers were not reflected in the system. 23. I recommend that the Organization ensure strict adherence to prescribed procedures relating to custody and handling of cash. There is also a need for regular bank reconciliations. Expenses which can be met from petty cash and imprest may be used for the purposes prescribed.
PERSONAL ADVANCES TO STAFF 24. Travel claims are required to be submitted within 30 days of completion of travel. The advance is to be recovered from salary or other entitlements if the travel claims are not submitted within 30 days of completion. In the Regional Office for Africa, 3248 cases of travel advances were outstanding of which 535 cases pertained to the period prior to 2007. In the Office of the WHO Representative in Nigeria, advances given are expensed at the point of disbursement without supporting documents. Claims were still to be received or processed in respect of 1355 travel advance cases. 25. Salary advances granted in an emergency against the current month’s salary shall be repaid within three months. In the Regional Office for Africa, 8877 cases of salary advances pertained to the period from January 2006 to June 2008. There were similar outstanding cases in advances given to staff members under education grant, rental advance and miscellaneous items that remained to be cleared. Salary advances in the Regional Office for the Western Pacific related to payment to new staff, pending their inclusion in the payroll system of the Global Management System. Staff contracts were still to be entered in the Global Management System with respect to the initiation of appointments and classified posts and approval hierarchy. The human resource module in the Global Management System did not record transactions relating to salary advances made during the post golive period and their clearance was not reported. 26. The objective of the Organization’s plan for staff health insurance is to reimburse a major portion of the expenses incurred for medically recognized health care. Instances were noticed in the Regional Office for the Western Pacific where, instead of reimbursement of admissible expenses, advances were made directly to the hospitals, for which there was no provision in the rules. In the Regional Office for Africa, 1652 staff health insurance cases in respect of 250 staff members pertaining to the period from January 2006 to September 2008 were still to be processed. Of these, 882 cases were more than one year old. 27. I have noted the assurance of regional and country managements on the ongoing exercises to settle outstanding advances. I recommend that the Organization intensify its efforts to settle the outstanding advances and ensure sanction as per Manual provisions.
6
Annex
A62/29
PERSONNEL MANAGEMENT 28. The importance of completion of contractual formalities before commencement of employment was discussed in my earlier reports. Instances continued to be noticed where contracts relating to short-term staff and Special Service Agreements had not been signed before commencement of employment. There were cases where the dates of commencement of the contracts pre-dated the dates of offers of the contracts. The need to complete formalities of employment contracts before commencement of the same is reiterated. Closer coordination between regional offices and concerned country offices is integral to this. Regional management of the Regional Office for the Western Pacific stated that there were bugs and technical problems in the Global Management System whereby many human resources actions were not successfully undertaken by the system. 29. The Performance Management Development System is one of the principal instruments for framing workplans and for evaluation of staff performance. The Performance Management Development System is updated through regular follow-up as it is the basis for assessment of performance of work and extension of contract. It incorporates a three-stage process, starting with recording of workplans by the end of the previous year, based on individual objectives, followed by a mid-term review and a year-end review. Adherence to the time-frame is critical if the system is to serve its purpose. A significant number of instances where all the three stages were in arrears were noted in the regional and country offices audited. In the Regional Office for Africa, the arrears in some cases pertained to 2006. 30. I recommend that drawing up of individual-oriented workplans and reviews of staff performance within the stipulated time frame be ensured.
CONTRACTS FOR SERVICES 31. Agreements for Performance of Work are intended for use in arrangements where a specific piece of work (normally of short duration) is performed by an individual or a firm. The documents required to be attached with Agreements for Performance of Work include costing details for the proposed activity and an adjudication report if the cost equals or exceeds US$ 15 000; any advance payment must be justified in writing. My earlier reports had highlighted instances of non-fulfillment of the above requirements. 32. We continued to notice cases where adjudication reports and costing details were not on record. Completion reports had not been obtained even though the contract periods were completed. In absence of these reports and details, transparency of the contracting process and satisfactory delivery of the services contemplated was not verifiable. Cases were noticed in the Regional Office for Africa where Agreements for Performance of Work were issued for non-entitled activities. In the Office of the WHO Representative in Nigeria advances were given to contractual partners without recording reasons. 33. In the Regional Office for the Western Pacific agreements were entered into subsequent to the date of commencement of work. The schedule for preparation of interim report and financial report was not indicated. The requirement to consider three bids for competitive rates was not complied with. In some cases, the amount of agreement was different from the costing details. Country management in the Office of the WHO Representative in Lao People’s Democratic Republic stated that the recent change in the approval process and procedures associated with the introduction of the Global
7
A62/29
Annex
Management System and its Global Service Centre had not been fully integrated in the existing monitoring system. 34. I recommend that a system be put in place to monitor Agreements for Performance of Work in the Global Management System from the stage of agreement to completion of the activity and settlement of amount with the contractual partners.
PROCUREMENT 35. Procurement is required to be made on a competitive basis including solicitation of quotations from all such qualified sources as are deemed necessary to ensure full and free competition consistent with the types of supplies and services necessary to meet the requirements of the Organization. Tenders from at least three suppliers are sought by formal invitation to bid whenever a single purchase of goods or services is likely to exceed US$ 15 000. It was seen in the Regional Office for the Western Pacific and country offices that some general terms and conditions such as acknowledgement, delivery date, payment terms, etc. for entering into the agreement by WHO were not part of all the purchase orders. The report indicating inspection of goods and certificate was not available either. 36. In the Regional Office for Africa and the Office of the WHO Representative in Nigeria, quotations were being invited/received through unsecured email, and were not done on a competitive basis from an approved list of vendors. The system of performance evaluation of vendors was not carried out. In respect of some purchase orders, the number of quotations received was below the specified minimum number of quotations. The database of prequalified vendors was required to be updated. Regional management’s efforts to put appropriate procurement procedures in place are encouraged. 37. Cases were also noticed in the Regional Office for the Western Pacific where purchase orders for the same commodity were placed on the same date with different firms, amounting to splitting up of purchase orders. This was not in consonance with the established principles of procurement and purchase authorization. 38. I recommend that the laid down purchase procedures be complied with.
INVENTORY MANAGEMENT 39. The WHO Manual provides that control of inventories is paramount to ensure the continued physical presence of the Organizations’ assets, maintain a record for the purposes of their warranty, replacement and maintenance, to provide a basis for insurance valuation, and to provide a basis for reporting in the financial statements of the Organization. The need for maintenance of updated and complete inventory records has been highlighted in my earlier reports. Instances of incomplete or inaccurately maintained inventory records continued to be noticed in the audits performed. A comprehensive database of non-expendable equipment in the prescribed format was required to be prepared and updated in the Office of the WHO Representative in Nigeria. The returns from country offices in the Regional Office for Africa were not complete and certified. Regional management’s efforts to ensure updated and timely returns are supported. 40. Inventory data of the Regional Office for the Western Pacific and country offices with the exception of the Office of the WHO Representative in the Philippines and Cambodia, had been
8
Annex
A62/29
uploaded on the Global Management System. It was seen that data uploaded by the Regional Office in the Global Management System during May to June 2008 only was available in the asset register. Goods currently procured through the Global Management System and goods procured outside the Global Management System were not getting recorded in the asset register. The revision of the asset register in the Global Management System by regional management is noted. 41. Details of inventory of non-expendable equipment for the country offices are not being maintained at the Regional Office for Africa, Brazzaville. It was therefore not possible to comment on the completeness and adequacy of records. Physical verification had not been carried out as per prescribed procedure. Obsolete inventory was pending disposal at the Regional Office. 42. There was a lack of uniformity noted in the marking of items as inventorable in the Regional Office for the Western Pacific. It was seen that the system in place for monitoring of cases referred to the Property Survey Committee and follow-through was not adequate. The monitoring system had information only of the cases referred to the Property Survey Committee for disposal by sale and not other means of disposal. 43. I recommend that a comprehensive database of non-expendable equipment be prepared and regularly updated.
GLOBAL MANAGEMENT SYSTEM-DATA CONVERSION 44. The Global Management System began operating on 1 July 2008 in headquarters, the Regional Office for the Western Pacific and country offices in that Region. It was noted that time was still needed for the system to work as intended and that the introduction of the system to the remaining regions had been postponed until it stabilized. 45. The findings of the detailed audit conducted on the project processes and preparedness for implementation of the Global Management System were presented in my report to the Health Assembly in May 2008.1 I had pointed out that the complexity and scale of work on data conversion had been underestimated or not appropriately prioritized by the Global Management System project management; the conversion strategy had not been followed consistently and the actual work did not follow the methods laid down in the conversion document. The Secretariat had stated that the conversions required for the Global Management System were indeed complex and that resource constraints had delayed the completion of some of the detailed conversion documents. It had further stated that the conversion strategy as outlined in the conversion document had been followed with a few exceptions. 46. We reviewed the processes adopted during data conversion and roll-out and their implementation at the headquarters in November–December 2008. The scope of audit was to review conversion processes until the Global Management System went live on 1 July 2008. There were many sunset applications in the legacy system whose data was converted to the Global Management System. It was observed that appropriate conversion had been done of the conversion objects to the extent that no valid balances were left out in the legacy system. The audit review of the conversion process was directed towards the conversion objects that directly impacted the financial statements and
1
Document A61/23.
9
A62/29
Annex
procedures associated with data conversion. These included data mapping, cleansing, business validations and sign-offs and conversion. Audit collected and analysed information on core Global Management System documentation relating to the design and build phase, conversion processes and test completion reports. 47. Data preparation and mapping. It was observed that a number of defects were logged as the data did not clear the validation checks in the Global Management System. The focus of conversion activity was more on ensuring that data is populated in the Global Management System rather than a review of quality of data per se. We noted that the efforts in cleaning the data to improve its quality were not followed as a policy at an organization level across the legacy system. There was also limited time available for business owners to confirm the data after it was populated in the Global Management System. 48. It was noted that there were many issues from “unclean” data that were loaded in the Global Management System. Some issues were due to insufficient data validation before go-live. A significant number of issues were also due to workarounds during data conversion to meet deadlines. 49. I recommend that for the existing data in the Global Management System, business owners be advised to conduct a time-bound exercise on verification of data in the System, both for its accuracy and quality. For the regional offices where the Global Management System is yet to be rolled out, procedures may be brought in place to identify data quality requirements and communicated to business owners in advance for a comprehensive data quality review at their end to improve the quality of data before making it available for conversion. The Secretariat has accepted the recommendation. 50. Business owners’ validation. It was commented in my earlier report that data validation was not explicitly embedded in the Global Management System project and there was no formal data integrity testing. Normally data should be reconciled and certified by business owners to have an assurance of the quality of output. The Secretariat maintained that significant efforts were made on business validation and technical validation was done for most of the objects. 51. I recommend that a centralized record of business owners’ validation of data conversion be maintained. As business owners’ validation of data is not centrally coordinated and reviewed, the quality of review and validation could vary between each conversion object. In the case of roll-out in the regional offices, business validation may be integrated with the conversion process and the sign-offs may be centrally recorded and monitored, before the system goes live. The Secretariat has accepted the recommendation. 52. Data conversion. Cutover (data conversion) readiness from a go-live perspective comprises data loading and business validation of the converted objects in production instance. 53. It was noticed that the information in Test Director1 was not updated following go-live. Defects in post classification conversion and assignment conversion2 indicate insufficient segregation of duties and responsibilities under the Global Management System. Many of these objects determine important 1 Test Director is a software tool that the Global Management System team used to track testing defects in various areas such as functionality testing, data conversion testing and performance testing. 2 Post classification conversion involves the conversion of information related to the post (e.g. description, terms of reference, grade). Assignment conversion involves assignments, which represent the link between the employee information and the position information (i.e. contract dates, probation status and supervisor name).
10
Annex
A62/29
transactions and a detailed reconciliation by the business should have been done before conversion and sign-off. A time bound strategy is imperative as keeping these issues open for long may have an impact on the financial statements. 54. I recommend that critical data be completely reconciled and validated and all key issues remaining open during conversion be resolved to ensure reliability of Global Management System outputs. The Secretariat has accepted the recommendation. 55. Testing the Global Management System for go-live. User acceptance testing is likely to give appropriate results when it is conducted on the application with fully converted data from the legacy system. It should attempt to cover end to end scenarios1 and simulated transactions to traverse a majority of paths of the system logic. It was observed in my earlier report that the use of partially converted and largely constructed data in user acceptance testing carries the risk of testing the solution without real data and not being able to replicate a real life situation. 56. User acceptance testing was conducted between 4 February 2008 and 18 March 2008. Different business scenarios (1553) were tested. All the primary objectives of user acceptance testing were considered met from the test results. User acceptance testing was perceived to have demonstrated a stable solution that did not encounter any major “show stoppers”. The solution was treated as accepted by all the business owners and declared ready for global deployment. 57. It was noted in the Regional Office for the Western Pacific that the Oracle application for the human resource module on the Global Management System was encountering problems. Similarly, in the procurement module some payments were made outside the Global Management System. The System needed to be modified for linking inventory with purchases. The large number of issues logged in user acceptance testing indicated the need for a fresh testing with fully converted data. The Secretariat stated that it had made the decision of rolling-out the solution in its state with the risks associated. 58. I recommend that an appropriate change management system within the defined scope of the System Integrator’s activities be put in place with joint participation of the management, users and the System Integrator. The Secretariat agreed to take appropriate action for future roll-outs. 59. Technical assessment of the Global Management System solution. In my earlier report we had expressed concern that key delivery phases of the Global Management System were not perfectly aligned with Oracle’s application implementation method phases. We had recommended a third party technical assessment of the Global Management System solution before go-live. WHO engaged Tata Consultancy Services to perform a technical assessment of the Global Management System vis-à-vis administration and operations documentation readiness, data integrity and security, solution internals and software usability. 60. High-risk areas highlighted in the report were required to be corrected immediately as they are indicative of the quality of the solution, which in turn will be critical in determining the scope of future support services. 61. The System Integrator is required to address this as part of its warranty obligations to the extent that the level of workmanship fell short of the required standard. The Secretariat stated that although 1
“End to end” refers to initiating a process and completing it, such as a travel request or a procurement request.
11
A62/29
Annex
the sampled data indicated code1 that was inconsistent with “best practice”, it was decided that go-live should not be delayed. The issue had since been revived with the System Integrator who would be responsible for revising the documents and codes in accordance with the prescribed standards. 62. I recommend that the risks highlighted in the technical assessment report be corrected as they would have an impact on the users’ comfort levels as well as on the effectiveness of support services to be engaged by the Organization. The Secretariat agreed to implement the recommendation in 2009. 63. Timelines for roll-out of the Global Management System in regional offices. It is required that all the regional offices migrate to the Oracle system in their functioning and reporting for the Global Management System to be successful. The roll-out of the Global Management System has been made functional only in the Regional Office for the Western Pacific and has been put on hold in the rest of the regional offices. The timeline and sequence of regional roll-outs remained to be finalized. The three phases of a regional roll-out (data preparation, data conversion tests and cutover) shall take at least five months from the start of preparation activities. 64. I recommend that a time schedule for structured roll-out of the Global Management System to regional offices be worked out soon. The Secretariat has accepted the recommendation. 65. Expenditure recognition in the Global Management System. The book-keeping system is aligned to the preparation of financial statements and therefore follows the accounting policies of the organization. The Financial Statements of WHO are prepared by relying on two essential accounting policy changes, namely, expenditure recognition (delivery principle) and income recognition (pledge), generally in line with the principles of the International Public Sector Accounting Standards. Headquarters and the Regional Office for the Western Pacific, which have gone live with the Global Management System, record the transactions of expenditure with the trigger of “delivery” and create accounts payable as a liability. Other regional offices, which continue to work on the legacy system (Administration and Finance Information System), book expenditure based on commitment of funds or creation of obligation. 66. It was observed that the obligations which do not result in delivery at the end of the biennium are required to be reversed. In the data conversion exercise, all the unliquidated obligations of the legacy system have been converted as accounts payable. This accounts payable would need to be tested periodically until roll-out of the Global Management System to all the regions. 67. I recommend that during the transition period of roll-out of the Global Management System in all the regional offices, appropriate procedures be implemented to test the obligations periodically for expenditure recognition under delivery principle. The Secretariat has acknowledged the need for developing specific procedures during the transition period. 68. Budget carry-forwards. For expenditure recognition, budget carry-forwards are required to be recognized. It was seen that the Global Management System does not distinguish the budget for the biennium for strategic objectives/Organization-wide expected results and the Budget Centre from the amount carried forward from the previous biennium. In the Regional Office for the Western Pacific, the present status of allotment and disbursement of obligation could not be accessed in the Global Management System. Customization would be required to be done in the Global Management System
1
Code is the programming language and the way it was used to build functionality.
12
Annex
A62/29
to incorporate this principle and for better transparency. The Secretariat stated that a custom report had been defined for carry-forwards but this was still to be developed. 69. I recommend that customization be done at the earliest to aid in monitoring the carry-forwards at summary level. The system should clearly distinguish the amount of budget carried forward from the previous biennium to cover unreceived orders from the budget of the current biennium. The Secretariat has agreed to implement the recommendation.
GLOBAL SERVICE CENTRE 70. WHO adopted a Global Service Delivery Model in March 2007 which was to be implemented concurrently with the Global Management System. A Global Service Desk provides functional and technical support to the users of the System. An audit of WHO’s Global Service Centre in Kuala Lumpur was conducted in November–December 2008 to ascertain the working of procedures and internal control following the decentralization of the administrative work to the Global Service Centre. 71. Post go-live scenario. The Global Service Centre has been operational since July 2008 with headquarters and the Regional Office for the Western Pacific going live. It was seen that two processes, procurement and support office Global Service Desk were stated to be on track while finance and payroll, including accounts payable and human resources processes, still required solutions. 72. The reasons were attributed to legacy invoices causing backlogs, persistence of system bugs, continuing lack of system stability, initial processing errors, inaccurate/invalid data by upfront users, and problems in the record management system. Missing data in supplier creation database impeded assigning of correct payment, and processing was being done with manual workarounds. The added work for transitional interfaces with non go-live regions further impacted on the month-end closures which got delayed. The Secretariat stated that the issues in payment processing were gradually being reduced or stabilized. 73. I recommend that management consider the go-live dates for the remaining regions in a structured manner after taking into consideration the critical path and the lead time required for different activities. The Secretariat has accepted the recommendation. 74. Accounts payable module. The Oracle Applications module uses the supplier database in an integrated manner. Creation of master data and its subsequent management is thus an important task. It was noted that supplier master data is maintained and controlled by the accounts payable unit with relevant input from different units. Creation of supplier records, bank account creation, technical support, tracking of items outside the system were identified by the unit as major problem areas that needed to be addressed. 75. I recommend that the Secretariat continue to exercise tight control in the matter of master data creation and its subsequent management. 76. Global procurement and logistics processes. It was noted that of the 8856 purchase requests received for processing during the post go-live period, July–November 2008, 1573 cases could not be processed for various technical reasons including wrong item selected by requestor, file folders not found/created, duplicate registration, wrong selection, currency mismatch, non-availability of approval. It was noted that while the extent of rejection had since declined over the succeeding
13
A62/29
Annex
months, greater user involvement and detailed training would be required for effective service delivery. 77. I recommend that the Secretariat continue to carry out training need analysis of users and impart training on an ongoing basis for ensuring effective service delivery. The Secretariat has accepted the recommendation. 78. Pending service requests. It was observed that 275 service requests were pending at the Global Service Desk for more than 60 days for want of feedback from user customers with regard to closure confirmation. Besides the cases pending at the Global Service Desk, there were 790 service requests pending at the Global Service Centre, local business unit and at the Department of Information Technology and Telecommunications at headquarters. The Global Service Desk is not tagged with Siebel (service measurement system) in such a way that service requests already logged in and closed are available for resolving subsequent service requests of a similar nature. 79. I recommend that the support matrix be completed, both at the headquarters and regional level to establish a link between the Siebel system and the Global Management System. The Secretariat has accepted the recommendation. 80. Information technology security management. The Global Management System has brought integrated software to the whole Organization, replacing legacy systems and adding a much wider range of functions that has enabled the Organization to pursue consolidation of the administrative services in the Global Service Centre. The database is centralized and applications reside on multiple users in the Global Management System and are accessible from different modules. Consequently, security of data has assumed foremost importance. Security risk assessment/reassessment is required to identify vulnerabilities and threats (with specific breakdown by host, operating system, application, data, network devices and links) to assess appropriate risk level in accordance with WHO’s global policy on information security. 81. It was observed that security risk assessment had not been done, before or after the Global Management System go-live. Thus potential threats and vulnerabilities have not been identified and associated risks not mitigated. No comprehensive review of the security management system was carried out post go-live. Security design and architecture were not incorporated in all phases of information system and network lifecycles, namely, the design, implementation, testing and maintenance of the Global Management System. We found no evidence of documentation to indicate formal risk management of the specific risks associated with the information technology infrastructure and service delivery. 82. The Secretariat agreed that presently there were no audit trails for checking master data changes and there were no security add-on tools implemented to address access restrictions. It was explained that the current primary focus was to achieve system stability. The Secretariat accepted that there was no documented procedure for reviewing access privileges on a regular basis, and stated that such processes were being developed. 83. I recommend that documented procedures for reviewing access privileges and monitoring unauthorized attempts on a regular basis be developed and standardized. Securities add-on tools to enable restricted access to critical programmes and data may be implemented further to development and implementation of the in-built security mechanism in the Oracle application. The Secretariat has accepted the recommendation.
14
Annex
A62/29
84. Disaster recovery and business continuity plan. An effective disaster recovery plan should include a number of preventive, detective, and corrective measures to ensure a smooth continuity of business operations in the event of a disruption or disaster. The last effort at such an analysis was made by the Organization prior to the Global Management System going live. 85. Determination of system recovery priorities had not been finalized for the Global Service Centre as recovery time objective/recovery point objective was still to be defined. This situation has resulted in an incomplete analysis of applications, and therefore, does not address full recovery in the event of a disruption. 86. A current business impact analysis should fully describe the system requirements, applications, processes and interdependencies to determine contingency requirements and priorities for all applications. The plan should address the basic stages of emergency reaction-emergency response, backup operations, and recovery operations. The business impact analysis done before the Global Management System going live did not include the Global Service Centre. Criticality of information resources (e.g. applications, data, networks, system software, and facilities) that support the Organization’s business processes is thus required to be established afresh. More training and awareness programmes are required to be conducted. 87. The Secretariat agreed that the plans established during 2008 addressing both the business impact analysis and the business continuity and disaster recovery procedures have to be further refined and coordinated with the regions and back-up sites. 88. Adoption of the Information Technology Infrastructure Library framework. One of the focus areas of WHO’s global information and communications technology strategy aims at implementing the Information Technology Infrastructure Library framework across the organization. The framework, for its part, aims to create a set of comprehensive, consistent and coherent codes of best practice for quality information technology service management, promoting business effectiveness in the use of information technology. A review of the WHO sites indicated that documentation needed to be updated with the latest best practices for users. 89. It was noted that although the Department of Information Technology and Telecommunications has included adoption of the Information Technology Infrastructure Library framework in the Medium-term strategic plan, no definitive time schedule had been prescribed for adoption of the framework across the Organization. 90. I recommend that the Secretariat continue to adopt a consistent and comprehensive approach towards implementation of the framework to a level that gives a detailed description of important information technology practices with comprehensive checklists, tasks, procedures and responsibilities to meet the aims set out in WHO’s global information technology strategy. A timeline should also be set out for implementation of the standards of the Information Technology Infrastructure Library framework. The Secretariat has accepted the recommendation. 91. The integration of the service catalogue into the Siebel system. The Global Service Desk support service is one of the services included in the Information Technology and Telecommunications service catalogue in the end-user services category. The creation of a service catalogue according to the Information Technology Infrastructure Library framework is a starting point for the implementation of the service level management process. It was observed that the service level catalogue had been created for the Global Service Desk, but it has not been linked to the existing
15
A62/29
Annex
template in the Siebel system. This led to difficulties in monitoring service level metrics and also to underutilization of the information technology system. 92. Further, the key performance indicators framework had been defined and documented for the Global Service Desk, but the key performance indicators and service level metrics could not be compiled by the system because of non-integration of these metrics to the Siebel system. 93. I recommend that the service catalogue along with the related key performance indicators be integrated with the existing template in the Siebel system in a specific time frame so as to enable monitoring of service level metrics. The Secretariat has accepted the recommendation. 94. Assessment of customer satisfaction with the Global Management System, post go-live. The quality of services and customer satisfaction are required to be managed actively through a Service Improvement Programme. User feedback should be obtained regularly to assess user satisfaction in compliance with Information Technology Infrastructure Library framework. It was seen that in the post go-live of the Global Management System, no survey had been conducted or feedback obtained to assess user satisfaction. 95. I recommend that a structured feedback from users of the Global Management System under the Information Technology Infrastructure Library framework may be obtained. A comprehensive survey and assessment of the Global Management System based on user feedback would help to improve the processes and functioning of the Global Management System in the roll-out to other Regional Offices. The Secretariat has agreed that an end-user survey of the Global Management System is required.
ACKNOWLEDGEMENT 96. I wish to record my appreciation for the cooperation and assistance extended by the DirectorGeneral, the Regional Directors and the staff of the World Health Organization during my audits.
Vinod Rai Comptroller and Auditor General of India External Auditor March 2009
=
=
=
16