Report of the External Auditor: report by the Secretariat

SEVENTIETH WORLD HEALTH ASSEMBLY A70/43 Provisional agenda item 21.1 15 May 2017 Report of the External Auditor Report by the Secretariat The Director-General has the honour to transmit to the Seventieth World Health Assembly the report of the External Auditor on the financial operations of the World Health Organization for the financial year ended 31 December 2016 (see Annex). A70/43 3 ANNEX Republic of the Philippines COMMISSION ON AUDIT Quezon City Report of the External Auditor to the Seventieth World Health Assembly on the Financial Operations of the World Health Organization For the Financial Year Ended 31 December 2016 A70/43 Annex 4 REPORT OF THE EXTERNAL AUDITOR TO THE SEVENTIETH WORLD HEALTH ASSEMBLY ON THE FINANCIAL OPERATIONS OF THE WORLD HEALTH ORGANIZATION FOR THE FINANCIAL YEAR ENDED 31 DECEMBER 2016 Executive summary ................................................................................................................................. 9 A. Mandate, scope and methodology ............................................................................................... 13 B. Results of the audit ...................................................................................................................... 14 1. Financial matters ....................................................................................................... 15 1.1 Audit of financial statements ....................................................................................... 15 1.2 Inventories – implementation of Global Inventory Management System ................... 15 1.2.1 Need to update the PFI rate in the system.................................................................... 15 1.2.2 Need to enhance classification of inventories .............................................................. 16 1.2.3 Need to fast track the development of policy/SOP on disposal of expired inventory ......................................................................................................... 16 1.3 Expenditures ................................................................................................................ 16 1.3.1 Misclassification of expenses in the accounts ............................................................. 16 1.3.2 Error in mapping expenditures in the recognition of Building CIP and Software under development ....................................................................................... 17 1.3.3 Non-recognition of costs/expenditures relating to retention fees ................................ 17 1.4 Staff claims dependency entitlements .......................................................................... 18 1.5 Direct financial cooperation ......................................................................................... 18 1.6 Direct implementation ................................................................................................. 19 1.7 Write-off of receivables related to long outstanding travel advances .......................... 19 1.8 Full IPSAS reporting of Property, Plant and Equipment in 2017 ................................ 20 1.8.1 GSM reporting using the Discoverer tool (Fixed Asset Register) ............................... 20 1.8.2 Financial reporting after end of transitional provision under IPSAS 17 ...................... 21 2. Governance matters ................................................................................................... 22 2.1 Management controls ................................................................................................... 22 2.1.1 Cash management ........................................................................................................ 22 2.1.2 Direct financial cooperation ......................................................................................... 23 2.1.3 Direct implementation ................................................................................................. 23 2.1.4 Human resource management ...................................................................................... 23 2.1.5 Donor reporting............................................................................................................ 24 2.1.6 Travel management ...................................................................................................... 24 2.1.7 Procurement management ............................................................................................ 24 2.1.8 Asset and iInventory management ............................................................................... 24 Annex A70/43 5 2.2 Managing information technology .............................................................................. 26 2.2.1 Strategic and operational planning – absence of a concrete and stable IT Strategic Plan .......................................................................................................... 26 2.2.2 Overall organization and accountability – lack of formal roles responsibilities and performance management framework ......................................................................... 27 2.2.3 Risk management – need to improve on risk contextualization and analysis ............. 28 2.2.4 IMT structure and organization – unclear reporting lines and jurisdiction ................. 29 2.2.5 Service delivery and measurement – absence and/or informal documentation of control frameworks ...................................................................................................... 31 2.3 Managing the WHO Procurement Strategy ................................................................. 32 2.3.1 Delivery of the 2015 WHO Procurement Strategy ...................................................... 32 2.4 Managing risks ............................................................................................................ 37 C. Disclosures by Management ....................................................................................................... 38 D. Implementation of External Audit Recommendations ................................................................ 38 E. ACKNOWLEDGEMENT .......................................................................................................... 39 Annex A Status of Implementation of External Audit Recommendations from Prior Years ..... 40 A70/43 Annex 6 LIST OF ABBREVIATIONS ADG Assistant Director-General AFRO Regional Office for Africa AMRO Regional Office for the Americas APW Agreement for Performance of Work BFO Budget and Finance Officer BY Begin-Year CAR Central African Republic CEO Chief Executive Officer CIO Chief Information Officer CIP Construction in progress CISO Chief Information Security Officer CN Category Network CO Country Office CPC Corporate Procurement Policy and Coordination CRE Compliance, Risk Management and Ethics Office CRMC Compliance and Risk Management Committee CRMP Corporate Risk Management Policy DAA DFC Accountability and Assurance DAF Director of Administration and Finance DFC Direct Financial Cooperation DI Direct Implementation DTR Delinquent Travel Request EAS Enterprise Architecture and Security EB Executive Board ECM Enterprise Content Management system EMRO Regional Office for the Eastern Mediterranean ePMDS Electronic Performance Management and Development System ERF Emergency Response Framework ERM Enterprise Risk Management FACE Funding Authorization and Certificate of Expenditures FAM Fixed Asset Module FAR Fixed Asset Register FCFS Final Certified Financial Statements FNM Department of Finance FWC Family, Women’s and Children’s Health Cluster GEM Global Engagement Management GIMS Global Inventory Management System GPL Global Procurement and Logistics GSC Global Service Centre GSM Global Management System GSMT Global Management System Transformation HQ Headquarters HR Human Resources Annex A70/43 7 HRD Department of Human Resources Management IARC International Agency for Research on Cancer ICC United Nations International Computing Centre ICT Information and Communication Technologies IEOAC Independent Expert Oversight Advisory Committee IMS Incident Management System IMT Department of Information Management and Technology IOS Office of Internal Oversight Services IPSAS International Public Sector Accounting Standards ISA International Standards on Auditing ISO International Organization for Standardization IST Intercountry Support Team IST ESA Intercountry Support Team for Eastern and Southern Africa IT Information Technology ITT Information Technology and Telecommunications KPI Key Performance Indicator KRA Key Result Area LEG Office of the Legal Counsel LOA Letter of Agreement LTA Long Term Agreement MOH Ministry of Health MTR Mid-term Review NGO Nongovernmental Organization NMH Noncommunicable Diseases and Mental Health ODG/DGO Office of the Director General PAHO Pan American Health Organization PAN Programme Area Networks PB Programme Budget PFI Packaging, Freight and Insurance PMO Project Management Office PO Purchase Order PP&E Property, Plant and Equipment PR Purchase Requisition PRP Planning, Resource Coordination and Performance Monitoring Department PSR Global Preparedness, Surveillance and Response PTAEO Project, Task, Activity, Expense, Organization PWC Price Waterhouse Coopers RACI Responsible, Accountable, Consulted, Informed RFP Request for Payment RTC Retroactive Travel Claim SEARO Regional Office for South-East Asia SHI Staff Health Insurance SIC Statement of Internal Control SMART Specific, Measurable, Attainable, Realistic, Time bound SOP Standard Operating Procedure A70/43 Annex 8 SQL Standard Query Language TC Travel Claim TSA Technical Services Agreement UN United Nations UNAIDS Joint United Nations Programme on HIV/AIDS UNGA United Nations General Assembly UNGM United Nations Global Marketplace UNITAID International Drug Purchase Facility USD United States Dollar WAC Weighted Average Cost WCO WHO Country Office WFP World Food Programme WHA World Health Assembly WHO World Health Organization WIGI Within-Grade Increase WPRO Regional Office for the Western Pacific WR WHO Representative Annex A70/43 9 EXECUTIVE SUMMARY Introduction 1. The report of the External Auditor on the audit of the financial statements and operations of the World Health Organization (WHO) is issued pursuant to Regulation XIV of the Financial Regulations of WHO and is transmitted through the Executive Board to the Seventieth World Health Assembly (WHA). 2. This is the first long-form report to the World Health Assembly by the Chairperson of the Commission on Audit of the Republic of the Philippines, under a new mandate as the External Auditor of the WHO for the four-year period from 2016 to 2019, granted by the Sixty-eighth World Health Assembly under resolution WHA68.14. 3. The objective of the audit is to provide independent assurance to Member States, to increase transparency and accountability in the Organization, and to support the objectives of the Organization’s work through the external audit process. We have detailed in this report the financial and governance matters that we believe should be brought to the attention of the World Health Assembly. Overall result of the audit 4. In line with our mandate, we audited the financial statements of WHO in accordance with the Financial Regulations and in conformity with the International Standards on Auditing issued by the International Auditing and Assurance Standards Board. 5. Our audit resulted in the issuance of an unmodified audit opinion on the Organization’s financial statements for the financial year ended 31 December 2016. We concluded that the financial statements present fairly, in all material respects, the financial position of WHO for the financial year ended 31 December 2016, and its financial performance, the changes in net assets/equity, the cash flows, and the comparison of budget and actual amounts in accordance with the International Public Sector Accounting Standards (IPSAS). 6. We also concluded that the accounting policies were applied on a basis consistent with that of the preceding year, and the transactions of the WHO that have come to our notice during the audit or that have been tested as part of the audit of the financial statements have, in all significant respects, been in accordance with the Financial Regulations and legislative authority of the WHO. 7. In addition to the audit of financial statements, we also reviewed critical business processes in the Noncommunicable Diseases and Mental Health (NMH) Cluster, the Department of Information Management and Technology (IMT), the Regional Office for Africa (AFRO), the Intercountry Support Team for Eastern and Southern Africa and five country offices – in Uganda, Zimbabwe, the Central African Republic, Benin and Mozambique. We also reviewed the information technology governance, Procurement Strategy delivery and risk management of the Organization. We provided significant recommendations on the observations noted to further improve the efficiency and effectiveness of operations, increase accountability and transparency, and improve and add value to WHO’s financial management and governance. A70/43 Annex 10 Summary of recommendations 8. The following audit recommendations, which are discussed in detail in this report, are that WHO Management: a. Further address inventory issues across the Organization through the evaluation of existing inventory control mechanisms on valuation and reporting, followed by the development of a Global Policy for Supply Chain and Inventory Management which would provide the basis for the development of the Standard Operating Procedure (SOP) on the management of expired inventories (paragraph 32); b. Fast track the implementation of the hardcoding enhancement in the Purchase Requisition (PR) page in the Global Management System (GSM) and continue to provide guidance and relevant training to users in the light of the new process in assigning expenditure types in GSM, to ensure capture of the correct expense account code for the transaction (paragraph 36); c. Map correctly the adjustment account for the recognition of Construction in progress (CIP) and Software under development to the appropriate expense accounts to prevent the occurrence of the same misclassification in the financial statements (paragraph 39); d. Establish the policy and procedure covering the accounting treatment of retention fees from contracts entered into by WHO to provide guidance and uniformity in recording the same and to ensure that retention fees are recorded in the financial period to which they relate (paragraph 42); e. Reinforce the requirements for data update and entitlement application, by introducing review and verification procedures of the dependency related documents at the staff member’s duty station, where information can readily be obtained and verified before uploading to the Enterprise Content Management system (ECM), to ensure accuracy of information as basis for the payment of claims (paragraph 46); f. Strengthen supervisory control to ensure completeness in all aspects of direct financial cooperation (DFC) implementation and reporting, while sustaining enhanced monitoring and intensified follow-up with offices with overdue DFC reports to ensure timely submission and reduce further the number that are overdue (paragraph 51); g. Strengthen controls on the evaluation of required documentation, incurrence of expenditures, and observance of milestones to ensure compliance with existing SOP on direct implementation (DI); and continue to adopt measures to diminish if not extinguish the causes of delays in the submission of DI reports to further reduce the number that are overdue (paragraph 56); h. Continue to address long outstanding receivables by ensuring early closure/settlement of travel transactions to minimize impact on the affected accounts in the financial statements and implement as envisioned the new processes and improved controls in handling travel advance recovery to prevent accumulation of the balance thereof (paragraph 60); Annex A70/43 11 i. Strive to attain complete and accurate tracking and reporting of items of Property, Plant and Equipment (PP&E) at both the regional and the country levels, particularly in the African Region, to ensure full compliance with IPSAS (paragraph 64); j. Introduce a more reliable tool for monitoring and tracking asset data and enhance the functionality of the existing Oracle financial reports for PP&E to ensure compliance with IPSAS (paragraph 65); k. Adhere to the recognition principle under paragraph 14 of IPSAS 17 and also the disclosure requirement under paragraph 94.(b) of IPSAS 17 on the carrying amount of fully depreciated PP&E still in use, upon the recognition of remaining asset classes after the transition period (paragraph 70); l. Disclose in the Notes to the financial statements pursuant to paragraph 30.(b) of IPSAS 17 the use of a standard rate for the incidental costs in the acquisition of PP&E and update the said rate, to approximate the directly attributable costs in bringing the asset to the location and the condition for its use (paragraph 71); m. Leverage on its existing Internal Control Framework and policy to further the effectiveness of monitoring the embedded management controls across operational processes, and maximize the value offered by its internal governance mechanism for internal control through closer guidance to ensure a high level of assurance on the Statement of Internal Control appended to its financial statements (paragraph 94); n. Develop a concrete and formal Information Technology (IT) Strategic Plan: (i) with a definite time frame as the product of an institutionalized strategic planning process to provide shared direction for all initiatives to be developed and for those currently under way; (ii) that contains the minimum requirements such as IT strategic directions and guiding principles, goals and objectives, key performance metrics, IT investments, and delivery milestones; and (iii) that ensures that the delivery and prioritization of core business solutions through the employment of dedicated resources and the management of constraints are based on formally-established strategies (paragraph 101); o. Establish (i) an IT Board with clear roles and responsibilities to provide an oversight function over IT projects from a cross-functional perspective and to ensure that the IT strategy is aligned with the strategic goals of the Organization and (ii) an IT Performance Management Framework with IT performance metrics to allow for the proper measurement of the quality of IT services and to provide effective information for decision-making; and redefine the Global Management System Transformation (GSMT) Project governance structure to provide clearer roles and functions as a basis for the composition of the members of the Steering Committee and Project Board (paragraph 107); p. Enhance its risk identification activities by infusing better root cause analysis of the identified risks to avoid assumptions and logic traps and ensure that remediation strategies result in the application of more effective risk controls within the appropriate context (paragraph 112); q. Ensure that the Project Management Office (PMO) bears responsibility for all major projects or initiatives of IMT to include the GSMT Project, to guarantee a more A70/43 Annex 12 streamlined and authoritative delivery of the mandated function, and make the prescribed accountabilities and responsibilities more stable, which may eventually result to more effective governance and project quality assurance process (paragraph 118); r. Recognize the pervasive and cross-cutting role of the Chief Information Security Officer (CISO) position, streamline the pertinent reporting lines and authority, and make the CISO report directly to the Chief Information Officer (CIO) to enhance information security service efficiency, and maintain a healthier posture of the Organization’s information assets (paragraph 122); s. Formalize the control frameworks on the critical processes of IT management, giving priority to: (i) outsourcing arrangements; (ii) criteria for the classification of critical IT assets; and (iii) the IT Performance Management Framework, and ensure that these control frameworks are documented and shared across the Organization for effective management and monitoring. Also align the control frameworks with the risk identification activities that need to be enhanced focusing on the defined key result areas (paragraph 126); t. Enhance the plan for the implementation and execution of the WHO Procurement Strategy to minimize the gap between planned versus actual activities by: (i) managing more effectively risks relating to delays and undelivered products; (ii) prioritizing better its deliverables through a more logical sequencing of activities giving consideration to tight timelines and the complexities of planned products; and (iii) allowing more time for coordination activities and closer engagements covering internal dependencies to factor in their requirements into the whole implementation plan (paragraph 135); u. Provide more focus on the delivery of the procurement planning component of the WHO Procurement Strategy through the prioritization of related policy formulation and the preparation of the specific procedures and accompanying templates to ensure the timely execution of planned procurement activities (paragraph 142); v. Craft the emergency procurement policy framework including related SOPs to support the Organization’s emergency response and integrate them into the WHO Procurement Strategy’s implementation plan to enhance the control and monitoring of the delivery of related activities and tasks (paragraph 148); and w. Enhance further the monitoring activities in the execution of risk management process across all levels of management, primarily focusing on formal risk contextualization and identification; and consider assessing the Organization’s level of risk maturity to identify strategic opportunities for improvements (paragraph 154). Implementation of external audit recommendations from prior years 9. We validated the implementation of the external audit recommendations contained in prior years’ audit reports. We noted that, of the 41 recommendations, 36 (88%) have been implemented, 2 (5%) were closed as they were updated and included in this report, while 3 (7%) are still in progress of implementation. The status of the three recommendations which are in progress will be validated and reported in the next financial reporting period. The expected dates of implementation of those in progress are provided by Management. Annex A presents the detailed analysis of the implementation of the recommendations. Annex A70/43 13 A. MANDATE, SCOPE AND METHODOLOGY Mandate 10. The Sixty-eighth World Health Assembly granted in May 2015 through resolution WHA68.14 a new mandate to the Chairperson of the Commission on Audit of the Republic of the Philippines as External Auditor of WHO for the four-year period from 2016 to 2019. Regulation XIV of the Financial Regulations of WHO and the Appendix to those Regulations elaborate on the terms of reference governing the external audit. The regulations require that the External Auditor report to the World Health Assembly on the audit of the annual financial statements and on other information that should be brought to its attention with regard to Regulation 14.3 and the Additional Terms of Reference. Scope and objectives 11. Our audit is an independent examination of the evidence supporting the amounts and disclosures in the financial statements. It also includes an assessment of WHO’s compliance with the Financial Regulations and legislative authority. The primary objective of the audit is to provide an independent opinion on whether: (a) the financial statements presented fairly the financial position, the results of financial performance, the changes in net assets/equity, the cash flows, and the comparison of actual amounts and budget of WHO for the financial year ended 31 December 2016 in accordance with IPSAS; (b) the significant accounting policies set out in Note 2 to the financial statements were applied on a basis consistent with that of the preceding financial period; and (c) the transactions that have come to our notice or that we have tested as part of the audit, in all significant respects, complied with the Financial Regulations and legislative authority. 12. We also carried out a review of WHO operations with regard to Financial Regulation 14.3, which requires the External Auditor to make observations with respect to the efficiency of the financial procedures, accounting system, internal financial controls and, in general, the administration and management of WHO operations. 13. Overall, the audit intends to provide independent assurance to Member States, to increase transparency and accountability in the Organization, and to support the objectives of the Organization’s work through the external audit process. Methodology and auditor’s responsibilities 14. We conducted our audit in accordance with the International Standards on Accounting. These Standards require that we plan and perform our audit to obtain reasonable assurance that the financial statements are free from material misstatement. The audit includes examining on a test basis evidence supporting the amounts and disclosures in the financial statements. The audit also includes assessing the accounting principles used and the significant estimates made by Management as well as evaluating the overall presentation of the financial statements. A70/43 Annex 14 15. The risk-based audit approach was adopted in the audit of the financial statements. This approach requires the conduct of risk assessments of material misstatements at the financial statement and assertion levels based on an appropriate understanding of the entity and its environment including its internal controls. 16. The auditor’s responsibility is to express an opinion on the financial statements based on an audit. The audit is performed to obtain reasonable assurance, not absolute assurance, as to whether the financial statements are free of material misstatement including those caused by fraud or error. 17. With respect to the review of WHO operations in line with our risk assessment, we focused on the review of management control activities operating in offices, the review of information and communication technology and the review of Procurement Strategy delivery. We also reviewed the implementation of risk management in the offices visited. 18. During the financial year 2016, in addition to the audit of the financial statements, we also audited offices at headquarters (HQ) – the NMH Cluster, IMT, Corporate Procurement Policy and Coordination (CPC) and the Global Service Centre (GSC); AFRO, as well as the IST for Eastern and Southern Africa; and the country offices in Zimbabwe, Uganda, Mozambique, Benin and Central African Republic. 19. In addition, we also audited the financial statements of five WHO hosted entities, namely: the Joint United Nations Programme on HIV/AIDS (UNAIDS); the United Nations International Computing Centre (ICC); the International Agency for Research on Cancer (IARC); the International Drug Purchase Facility (UNITAID); and the Staff Health Insurance (SHI) Fund. A separate report is issued to the governing body of these entities. 20. This report does not include any comments on the financial statements of the Pan American Health Organization (PAHO)/the Regional Office for the Americas (AMRO), which is being audited by the Spanish Court of Audit. We placed reliance on that audit based on the Comfort Letter dated 15 March 2017. The Court informed us that the audit of 2016, thus far, did not detect any material errors, misstatements or any other matters that adversely affected the audit opinion on the PAHO financial statements. An unqualified audit opinion was also given on the 2015 annual accounts. The Court further informed us that it will be able to conclusively give assurance that there are no material misstatements once the audit of the 2016 financial statements is fully concluded and has been certified. 21. We coordinated with the Office of Internal Oversight Services (IOS) on the planned audit areas to avoid unnecessary duplication of efforts, and to determine the extent of reliance that can be placed on IOS work. We also collaborated with the Independent Expert Oversight Advisory Committee (IEOAC) to further enhance our audit work. 22. We continued to report audit results to WHO Management through audit observation memoranda and management letters containing detailed observations and recommendations. We issued 18 audit management letters during the financial year 2016. The practice provides a continuing dialogue with Management. B. RESULTS OF THE AUDIT 23. The present report covers matters that, in the opinion of the External Auditor, should be brought to the attention of the World Health Assembly. The WHO Management was afforded a full opportunity to comment on our audit observations. The recommendations provided to Management Annex A70/43 15 are designed to support the objectives of WHO’s mandate, and to help improve and add value to WHO’s financial management and governance. 1. FINANCIAL MATTERS 1.1 Audit of financial statements 24. We issued an unmodified opinion on the WHO’s financial statements. As such, we concluded that the financial statements present fairly, in all material respects, the financial position of WHO for the financial year ended 31 December 2016, the results of its financial performance, the changes in net assets/equity, the cash flows, and the comparison of budget and actual amounts in accordance with IPSAS as disclosed in Note 2 to the financial statements. 25. We appreciate the efforts taken by Management to address a number of recommendations issued in the course of the interim and year-end audits of the WHO’s 2016 financial statements in order to present fairly the balances of the affected accounts and improve the presentation and disclosures in compliance with IPSAS. The financial statements for the period ended 31 December 2016 reflect the adjustments on the balances of the accounts affected in the statements, as well as the corrections and additions to the note disclosures. 26. In addition, as required by WHO’s Financial Regulations, we concluded that the accounting policies were applied on a basis consistent with that of the preceding year. Further, we concluded that the transactions of WHO that have come to our notice during the audit or that have been tested as part of the audit of the financial statements have, in all significant respects, been compliant with the Financial Regulations and legislative authority of WHO. 27. While we issued an unmodified audit opinion on the financial statements, we noted the following improvement opportunities which need to be made by Management to further improve the recording, processing and reporting of financial transactions and ensure the fair presentation of the financial statements in the next reporting period. 1.2 Inventories – implementation of Global Inventory Management System 1.2.1 Need to update the PFI rate in the system 28. Management outlined in our previous audits that the issues on the computation of Weighted Average Cost (WAC), the inclusion of actual Packaging, Freight and Insurance (PFI) costs, the monitoring of expired inventory and the reporting of inventories in transit at cut-off period, would be addressed by the Global Inventory Management System (GIMS). 29. We noted that the implementation/roll-out of GIMS started in January 2016 and HQ-Enterprise Risk Management (ERM), HQ Global Preparedness, Surveillance and Response (PSR) and the Regional Office for South-East Asia (SEARO) Warehouses have been using the system while migration by the warehouses at the Regional Office for the Western Pacific (WPRO), the Regional Office for the Eastern Mediterranean (EMRO) and AFRO will be completed in 2017. Our review of the implementation of GIMS revealed that the WAC is calculated automatically by the system. Capture of Stocks-in-transit is not currently included among the functionalities in GIMS while Donations in-kind are taken up in the system as miscellaneous receipts with an addition of 14 per cent for PFI. Actual PFI costs are not captured by the system and instead a 14% PFI rate is applied to the cost of purchased inventories. This rate, however, is lower than the current standard rate used by GSC A70/43 Annex 16 in encumbering/reserving funds for Packaging and Freight which is at 15% starting July 2016 excluding the costs for insurance. In order to approximate the actual PFI costs to be added to the cost of inventories, the PFI rate must be updated and must be used consistently throughout a given financial period to ensure fair presentation of the Inventories account in the financial statements. 1.2.2 Need to enhance classification of inventories 30. Further review of data in GIMS revealed the need for classification of the inventories into expiring and non-expiring items to enhance data integrity and usefulness in financial reporting. 1.2.3 Need to fast track the development of policy/SOP on disposal of expired inventory 31. Our validation of the status of implementation of our previous audit recommendation on the global SOP relating to disposal of expired inventory revealed that its issuance has not yet been completed. Currently, a concept note has been developed on how to address the broader issue of the need for a global policy and strategy for emergency response, supply chain management and inventory management. Once this global policy has been implemented, it will form the basis for the SOP on the disposal of expired inventories. 32. We recommended that WHO further address inventory issues across the Organization through the evaluation of existing inventory control mechanisms on valuation and reporting, followed by the development of a Global Policy for Supply Chain and Inventory Management which would provide the basis for the development of the SOP on the management of expired inventories. 1.3 Expenditures 1.3.1 Misclassification of expenses in the accounts 33. To enhance compliance with policies and avoid errors in account classifications, we recommended in 2015 and WHO agreed to provide further guidance and relevant training to staff members, enforce compliance with regulations and strengthen the review process in the assignment of expenditure types to be used before a Purchase Order is created in GSM. 34. During the 2016 interim audit we noted misclassification of entries between Contractual Services (USD 8.4 million), Agreements with United Nations (UN) and nongovernmental organizations (NGO) (USD 5.3 million), and General Operating Costs (USD 3.1 million) for which non-standard eExpenditure batches were raised to correct the misclassification errors to ensure that balances of expenditure accounts affected are fairly presented at year-end. We also reiterated the recommendation to further strengthen the review process in raising PTAEO classification particularly in assigning expenditure types, to which Management agreed, and will continue to identify other possible erroneous transactions that need to be corrected. 35. At year-end, we still noted misclassified General operating costs (USD 1.9 million), Medical supplies and materials (USD 2.2 million) and Contractual services (USD 1.1 million) impacting on other expense accounts such as Staff costs and Equipment, vehicle and furniture accounts. Management corrected the misclassified expenses and pointed out that the accuracy of expenditure recording and coding will be greatly enhanced through the hardcoding enhancement in the Purchase Requisition page in GSM to be implemented in mid-2017, as well as through enhanced monitoring and follow-up with users. Annex A70/43 17 36. We recommended that WHO fast track the implementation of the hardcoding enhancement in the PR page in GSM and continue to provide guidance and relevant training to users in the light of the new process in assigning expenditure types in GSM, to ensure capture of the correct expense account code for the transaction. 1.3.2 Error in mapping expenditures in the recognition of Building CIP and Software under development 37. For 2016, the expenses relating to the ongoing HQ building construction were recorded under the Contractual services expense (USD 4.7 million) and General operating costs (USD 1.69 million). In the recognition of the Building CIP for financial statement reporting at year-end, the said amounts were recorded in the Fixed asset adjustment account, which was mapped as a deduction to the Equipment, vehicles and furniture expense account, instead of as a deduction to the previously charged expense accounts for Contractual services and General operating costs respectively. Similarly, in the recognition of Intangible Software under development, the Contractual services expense account was not reduced by USD 2.4 million but instead the reduction was made against the Equipment, vehicles and furniture expense account. 38. While necessary adjustments were already effected to correct the balances of the affected accounts in the financial statements, this misclassification highlighted the need to correct the path in the mapping of expenditures to the appropriate accounts where expenditures were originally recorded in line with the expected increase of transactions brought about by the construction of the new building and development of new software. This will ensure that correct accounts are used for the recognition of CIP and Software under development. 39. Moving forward, we recommended that WHO map correctly the adjustment account for the recognition of CIP and Software under development to the appropriate expense accounts to prevent the occurrence of the same misclassification in the financial statements. 1.3.3 Non-recognition of costs/expenditures relating to retention fees 40. We noted that the contract entered into by WHO in 2016 for CHF 17.5 million for the construction of a new building at WHO headquarters includes a provision under Item 6.7 to retain an equivalent of 5% of the amount billed and the retained amount shall be released by WHO within 30 days upon acceptance of the project. 41. We noted that WHO paid the contractor and charged to the Contractual services expense account, the amount requested for payment net of a 5% retention fee. The amount of the 5% retention also forms part of the cost of work or services rendered WHO, however, has no policy and procedure in place for the accounting treatment of retention fees. The Retention fees in 2016 amounted to USD 0.3 million. 42. We recommended that WHO establish the policy and procedure covering the accounting treatment of retention fees from contracts entered into by WHO to provide guidance and uniformity in recording the same and to ensure that retention fees are recorded in the financial period to which they relate. A70/43 Annex 18 1.4 Staff claims dependency entitlements 43. Our review of staff members’ applications for change in status and entitlements processing at GSC revealed that supporting documents submitted through ECM are checked for completeness based on the entitlement checklist. We noted that the process does not involve any review or verification by the designated/authorized officer of the documents submitted from the staff member’s place of assignment. Global Human Resources at GSC confirmed that there is no policy and procedure on the review or verification of the documents uploaded by staff members to ECM when requests for data update and entitlement application are made. 44. Changes in the personal data of staff members have financial implications with respect to a number of entitlements. It is thus important that documentation submitted to change the status of staff members as well as applications for entitlements be reviewed at the duty station before they are uploaded to ECM. The absence of a verification procedure on supporting documents poses the risk of overpayment and breach of staff rules. 45. Management commented that Staff Rule 490 has always been relied upon when requiring staff members to provide documentation. It was added that the requirement to upload supporting documents to GSM for these human resources (HR) related transactions has already been indicated as verifiable by Global Human Resources in published SOPs. We consider, however, that the verification of documents at the staff member’s duty station, where information can be readily be obtained and verified before uploading to ECM, will help ensure correctness of information in GSM. 46. We recommended that WHO reinforce the requirements for data update and entitlement application, by introducing the review and verification procedures of the dependency related documents at the staff member’s duty station, where information can readily be obtained and verified before uploading to ECM, to ensure accuracy of information as basis for the payment of claims. 1.5 Direct financial cooperation 47. The DFC expenses for 2016 amounted to USD 203.7 million from USD 243.5 million in 2015. As at 31 December 2016, a total of USD 0.4 million refund was reported as direct deduction to the DFC expense accounts and a total of USD 0.22 million was recorded as additions to the DFC receivable account, of which USD 0.18 million was collected. 48. Results of our review of compliance with the required documentation in the DFC process based on tests of purchase orders (POs) with amounts of at least USD 1.0 million revealed incomplete DFC documents or absence of a DFC link in ECM in spite of the available DFC checklist. In two country offices in Africa, we noted that DFC implementation dates were ahead of the approval dates of the DFC agreement while one country office was noted to have accepted a non-compliant proposal. Furthermore, we noted that DFC POs were closed in GSM without the required technical reports prescribed in the SOP. 49. Notably, these gaps on documentation were reported in the DFC Monitoring Report for 2016 in response to which Management aimed to strengthen controls through the operationalization of DFC assurance activities in the Regions, such as on-site monitoring and spot checks of ongoing activities and post facto reviews of completed activities. Annex A70/43 19 50. We noted the progressive reduction in the overdue DFC reports in 2016 to 588 from 1116 in 2015, 1287 in 2014 and 3234 in 2013. In the audit of country offices, delayed submission of DFC reports were noted in AFRO, the IST for Eastern and Southern Africa, and the country office in Uganda. The downward trend in the number of overdue reports is a manifestation of the determined effort of Management to reduce the overdue reports through enhanced monitoring, intensified follow-ups with the WHO Regional Offices which cascaded to the different country offices, as well as through strengthened policies on DFCs. Nevertheless, there is still a need to address the presence of overdue reports and the possible effects of any DFC refunds in the financial statements. 51. We recommended that WHO further strengthen supervisory control to ensure completeness in all aspects of DFC implementation and reporting, while sustaining enhanced monitoring and intensified follow-up with offices with overdue DFC reports to ensure timely submission and reduce further the number that are overdue. 1.6 Direct implementation 52. The direct implementation (DI) expenditure in 2016 stood at USD 233.02 million representing a 5.5% increase compared to USD 220.9 million in 2015. The increase in expenditure is mainly attributed to Polio expenditure in EMRO. AFRO and EMRO incurred 99% of the DI expenditure in 2016. 53. The Direct Implementation Monitoring Report for 2016 showed a significant decrease in the number of overdue DI reports from 1837 as at 31 December 2015 to 1101 as at 2 March 2017, registering a decrease of 40%. The African Region had 671 overdue reports (60.9% of the total) while EMRO had 420 (38.1% of total). Confirmation made with the audit teams in AFRO and the country offices in Uganda, the Central African Republic, Benin and Mozambique validated the existence of overdue reports. We recognize the effort of Management in reducing the number of overdue reports. 54. In the audit of the country offices in Africa, we also noted gaps such as the incomplete documentation of justifications, the inappropriate use of a DI scheme, ineligible expenses and delayed commencement of activities. 55. Management explained that one of the challenges in the submission of DI reports is the turnover of focal persons and Award Managers in the different country offices, which greatly affected the chain of feedback and the monitoring mechanism. To address these challenges, Management introduced measures to facilitate timely individual alerts to persons responsible for the submission of required reports. In addition, Management requested the Budget and Finance Officers (BFOs) to follow up with the country offices to further reduce the number of overdue reports, and for the technical officers responsible to ensure the timely finalization and receipt of reports in GSM. 56. We recommended that WHO strengthen controls on the evaluation of required documentation, incurrence of expenditures, and observance of milestones to ensure compliance with existing SOP on DI; and continue to adopt measures to diminish if not extinguish the causes of delays in the submission of DI reports to further reduce the number that are overdue. 1.7 Write-off of receivables related to long outstanding travel advances 57. The Travel Advance Recoverable account is used to record excess travel advances or travel transactions that are delinquent for which recoveries will be deducted through payroll. The balance of this account was reduced from USD 0.5 million in 2015 to USD 0.4 million in 2016. In 2015, Global A70/43 Annex 20 Finance at GSC started an extensive clean-up of the long outstanding receivables, which resulted in write-off in 2016 of travel advance receivables amounting to USD 0.3 million. The complexity of past balances prompted Management not to recover balances that were outstanding for more than two years as at 31 December 2016. 58. We appreciate the initiative of Management in undertaking the clean-up and review exercise on long outstanding receivables from travel transactions which led, among others, to the enhancement of GSC’s approach in handling recoveries from staff members to be separated through a new standard query language (SQL) script to be used in conjunction with the GSM travel module. Management explained that the reconciliation process and coordination with relevant units have been strengthened to ensure recoveries of advances before the finalization of action for separation. Moreover, a new process has also been introduced to create a credit memo to set up recoveries from separated staff in all cases when travel claims (TCs) are not submitted and delinquent travel requests (DTRs) are still pending 60 days after return. This process aims to reduce the risk of discovering recoverable amounts after separation is finalized. 59. The write-off of receivables related to travel for the period audited should not be taken as a precedent. With the introduction of new policies and improved controls, it is expected that accumulation of long outstanding travel advances will be prevented and further write-offs can be avoided. 60. We recommended and WHO agreed to continue to address long outstanding receivables by ensuring early closure/settlement of travel transactions to minimize impact on the affected accounts in the financial statements and implement as envisioned the new processes and improved controls on handling travel advance recovery to prevent accumulation of the balance of Travel Advance Recoverable account. 1.8 Full IPSAS reporting of Property, Plant and Equipment in 2017 1.8.1 GSM reporting using the Discoverer tool (Fixed Asset Register) 61. We reviewed the Fixed Asset Register (FAR) as at 31 December 2016 as part of our audit initiative to determine WHO’s readiness to fully comply with the requirements of IPSAS 17 following the end of the transition period. The FAR is currently used by WHO offices to track their fixed assets and is an important tool that contributes in ensuring that complete and accurate information is recorded and monitored in the Fixed Asset Module (FAM). 62. Physical verification of items reported as “In use” in the FAR of country offices visited during the 2016 year-end audit revealed items which are: (a) no longer serviceable due to obsolescence in Mozambique; (b) for disposal or already sold/disposed of in Benin and the Central African Republic; (c) not reported in the FAR of Benin and the Central African Republic; and (d) located in AFRO (Benin). These are indications of multiple challenges in the field offices that impact on WHO’s readiness for full compliance with IPSAS in 2017. 63. We also noted that certain Discoverer reports do not provide the correct information on assets. Management explained that reports should be extracted directly from Oracle. One standard Oracle reporting tool (Cost Summary Report and Reserve Summary Report) is a reliable option to obtain financial data and to conduct accurately the monthly and year-end closure process. We noted, however, that the output was only available in text format and may require manual inputs for flexibility of use during analysis. Annex A70/43 21 64. We recommended that WHO strive to attain complete and accurate tracking and reporting of items of PP&E at both the regional and the country levels, particularly in the African Region, to ensure full compliance with IPSAS. 65. We further recommended that WHO introduce a more reliable tool for monitoring and tracking asset data and enhance the functionality of the existing Oracle financial reports for PP&E to ensure compliance with IPSAS. 1.8.2 Financial reporting after end of transitional provision under IPSAS 17 66. In 2012, WHO reported Buildings and Land in its financial statements and took advantage of the five-year transition period under IPSAS 17 before recognizing entire asset classes in 2017. 67. According to WHO’s PP&E Transitional Provision document, an item of PP&E will be capitalized if it has remaining useful life as at 1 January 2017. Assets that are fully depreciated but still serviceable or in use will not be considered for the purposes of establishing the 2107 PP&E opening balance. Management also informed us that the opening balance includes an additional 14% which is an estimate envisioned to cover the directly attributable costs of bringing the asset to the location and condition for use. 68. We maintain that recognition of item of PP&E for 2017 shall conform with the requirement of paragraph 14 of IPSAS 17 and WHO’s IPSAS Manual that the cost of an item of PP&E shall be recognized if, and only if, it is probable that future economic benefits or service potential associated with the item will flow to the entity and the cost or fair value of the item can be measuredly reliably. An item of PP&E which is fully depreciated but still in use should be recognized and reported in the financial statements mainly due to the service potential and economic benefit that it will still bring to WHO until it is derecognized. In addition, entities are encouraged to disclose the number of items or the gross carrying amount of any fully depreciated PP&E that is still in use pursuant to paragraph 94.(b) of IPSAS 17. 69. Management informed us that actual incidental costs in bringing the asset to use could not be added to the acquisition cost but a system solution was put in place in October 2016 to account for the 14% addition for all asset acquisitions where incidental costs are not included in the purchase cost. This rate is, however, lower than the standard 15% used by GSC in encumbering funds for Packaging and Freight and will impact on the total acquisition cost of an asset. 70. We recommended that WHO adhere to the recognition principle under paragraph 14 of IPSAS 17 and also the disclosure requirement under paragraph 94.(b) of IPSAS 17 on the carrying amount of fully depreciated PP&E still in use, upon the recognition of remaining asset classes after the transition period. 71. We further recommended that WHO disclose in the Notes to the financial statements pursuant to paragraph 30.(b) of IPSAS 17 the use of a standard rate for the incidental costs in the acquisition of PP&E and update the said rate, to approximate the directly attributable costs in bringing the asset to the location and the condition for its use. A70/43 Annex 22 2. GOVERNANCE MATTERS 72. In line with our mandate to make observations with respect to the efficiency of the financial procedures, the accounting system, the internal financial controls and, in general, the management and operations of the Organization pursuant to Regulation 14.3 of the WHO Financial Regulations, we reviewed the internal controls implemented in key areas of operations in Africa and in two offices at headquarters. We also reviewed the information and communication technology governance, WHO Procurement Strategy delivery and risk management. Value-adding recommendations were communicated and discussed with Management to help enhance efficient and effective management of the Organization. 2.1 Management controls 73. WHO’s system of internal control is designed to ultimately provide assurance to its Member States and contributors that: (a) it is achieving its results and objectives; and (b) it is complying with legal, statutory and regulatory requirements among others. Its Internal Control Framework is expected to also allow it to have smarter controls to enable the use of its resources more effectively and efficiently. WHO specifically adheres to the objective of identifying risks and developing effective strategies and procedures to control or manage them. These organizational aspirations are expected to strengthen its ways of working to achieve the expected results, accountability and stewardship of resources. 74. In view of the issuance of a Statement of Internal Control by the Organization, it is vital that management controls are in order and that these are operating as expected. During the year, we reviewed the operation of WHO’s front line controls, its recognized first line of defence for the effective control of its operations, as these are installed and manifested across several critical processes in selected offices. Our tests centred on determining the level of effectiveness of these management controls and the opportunities for process improvements across management layers. Specifically, we have reviewed management controls as these are carried out in several critical management processes in the WHO Regional Office for Africa, the IST for Eastern and Southern Africa, and the country offices in Zimbabwe, the Central African Republic, Uganda, Benin and Mozambique. We also reviewed the said controls in two headquarters offices, namely IMT and the NMH Cluster. 75. In general, our review found notable developments towards improving operational efficiency and effectiveness such as the requirement on the Accountability Compact; the use of the Internal Control Self-Assessment Checklist; the commencement of the Transformation Agenda of the WHO Secretariat in the African Region; the introduction of key performance indicators as a measurement tool to help the Organization define and measure its progress; the establishment of a Compliance and Risk Management Committee (CRMC) through AFRO’s Accountability and Internal Control Strengthening Project; and the introduction of DFC Accountability and Assurance (DAA) activities. However, we still determined several control gaps, as presented in the succeeding paragraphs. 2.1.1 Cash management 76. In four of the country offices we visited, we noted non-segregation of incompatible functions over the custodianship and record-keeping of cash. While there were compensating controls of the WHO Representative (WR) being responsible overall, this should be avoided wherever possible. In two country offices, we also noted excessive balance of cash over the required imprest ceiling. In one Annex A70/43 23 country office, the required surprise cash counts were not regularly performed and the cash custodian was not properly designated to perform the function. 2.1.2 Direct financial cooperation 77. We observed delays in the submission of DFC reports and non-completion of documentary requirements for DFC projects. Inadequate review and approval procedures prior to the release of DFC funds were also noted. On-site and spot monitoring and post-facto assurance activities need to be strengthened. Moreover, we noted that there were incidents of non-compliance by the implementing partner with the existing SOPs on completeness of proposals. A comprehensive discussion of this area is presented among the observations on financial matters. 2.1.3 Direct implementation 78. Overdue and delayed submissions of DI reports were observed to be still evident in the African Region. There were DI projects which were not implemented as scheduled. It was also noted that there were ineligible expenses charged against the DI funds which impacts on the implementation of the project. There were also lapses in providing appropriate justification on the use of the DI scheme. The review of reports as well as the monitoring of the DI implementation also needs to be enhanced. A comprehensive discussion of this area is also included in the section of this report on financial matters. 2.1.4 Human resource management 79. Across the African Region, there were observed delays in submissions to the Electronic Performance Management and Development System (ePMDS) and/or non-compliance with ePMDS requirements and the non-alignment of objectives with the SMART objective criteria. There is also need to (a) intensify efforts to perform appraisals of staff performance to inculcate a culture of enhanced accountability by individuals and teams through improved compliance with the submission of staff performance evaluations; and (b) enhance the SMART objectives criteria of the ePMDS in order to ensure clarity of individual commitments, quantified outputs and performance standards as a basis for an appropriate performance evaluation. 80. In IMT, we noted that performance objectives in the ePMDS were not measurable and time-bound thus were not formulated in a SMART manner. The Within-Grade Increase (WIGI) in IMT was granted without the required basis as provided in the ePMDS+ which runs contrary to the WIGI policy. In addition, career management training opportunities were not taken advantage of and some IMT staff attended training sessions that are not aligned with their needs or have not undergone training at all. 81. In the NMH Cluster, we observed that there is a need for sufficient and appropriate control particularly in the form of monitoring and review of the recruitment and selection processes. With regard to performance management, there were noted delays in the submission of the ePMDS+ particularly during the mid-year cycle. Moreover, performance objectives were observed to be not measurable and time-bound thus not meeting the SMART criteria. We also noted that the WIGI is not in accordance with the pertinent policy thus requires tighter and uniform application across the Cluster. A70/43 Annex 24 2.1.5 Donor reporting 82. We observed that the incidence of overdue donor reports continue to persist in the African Region. As at 31 December 2016, there were 118 overdue reports, or 18% of the total global overdue reports of 659. A significant decrease on overdue reports was however noted due to the implementation of a monitoring control and intervention by top Management. 83. In the NMH Cluster, we also noted occurrence of delayed delivery of the required donor reports despite several monitoring mechanisms instituted by the Department of Finance (FNM). The Cluster has 23 overdue reports as at 31 December 2016, or 3% (23/659) of the total global overdue reports. 2.1.6 Travel management 84. Perennial issues on the ineffectiveness of controls over travel within the African Region still exist, namely: non-preparation of travel plans; delayed and/or non-compliance with the existing rules on the approval of travel requests; non-submission if not delayed submission of required travel reports; and improper creation of travel claims in the GSM travel module. In IMT, we observed that the travel details or travel plans were not updated on a quarterly basis and not approved by the Project Manager. Non-observance of the required ten-day gap between travel request approval and actual travel, were noted to be a common occurrence. 2.1.7 Procurement management 85. We observed lapses in the preparation of procurement plans in some offices in the African Region. Likewise, the required procurement documents for certain procurement transactions were noted to have not been uploaded in ECM. 86. In IMT, we noted that the mandatory and vital clearance by the Office of the Legal Counsel (LEG) was not uploaded in GSM to support Non-Grant Letter of Agreement (LOA) contracts. In the same vein, there were erroneous classifications of Non-Grant LOAs which were recorded as Grant LOAs. In the NMH Cluster, our review revealed that some Grant LOAs have no supporting documentation for technical assessment, screening results and selection memorandum, contrary to SOP XVI 003. 2.1.8 Asset and iInventory management 87. In the African Region, gaps in the management of assets were noted such as the non-conduct of or incomplete verification of assets, the non-issuance of declarations of receipt, the inclusion of non-reportable items and non-inclusion of reportable items in the FAR, the non-disposal or delayed disposal of obsolete and unserviceable assets, and the late submission of the annual fixed asset certificate. 88. In the same Region, we noted inadequacies in the recording of inventory movements as well as the performance of incompatible functions. We also observed the absence of information on the cost and expiry dates of a number of inventory items as well as the presence of undisposed expired medicines. 89. In IMT, we noted that there were no available Department guidelines that define accountability, custodianship and safeguarding of IT assets while these are in its custody for ongoing configuration. Annex A70/43 25 90. We issued Management Letters to convey the results of our audit of the offices in Africa, IMT and the NMH Cluster. The Management Letters contained the audit recommendations to mitigate operational risks and address the deficiencies noted in audit which were mostly accepted and implemented by Management. We noted however, that the deficiencies were recurring and common to the offices visited. 91. The Statement of Internal Control (SIC) pronounces the accountability of the Director-General over the administration and implementation of WHO Programmes. Also, accompanying the Statement is the declaration that internal control is a key role of Management and an integral part of the overall process of managing WHO’s operations. Essentially, what is brought forward in the SIC is the value that internal control brings into the operational and managerial decisions of the Organization. It is therefore vital for WHO to maximize its efforts in ensuring that the internal controls are put in place to manage its risks. 92. The WHO Internal Control Framework prescribes the responsibilities and accountabilities of the following officers: (a) Regional Directors – ensuring that Heads of WHO country offices are complying with internal control policies and procedures and identifying and addressing known and significant internal control weaknesses; (b) Assistant Directors-General – ensuring that action is taken to address known and significant internal control weaknesses in their respective cluster and implementing in the cluster the specific internal control policies and procedures delegated to them by the Director-General; and (c) WHO Representatives – implementation in the country office the specific internal control policies and procedures, ensuring compliance with internal management policies and procedures such as policies and procedures for procurement and asset management, travel, human resources and financial resources, and identifying and addressing known and significant internal control weaknesses and risks. 93. We therefore see the need for the African Region as well as IMT and the NMH Cluster to further enhance and strengthen their system of internal control and make it function more effectively to ensure that their operating objectives are met without material impediments. In maintaining a sound system of internal control, Management needs to regularly assure that appropriate control processes are functioning effectively to manage related risks to which the Organization is exposed and reduce these to acceptably low level. A deeper sense of accountability and responsibility should thus be impressed upon all staff members as the Organization proceeds to address the control gaps and weaknesses noted in our audit. Management should set a clear tone-at-the-top on the effective delivery of control responsibilities to provide higher level of assurance on the Statement of Internal Control that it has issued. 94. We recommended that WHO leverage on its existing Internal Control Framework and policy to further the effectiveness of monitoring the embedded management controls across operational processes, and maximize the value offered by its internal governance mechanism for internal control through closer guidance to ensure a high level of assurance on the Statement of Internal Control appended to its financial statements. A70/43 Annex 26 2.2 Managing information technology 95. Essentially, information technology governance refers to the overall organizational information technology capacity building undertaken by the executive management or the Information Technology Board to effectively control the development and delivery of an information technology strategy in support of the overall business of an entity. In August 2016, IMT’s planned portfolio of initiatives received the Organization’s support to establish the Global IT Fund as proposed by the Department. It was projected that funds would be released in September 2016. The Department envisioned an initial funding requirement of USD 28.22 million for the current biennium and a total of USD 80.02 million spread across the three biennia. 96. The significant challenge to IMT in achieving its new vision of being a strategic enabler of WHO, is the establishment and institutionalization of an official blueprint of a well-defined Organization-wide technology direction that is aligned to the strategic organizational goals and objectives. This governance blueprint should be supported by a structured IT governance framework that can pave the way for critical processes at the subunit level, to function as intended. While IMT had demonstrated substantial efforts in putting in place systems and procedures to improve its overall governance, such should be made more stable. When IT governance mechanisms become established, the Department can expect excellent synergies along the broad spectrum of operational processes. 2.2.1 Strategic and operational planning – absence of a concrete and stable IT Strategic Plan 97. The use of information technology is considered by the Organization as a key enabling function in its global operations as it will enable the Organization to deliver high quality information management services and technology to all offices across the globe. This vision is clearly declared in IMT’s proposal for a Global IT Fund along four key result areas. Relative to that vision, we determined that IMT has no documented and formal IT Strategic Plan. Instead, we were furnished with the PowerPoint presentation on the Update on the IT strategic plan that is anchored on the major IT initiatives currently in the pipeline. In its current state, the document cannot be considered as a complete official document intended to ensure the delivery of core initiatives, manage constraints and provide long term overall direction to IMT. 98. We observed that the PowerPoint presentation on Update on the IT strategic plan was drawn from several documents such as: document EBPBAC21/3; the strategy on a map (balanced scorecard) slide; a presentation on WHO’s IT vision, mission, strategy and tactics; and the Global IT Fund document. Our examination of such documents disclosed fragmented IT strategies, a “siloed” strategic planning process and an unstable overall strategic direction. As such, we determined that the Update on the IT strategic plan does not show clear alignment with the overall business strategy when viewed from the standpoint of IT solutions/initiatives that are still ongoing and which are intended to improve efficiency of business processes. This can be attributed to the absence of a formal IT governance structure where accountabilities for non-performance are lodged. 99. We further observed that the direct and indirect effects of the absence of a formal and concrete WHO IT Strategic Plan had already manifested in all three constraint areas of project management, i.e., Scope, Time and Resources. In the analysis of the GSMT deliveries for Wave 1, we determined that: (a) none of the seven initial GSMT initiatives started in 2015 were delivered on the original target dates; (b) all project initiatives were revised in terms of time delivery due to significant scope changes; (c) the funding of all initiatives affected by significant scope changes was revised; (d) there are ongoing initiatives including those already started and finished that have unclear support from the Update on the IT strategic plan (PowerPoint presentation); and (e) due to the number of initiatives Annex A70/43 27 currently under development, the timelines for Wave 1 (March 2015–February 2016) and Wave 2 (March 2016–March 2017) had been revised to only Wave 1 (March 2015–March 2017), indicating that the entire timeline of the GSMT Project is already affected by the incoherent business strategic direction. 100. The critical need for a well-crafted IT Strategic Plan is further highlighted by the Global IT Fund proposal that includes IMT’s long-term strategic goals from 2016 to 2021. These goals encompass the IT initiatives relative to the key result areas it intends to pursue. These strategic pieces of information are supposed to be fed into WHO’s IT Strategic Plan to clarify the Department’s contribution to organizational decisions, which eventually fulfils the vision of making information technology a strategic enabler of the Organization. It is therefore vital that the IMT Strategic Goals are formally defined and aligned with WHO’s Strategic Objectives through an IT Strategic Plan to enhance accountability and managerial investment decisions that will, in turn, guarantee the achievement of the Department’s vision. 101. We recommended that WHO: (a) develop a concrete and formal IT Strategic Plan with a definite time frame as the product of an institutionalized strategic planning process to provide shared direction for all initiatives to be developed and for those currently under way; (b) see to it that the IT Strategic Plan contains the minimum requirements which include IT strategic directions and guiding principles, goals and objectives, key performance metrics, IT investments, and delivery milestones; and (c) ensure that the delivery and prioritization of core business solutions through the employment of dedicated resources and the management of constraints are based on formally-established strategies. 2.2.2 Overall organization and accountability – lack of formal roles responsibilities and performance management framework 102. We noted that WHO does recognize that, in the management of its Global IT Fund, an IT governance structure must be put in place where layers of accountability and responsibility are identified and spread across a three-tiered structure composed of the Global Policy Group, the IT Board and the IT Leadership Team. We also observed that several IMT initiatives are already under way. IMT however, informed us that there is no formal document covering the creation of the IT Board and the IT Leadership Team. Instead, we were provided with presentation slides used in the IT Leadership Forum it hosted in March 2016. 103. Another governance mechanism that is material to the overall delivery of information technology within the Organization is the IT performance management framework. It surfaced in our perusal of IMT’s Performance Metrics that the framework is differently labelled as IT Strategy map for 2015–2017, which is still in raw draft form and does not contain the essentials of good measurable performance indicators relevant to the specific IT processes. We view IT performance metrics as a critical generator of information that are fed into decision tables; thus, the information has to be of the utmost integrity. Further, we determined that the roles of the CIO sitting on both the IT Board and in the IT Leadership Team need to be clarified or even revised to avoid bias, such as in the review of his own work as defined in the responsibilities of the IT Leadership Team. Ideally, this layer of accountability in the IT governance structure is composed of advisory committees that provide inputs A70/43 Annex 28 to the IT governance committee or its equivalent, on areas of IT decision domains like project implementation, IT investments, infrastructure, and IT policies and standards for good governance. 104. For the initiative to be effective, the programmed IT transformation must be supported also by formal policies creating the Transformation Steering Committee and Initiative Project Board owing to the critical function of both governance layers. While the governance roles and the accountable parties are already identified, the authority for these parties to perform their assigned roles must be based on a concrete accountability document. This governance requirement is highlighted in document A68/52 (Report of the Programme, Budget and Administration Committee of the Executive Board to the Sixty-eighth World Health Assembly), which called for the need to sustain a strong culture of accountability. 105. While we recognize the vigorous efforts of IMT in pursuing its new mandate, the formalization of its authority across the IT governance continuum deserves to be afforded with utmost priority because a well-defined and concrete authority can spell the difference between the success and the failure of this global endeavour. The absence of a formal document that clearly identifies the specific WHO officers comprising both IT governance groups with their specific roles and responsibilities makes the reporting lines and relationships amongst the three governance layers unclear. This will eventually render their authority to act less effective. 106. Within a very dynamic and fast-changing technological environment and the organizational dependency on information technology to deliver services effectively, there is inherently a big risk of failure if the investment on technology is not supported with the most appropriate structure for exacting accountability and managing risks and performance. 107. We recommended that WHO: (a) formalize the creation of the WHO IT Board, with clear roles and responsibilities, to provide an oversight function over IT projects from a cross-functional perspective and to ensure that the IT strategy is aligned with the strategic goals of the Organization; (b) establish the IT Performance Management Framework including IT performance metrics to allow for the proper measurement of the quality of IT services and provide effective information for decision-making; (c) redefine the GSMT Project governance structure to provide clearer roles and functions as a basis for the composition of the members of the Steering Committee and Project Board. 2.2.3 Risk management – need to improve on risk contextualization and analysis 108. We noted that IMT has a Risk Register that is prepared based on Executive Board document EB133/10 (Corporate risk register: Organization-wide strategic risk management in WHO) and the November 2015 Corporate Risk Management Policy. IMT also represented that the formulation of the Risk Register started in around 2010 and involved a consultative process via workshops by the former Information Technology and Telecommunications (ITT) managers in the regional offices. IMT, however, did not present to us concrete documentation used as the basis for the preparation of its 2016 Risk Register. Instead, we were provided with a copy of a PowerPoint presentation delivered during the Global ICT Leadership Team meeting last June 2012 where Risk Management was on the agenda of the event. It was also emphasized by the Department that the Compliance, Risk Management and Annex A70/43 29 Ethics Office (CRE) had provided the Department with technical assistance through training and orientation that helped facilitate the preparation of the most current Risk Register of the Department. 109. Upon consideration of IMT’s representation, we examined the entries in the 2016 IMT Risk Register and noted several misalignments. We observed that some risks identified do not relate directly to the recognized risk factors. In most cases, the root causes of the risks are not identified. Further, we noted that some mitigation actions do not directly relate to the risks being managed and, in some instances, the risk response to a specific risk is too broad to warrant the application of an effective risk management strategy. We also observed one instance where the risk number is labelled as new, but it is not clear as to the date of its identification. 110. It appears that IMT risks reflected in its Risk Register are not complete and updated. The gaps that we noted exhibit arbitrary identification of risks that is not based on a proper context and the right IT risk topology where risks inherent and unique to information technology are included. The non-identification of risks in the IMT Risk Register relating to some slippages in the delivery of the GSMT Project proves that the Register is not updated. IMT’s risk topology should ideally be crafted based on the defined key result areas to bring risk management within the Department closer to its defined goals and strategic objectives. 111. The critical nature of a risk management exercise is always underlined by a risk management philosophy where a risk that is not identified is a risk that is not managed at all. Generic activities involving the contextualization of risk management within any organization involve the setting of criteria against which risks will be assessed. In essence, these contextualization requirements will enable IMT managers and staff to identify the critical factors that can give rise to risks specifically from an IT operations perspective and particularly those that impact on the defined goals of the Department. For risk management within IMT to mature, these activities must not be overlooked. 112. We recommended that WHO enhance its risk identification activities by infusing better root cause analysis of the identified risks to avoid assumptions and logic traps and ensure that remediation strategies result in the application of more effective risk controls within the appropriate context. 2.2.4 IMT structure and organization – unclear reporting lines and jurisdiction 113. Supporting the reorganization of an IT unit are assigned roles and responsibilities that specify the functions related to operations, security, applications development and maintenance, and technical support for network and systems administration. Clearly defined, contextualized and communicated roles and responsibilities are important organizational parameters that must be clearly articulated to all employees so that reporting hierarchies, authorities, responsibilities and accountabilities support decisions. Job descriptions, RACI (Responsible, Accountable, Consulted, Informed) charts and swim lane workflow diagrams provide the IT department employees with a more complete and clear direction regarding roles and responsibilities. 114. Taking into account the rationale for IMT’s transformation in the preceding paragraphs, we noted that the document Reform of Information Technology – A new IT organization to become Strategic Enablers for WHO dated September 2015 defines the proposed structural changes of the Department. To support the reform proposal, we also took note of the document dated January 2016 that approved the reorganization of IMT, and the Information Note dated 30 March 2016 that listed the newly created units with a brief description of their functions and responsibilities. A70/43 Annex 30 2.2.4.1 On the creation of the GSMT vis-à-vis the existing PMO function 115. We noted that the PMO is not directly involved in the GSMT Project, as this has been delegated to another unit created within IMT to specifically deliver a simplified GSM platform. IMT informed us that the GSMT Project under the leadership of the CIO is perfectly aligned with the PMO function. We point out, however, that the argument is not in the involvement of the CIO in the GSMT Project, but rather on the PMO and its role in managing the delays in the delivery of the initiatives. The observed delays in the delivery of all initiatives under Wave 1 are attributed to the limited involvement of the PMO in the GSMT Project. 116. Thus, the function of the PMO is not optimally leveraged due to its limited engagement with the GSMT Project and the additional costs that are incurred from the creation of a separate unit that handles the GSMT Project. Given the ad hoc nature of the Project and the present capabilities of the current PMO, it is clear that the Project can be more effectively managed at the level of the PMO unit. The critical nature of Project Management as a discipline lies in the application of knowledge, skills, tools and techniques to a broad range of activities to achieve a stated objective such as meeting the defined user requirements, budget and deadlines for an IT or any other project. In IMT, a major function of the PMO is to provide project management services for any major WHO project and ensure that projects are delivered according to expectations and within the agreed constraints of scope, time and resources. 117. In alignment with WHO’s accountability and internal control standards and value propositions, it is best for any unit within the Organization to be appropriately streamlined in terms of roles and responsibilities having in mind cost effectiveness. The functions cannot simply be ceded to any other unit in view of PMO’s clear jurisdiction over the project. To this end, better clarity of roles, responsibilities and authorities should be established between the GSMT Project and the PMO whose functions must take precedence over the other. Transition strategies have to be adopted for the change. 118. We recommended that WHO ensure that the PMO bear responsibility for all major projects or initiatives of IMT to include the GSMT Project, to guarantee a more streamlined and authoritative delivery of the mandated function, and make the prescribed accountabilities and responsibilities more stable which may eventually result to more effective governance and project quality assurance process. 2.2.4.2 Function of the Chief Information Security Officer 119. As early as November 2005, WHO already recognized and we noted the important role of the CISO as disclosed in the implementing guidelines of the Global Information Security Policy, marked as having been approved by the Director-General on 2 November 2005, where significant responsibilities of the CISO were articulated such as the regular assessment of global risks to WHO information assets to ensure that the Organization’s risk profile is accurate and risk is minimized. In essence, the function of the CISO in the Enterprise Architecture and Security unit (EAS) is misplaced since information security has a “cross-cutting and pervasive” role not only within IMT but across the Organization. 120. According to ISO/IEC 27002, Information technology – Security techniques – Code of practice for information security controls, a CISO should be responsible for taking the lead on information governance as a whole by (a) providing the overall strategic direction and the support and review necessary to ensure that information assets are identified and suitably protected throughout Organization; and (b) appointing and managing the information security and its team. The 2011 Annex A70/43 31 Annual Information Security Survey by Price Waterhouse Coopers (PWC) disclosed that 80% of businesses had a CISO or equivalent. In addition, about one third of the Security Chiefs report to a CISO, about one third reported to a Chief Executive Officer (CEO), and about one third reported to a Board of Directors. 121. The recognition by IMT of the CISO as being of the same position level as the EAS manager suggests that these two positions should report directly to the CIO. As co-equal positions being held by two separate individuals, the CISO cannot be under the EAS manager. The discharge by the CISO of his functions should not be obstructed or hampered by an obligation to report directly to another managerial layer apart from the CIO. The implementing guidelines of the Global Information Security Policy support this argument, which also aligns with the accountability requirements of the Organization. The recommended reporting line is practiced by other UN organizations. As one of IMT’s key result areas, the responsibility to ensure information security is primarily lodged with the CISO but his current placement within the IMT structure does not complement this. 122. We recommended that WHO recognize the pervasive and cross-cutting role of the CISO position, streamline the pertinent reporting lines and authority, and make the CISO report directly to the CIO to enhance information security service efficiency, and maintain a healthier posture of the Organization`s information assets. 2.2.5 Service delivery and measurement – absence and/or informal documentation of control frameworks 123. Service delivery and measurement is about proactively managing IT spending and measuring the resulting value which increases the likelihood of greater returns from IT investments. The existence of control frameworks creates an organizational environment in which people think and act for themselves, yet collaborate to achieve common goals and objectives. It also provides the structure needed to implement key performance management, compliance management and IT resource management policies. The convergence of all of these IT managerial components results in a well-designed IT control environment. 124. Our review of the IT operations component of its governance centred on several control frameworks that support application deployment to internal and external users, including the network infrastructure, device management, computer operations and help desk services. We observed that: (a) The Information Technology Enterprise Architecture Principles Version 0.8 22-02-2016 and Enterprise Charter ver.0 are still in draft form; (b) The outsourcing management strategy, policy and guidelines are still under conceptualization, but IMT has already entered into a significant number of outsourcing arrangements; (c) There are no guidelines as to the classification of IT critical assets although an information classification policy exists; (d) A cyber security road map for WHO dated June 2016, which aims to provide and develop secure and resilient information services which enable and advance WHO’s mission, is now completed but its implementation is still to be funded; and A70/43 Annex 32 (e) There are no documented or formally identified performance metrics in place, except for IT support, particularly in respect of IT Help desk services management where key performance indicators are clearly defined. 125. The current efforts by IMT in crafting the needed frameworks for the different aspects of IT management deserve recognition. The existing frameworks in draft and unapproved form, however, do not command authority as a guide to the staff in the performance of their day-to-day functions. Thus the urgency of establishing these control frameworks should be given the utmost attention since the Department is exposed to risk of non-alignment of the IT function with the Organization’s goals and objectives. 126. We recommended that WHO formalize the control frameworks on the critical processes of IT management, giving priority to: (i) outsourcing arrangements; (ii) criteria for the classification of critical IT assets; and (iii) the IT Performance Management Framework, and ensure that these control frameworks are documented and shared across the Organization for effective management and monitoring. Also, align the control frameworks with the risk identification activities that need to be enhanced focusing on the defined key result areas. 2.3 Managing the WHO Procurement Strategy 2.3.1 Delivery of the 2015 WHO Procurement Strategy 127. Driven by the view that WHO’s procurement function is both complex and wide-ranging in scope and buoyed by the risks and challenges brought to fore by internal assessments and external oversight bodies, the Organization’s Procurement Strategy of 2015 aims to crystalize a vision and mission for its procurement function. The Strategy defines the necessary key outputs for realizing it with a corresponding time frame for implementation. As a critical function in support of the effective discharge of its mandate, WHO understands how this function is evolving and why its procurement operations for goods and services need to be steered under a new and enhanced Procurement Strategy. 128. For the Strategy to be appropriately carried out, however, it has to align to widely-recognized principles on strategy implementation and execution. Identifying a common ground for the Strategy to take foothold is primordial, as is recognizing the importance of coordination and communication, and of its flowing out of the leadership into the whole Organization. All of these require a good amount of strategic mapping of implementation tactics to ensure that the Strategy to be implemented will pave the way for its effective execution. Delivering a strategy also requires that appropriate implementation and execution mechanisms are put in place bearing in mind that there ought to be a plan to implement the strategy. i. Challenges in the overall implementation of the Strategy 129. We determined that WHO has a documented plan to implement its Procurement Strategy set out in two parts, called Procurement Strategy Implementation Plan Phase 1 and Procurement Strategy Implementation Plan Phase 2, which is a translation of the three pillars of the Strategy into activities. CPC informed us that the rationale to split the implementation plan into two parts was purely managerial, as there was no capacity to do all at once. In terms of progress monitoring, CPC informed us that one overall Procurement Strategy implementation schedule is being used, which combines all activities identified in “part 1” and “part 2”. With such a complex undertaking, we determined that a strategy to implement the Strategy needs to be effectively designed to warrant unimpeded delivery. Annex A70/43 33 130. With respect to the implementation of Phase 1, we noted that it is planned to be delivered at the end of 2017. We observed however, that while various Phase 1 tasks were undertaken for each of the activities, other tasks to complete the activities were not done within the Phase and had spilled over to Phase 2, as shown in the latest implementation plan provided by CPC. Activities such as the transfer to HR of non-staff service procurements were put on hold with no target date. The modification of the procurement module in GSM under various tasks is still to be started. 131. In the case of Phase 2 implementation, 14 activities were originally programmed to be carried out. Closer examination of the activities disclosed that while Phase 2 is also supposed to be delivered by the end of 2017, six activities are planned to flow into 2018, two of which will move to 2019. Of the 14 planned Phase 2 activities, 12 are noted to be ongoing while contract management implementation is still waiting for the related policy, and the completion of vendor management implementation is expected to rely on the modification of the procurement module in GSM. 132. With respect to the updated implementation plan for the Procurement Strategy, we observed that two Phase 1 activities had actually been delivered though not provided with timelines in the original implementation plan. These activities are to provide the backbone of the succeeding activities in the two phases and material time was inputted into the tasks within these activities. Further, we noted that the status of several activities indicated strong dependencies on the United Nations Global Marketplace (UNGM), the availability of staff, and on the actions of IMT, the Planning, Resource Coordination and Performance Monitoring Department (PRP) and the Department of Human Resources Management (HRD). We also observed that almost all of the planned end dates of the policy frameworks are either too close to the end date of the procurement handbook preparation or scheduled to be completed after the end date of thereof. These timing milestones do not provide effective support to the preparation of the handbook in as much as it is dependent to a large extent and in a logical way on the policies to be produced. 133. Based on the foregoing, we determined that: (a) The assumptions made at the initial preparation of the implementation plan for Phases 1 and 2 of the Procurement Strategy allowed flexibility that weakened accountabilities in meeting expectations as evidenced by the spill-over of activities and scope creeps; (b) The dependencies with HRD, PRP and IMT defined in the implementation plan, including the milestones, are not adequately covered and do not reflect the realities, resulting in the protraction of activities thus requiring closer coordination; (c) The tight timelines do not provide enough room for the testing of new processes, and the sequencing of tasks under a planned activity does not warrant the execution of certain tasks owing to the ineffective coordination of milestones and deliverables; and (d) The achievement of “quick wins” in the implementation and execution of the Strategy necessitated adjustments to the implementation plan so that prioritization in the delivery of planned products now becomes inevitable making the implementation more complex and requiring more coordination activities. 134. Thus, optimizing business decisions is always dependent on the appropriate control in project implementation. The implementation of the WHO Procurement Strategy of 2015, a project in itself, has to be viewed and operated within an environment where controls, accountabilities and risk management are in unison. While there is a chance that the Strategy will be delivered within 2017, A70/43 Annex 34 such cannot still be viewed as an outright success with some activities expected to be delivered beyond 2017. Establishing the Strategy rhythm where focus on the big picture is needed at all times to keep the implementation moving smoothly deserves more attention. Implementation strategies and tactics have to be put in place to arrest vulnerabilities to extensions, longer turnarounds, and uncoordinated activities. 135. We recommended that WHO enhance the plan for the implementation and execution of the WHO Procurement Strategy to minimize the gap between planned versus actual activities by: (i) managing more effectively risks relating to delays and undelivered products; (ii) prioritizing better its deliverables through a more logical sequencing of activities giving consideration to tight timelines and the complexities of planned products; and (iii) allowing more time for coordination activities and closer engagements covering internal dependencies and to factor in their requirements into the whole implementation plan. ii. Need to prioritize the procurement planning policy 136. As a driver of expenditure, the decision on what, when and from what source to buy needs an effective policy. In terms of cost management, a procurement plan adds stability to the information base for management decisions although it is made up of estimates and does not guarantee a high level of accuracy at all times. Procurement planning influences managerial decisions. It can be recalled that in 2012, we raised an audit observation on the existence of expired medicines in various WHO warehouses across the globe involving an amount over USD 12 million in just one warehouse. Our examination of the issue led us to conclude that an ineffective procurement planning decision was one of the primary root causes. This also gave rise to a collateral issue on the cost of disposal of these expired medicines. 137. The delivery of the WHO Procurement Strategy, particularly Pillar 2, answers now the issue on cost-effectiveness and recognizes that an enhanced planning effort and a close assessment of the level of risks and financial exposure linked to the various products are expected to help manage the Organization in making its procurement practices cost-effective. The importance of procurement planning is also highlighted in the draft procurement planning SOP indicating that the ultimate goal of procurement planning is to pursue a coordinated and integrated action to fulfil a need for goods in a timely manner and at a reasonable cost and that the Organization must ensure that effective procurement planning is in place at the corporate, regional and country levels. 138. We noted that CPC had already prepared an Excel sheet to capture the data that will support procurement planning although we did not observe any indication that a policy framework on procurement planning is upcoming based on the updated Strategy implementation plan. CPC had informed us that the template for the procurement plan had been prepared for distribution. Our review of the procurement planning template, however, indicated that such still needs inclusion of more vital information for better decisions such as data on planned delivery dates and milestones, adherence to specific regulatory frameworks, sourcing from specific groups of suppliers and use of specific brands. 139. Further, we determined that related necessary guidelines and learning tools will still have to be formulated involving several actors including PRP, Directors of Administration and Finance (DAFs), Procurement Officers, Management Officers, GSC and CPC. As of date, we noted that two related activities have already been delivered: (a) review and analysis of procurement planning practices used in major offices, and (b) the definition of the best implementation planning process throughout the Organization. A draft SOP for goods procurement planning is already available, although it lays out procedures only for requisitioning, planning and general requirements of the Corporate Procurement Annex A70/43 35 Plan, which in our view still needs more enhancements. In support of Pillar 2, we also noted that an expert committee will be formed and will be involved in the procurement service early in the programme design to increase product standardization, consolidate procurement plans and expand the number of prequalified products and suppliers. 140. While we recognize that procurement planning is highly dependent on other policies and arrangements which are also currently being delivered based on the Strategy, we observed that much still needs to be done in the pursuit of the Strategy. Mindful of the tight timelines and the nearing delivery deadlines, we highlight the following areas for improvement in procurement planning and the procurement plan: (a) inclusion in the Strategy implementation plan of the preparation of a policy framework on procurement planning to recognize accountabilities in the delivery of the Strategy and monitoring of accomplishments; (b) provision of better information quality and clarity in the draft SOP on procurement planning that is to be delivered; (c) enhancement of the procurement plan template giving due regard to information needs of the end-users apart from that of the other offices such as PRP and Global Procurement and Logistics (GPL) in GSC; (d) implementation of an effective strategy in the global practice of procurement planning including the conduct of pilot tests within the next nine months. 141. The management of scarce resources needs proper timing in the allocation of resources to users, addressing logistical difficulties and clearance for both local and international markets. These are heavily dependent on the level of effectiveness of procurement planning. Procurement planning, as an activity, can spell success or failure in achieving cost savings and efficiency. As one of the main vehicles for procurement cost management, procurement planning cannot take the back seat in procurement business process enhancements. Given the current state of the WHO Procurement Strategy, procurement planning must be given the needed attention in the roll out of the Strategy. 142. We recommended that WHO provide more focus in the delivery of the procurement planning component of the WHO Procurement Strategy through the prioritization of related policy formulation and the preparation of the specific procedures and accompanying templates to ensure the timely execution of planned procurement activities. iii. Recognition of emergency procurement in the Strategy 143. The strong correlation between Pillars 1 and 2 of the WHO Procurement Strategy is covered by policies that will control financial and reputational risks associated with procurement services, reduce costs and manage supply risk in the procurement of logistics through product category management. These basic objectives of the Strategy mainly hinge on the enabling policies and procedures particularly for emergency procurement. Fiscal statistics can justify the need to prioritize the policies for emergency procurement in WHO. Emergency procurement in the Organization was estimated at USD 88 million for 2016. Beyond the procurement statistics, WHO’s mandates, strategic goals and success with external engagements can never be achieved without systematic service and emergency procurement. A70/43 Annex 36 144. WHO’s leading role in emergencies has been documented and strengthened by Article 2 (d) of the WHO Constitution and several World Health Assembly resolutions. Its core commitments in emergency response are those actions which the Organization will always deliver and be accountable for during emergencies with public health consequences. The critical functions of the Organization defined in its draft Emergency Response Framework (ERF) for 2017 within the Incident Management System (IMS) involve the areas such as leadership, partner coordination, information and planning, health operations and technical expertise, operations support and logistics, and finance administration. In these areas, procurement is expected to drive important decisions particularly with the required immediate response by WHO that comes within 24 hours from the onset of the emergency. 145. The foregoing essential WHO roles, obligations and commitments however necessitate a robust procurement framework. Any weak link should be responded to. A unique policy within the Organization that is directly related to emergencies and which can have an impact on procurement activities is its “no regrets” policy. The results of our audit of Ebola activities showed that WHO entered into a Service Level Agreement with the World Food Programme (WFP) with the latter acting as Agent for WHO to arrange the procurement and transportation to Monrovia, Liberia for the construction of four Ebola treatment centres without the necessary clearance from LEG. The transaction necessitated a clear policy on entering into Letters of Agreement during emergencies taking into consideration the limited time available for the review of the provisions of the agreements without sacrificing timely response during emergencies, and without compromising the interests of WHO. While a policy framework on Long Term Agreements (LTAs) is to be included in the Strategy, the Strategy must also cover the policy for emergency procurement for better clarity of accountabilities and procedures. 146. We noted that the SOP on the emergency procurement of services, PRT.SOP.VI.056 dated June 2013, includes among others, APWs and Consultants with no distinction as to whether these are firms or individuals. In the same vein, the SOP on the emergency procurement of goods, PRT.SOP.VI.052 revised in May 2013, now requires alignments to the new WHO Procurement Strategy, given the various changes taking place within the Organization’s procurement function. With the implementation of the WHO Procurement Strategy, it is therefore vital to craft, align or update the existing SOPs related to emergency procurement, including related templates. The SOPs to be revised must be based on a policy framework for the procedures to be well-founded and established. 147. Our scrutiny however, of the WHO Procurement Strategy revealed that it does not indicate any planned activity that is obviously related to emergency procurement. Although CPC has already initiated the drafting of a supplemental section for procurement in the e-Manual, the formulation of a policy on emergency procurement must be recognized as a priority activity in its work programme. The completeness of WHO’s procurement policies will accelerate the implementation of the Strategy, thereby allowing the implementation of better and more effective control mechanism to deliver procurement expectations. This can lead to accelerated implementation of the procurement strategy and thus, the continuous improvement and support to the overall goal of business process excellence. 148. We recommended that WHO craft the emergency procurement policy framework including related SOPs to support the Organization’s emergency response and integrate them into the WHO Procurement Strategy’s implementation plan to enhance the control and monitoring of the delivery of related activities and tasks. Annex A70/43 37 2.4 Managing risks 149. When the WHO Corporate Risk Management Policy (CRMP) was adopted in November 2015, it was envisioned to improve the quality of management and to calibrate WHO internal controls in the context of continuous improvement of operational processes, instructions, guidance, tools, and management information systems. Since 2012, that vision had been expected to promote effective decision-making and improve delivery of results and embed it in operational processes as they relate to accountability and internal control mechanisms. The Organization issued the WHO Corporate Risk Management Policy to establish a systematic mechanism to support decision-making and complement the risk register exercise that has recently been completed across the Organization, giving emphasis on monitoring activities to improve the process across all management layers. 150. Within that context, risk management within the Organization is expected to have already created an obvious risk culture that crystalizes the Organization’s vision to identify risks and respond better and ensure that WHO understands and chooses the appropriate strategy to manage these risks. This organizational commitment should move risk management forward to achieve its intended benefit. In essence, risk management as a management tool need not be static. Its level of maturity must form part of the strategic opportunity to further improve and obtain more value from it. As a process, risk management consists of several activities where specific competencies must be developed to further its growth and value. Risk management maturity 151. Our review of risk management is geared towards helping the Organization identify improvement opportunities to further its risk culture as well as its maturity level. In our review of risk management activities within the NMH Cluster, AFRO, the IST for Eastern and Southern Africa and country offices in the Central African Republic, Zimbabwe, Uganda, Mozambique and Benin, we noted persistent gaps in (a) establishing the right risk management context, (b) alignment of risks identified to their identified root cases, and (c) resulting risk mitigation actions. The gaps that we observed exhibited the arbitrary identification of risks which was not based on a complete and clear context. The same observation was made in our assessment of the IMT Risk Register. One factor that could have influenced these gaps is the requirement under the WHO’s risk management instruction that Budget Centres are required to formulate and describe the risks they see in their daily operations on an intuitive basis. Risk identification has to be done beyond mere intuition. A process has to be properly installed. 152. We also noted that the country office in the Central African Republic was required by AFRO to prepare the Risk Register towards the end of the calendar year 2015. No competency training was, however, provided other than the brief introduction about the preparation of the Risk Register. They explained that the gaps noted in risk identification could also be attributed to the language barrier as the team involved in the preparation of the Risk Register was more fluent in French than in English, which was the language used in the Risk Management Guide and related policies. 153. The execution of risk management, as a management tool for effective decision-making, is always dependent on several factors and several key characteristics and provides information on the level of its maturity. Actions and information on risk management training, the proper definition of process to identify risks, the attribution of risks to certain processes, the review and selection of the most appropriate risk response, the monitoring of risk response implementation, and the assessment of managers on their risk management performance provide vital information on the overall level of risk management maturity within an entity. The gaps that we observed as explained in the preceding A70/43 Annex 38 paragraphs point towards the need for WHO to further cultivate risk management as an invaluable tool for decision-making. The most vital rationale is that WHO’s risk management maturity level has to progress to a level that will fully enable the internal controls to manage risks at all levels of the Organization. WHO therefore must now have a more robust risk management culture. 154. We recommended that WHO enhance further its monitoring activities in the execution of risk management process across all levels of management, primarily focusing on formal risk contextualization and identification; and consider assessing the Organization’s level of risk maturity to identify strategic opportunities for improvements. C. DISCLOSURES BY MANAGEMENT 155. Write-off of cash. Management reported that in accordance with section 13.6 of Financial Regulation XIII, a total of USD 328 434 was approved as write off in 2016. The amount is comprised of (i) USD 300 828 for salary advances, travel advances and missing pension contributions, mainly from former staff members from which recovery was deemed impossible; and (ii) USD 27 606 relating to supplier advances and credit memos where the balance was deemed impossible to recover. We noted that the appropriate procedures for the write off were observed. 156. Ex-gratia payment: There were ex-gratia payments made in 2016. 157. Administrative waivers: During 2016, two administrative waivers were approved – one for Sierra Leone (AFRO) for USD 390 951 and one for the Syrian Arab Republic (EMRO) for USD 14 003 – both of which were related to old and overdue DI and DFC reports, where reports were no longer possible to obtain from the Government. 158. Frauds and presumptive frauds: In accordance with International Standard on Auditing 240, we plan our audits of the financial statements so that there is reasonable expectation of identifying material misstatements and irregularity (including those resulting from fraud). Our audit however, should not be relied upon to identify all misstatements or irregularities. The primary responsibility for preventing and detecting fraud rests with Management. Management confirmed that there are no cases of fraud or presumptive fraud that they are aware of that impact on the financial statements. The Internal Auditor raises all cases of fraud in his report to the World Health Assembly. D. IMPLEMENTATION OF EXTERNAL AUDIT RECOMMENDATIONS 159. We validated the implementation of the external audit recommendations contained in prior years’ audit reports. We noted that, of the 41 recommendations, 36 (88%) have been implemented, 2 (5%) were closed as they were updated and included in this report while 3 (7%) are still in progress of implementation. The status of the three recommendations which are in progress will be validated and reported in the next financial reporting period. The expected dates of implementation are provided by Management. Annex A presents the detailed analysis of the implementation of the recommendations. Annex A70/43 39 E. ACKNOWLEDGEMENT 160. We wish to express our appreciation for the cooperation and assistance extended to our staff during our audit by the Director-General, the Deputy and Assistant Directors-General, the Regional Directors, HQ Directors, the Comptroller, Country Representatives and members of their staff. 161. We also wish to express our appreciation to the World Health Assembly for its continued support and interest in our work. Commission on Audit Republic of the Philippines External Auditor 3 April 2017 Quezon City, Philippines A70/43 Annex 40 ANNEX A STATUS OF IMPLEMENTATION OF EXTERNAL AUDIT RECOMMENDATIONS FROM PRIOR YEARS (A66/34, A67/45, A68/41 AND A69/50) 2015 Recommendation External Auditor’s validation A69/50 1 Donor agreement - centralized tracking tool: Fast track the completion of a centralized tracking tool for donor agreements under the Global Engagement Management (GEM) project, to immediately address the delay in the creation of awards thus, ensuring timely recognition of revenue (paragraph 31) In progress Target date of implementation: June 2017 We took note of the planned roll out in mid-2017. Closure of this recommendation will be effected upon actual implementation of GEM. 2 Policy guidance on revenue and accounts receivable recognition: Stipulate in the WHO eManual and WHO IPSAS Manual further policy guidance regarding revenue and accounts receivable recognition for voluntary contributions (paragraph 32) Implemented Policy guidance was provided in the WHO eManual and related SOP. In addition, a further table has been added to the SOP on award creation summarizing revenue recognition treatment over year end closure. 3 Advance payments vs prepayments: Incorporate the standard advance payment modality provision in the agreement itself, and record advance payments to suppliers as prepayments in accordance with existing accounting policy (paragraph 34) Implemented Processes at GSC have been updated to ensure such payments are not expensed. The updated processes are sufficient to mitigate the risks of prepayments being recorded as expenses. 4 GIMS roll-out: Continue the planned migration and roll-out of the Global Inventory Management System (GIMS) in the regional and country offices to ensure the accuracy of reported inventories (paragraph 39) Implemented Start of implementation had been validated in 2016. In 2016, GIMS has been implemented for all HQ, SEARO and WPRO locations and 2 EMRO locations with 19/42 inventory locations yet to go live. 5 Inventory expiry dates: Provide information on the expiry dates of inventories in preparation for capture in the Global Inventory Management System (GIMS) (paragraph 40) Implemented Validation revealed that expiry dates were provided in the capture of inventories in the system. However, the current audit revealed that there is a need for further classification of inventories into expiring and non-expiring to enhance data integrity and usefulness in reporting. Annex A70/43 41 2015 Recommendation External Auditor’s validation 6 SOP on the disposal of expired inventories: Finalize the global SOP on the disposal of expired inventories to provide guidance to technical units and warehouse managers taking into consideration their valuable inputs for a responsive global SOP for the management of expired inventories (paragraph 43) This will be closed since the issue was updated and included in paragraph 32 of the present report. Finalization of the global SOP on the disposal of inventories was deferred. Meanwhile, a global policy for supply chain and inventory management is being developed from which a SOP on the management of expiring inventories would be crafted and implemented by WHO. 7 Assignment of expenditure types in POs: Provide further guidance and relevant trainings to staff members, enforce compliance with regulations and strengthen the review process in the assignment of expenditure types to be used before a purchase order is created in GSM to enhance compliance with regulations and ensure correct recording of expenditures (paragraph 47) This will be closed since the issue was updated and included in paragraph 36 of the present report. The project on the hard coding of expenditure was approved in January 2017 with the timeline for implementation in July 2017. Further guidance and relevant training are needed to ensure the smooth implementation of this enhancement in GSM. 8 Improvement of data sources quality: Continue to undertake the necessary action to further improve the quality of data sources as well as the efficiency and effectiveness of functional and operational processes within GSC and GSM (paragraph 49) Implemented We noted GSC’s activities to improve the quality of data sources in 2016. A new recommendation was provided for new issues discovered. 9 Retroactive travel claims: Implement strictly the policy of no retroactive travel claims for duty travel in line with Section VII.5.8 of the WHO eManual until a change in policy to cover RTCs on exceptional cases is approved and effected in the eManual (paragraph 51) Implemented Revision in the relevant provision of the eManual was noted. The changes to the Duty Travel Policy effective 1 February 2017 require that travel claims not submitted within 90 days of the end-date of travel will result in the automatic recovery of unclaimed travel payments. 10 Overpayment of hardship allowances: Align with the provisions of the eManual and the GSM calculation formula to prevent overpayment of hardship allowances and recover any overpayments on hardship allowances from staff members concerned (paragraph 53) Implemented The eManual and GSM calculations will be updated with adoption of the new International Civil Service Commission compensation package from 1 January 2017. 11 Procurement plans: Strengthen procurement planning capabilities and related accountabilities by considering the development of comprehensive procurement plans to ensure that procurement needs are appropriately managed (paragraph 67) Implemented With the actions taken, the recommendation is considered implemented. Implementation of the new WHO Procurement Strategy is under way. A related recommendation is advanced in the current review of the strategy. A70/43 Annex 42 2015 Recommendation External Auditor’s validation 12 Controls of procurement of services activities: Strengthen review and monitoring activities across the business processes involved in the procurement of services through TSAs, APWs, LOAs and Consultancy Contracts to ensure that prescribed controls are adhered to and to consequently install fixes to the related gaps noted (paragraph 72) Implemented Controls have been strengthened across many areas. Finance has issued guidance and enhanced system controls for procurement types moved to finance. 13 Risk mitigation strategies: Craft the most appropriate mitigation strategies to ensure that risks to the Organization in terms of accountability, representation and safety of personnel with inappropriate insurance coverage brought about by hiring more individual service contractors are better addressed (paragraph 76) Implemented HRD has taken over ownership of non-staff contracts and clear guidance has been provided as well as quality control of files. 14 ePMDS staff adherence: Ensure staff adherence to ePMDS+ completion within the required time frame by employing a suitable strategy to exact full compliance, and completely measure staff performance (paragraph 85) Implemented HRD publishes regular reminders on staff’s PMDS obligations; the PMDS compliance rate is available anytime in the Business Intelligence Management Dashboard and is part of the ADG Accountability Compact. 15 Staff objectives: Review the definition of the Staff objectives as enumerated in each of their ePMDS+ and ensure that these are accomplished following the SMART model (paragraph 89) Implemented HRD has provided clear guidance as well as learning opportunities to all staff to ensure that objectives are SMART. 16 Competency build-up and staff training: Ensure that competency build-up is undertaken for all staff and that the staff individual training needs are assessed formally, in close engagement with the HRD, so that the developmental needs along the required staff competency areas are adequately tracked and managed (paragraph 97) Implemented The Global Learning and Development Committee undertakes regular reviews of learning needs. 17 Post vacancies: Ensure that post vacancies are appropriately managed and the building and populating of the pipeline of talents are robustly dealt with to prevent talent-drought when vacancies arise (paragraph 104) Implemented This is an ongoing process through the new recruitment, onboarding and rostering system (Stellis) and the mobility policy. 18 Award management: Address the control gaps noted in award management by strengthening monitoring mechanism on: the status of all awards especially those nearing their end dates to ensure that planned activities are fully implemented pursuant to the Donor’s Agreement; updating the status of overdue receivables; and review actions for encumbrances to ensure timely decision and disposition of encumbrances not yet liquidated past the transaction’s completion date and award’s end date (paragraph 111) Implemented Award management has been strengthened through enhanced reporting and regular follow up on amounts receivable, encumbrances and awards expired. Annex A70/43 43 2015 Recommendation External Auditor’s validation 19 Donor reporting monitoring capabilities: Improve donor reporting monitoring capabilities and coordination among Technical Units with the end view of producing more complete and accurate statistics in GSM thereby assuring better support to managerial decisions, and providing donors with relevant and timely information on their donated funds (paragraph 112) Implemented Enhanced information on donor reporting is now available through Business Intelligence and automated reminders are sent on reports due. In addition, the ADG Accountability Compact includes a performance indicator on the timeliness of donor reporting. 20 DFC funding: Clarify control and authority in DFC funding in relation to roles and responsibilities given to the WHO HQ departments and with reference to the related provisions in the eManual (paragraph 117) Implemented The eManual and SOPs have been updated to reflect that DFCs must be implemented through country office work plans and not through HQ. 21 Align DFC engagements with the Organization’s accountability principles by obtaining better clarity of roles and responsibilities through close engagements with SOP policy managers to ensure that distinct activities amongst the clusters, regional and country offices are better defined and applied uniformly across the Organization (paragraph 121) Implemented Operational planning includes guidance on the tasks that will require delivery through DFCs. The eManual and SOPs have been updated to reflect the updated guidance. 22 Continue improving on: (a) complying with policies in ensuring that contracts are signed before the planned start date; (b) monitoring of the implementation of DFC projects/activities; (c) monitoring DFC Reports; and (d) conducting assurance activities on a periodic basis and spot checks to assure the successful implementation of DFC projects/activities. In addition, continuously provide training and guidance to staff involved in the receipting of DFCs in GSM; and require the country offices to secure prior approval of RD/Comptroller for new DFC releases to implementing partners with overdue reports (paragraph 128) Implemented DFC policy guidance has been updated for all areas. Most importantly, DFC assurance activities policy guidance has been provided and a DFC SharePoint site has been set up to substantiate DFC assurance activities. New and related recommendations on DFC are included in the present report. 23 Imprest accounts: Address the control gaps noted on the imprest accounts by improving the strategy in studying and forecasting future expenditures, segregating incompatible duties, strengthening the controls to mitigate the risks of misuse of funds, conducting a formal handover process for proper accountability purposes (paragraph 132) Implemented SOPs have been updated to include guidance on granting, modifying and removing access rights; new reports were developed to review access responsibilities and enhancements have been made to the imprest forms. In addition, training materials for Heads of WHO offices for countries, territories or areas has been finalized. A70/43 Annex 44 2015 Recommendation External Auditor’s validation 24 Asset and inventory management: Address control gaps noted in asset and inventory management by maintaining adequate and correct records, placing bar codes, conducting timely disposal of obsolete items, securing approval before disposing expired items, and by segregating incompatible functions to further safeguard the Organization’s assets (paragraph 135) Implemented Asset management SOPs have been updated and linked to the eManual and WHO is complying with the updated guidance. 25 Travel management: Address the control gaps noted in travel management by ensuring the preparation of travel plans, enforcing adherence to the travel requests approval period, requiring timely submission of travel reports as well as travel claims, and ensuring efficient recovery of per diems/travel claims (paragraph 139) Implemented The changes to the Duty Travel Policy were effective from 1 February 2017 and included: the mandatory requirement for all staff travel to be included in an annual travel plan; the escalation of late staff travel requests; the strict enforcement of the requirement for travel reports and travel claims; and the immediate recovery of non-compliant claims. 26 Enhance programme results review by ensuring that expected results and programme status deviations are constantly and iteratively monitored to have better programme and project decision base (paragraph 146) Implemented Expected results and programme status deviations are systematically monitored through the mid-term review (MTR) and end of biennium assessment processes. 27 Strengthen the systematic tracking of lessons learned with the current process of mid-term review and end of biennium assessment linking this to operational planning and monitoring on programme management in the country offices and in the HQ Cluster (paragraph 152) Implemented Lessons learned are collated and widely disseminated through the programme budget portal. 28 Consider in the monitoring framework a mechanism where lessons learned are structured coherently, monitoring results and lessons learned as well as best practices are documented, disseminated and tracked for use in decision-making, organizational learning, future planning and programming, and evaluation (paragraph 153) Implemented Lessons learned are collected systematically through the MTR and the end of biennium assessment processes. 29 Monitoring activities at the country level: Enhance the monitoring activities at the country level by conducting periodic and comprehensive monitoring of the work plans and taking appropriate measures on the occurrence of adverse condition such as negative balances or variances (paragraph 157) Implemented Work plan monitoring is undertaken at the country level during the MTR and end of biennium assessment processes and also the Organization-wide monitoring and performance assessment exercises. Annex A70/43 45 2015 Recommendation External Auditor’s validation 30 Risk identification activities: Enhance risk identification activities, in close engagement with the CRE, by infusing better root cause analysis of the identified risks within a defined context to avoid assumptions and logic traps and ensure that remediation strategies result in the application of more effective risk controls (paragraph 164) Implemented Risk mitigation plans have been submitted. Root cause analysis was included in the implementation of the risk mitigation measures. 31 Risk Register: Pursue the risk register exercise and integrate risk management in the critical management areas such as planning, budgeting, and programme management to ensure that risks are identified, prioritized and mitigated to attain programme objectives (paragraph 167) Implemented Risk management is now an integral part of the operational planning, budgeting and programme management. A68/41 32 Various Implement and maintain a centralized tracking tool for donor agreements and donations in- kind, record all the in-kind donated property that meet the monetary threshold in the correct financial period, formulate standard operating procedures for LOAs, formulate global standard operating procedures on the disposal of expired inventory items to enhance its inventory management system and enforce compliance with the requirements on DFC to further minimize the number of overdue DFC reports (paras 30, 32, 35, 40, 44, 49 and 53) Implemented This recommendation consolidated various individual parts. Five recommendations have been fully implemented. Two recommendations have been raised as separate recommendations in document A69/50 – the centralized tracking tool for donor agreements and the SOP on the disposal of expired inventory items. 33 Programme governance Formalize a Term of Reference to have a formal mechanisms for communication, facilitation, monitoring and evaluation of the results of the Category Networks and Programme Area Networks, finalize the planned Programme Monitoring Framework within the defined timeframe, continuously improve the formulation of the elements of the results chain to support harmonization of its presentation in the Programme budget 2016–2017 and enhance the MTR template to achieve clearer linkages of actual deliveries to planned deliverables (paras 63, 68, 74, 78, 83, 89 and 93) Implemented The Terms of Reference were finalized for review and consideration by the Global Policy Group (GPG). This was provided to the GPG to review and consider during the meetings in March 2016 and May 2016. The GPG during its discussion on this matter requested an evaluation of the Category Networks and Programme Area Networks by the Evaluation Unit of WHO. This was carried out and the evaluation report is being finalized. A70/43 Annex 46 2015 Recommendation External Auditor’s validation 34 Programme budget progress report training Identify and provide appropriate capacity building and learning initiatives across Programmes to strengthen analysis, review and reporting of results, enhance monitoring activities on the task status and progress in each work plan, and ensure that fiscal and budgetary figures are brought to agreement particularly towards the start of periodic assessments so these data can have a higher degree of correlation to reported accomplishments (paras 96, 103 and 108) Implemented Training was undertaken for the MTR 2016–2017 in December 2016. The training material is available on PRP’s intranet site. 35 Formalize a change management strategy Through the implementation of the revised HR Strategy, develop an Action/Implementation Plan, draw a robust governance arrangement for the HR Strategy and identify the implementation risks in a comprehensive manner for the HR Strategy to facilitate implementation, monitoring and measurement of results, and to establish accountability for results (paras 116, 120, 124 and 127) Implemented The change management strategy is summarized in the various initiatives undertaken by HRD. 36 Recruitment Develop a workforce planning model as called for by the World Health Assembly and the appropriate tools such as the skills inventory, staffing and skills gap analyses, and workforce risk assessment including a succession planning policy for implementation in the ongoing workforce planning exercise (paras 149 and 155) In progress Target date of implementation: December 2017 The recommendation cannot yet be considered implemented. The exercise has already been defined and the requirement does not suggest a one-size-fits-all model for workforce planning. HRD can move forward and create one framework for workforce planning as called for by the World Health Assembly, given the identified challenges and dependencies. 37 Knowledge transfer strategies: Craft knowledge transfer strategies based on best practices and develop a plan to implement them, incorporate clear requirements in the ePMDS+ for the identification of the activities, outputs, outcomes, and performance indicators under each objective, and develop a quality assurance framework for iLearn that should contain systematic measurement processes, comparison with a standard, monitoring of processes and an associated feedback loop that confers achievement of organizational learning objectives (paras 159, 163 and 168) Implemented The knowledge transfer strategy is informed by ePMDs data for individual learning pathways, and supported by learning/development needs analysis and implemented via ilearn which provides systematic monitoring of course registration/assessments across different subjects/competencies. Annex A70/43 47 2015 Recommendation External Auditor’s validation A67/45 38 Final Certified Financial Statements (FCFS) Enjoin all relevant offices responsible for the preparation and release of Final Certified Financial Statements (FCFS) to donors to improve the timeliness of reporting to donors (paragraph 50) Implemented We appreciate the actions taken by Management to improve the timeliness of reporting to donors. These include the automated email to award managers before donor reports are due, circulation of quarterly reports on the status of outstanding reports and the follow up and circulation of expired/expiring awards with reports due on a monthly basis. 39 Asset accountability policy Improve its Asset Accountability Policies by incorporating the following procedures: (i) criteria defining various circumstances surrounding asset loss; (ii) guidelines for documenting asset loss; and (iii) levels of administrative and fiscal responsibility for every type of circumstance identified as the cause of asset loss (paragraph 65) Implemented The eManual has been updated to incorporate the improved asset accountability policies. A66/34 40 Update to WHO Emergency Standard Operating Procedures Include specific operating standards in the area of logistics in the ERF taking into account the accountability in managing resources and the risks involved in specific arrangements with suppliers and donors (paragraph 64.a) In progress Target date of implementation: July 2017 The closure of the recommendation will depend on the result of inventory management policy vis-à-vis the ERF and the Emergency Procurement Policy Framework that is still to be developed. 41 WHO Emergency Response Strategy and Framework Design strategies in stockpile deployment that maintain a balance among the No Regrets Policy, the expectations of stakeholders and the optimal inventory management to avoid occurrence of expired medicines (paragraph 64.b) Implemented The project has been fully implemented since June 2016. = = =