Seventy-fifth session
Item 139 of the provisional agenda*
Review of the efficiency of the administrative and financial functioning of the United Nations
Activities of the Independent Audit Advisory Committee for the period from 1 August 2019 to 31 July 2020
Report of the Independent Audit Advisory Committee
|
Summary |
|
The present report covers the period from 1 August 2019 to 31 July 2020. During the period, the Independent Audit Advisory Committee held four sessions, which were presided over by Janet St. Laurent (United States of America) as Chair and Richard Quartei Quartey (Ghana) as Vice-Chair. As has been the case during the history of the Committee, all members attended all of the sessions during their appointments. |
|
Section II of the report contains an overview of the activities of the Committee, the status of its recommendations, and its plans for 2021. Section III sets out the detailed comments of the Committee. |
|
|
Contents
|
|
|
|
Page |
|
3 |
||
|
3 |
||
|
3 |
||
|
4 |
||
|
5 |
||
|
6 |
||
|
6 |
||
|
11 |
||
|
13 |
||
|
17 |
||
|
21 |
||
|
22 |
||
|
22 |
||
I. Introduction
1. The General Assembly, by its resolution , established the Independent Audit Advisory Committee as a subsidiary body to serve in an expert advisory capacity and to assist it in fulfilling its oversight responsibilities. By its resolution , the Assembly approved the terms of reference for the Committee, as well as the criteria for its membership, as contained in the annex to that resolution. In accordance with its terms of reference, the Committee is authorized to hold up to four sessions per year. To date, the Committee has held 51 sessions since its inception in January 2008.
2. In accordance with its terms of reference, the Committee submits an annual report containing a summary of its activities and related advice to the General Assembly. The present thirteenth annual report covers the period from 1 August 2019 to 31 July 2020.
3. The Committee is also required to advise the General Assembly on the compliance of management with audit and other oversight bodies’ recommendations; the overall effectiveness of the risk management procedures and deficiencies in the internal control systems; the operational implications of the issues and trends set out in the financial statements and the reports of the Board of Auditors; and the appropriateness of the accounting and disclosure practices in the Organization. The Committee also advises the Assembly on the steps necessary to facilitate cooperation among the oversight bodies.
4. The present report addresses the issues identified during the reporting period as they pertain to the above-mentioned responsibilities of the Committee.
II. Activities of the Independent Audit Advisory Committee
A. Overview of the sessions of the Committee
5. During the reporting period, the Committee held four sessions: from 10 to 13 December 2019 (forty-eighth session), from 19 to 21 February 2020 (forty-ninth session), from 29 April to 1 May (fiftieth session) and from 22 to 24 July (fifty-first session). Two of the sessions were held at United Nations Headquarters, while the remaining two were held virtually.
6. The Committee functions under its adopted rules of procedure, as contained in the annex to its first annual report (). To date, all members of the Committee have had a 100 per cent attendance rate at its sessions. All the decisions of the Committee have been unanimous; however, its rules of procedure make provision for members to record their dissent with respect to decisions taken by the majority.
7. During the forty-eighth session, in December 2019, the members elected Janet St. Laurent (United States of America) as Chair and Richard Quartei Quartey (Ghana) as Vice-Chair for 2020. Furthermore, the Committee hosted a fourth meeting of the Chairs and Vice-Chairs of the United Nations system oversight committees to discuss best practices, lessons learned and other issues of importance to the United Nations oversight community. Additional information about the Committee can be found on its website () in all the official languages of the United Nations.
8. During the reporting period, the Committee published three reports: the Committee’s annual report to the General Assembly for the period from 1 August 2018 to 31 July 2019 (); and two reports to the Assembly, through the Advisory Committee on Administrative and Budgetary Questions, on the proposed budget of the Office of Internal Oversight Services (OIOS) under the support account for peacekeeping operations for the period from 1 July 2020 to 30 June 2021 () and on the proposed programme budget of the Office for 2021 ().
B. Status of the recommendations of the Committee
9. The Committee meets four times per year, typically for three days at each session. During the reporting period, several issues, in particular in relation to enterprise risk management, organizational culture, cybersecurity, the statement of internal control and the operations of OIOS, were addressed. The Committee follows up on the implementation of its recommendations as a standard agenda item at each session. Some of the significant recommendations made by the Committee during the reporting period relate to:
(a) The need for the Management Committee to look into the factors that contribute to the low implementation rate of the recommendations, especially those pertaining to the Board of Auditors, with a view to ensuring that Management is addressing the implementation of oversight bodies’ recommendations as a priority;
(b) The need for Management to accord the implementation of enterprise risk management high priority throughout the United Nations system, if enterprise risk management is to be a useful management tool;
(c) The need to establish specific milestones for assessing risks and completing risk mitigation plans in the Secretariat as well as in subordinate and field-based units and to hold managers accountable for achieving those milestones;
(d) The need for Management to include culture as a regular feature of their discussions and to be clear about: (i) the values and behaviours that will help the Organization to excel; (ii) how the incentives, policies and controls they are designing will support the entities’ purpose and desired culture; and (iii) the behaviours for which there will be zero tolerance;
(e) While noting the importance of the tone at the top, the Committee reiterated its recommendation that the Organization take advantage of the reform to undertake a holistic review of the culture of the Organization and systematically identify the attributes of a positive culture that should define the Organization and implement them both in word and in action;
(f) The need for Management to make a concerted effort to obtain a 100 per cent completion rate for mandatory cybersecurity training;
(g) While commending OIOS for the effort it was investing in making performance audits a priority, the Committee noted that more needed to be done;
(h) The need for OIOS to come up with a sustainable strategy to address vacancies and staff retention issues, especially with respect to the Investigation Division;
(i) The need for OIOS to ensure that the investigation of retaliation cases is a priority, given the high risk such cases present, and for OIOS to work to reduce the length of time it takes to investigate such cases;
(j) The need for the Investigation Division to analyse the root causes of why investigations exceed targeted time frames, including any constraints on resources, and to propose solutions to improve time frames;
(k) In view of the importance of Umoja, the need for the Organization to ensure that the roll-out of the remaining modules is properly addressed;
(l) The need to consider the governance, risk and compliance module high priority in the implementation of Umoja, as this will lead to more effective second and third lines of defence;
(m) The Committee continues to believe that, for the United Nations to have after-service health insurance liabilities making up 75 per cent of the total end-of-service liabilities presents, in and of itself, a significant risk which should be properly managed.
C. Overview of the plans of the Committee for 2021
10. The Committee undertook its responsibilities, as set out in its terms of reference, in accordance with the scheduling of the sessions of the Advisory Committee on Administrative and Budgetary Questions and the General Assembly. The Committee will continue to schedule its sessions and activities to ensure coordinated interaction with intergovernmental bodies and the timely availability of its reports. In a preliminary review of its workplan, the Committee identified several key areas that will be the main focus for each of its four sessions for fiscal year 2021 (see table 1).
Table 1
Workplan of the Committee from 1 August 2020 to 31 July 2021
|
Session |
Key focus area |
Intergovernmental consideration of the report of the Committee |
|
|
|
|
|
Fifty-second |
Review of the 2021 workplan of the Office of Internal Oversight Services in the light of the workplans of other oversight bodies Proposed budget of OIOS under the support account for peacekeeping operations for the period from 1 July 2021 to 30 June 2022 Operational implications of issues and trends in the financial statements and reports of the Board of Auditors Coordination and cooperation among oversight bodies, including hosting a coordination meeting of oversight committees Election of the Chair and Vice-Chair for 2021 |
Advisory Committee on Administrative and Budgetary Questions, first quarter 2021 General Assembly, second part of the resumed seventy-fifth session |
|
Fifty-third |
Status of implementation of oversight bodies’ recommendations Report of the Committee on the OIOS support account budget Review of the enterprise risk management and internal control framework in the Organization |
General Assembly, second part of the resumed seventy-fifth session |
|
Fifty-fourth |
Operational implications of issues and trends in the financial statements and reports of the Board of Auditors Proposed programme budget for OIOS for the year ended 31 December 2022 Coordination and cooperation among oversight bodies Transformational projects and other emerging issues |
Advisory Committee on Administrative and Budgetary Questions, second quarter 2021 General Assembly, main part of the seventy-sixth session |
|
Fifty-fifth |
Preparation of the annual report of the Committee Review of the enterprise risk management and internal control framework in the Organization Status of implementation of oversight bodies’ recommendations Coordination and cooperation among oversight bodies |
General Assembly, main part of the seventy-sixth session |
11. In planning its work, the Committee is mindful of the following relevant events that could have an impact on its work activities:
(a) The various reform/transformational initiatives on which the Organization has embarked, such as the management reform, including the delegation of authority, the shift in the management culture from process to results, and Umoja;
(b) The prevailing financial situation, should it persist into the following year;
(c) The end of the terms of office of two of the five members of the Committee, whose three-year terms expire in December 2020;
(d) The impact of the coronavirus disease (COVID-19) pandemic on the work of the Committee.
III. Detailed comments of the Committee
A. Status of the recommendations of United Nations oversight bodies
12. Under paragraph 2 (b) of its terms of reference, the Committee is mandated to advise the General Assembly on measures to ensure the compliance of management with audit and other oversight recommendations. The Committee maintains that if the weaknesses identified by the oversight bodies are fully addressed in a timely manner, the chances for the Organization to achieve its objectives are greatly improved. During the reporting period, the Committee reviewed the status of implementation by management of the recommendations of United Nations oversight bodies, as a standard practice.
Board of Auditors
13. According to the concise summary report of the Board of Auditors for the period ended 31 December 2019 (), the overall average implementation rate of outstanding prior period recommendations for the entities under the Board’s purview has increased, from 39 per cent in 2018 to 41 per cent in 2019. For the entities under the purview of the Independent Audit Advisory Committee, the implementation rate continued the downward trend, declining from 29 per cent in 2018 to 25 per cent in 2019. The increase in the overall implementation rate was driven by improvements in the rates for entities that are not under the Committee’s purview, from 49 per cent in 2018 to 58 per cent in 2019 (see table 2).
Table 2
Overall status of implementation of outstanding previous audit recommendations for entities under the purview of the Board for 2019 and 2018
|
|
Recommendations |
|
Implemented |
|
Implementation rate (percentage) |
|||
|
Category |
2019 |
2018 |
2019 |
2018 |
2019 |
2018 |
||
|
|
|
|
|
|
|
|
||
|
Under the Committee’s purview |
486 |
414 |
120 |
118 |
25 |
29 |
||
|
Outside the Committee’s purview |
464 |
441 |
271 |
218 |
58 |
49 |
||
|
Overall |
950 |
855 |
391 |
336 |
41 |
39 |
||
14. Tables 3 and 4 show colour-coded details of the implementation rates for the two categories of entities. As can be seen, none of the Secretariat entities were able to attain even 50 per cent implementation rates. The most significant decline was in United Nations peacekeeping operations (Vol. II) and the United Nations Human Settlements Programme (UN-Habitat), whose rates fell from 51 per cent to 23 per cent and 20 per cent to 8 per cent, respectively (see table 3). In contrast, table 4 shows the implementation rates of non-Secretariat entities, which have improved significantly since 2018. Except for the United Nations Children’s Fund, all the entities in this category have implemented at least 50 per cent of their recommendations, with the United Nations Capital Development Fund registering a 100 per cent implementation rate.
Table 3
Detailed status of implementation of outstanding previous audit recommendations for 2019 and 2018: entities under the purview of the Committee
|
|
Recommendations |
|
Implemented |
|
Implementation rate (percentage) |
|||
|
|
2019 |
2018 |
2019 |
2018 |
2019 |
2018 |
||
|
|
|
|
|
|
|
|
||
|
United Nations Vol. I |
224 |
167 |
49 |
13 |
22 |
8 |
||
|
United Nations peacekeeping operations (Vol. II) |
103 |
110 |
24 |
56 |
23 |
51 |
||
|
International Trade Centre |
17 |
17 |
4 |
8 |
24 |
47 |
||
|
United Nations Environment Programme |
35 |
17 |
11 |
3 |
31 |
18 |
||
|
United Nations Human Settlements Programme |
38 |
20 |
3 |
4 |
8 |
20 |
||
|
United Nations Office on Drugs and Crime |
50 |
65 |
22 |
27 |
44 |
42 |
||
|
International Residual Mechanism for Criminal Tribunals |
19 |
18 |
7 |
7 |
37 |
39 |
||
|
Total |
486 |
414 |
120 |
118 |
25 |
29 |
||
|
Legend |
||||||||||
|
0 |
10 |
20 |
30 |
40 |
50 |
60 |
70 |
80 |
90 |
100 |
|
Low implementation rate (percentage) |
High implementation rate (percentage) |
Table 4
Detailed status of implementation of outstanding previous audit recommendations for 2019 and 2018: entities outside the purview of the Committee
|
|
Recommendations |
|
Implemented |
|
Implementation rate (percentage) |
|||
|
2019 |
2018 |
2019 |
2018 |
2019 |
2018 |
|||
|
|
|
|
|
|
|
|
||
|
United Nations Capital Development Fund |
8 |
9 |
8 |
8 |
100 |
89 |
||
|
United Nations Development Programme |
51 |
49 |
29 |
17 |
57 |
35 |
||
|
United Nations Population Fund |
27 |
26 |
22 |
13 |
81 |
50 |
||
|
United Nations Children’s Fund |
80 |
66 |
33 |
34 |
41 |
52 |
||
|
United Nations Institute for Training and Research |
9 |
10 |
7 |
8 |
78 |
80 |
||
|
Office of the United Nations High Commissioner for Refugees |
96 |
67 |
48 |
35 |
50 |
52 |
||
|
United Nations Joint Staff Pension Fund |
45 |
38 |
33 |
12 |
73 |
32 |
||
|
United Nations Office for Project Services |
48 |
51 |
32 |
31 |
67 |
61 |
||
|
United Nations Relief and Works Agency for Palestine Refugees in the Near East |
46 |
54 |
27 |
32 |
59 |
59 |
||
|
United Nations University |
32 |
55 |
17 |
22 |
53 |
10 |
||
|
United Nations Entity for Gender Equality and the Empowerment of Women |
22 |
16 |
15 |
6 |
68 |
38 |
||
|
Total |
464 |
441 |
271 |
218 |
58 |
49 |
||
|
Legend |
||||||||||
|
0 |
10 |
20 |
30 |
40 |
50 |
60 |
70 |
80 |
90 |
100 |
|
Low implementation rate (percentage) |
High implementation rate (percentage) |
15. The Committee enquired of Management the reasons for such a marked difference in the rates of implementation of the Board’s recommendations. In response, Management noted that it was carrying out a detailed long-term analysis of the root causes of the low implementation rates and would inform the Committee of the outcome, and of the actions that would be taken to remedy the situation, at the next session of the Committee. Notwithstanding, Management reiterated its previous position that, over time, the Secretariat implemented most of the recommendations. The overall implementation rate of the Board’s recommendations on the United Nations peacekeeping operations for the six prior financial periods was 71 per cent, and an additional 7 per cent of the recommendations were closed by the Board or assessed as overtaken by events (see table 5).
Table 5
Overall status of implementation of the recommendations of the Board of Auditors on the United Nations peacekeeping operations (Vol. II) for prior financial periods, as at 30 June 2019
|
Financial period |
Report symbol |
Total recommendations issued for each period |
Implemented since date of issue |
|
Closed by the Board/ overtaken by events |
|
Under implementation |
|
Not implemented |
||||
|
Number |
Percentage |
Number |
Percentage |
Number |
Percentage |
Number |
Percentage |
||||||
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
2012/13 |
|
49 |
48 |
98 |
– |
– |
1 |
2 |
– |
– |
|||
|
2013/14 |
|
63 |
58 |
92 |
5 |
8 |
– |
– |
– |
– |
|||
|
2014/15 |
|
31 |
25 |
81 |
5 |
16 |
1 |
3 |
– |
– |
|||
|
2015/16 |
|
55 |
41 |
75 |
6 |
11 |
8 |
14 |
– |
– |
|||
|
2016/17 |
|
75 |
48 |
64 |
2 |
3 |
25 |
33 |
– |
– |
|||
|
2017/18 |
|
52 |
11 |
21 |
3 |
6 |
24 |
46 |
14 |
27a |
|||
|
Total |
|
325 |
231 |
71 |
21 |
7 |
59 |
18 |
14 |
4 |
|||
a Includes eight recommendations that the General Assembly, in its resolution B, requested the Secretary-General not to implement.
16. The Committee continues to be aware that, over time, the rate of implementation of oversight bodies’ recommendations improves. The Committee is also aware that some of the recommendations to the Secretariat were dependent on or affected by the reform. The Committee believes, however, that timely implementation of recommendations is a hallmark of an effective and accountable organization. The Committee therefore reiterates its call to the Management Committee to look into this matter with a view to ensuring that Management is addressing the timely implementation of oversight bodies’ recommendations as a priority. For a start, Management should aspire to implement the recommendations at the rate of the other entities under the purview of the Board of Auditors, that is, to implement at least 50 per cent of the recommendations within two years of the date of issue.
Office of Internal Oversight Services
17. The Committee was informed that, during 2019, OIOS had issued 382 reports, a slightly smaller number than the 397 issued in 2018. Those reports contained 968 recommendations, compared with 1,183 in 2018. According to OIOS, 85 per cent of the recommendations were in areas considered high risk in the Secretariat risk register, hence it is expected that Management attention and action on those recommendations will reduce risk and improve the performance of the Secretariat.
18. All recommendations categorized as “critical” by OIOS are brought to the attention of the Management Committee for follow-up action, and special focus is placed on those recommendations whose implementation is past due. The Committee receives quarterly updates from OIOS and the Department of Management Strategy, Policy and Compliance on the status of implementation of critical recommendations.
19. According to Management, the total number of outstanding critical recommendations decreased from 47 at the end of the fourth quarter of 2018 to 43 at the end of the fourth quarter of 2019. Of the 43 outstanding critical recommendations, 16 were addressed to the Office of the United Nations High Commissioner for Refugees (UNHCR), 4 to the United Nations Joint Staff Pension Board, 1 to the United Nations Joint Staff Pension Fund, and 1 to the secretariat of the United Nations Framework Convention on Climate Change, leaving 21 as the outstanding critical recommendations relating to the Secretariat.
20. Of the 21 outstanding critical recommendations, 13 (62 per cent) were past due at the end of the fourth quarter of 2019.
21. The Committee urges Management to continue to improve its efforts to implement past due critical recommendations in a timely manner.
Joint Inspection Unit
22. In its annual report for 2019 and programme of work for 2020 (), the Joint Inspection Unit noted that the average rate of acceptance of recommendations made between 2011 and 2018 in single organization reports and notes was higher (77 per cent) than that of recommendations in system-wide reports and reports covering several organizations (69 per cent). The Unit noted that, during the same period, the implementation rate of recommendations in single organization reports and notes was also higher (82 per cent, compared with 74 per cent in the period 2010–2017) than that of recommendations in system-wide reports, which fell from 85 per cent in the period 2010–2017 to 81 per cent.
23. For the United Nations Secretariat, the average acceptance rate remained constant at 63 per cent for the period 2011–2018 and the average implementation rate also remained constant at 78 per cent for the period 2011–2018 (see figures I and II).
Figure I
Status of acceptance of recommendations of the Joint Inspection Unit (entities under the purview of the Committee), 2005–2012 to 2012–2019
Abbreviations: ITC, International Trade Centre; UNCTAD, United Nations Conference on Trade and Development; UNEP, United Nations Environment Programme; UN-Habitat, United Nations Human Settlements Programme; UNODC, United Nations Office on Drugs and Crime.
Figure II
Status of implementation of recommendations of the Joint Inspection Unit (entities under the purview of the Committee), 2005–2012 to 2012–2019
Abbreviations: ITC, International Trade Centre; UNCTAD, United Nations Conference on Trade and Development; UNEP, United Nations Environment Programme; UN-Habitat, United Nations Human Settlements Programme; UNODC, United Nations Office on Drugs and Crime.
24. The Committee also looked at an eight-year trend analysis of the average acceptance rates of the recommendations of the Joint Inspection Unit for entities under its purview. The Committee noted that three entities (the Secretariat, the United Nations Conference on Trade and Development and the International Trade Centre) had consistently performed better with respect to acceptance rates (see figure I). On the other hand, UN-Habitat and the United Nations Office on Drugs and Crime (UNODC) exhibited a declining acceptance rate during the same period. In fact, the acceptance rate for UNODC declined from a high of 26 per cent in 2005–2012 to a mere 3 per cent in the 2012–2019 period. In the same vein, the average acceptance rate for UN-Habitat declined from 25 per cent in 2005–2012 to 12 per cent during the period 2012–2019. The Committee sought comments from Management, but at the time of finalizing the present report, it had not received any input in that regard.
25. The Committee notes the importance and value of the recommendations of the Joint Inspection Unit to the Organization. The low acceptance rate could be either a sign of some systemic problems in the entities concerned or a sign that the reports/recommendations of the Joint Inspection Unit are not relevant to such entities. Since the implementation rate is a derivative of the acceptance rate, the Committee believes that there is a risk that significant findings of the Joint Inspection Unit are not being addressed. The Committee therefore calls upon the Joint Inspection Unit, the Management Committee and the entities concerned to look into this issue as a matter of priority.
B. Risk management and internal control framework
26. Paragraphs 2 (f) and (g) of the terms of reference of the Committee (see General Assembly resolution , annex) mandate the Committee to advise the General Assembly on the quality and overall effectiveness of risk management procedures and on deficiencies in the internal control framework of the United Nations.
Enterprise risk management
27. The Committee has long believed that enterprise risk management is an integral and important management tool of the Organization and emphasized that top management effort is needed to continue to actively lead enterprise risk management efforts so as to ensure that identifying and managing risks become standard ways of doing business across the Organization. The Committee also fully agrees with General Assembly resolution (paras. 7 and 8) and the observations of the Advisory Committee on Administrative and Budgetary Questions (, para. 8), the Board of Auditors and the Joint Inspection Unit regarding the importance of embedding a culture of enterprise risk management in the day-to-day work of departments.
28. In its previous reports, while acknowledging the progress made in embedding enterprise risk management, the Committee was concerned that enterprise risk management was still mainly a Headquarters-driven exercise that had not yet been translated into a practical tool to help offices assess their risks. That conclusion led the Committee to recommend that, in order for enterprise risk management to be an important management tool, it should not only be Headquarters-centric but should also be properly expanded to all offices.
29. In its previous report (), while welcoming the efforts to date, and mindful of the ongoing reforms, the Committee noted that the implementation of enterprise risk management should be accorded high priority throughout the United Nations system, if enterprise risk management was to be a useful management tool. During the current fiscal year, the Committee followed up with Management and was informed that, in the context of emerging risks, including the COVID-19 pandemic and its impact on the strategic focus, the Organization had had to revisit the Secretariat-wide risk register.
30. Management further noted that a task force composed of senior leadership had performed a detailed risk analysis of the six overarching strategic focus areas of the Secretary-General, namely peace and security, including the global ceasefire; the economic and social crisis; protection of human rights; effective humanitarian response; building a better world after the crisis; and effective and coordinated mandate delivery and business continuity of the United Nations system. Accordingly, the Committee was informed that the task force had developed the risk register to ensure that it was detailed and explicit enough to provide a guide to action for the corporate risk owners.
31. Consequently, the Committee was informed that the task force had identified 16 critical risks affecting the processes that supported the implementation of the above six strategic focus areas of the Secretary-General, and that the Management Committee had approved the resultant Secretariat-wide risk register in July 2020. The Committee welcomes the Secretariat’s effort to finalize the revised risk register and looks forward to a detailed discussion of this matter with Management.
32. Management further informed the Committee that it would continue to treat the risk register as a living document and that regular updates would be made as a result of changes to the risk profile of the Organization. Consistent with the previous recommendation of the Committee regarding senior leadership involvement in the enterprise risk management process, Management noted that the Executive Committee, chaired by the Secretary-General, would play a critical role in facilitating effective coordination pertaining to the strategic focus areas.
33. As a way forward, the Committee was informed that the updated risk register would be disseminated to all entities to guide the process of updating and developing their local registers as well as the risk treatment and response plans. Management further noted that the process would be monitored by the Business Transformation and Accountability Division of the Department of Management Strategy, Policy and Compliance and that progress at both the corporate and entity levels would be reported to the Management Committee through the enterprise risk management task force. To support the process of monitoring the progress made in the implementation of enterprise risk management, Management indicated that it was exploring alternatives for a risk management software system, including reviewing the governance, risk and compliance module of Umoja and other off-the-shelf risk management systems as potential solutions.
34. The Committee welcomes the progress made in addressing this important subject, especially the decision to involve all the entities of the Secretariat. The Committee is aware that more needs to be done, especially in ensuring that enterprise risk management is a useful management tool. The Committee plans to revisit the specific risk categories that it has been following, including organizational culture and cybersecurity, after Management has operationalized the new enterprise risk management system in the Organization. The Committee also reiterates its prior recommendation that Management establish specific milestones for assessing risks and completing risk mitigation plans in the Secretariat and field-based units and hold managers accountable for achieving those milestones.
C. Effectiveness, efficiency and impact of the audit, investigation, inspection and evaluation activities of the Office of Internal Oversight Services
35. Under its terms of reference, the Committee has the responsibility to advise the General Assembly on aspects of internal oversight (resolution , annex, para. 2 (c)–(e)). In undertaking to fulfil its mandate, the Committee has maintained its standard practice of meeting with the Under-Secretary-General for Internal Oversight Services and other senior OIOS officials during its sessions. The discussions have been focused on OIOS workplan and budget execution, significant findings reported by OIOS, operational constraints (if any), post incumbency, the status of implementation by management of OIOS recommendations, including critical recommendations, and strengthening investigations.
36. During the current period, the Committee focused its assessment on: (a) strategic planning, OIOS effectiveness and performance measurement; (b) organizational culture; (c) matters associated with the Investigation Division; and (d) the role of OIOS in the 2030 Agenda for Sustainable Development.
1. Strategic planning, effectiveness of the Office of Internal Oversight Services and performance measurement
Performance audit
37. According to the standards of the Institute of Internal Auditors, internal auditors have an obligation to assist the organizations they serve in improving the quality of governance, risk management and control processes.[1] In its report on the state of the internal audit function (), the Joint Inspection Unit noted that one of the benefits of performance audits was that they could identify redundancies and unnecessary controls and processes and thereby increase efficiency and value for money. During the reporting period, the Committee followed up with OIOS regarding its prior recommendation that OIOS clearly identify the steps it plans to take to improve its capability to conduct performance audits.
38. In response, OIOS informed the Committee that the Internal Audit Division of OIOS planned to undertake methodological development in those areas, where the focus would be on practice and skills development. Furthermore, as noted in the Committee’s report on the proposed programme budget of OIOS for 2021 (), OIOS changed the way that the Inspection and Evaluation Division was addressing the Organization’s evaluation needs. Under the new arrangement, “non?programmatic” departments, such as the Department of Management Strategy, Policy and Compliance and the Department of Operational Support, would be subject to performance auditing by the Internal Audit Division rather than through programme evaluation conducted by the Inspection and Evaluation Division.
39. Following the adoption of the new measures, concerns were raised as to whether performance audits alone would be sufficient to address the evaluation needs of such departments. In its discussion with OIOS, the Committee was informed that, since departments such as the Department of Management Strategy, Policy and Compliance and the Department of Operational Support were essentially delivering administrative support to other Secretariat entities, the required level of assurance was more efficiently and effectively provided through internal audit, rather than through programme evaluation. At the same time, OIOS indicated that, in that process, the two divisions (the Inspection and Evaluation Division and the Internal Audit Division) planned to collaborate, as necessary, to ensure that the approach adopted by the Internal Audit Division encompassed questions of relevance and impact.
40. The Committee welcomes this approach of making performance audits a priority. The Committee is aware that more needs to be done, especially in striking the right balance between performance and compliance auditing. The Committee will continue to follow up with OIOS in this regard.
Vacant posts in the Office of Internal Oversight Services
41. The Committee has consistently expressed its concerns about the high number of vacancies in OIOS. The Committee continues to consider this a significant risk; hence it appears as a standing item on its agenda. At its fifty-first session, the Committee was informed that the austerity-induced increase in vacancies had levelled off. This resulted in a slight overall increase in the vacancy rate from 14 per cent as at 30 June 2019 to 16.1 per cent as at 30 June 2020. The overall vacancy rate, however, masks a much bigger problem with respect to the Inspection and Evaluation Division, where the vacancy rate increased from 10.3 per cent in 2019 to 35.3 per cent in 2020, with the 国产AVkeeping Evaluation Section of the Division registering a vacancy rate of 44.4 per cent and the Regular Budget Section of the Division registering a vacancy rate of 36.4 per cent as at 30 June 2020.
42. The Committee enquired as to the impact of such a high vacancy rate on programme delivery, especially since the Inspection and Evaluation Division is the smallest Division in OIOS. In response, OIOS indicated that, for the peacekeeping evaluation, the impact of the current vacancies was that the Division would be able to start work on only three out of six mandated oversight assignments for the current cycle: the evaluations of political affairs work in peacekeeping, of peace operations in Somalia, and of the United Nations Multidimensional Integrated Stabilization Mission in the Central African Republic would commence, while the planned evaluations of the United Nations Multidimensional Integrated Stabilization Mission in Mali and the United Nations Organization Stabilization Mission in the Democratic Republic of the Congo and a triennial review would not be conducted pending the filling of vacancies. With respect to regular budget activities, OIOS indicated that the impact of the current vacancies was that the Division would be able to start work on only three out of five planned mandated oversight assignments for the current cycle. Work on the evaluation of the Economic Commission for Africa and the Economic Commission for Latin America and the Caribbean and on the biennial report on strengthening evaluation will commence, despite two existing vacancies (one in each team), while the planned evaluations of the Economic and Social Commission for Western Asia and the Office of the United Nations High Commissioner for Human Rights will not be conducted pending the filling of vacancies.
43. The Committee continues to be aware that OIOS, like any other department in the Secretariat, is operating within the constraint of a tight financial situation, which has required the maintenance of specific vacancy levels for fiscal reasons. The Committee is also aware of the improvement in the vacancy rate in the Investigation Division reported over the past year. The Committee is nevertheless concerned that such improvement has not extended to other Divisions, especially the Inspection and Evaluation Division. The Committee believes that the Inspection and Evaluation Division, being the smallest Division, cannot afford to operate effectively with a vacancy rate of close to 50 per cent in one of the sections, especially since the Committee is on record as supporting the augmentation of the Division. The financial situation notwithstanding, the Committee reiterates its prior recommendations that OIOS address the issue of vacancy levels as a matter of priority. This could include considering options such as reallocating resources among the Divisions.
Timeliness in the completion of investigation cases
44. The Committee has long contended that the timeliness with which an investigation is completed is an essential element of an effective accountability system. During the reporting period, the Committee followed up with OIOS on some of its performance indicators and was informed that 71 per cent of its investigations were completed within 12 months (down from 82 per cent in 2019), whereas 29 per cent took more than one year to complete (up from 18 per cent in 2019). The Committee was further informed that the average length of an investigation stood at 10.8 months (down from 11.5 months in 2019). The Investigation Division further informed the Committee of the additional effort it was putting into addressing the quality and timeliness of investigations, especially with respect to retaliation. Specifically, OIOS noted a new system of handling the investigation of retaliation, which was aimed at dispatching such cases promptly.
45. While the average length of an investigation has been brought down to 10.8 months, this is still longer than the six-month period prescribed by OIOS in its programme impact pathways. The fact that the proportion of investigations taking more than one year to complete went up from 18 per cent in 2019 to 29 per cent in 2020 continues to be worrying. The Committee recalls its previous assertion that best practice and due process require that investigations be carried out with dispatch to deter impunity and feelings of uncertainty in the workplace. The Committee therefore continues to urge the Investigation Division to increase its focus on completing investigations in a timely manner. The Committee reiterates its prior recommendations that the Division analyse the root causes of why investigations exceed targeted time frames, including any constraints on resources, and propose solutions to improve time frames.
2. Assessing the organizational culture
46. In paragraph 46 of its report for the period from 1 August 2017 to 31 July 2018 (), the Committee called upon OIOS to come up with a clear methodology, taking into account best practices, for periodically assessing the culture of the Organization. The Committee followed up with OIOS on the progress in this regard and was informed that the Internal Audit Division had provided training to almost all of its auditors on auditing culture so as to raise awareness of the subject and share the Division’s strategy for incorporating information regarding the culture and the control environment in its audits. The Committee was further informed that the Division, in collaboration with the Inspection and Evaluation Division, had issued common audit and evaluation guidelines for assessing organizational culture. In addition, OIOS informed the Committee that the Inspection and Evaluation Division had issued an inception paper on the evaluation of organizational culture in peacekeeping missions and its impact on effectiveness in mandate implementation.
47. The Committee followed up with OIOS on the further progress in this regard. It was informed that the report on evaluating the culture in peacekeeping operations would be completed in August 2020. In the meantime, OIOS indicated that a synthesis report providing an overarching summary of key results and recommendations pertaining to organizational culture had been completed. According to OIOS, that report is based on 37 inspection and evaluation reports published by OIOS since 2017 and covers 29 UN entities. The Committee was informed that all of the reports, while not explicitly assessing organizational culture, had content that was germane to the subject.
48. Given the importance of having the right culture in an organization, the Committee continues to welcome the steps OIOS is taking to assess the organizational culture. The Committee will continue to review the matter further at its future sessions, including the status of implementation of the resultant recommendations and the role of the Internal Audit Division in assessing culture.
3. Role of the Office of Internal Oversight Services in the context of the 2030 Agenda for Sustainable Development
49. In paragraphs 64 to 66 of its report for the period from 1 August 2016 to 31 July 2017 (), the Committee looked at the progress OIOS was making in embodying the integrated, universal and indivisible nature of the 2030 Agenda throughout its own operations. As part of its follow-up process, the Committee was informed that an evaluation of preparedness and policy coherence had been finalized. The Committee was further informed that the evaluation covered 27 Secretariat entities, as well as the United Nations Relief and Works Agency for Palestine Refugees in the Near East, the United Nations Entity for Gender Equality and the Empowerment of Women (UN-Women) and UNHCR.
50. According to OIOS, most United Nations entities have taken steps to align the relevance of their work with the 2030 Agenda, but the extent of their preparedness to support Member States in their implementation of the Sustainable Development Goals has varied. OIOS further noted that, given their key roles in the 2030 Agenda, the Department of Economic and Social Affairs and the regional commissions had made multiple needed changes to their work programmes but still faced challenges in coordinating the work of United Nations entities relating to the Goals. However, in the absence of an overarching system-wide plan, entities were still striving for coherence and efficiency. Furthermore, while some effective partnerships have been created to support the Goals, the lack of a comprehensive framework to guide how those partnerships operate has created risks of ineffectiveness and inefficiency. OIOS also found that some United Nations entities had reported effective support to Member States in achieving the Goals. The Committee was further informed that the Inspection and Evaluation Division had made two recommendations, which have since been implemented.
51. The Committee welcomes the steps OIOS is taking with respect to the 2030 Agenda and will continue to follow up with OIOS on this matter.
D. Financial reporting
52. During the reporting period, the Committee engaged in discussions with the Board of Auditors, the Under-Secretary-General for Management Strategy, Policy and Compliance, and the Controller on several issues relating to financial reporting. The issues discussed included:
(a) Implementation of Umoja;
(b) Internal control, especially as it pertains to the delegation of authority and fraud prevention and detection;
(c) After-service health insurance;
(d) Issues and trends apparent in the financial statements of the Organization and the reports of the Board of Auditors.
Implementation of Umoja
53. In paragraph 81 of its report for the period from 1 August 2017 to 31 July 2018 (), the Committee welcomed the progress achieved in implementing Umoja, including the commitment to capture the Organization’s cycle from strategic planning to reporting. Regarding the status of the roll-out of Umoja, the Committee followed up with Management with respect to Umoja deployments since its previous report.
54. The Committee was informed that, to date, Management had: (a) implemented numerous Umoja changes in response to COVID-19; (b) undertaken multiple Umoja Extension 2 deployment projects, such as the strategic planning, budgeting and performance management module, implementation of the partner management, uniformed capabilities management, supply chain management and conference and event management modules; (c) deployed Umoja Mobile; (d) deployed the Member States’ contributions portal; (e) made operational and continuous improvements to the Umoja Foundation and Umoja Extension 1 processes; and (f) launched the United Nations business intelligence system.
55. With respect to capturing the entire cycle, including strategic planning, budget execution, monitoring and reporting, Management informed the Committee that the strategic planning, budgeting and performance management solution supported the full programme management life cycle, covering strategic planning, resource planning, programme execution and performance management. According to Management, the solution has been deployed to all Secretariat offices and entities as part of the Umoja Extension 2 deployments, which enabled the 2020/21 peacekeeping budget planning and performance management. The solution also facilitated the 2020 programme and budget management and enabled 2021 programme planning. Management also noted that progress continued on further integration of the Umoja solution for the voluntary contribution module to deliver a robust solution tailored to selected entities funded by voluntary contributions. Key components of this solution include project management, project budget planning and grantor management integration.
56. The Committee was further informed that the performance monitoring module, complemented by a performance dashboard deployed to all entities, enabled managers to visualize their results-based progress against the approved programme plan. With the ongoing Umoja Extension 2 deployments and continuous improvements delivered in the past few years, Management noted that Umoja offered an integrated information repository and improved reporting and analytical capabilities that were an integral part of the Organization’s strong emphasis on transparency, accountability and the better implementation of mandates.
57. The Committee continues to welcome the progress achieved in implementing Umoja. The Committee is aware of the December 2020 deadline to complete the implementation of Umoja. Given the importance of the enterprise resource planning system to the Organization, the Committee believes that it is imperative to ensure that the roll-out of the remaining modules is properly addressed.
Governance, risk and compliance module
58. In paragraph 84 of its report for the period from 1 August 2017 to 31 July 2018, the Committee noted that the governance, risk and compliance module was a critical enabler of a strong accountability system and should be considered high priority in the implementation of Umoja. The Committee further believes that a fully implemented governance, risk and compliance module will lead to more effective second and third lines of defence. The Committee is also of the opinion that a fully functional governance, risk and compliance module and a robust data analytics capability are not mutually exclusive, especially since not all auditors will be experts in data analytics. On that note, the Committee reiterated its previous recommendation that, in finalizing Umoja, Management should ensure that it has in place a module that will facilitate the work of both the second and third lines of defence.
59. Upon follow-up, the Committee was informed that the upgrade of SAP Governance, Risk and Compliance to version 10 was in progress and that production deployment was slated for the fourth quarter of 2020. According to Management, the subsequent deployment (version 12) will upgrade three key modules of the governance, risk and compliance suite of tools that the Organization is interested in: (a) process control, which will link to the statement of internal control; (b) risk management, which will link to enterprise risk management; and (c) access control, which may require re-engineering of the Umoja user access provisioning model. Regarding access control, the Committee was also informed that the current user provisioning process and technical design must be completely re-engineered and that the Organization must be extremely judicious in this decision, considering the risk and significant effort required.
60. Management further noted that all the above-mentioned steps would be undertaken within the context of: (a) a heavy Umoja Extension work plan for 2021; (b) pent-up demand for improvement of Umoja Foundation/Umoja Extension 1; (c) reduced resources when the project ends in 2020; and (d) efforts to exploit synergies with the statement of internal control and enterprise risk management projects.
61. While mindful of the conflicting priorities in implementing the remaining elements of Umoja, the Committee still believes that the governance, risk and compliance module is a critical enabler of a strong accountability system that can facilitate effective enterprise risk management, the statement of internal control and internal audit. The Committee therefore continues to recommend that its implementation be considered high priority.
Internal control system and anti-fraud policy
Statement of internal control
62. With respect to the statement of internal control, the Committee continued to receive regular updates from Management. According to Management, the strengthening of the Secretariat-wide internal control framework is a key enabler of the implementation of the Secretary-General’s management reform initiative, especially in the light of the significant change in the business model of the Secretariat derived from the delegation of authority framework. As noted in the Committee’s previous report, the statement of internal control is an accountability document that describes the effectiveness of internal controls in an organization. The Committee was previously informed that the statement of internal control was set around four main work pillars covering the assurance process, training, the Umoja governance, risk and compliance module and the Internal Control Advisory Group.
63. With respect to the Advisory Group, the Committee was informed that the Group continued to provide technical advice on the implementation of the statement of internal control across the Secretariat. Specifically, Management noted that the Group had advised on: (a) the approach and framework employed for adapting the United Nations Secretariat internal control environment to the integrated framework of the Committee of Sponsoring Organizations of the Treadway Commission; (b) the United Nations Secretariat entity-level controls, as adapted to that integrated framework; (c) the self-assessment questionnaire; and (d) the assurance statement.
64. Management further contended that the assurance statement would be a tool for managers to measure performance and manage risk. In addition, the statement of internal control will help managers to oversee a more decentralized and more risky environment.
65. In the intervening period, the Committee was informed that a pilot had been launched in the later part of 2019 (the Department of Economic and Social Affairs) and in January 2020 (Beirut-based entities: ESCWA, the United Nations Interim Force in Lebanon and the Office of the United Nations Special Coordinator for Lebanon) to review the process flow charts and the risk control matrices. On the basis of the outcome of the pilot project, the team would conduct the analysis of the responses to finalize the self-assessment questionnaire. Accordingly, the plan was to finish the entity-level controls and related documentation by June 2020. The Committee followed up with Management on the progress in that regard, and was informed that the entity-level controls had been documented, finalized and adapted to the 17 principles of the integrated framework of the Committee of Sponsoring Organizations of the Treadway Commission, and that they would be presented to the Management Committee in the fourth quarter. The Committee welcomes this significant milestone and looks forward to reviewing the controls at its next session.
66. The status of the governance, risk and compliance module is discussed extensively in paragraphs 58 to 61 above. The Committee nevertheless recalls paragraph 91 of its report for the period from 1 August 2017 to 31 July 2018 (), in which Management informed the Committee that the Organization was building the governance, risk and compliance platform in Umoja with the hope of issuing the first statement of internal control in the financial statements for 2020. The Committee was informed that Management was on track to issue the first statement of internal control in early 2021 for the 2020 fiscal period.
67. The Committee continues to see the relevance of a fully functional governance, risk and compliance module, as an important element with regard to the issuance of the statement of internal control, and believes that it will be implemented by December 2020 as planned.
68. The Committee thus commends the progress made so far and acknowledges the role of the Advisory Group in helping the Organization to develop a comprehensive statement of internal control. The Committee will continue to monitor and report on the status thereof in future reports.
Fraud and presumptive fraud
69. With respect to fraud and presumptive fraud, Management provided a summary of the cases for a period of three years (see table 6). As the table shows, there was a significant increase in the number of reported cases of fraud and presumptive fraud in 2019, compared with 2018. Management attributed the increase to improved reporting as a result of: (a) the fraud guidelines that have been revised to provide more details and a timeline; (b) regular reporting of fraud and presumptive fraud in health insurance claims from the Health and Life Insurance Section, Office of Programme Planning, Finance and Budget, to OIOS (in response to the 2018 audit observation); and (c) close coordination between the Office of Programme Planning, Finance and Budget and OIOS to ensure completeness in the reporting of fraud and presumptive fraud (in response to the 2017 audit observation).
Table 6
Fraud and presumptive fraud
|
|
Fraud |
|
Presumptive fraud |
||
|
|
Number of cases |
Estimated amount (millions of United States dollars) |
Number of cases |
Estimated amount (millions of United States dollars) |
|
|
|
|
|
|
|
|
|
2019 |
13 |
0.3 |
134 |
6.1 |
|
|
2018 |
6 |
3.6 |
26 |
2.9 |
|
|
2017 |
4 |
0.5 |
62 |
44.4 |
|
70. Despite the efforts of Management, the Board of Auditors noted, in its report on the financial statements of the United Nations for the year ended 31 December 2019 (A/75/5 (Vol. I)), that the existing mechanism of initially reporting fraud and presumptive fraud cases locally and then later reporting them to the Office of Programme Planning, Finance and Budget was not effective and led to belated reporting of cases of fraud and presumptive fraud to the Board, and that complete details of investigations were not available.
71. The Committee welcomes the efforts of Management to improve the reporting of fraud and presumptive fraud. The Committee nevertheless agrees with the Board that more needs to be done to improve the process.
End-of-service liabilities
72. With respect to the end-of-service liabilities, the Committee recalled its prior comments and recommendations (contained in its reports and ), in which the Committee had called upon the General Assembly to decide whether, how and to what extent the liabilities would be funded. Furthermore, during the Committee’s discussions with various offices, Management continued to consider as a major concern the issue of employee benefits liabilities, specifically after-service health insurance.
73. According to the Board of Auditors, after-service health insurance liabilities increased from $4.27 billion (Vol. I) as at 31 December 2018 to $5.39 billion as at 31 December 2019, representing an increase of 26.2 per cent. For peacekeeping operations (Vol. II), the after-service health insurance liabilities as at 31 December 2019 stood at $1.67 billion, up from $1.36 billion the previous year, representing a 22.8 per cent increase. According to the Board of Auditors, employee benefit liabilities constituted 82.9 per cent of total liabilities for non-peacekeeping financial statements, up from the 75 per cent figure reported the previous year.
74. The Committee enquired of Management the reasons for the increases in the after-service health insurance liability and was informed that they were due mainly to changes in actuarial valuation, especially the financial assumptions such as the discount rates and per capita claims. According to Management, the discount rate declined from 3.93 per cent in 2018 to 2.43 per cent in 2019, which led to a much higher present value for the future obligations.
75. The Committee continues to believe that for the United Nations to have after-service health insurance liabilities making up the largest share (currently 82.9 per cent) of the total liabilities presents, in and of itself, a significant risk which should be properly managed. Although, as noted in the Committee’s previous report, the General Assembly has decided to maintain the pay-as-you-go approach for after-service health insurance, the Committee notes that the Assembly continues to focus on this matter.
E. Coordination among United Nations oversight bodies
76. During the reporting period, in addition to its regularly scheduled meetings with OIOS, the Committee met with other oversight bodies, such as the Joint Inspection Unit and the Board of Auditors, including the Audit Operations Committee. The dialogue allowed for the sharing of perspectives on matters of mutual concern and provided a useful opportunity for cooperation among United Nations oversight bodies.
77. The Committee sought comments from the three oversight bodies, each of which emphasized, in their comments, the existing coordination mechanisms, including the sharing of their programmes of work. In separate meetings with the Board of Auditors, the Joint Inspection Unit and OIOS, the Committee noted the positive relationship fostered through the tripartite coordination meetings of the oversight bodies and the sharing of workplans in an effort to avoid duplication. The Committee believes that such coordination provides a valuable platform for additional opportunities for cooperation.
78. Furthermore, in December 2019, the Committee hosted a fourth meeting of the Chairs and Vice-Chairs of the United Nations system oversight committees. A total of 27 representatives from 21 oversight committees, from organizations within the Secretariat, the funds and programmes, and the specialized agencies attended the meeting.
79. During the meeting, discussions resumed, building on the previous meetings, with regard to common challenges and potential identification of good practices in the work and conduct of the United Nations system oversight committees. Participants continued to focus on how oversight committees can contribute to the assessment and understanding of organizational culture, the escalating and potentially unsustainable cost of after-service health insurance under a pay-as-you-go approach and the risk it presents, the evolving state of cybersecurity threats, potential skill-set deficits in cybersecurity, data analytics and data governance, together with the major findings in the reports of the Joint Inspection Unit on the Sustainable Development Goals, ethics offices and whistle-blower protection policies in the United Nations system.
80. Following the conclusion of the meeting, the participants agreed to convey the concerns outlined above to the Secretary-General, in his capacity as Chair of the United Nations System Chief Executives Board for Coordination. In his letter, the Secretary-General highlighted the progress the organizations had achieved in that respect.
F. Cooperation and access
81. The Committee reports that it received good cooperation from OIOS and senior management in the Secretariat, including the Department of Management Strategy, Policy and Compliance, in discharging its responsibilities. The Committee was given appropriate access to staff, documents and information that it needed in order to conduct its work. The Committee is pleased to report that it continued to work closely with the Joint Inspection Unit and the Board of Auditors. The Committee looks forward to continued cooperation with the entities with which it interacts in order to discharge its responsibilities, as set out in its terms of reference, in a timely manner.
IV. Conclusion
82. In the context of its terms of reference, the Independent Audit Advisory Committee presents the preceding observations, comments and recommendations, as contained in paragraphs 16, 21, 25, 31, 34, 40, 43, 45, 48, 51, 57, 61, 65, 67, 68, 71 and 75, for the consideration of the General Assembly.
[1] See Institute of Inte rnal Auditors Standard 2110-Governance; Standard 2120-Risk management; and Standard 2130-Control.