UNFPA Management response.doc


Published on

Published in: Business, Economy & Finance
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

UNFPA Management response.doc

  1. 1. 2 June 2008 UNFPA Management Response Item 6: UNFPA internal audit and oversight activities in 2007 Executive Board of UNDP and UNFPA Annual Session 2008 Geneva
  2. 2. I. INTRODUCTION 1.In compliance with decision 2006/13, UNFPA is pleased to present its Management Response to the report on UNFPA internal audit and oversight activities in 2007 (DP/FPA/2008/11). This response is supplementary to DP/FPA/2008/11 and should be read in conjunction with that report. 2.As noted in DP/FPA/2008/11, UNFPA has taken important steps in the areas of accountability, assurance, risk management, internal controls, and fraud prevention over the last few years. UNFPA is strongly committed to continuous improvement in these areas. The present report focuses on how UNFPA is systematically addressing the key risks outlined in DP/FPA/2008/11. II. GLOBAL DEVELOPMENTS 3.During 2007 a number of milestones were reached. In September 2007, at the Second regular session, the Executive Board endorsed the UNFPA accountability framework that covers the same period as the UNFPA strategic plan, 2008-2011. The accountability framework provides the overall approach for UNFPA accountability and is closely linked to the strategic plan, which was also approved at the same session of the Board. Since September 2007, UNFPA has worked to operationalize these in part through the results-based biennial support budget, which was approved by the Executive Board at its First regular session in January 2008, and through the balanced scorecard, the organizational unit office management plan (OMP), and linked to this individual workplans using the performance appraisal and development (PAD) system. The reorganization of UNFPA is also a cornerstone of the operationalization of the strategic plan. Global risks and enterprise risk management 4.Managing risks is not new to UNFPA. The organization is faced with and manages its risk universe in a number of ways. At the country level, UNFPA participates in security risk assessment, assessment of implementing partners (financial management including harmonized approach to cash transfers (HACT) and programme implementation) and the fraud risk assessment/action plans that were undertaken for the first time in 2007 based on the fraud workshops. At the global level, UNFPA undertakes environmental scanning, business continuity planning, and risk aspects and reorganization- specific business continuity issues are part of the reorganization process. At all levels the internal control framework (ICF) is being implemented to manage and reduce risks. The UNFPA Division for Oversight Services uses a risk model, as noted in DP/FPA/2008/11, to select organizational units to be audited. 5.With the support of the Audit Advisory Committee (AAC), UNFPA is developing, in 2008, an enterprise risk management (ERM) approach which will ensure that all risk management-related initiatives will be coordinated and linked together. The ERM will take advantage of existing processes and procedures already in place in the organization. It will include ways to institutionalize the important work undertaken through the fraud risk workshops, including the fraud risk assessment and action plans. Ethics Office 6.In line with the Secretary General’s bulletin on ethics (ST/SGB/2007/11), UNFPA established an Ethics Office in January 2008. The functions of the UNFPA Ethics Office include: • Developing standards, awareness-raising, training and education on ethics issues, in coordination with various offices, including the UNFPA Division for Human Resources, the UNFPA Division for Oversight Services and the United Nations Ethics Committee; 2
  3. 3. • Providing individual advice and guidance to UNFPA staff members on ethical issues (e.g., conflict of interest); • Administering the UNFPA financial disclosure programme; • Undertaking the responsibilities assigned to it under the UNFPA policy for the protection of staff against retaliation; • Participating in the United Nations Ethics Committee. The UNFPA Ethics Office contributes to the Fund’s risk management strategy by supporting it in two ways: (a) taking steps meant to prevent unethical or fraudulent behaviour; and (b) reviewing cases of possible retaliation for reporting of misconduct. Advice and support from internal and external audit and the Audit Advisory Committee 7.UNFPA benefits from the regular interactions with the United Nations Board of Auditors (external audit) and from the work of the UNFPA Division for Oversight Services (internal audit), including through internal audit reports and the risk models applied to oversight by UNFPA. 8.Throughout 2007, UNFPA has increasingly benefited from the input of the Audit Advisory Committee with which UNFPA Management has regular interactions. Management is responding to the requests from and advice of the AAC and sees the value added by the AAC across a broad spectrum of issues such as the internal control framework, ethics, accountability framework and oversight policy, the International Public Sector Accounting Standards (IPSAS), reorganization, implementation of internal and external audit recommendations, national execution, and review of the unaudited financial statements for UNFPA. III. KEY AND RECURRENT AUDIT FINDINGS 9.The key and recurrent audit findings as identified in section IV of DP/FPA/2008/11 pertain to the 18 internal audit and oversight reports issued by the UNFPA Division for Oversight Services in 2007. As pointed out the internal audit and oversight reports are a selective source of information as each year the organizational units to be audited are selected based on the risk model and different organizational units are audited every year. In other words, the highest risk units are selected for audit. It can therefore be expected that there are some findings that recur over time. The following sections cover the management response to these key and recurrent findings. 1. Process risks Internal controls 10.UNFPA has taken a variety of steps to strengthen internal controls and increase transparency. Within the United Nations system UNFPA is committed to implementing General Assembly resolution 60/1 (of 16 September 2005) to be fully compliant with IPSAS by 2010. UNFPA actively participates in the inter- agency working group on IPSAS. Effective 2008, UNFPA records its expenses upon the delivery and receipt of services, a major step towards IPSAS compliance. Concurrently, the Atlas partner agencies have started the upgrading of the Atlas system. Within this upgrade, which is expected to be operational in 2008, implementation of configuration changes facilitating IPSAS compliance and tighter internal controls will be initiated. UNFPA is also an active participant in a system-wide effort to harmonize and 3
  4. 4. strengthen the financial rules and regulations. To this effect the United Nations Secretariat, UNDP, UNICEF, WFP and UNFPA are in the process of finalizing a set of harmonized rules and regulations. 11.Furthermore, UNFPA has taken additional measures to increase efficiency and to tighten internal controls. Jointly with UNDP, UNFPA is operating an oversight software to identify data errors and potential fraud in Atlas. UNFPA is following up on audit recommendations related to internal controls and has conducted a number of internal reviews on systemic weakness in the current operational procedures in Atlas. Working together with UNDP, the Fund has engaged the services of KPMG (a private firm) to review Atlas controls and determine how they can be further enhanced. This report is expected shortly and UNFPA, together with UNDP, will carefully review the recommendations. 12.UNFPA is also reviewing alternative sources for managing the vendor database in order to strengthen the control by eliminating segregation of duties conflicts. Internal control framework 13.The internal control framework is the key element of the security and control environment and assists all UNFPA offices in implementing effective internal controls. Following the initial issuance of the ICF, UNFPA has worked to enhance both the framework and its understanding and application. In March 2007, UNFPA expanded its ICF, in particular in the areas of the segregation of duties and approval functions in Atlas. The approval functions are now explicitly linked to the size and composition of country offices. The framework links the control mechanisms to responsibilities of the Fund’s organizational units and to the applicable guidelines, policies, rules and regulations. The ICF is a living document and UNFPA will revise it in light of the new organizational structure with a view to making it compliant with the Committee of Sponsoring Organizations of the Treadway Commission (COSO), taking into account the outcomes of the 2007 fraud workshops. 14.The application of the ICF and follow-up is an integral part of the Atlas/financial training workshops that are provided on a regular basis. During the UNFPA annual regional meetings and regular visits to country offices, pertinent internal control matters emanating from internal and external audit observations are raised and actions to be taken discussed. In order to enhance the awareness and understanding of and compliance with the internal control framework, UNFPA is developing an ICF certification programme. 15.Country offices are held accountable for reviewing and adjusting internal controls based on a review of overall or office-specific risks, guided by internal and external audit findings. General weaknesses are systematically addressed. In this context, a checklist has been issued of activities/controls to be regularly certified by country offices. The checklist includes the review of outstanding obligations and purchase orders, a verification of recorded assets and an analysis of staff receivables. 16.As mentioned in DP/FPA/2007/14, a Fund-wide fraud prevention and risk management programme was implemented in 2007 with a view to heighten awareness (especially of senior managers) and familiarity with risk management and the prevention of fraud. This included regional workshops combined with training on the essence of responsible financial management in all four regions and UNFPA headquarters. Each participating organizational unit was requested to prepare a fraud risk assessment of their office and to plan and implement a fraud prevention action plan to reduce and mitigate the risks identified. Results-based management and monitoring and evaluation 17.UNFPA is systematically implementing results-based management (RBM) to ensure that the organization’s processes, products and services contribute to the achievement of desired results (outputs, 4
  5. 5. outcomes, impacts). RBM systems are mainstreamed in UNFPA policies and procedures and for each programme funded by UNFPA. 18.To address the challenge of specific and measurable indicators and baselines and targets, UNFPA in its strategic plan has defined outcomes and indicators to reflect the organization’s unique niche and comparative advantage. Baselines as available have been included in the plan and are also envisaged to be collected through the 2007 annual reporting process. Following alignment of the country programmes with the strategic plan targets are developed. Country, regional and global programmes are required to have specific and measurable indicators for every programme output. 19.With regard to weaknesses in supporting documentation, UNFPA is ensuring that programme management units at all levels are accountable for implementing the RBM processes so that they can measure the impact of UNFPA-funded interventions. UNFPA geographical divisions/regional offices are held accountable to ensure that the RBM approach and monitoring and evaluation activities are considered in all country office OMPs. 20.In the area of annual reporting by country offices and headquarters, there has been progress in more timely submissions during the multi-year funding framework (MYFF) 2004-2007 cycle, which has been monitored globally through iTrack (impact tracking system). For the recent 2007 annual reporting exercise, 99 per cent of UNFPA country offices submitted the annual report on time within the deadline of 31 January 2008. 21.UNFPA has significantly advanced its RBM systems through developing and implementing various results management tools. Reporting mechanisms such as the country office annual report (COAR) create a capability to manage based on results (rather than just inputs) at the country and corporate levels. The implementation of iTrack has allowed for easier, quicker and more transparent reporting as well as usage of reports at country, regional and corporate levels. UNFPA will introduce additional tools to strengthen the objectivity and reliability of reporting. These include the partner surveys that are to be conducted in 2008, for the baseline, and in 2011 for the strategic plan end-line data. Also, a verification of annual report data/information is envisaged in selected countries in conjunction with the regular programme audits being conducted by UNFPA annually. Strengthening staff capacity for integration of results in management processes is also envisaged in this cycle. 2. People risks Vacancy management 22.Recruitment and placement of staff has been impacted by attrition rates due to the decreasing attractiveness and competitiveness of the United Nations system employment conditions as well as staff retirements, the difficult living conditions and increasing security concerns in a number of field duty stations. There is increased competition for suitable candidates from within the United Nations family of organizations, the private sector, and resource-rich non-governmental organizations (NGOs) and foundations. United Nations salaries and conditions of service are not as competitive as those offered in other sectors. In some instances delays in government clearance for positions of the UNFPA Representative have jeopardized UNFPA ability to maintain the interest of internal and external candidates. To address this situation, UNFPA is taking a multipronged approach. 23.UNFPA continues its recruitment drives, and periodically conducts accelerated competency-based recruitment campaigns. On a regular basis, senior management reviews the status of key vacancies with a view to reduce the vacancy period. The creation and expansion of dedicated rosters for key positions in the organization have contributed to further expedite the filling of vacancies. In addition, UNFPA 5
  6. 6. continues to explore systems and services that could enhance its ability to effectively and efficiently search for high quality candidates and process applicants. 24.For example, in September 2007, UNFPA successfully launched the basic version (phase I) of PeopleSoft e-Recruit, which enables the collection of applicant data through a web-based self-service system. The system conforms to best practices and standards, and has already improved the processing of application management. With over 10,000 applications a year, the system is expected to enhance the tracking of applications throughout the selection and recruitment process. Further customization to streamline the system and exploit its full functionality is an ongoing priority. 25.Furthermore, UNFPA has developed key elements of a succession-planning framework. The aim is to structure the planned management of the UNFPA workforce, linking it to recruitment and staffing development, with an emphasis on developing high-performing, talented and versatile staff with the potential for upward progression within the organization. 26.In addition, in order to attract and retain suitable candidates for important positions, UNFPA is making efforts to pay increasing attention to promoting the Fund as an attractive employer by focusing on developing an enabling work environment where staff are given opportunities to realize their potential and acquire new skills; supporting work/life balance; and ensuring staff well-being, safety and security. Contract management 27.Line managers are responsible for managing special service agreements (SSAs) and service contracts. In order to facilitate the administration and management of SSAs in particular, UNFPA is planning to develop its own SSA policy that will apply to all consultants (at headquarters and in the field), and which should help to ensure more consistency in the management of SSAs within UNFPA and minimize any possible confusion regarding which guideline to apply. 28.With the recent approval by the Executive Board, the creation of International Operations Manager posts is a new cadre of staff that will enhance significantly the managerial capacity of country offices and contribute to ensuring more consistent compliance with policies and standards. 29.In addition, with the advent of Atlas Wave 2, the administration of service contracts will be piloted in the human resource module. This will facilitate access to service contracts data, and improve UNFPA ability to monitor compliance with established policies and provide guidance and support where needed. 3. Relationship risks 30.UNFPA is strengthening efforts to optimize resources to provide integrated technical, programme and management support to programme countries as they integrate the goals of the International Conference on Population and Development (ICPD) as well as the Millennium Development Goals (MDGs) into their national plans and as they implement them. 31.The organization is addressing issues raised related to programme management in programme formulation and review, including selecting strategies which better target vulnerable groups and ensure stronger coordination among country programme implementing partners. Cognizant of the need for more use of operations research and evidence-based approaches to programme formulation and monitoring and evaluation, UNFPA is focusing more attention on results-based programming and greater quality assurance in programme formulation. 6
  7. 7. Promoting the use of national execution 32.National execution (NEX) is a priority for UNFPA in the new strategic plan, 2008-2011. In response to General Assembly resolution 62/208 on the triennial comprehensive policy review of operational activities for the development of the United Nations system (TCPR), adopted in December 2007, UNFPA will strive to harmonize its audit procedures and system with other United Nations partners, taking into consideration the Fund’s different execution modalities. UNFPA makes cash advances to governments where programmes are government-implemented or to NGOs where civil society organizations are engaged with the national governments. Timely submission of financial data has been a central concern for all. Some of the challenges can be identified as limited capacity for both UNFPA and implementing partners; while others clearly point to the need for closer monitoring of programme and financial management, including greater risk mitigation on the part of UNFPA. 33.The UNFPA management has reiterated its commitment to address NEX as witnessed, inter alia, by the appointment in April 2008 of an Executive Coordinator for national execution. NEX is one of the four highest priority areas for UNFPA, for 2008 and beyond, and requires implementation across all levels of the organization. 34.Other concrete steps taken by UNFPA include identifying measures to promote national execution. These have been incorporated into a guidance note with practical suggestions for country offices and include among others: • Training of implementing partner counterparts on project management skills and results- based management; • Provision of technical support to an implementing partner for an agreed time frame for capacity-building; • Short-term partnering of one implementing partner counterpart with another implementing partner with proven capacity in programme and financial management; • Appropriate training and equipment for implementing partners for projects that have staff working at the regional/district/unit level who are responsible for recording and reporting of expenditures to assist them in timely and accurate reporting of financial reports. 35.As the TCPR and the new aid environment requirements promote greater national ownership and national participation, a renewed effort is being made by UNFPA to ensure that country offices, jointly with the United Nations country teams enhance their collaboration for successful national execution. UNFPA will continue to work with other United Nations partners, the United Nations Development Group (UNDG) in particular, to promote the use of national execution and to build national capacity. This is already happening within the context of the UNDG harmonized approach to cash transfer which directly links the assessed implementing partners’ risk to the selection of cash transfer modality, and frequency of on-site visits, monitoring reports and audits. Thus, the oversight activities are more efficiently directed towards areas where UNFPA is exposed to risks. This risk-based approach, introduced in a phased manner, will provide greater assurance on the funds advanced to national implementing partners. The HACT also requires the United Nations system/shared United Nations partners to draw a capacity-building plan to address areas in need of strengthening, based upon the results of the micro-assessment. UNFPA has monitored the status of implementation of HACT and has also issued further guidance to staff. 7
  8. 8. 36.UNFPA is piloting an external access application for electronic submission of the HACT funding authorization and certificate of expenditures (FACE) forms. Following testing, this application will be offered to implementing partners. The application allows implementing partners to submit to UNFPA consistent and complete financial data through an online interface. This will further enable UNFPA and implementing partners to better manage flows of funds as well as timely financial reporting. 37.Revised standardized terms of reference for project audits have been developed and issued. These will contribute to the improvement of the quality of audits. A database for nationally implemented project audits launched recently is a strong tool for analysing the outcomes of the nationally implemented project audits. Managing risks related to national execution 38.While training of implementing partners on HACT has been conducted in most countries, longer-term capacity-building efforts are being explored. Monitoring of project audits was given a high priority as part of the organizational effort to address the issues related to NEX project audits. UNFPA divisions are ensuring significant improvement in the number of project audit reports uploaded into the system. In this efforts, headquarters is working closely with the country offices to take various actions, such as ensuring improved quality in data capture in the NEX database; following up more rigorously and regularly on missing audit reports; following up on a more timely basis on audit recommendations and unsupported and disallowed expenditure with implementing partners at country level; selecting regional auditors; supporting auditors with briefing kits about UNFPA rules, procedures and accounting policies and practices; and reviewing terms of reference of NEX projects. 4. Technology and systems risks Security and control environment in Atlas 39.Access to Atlas financials and human resources modules is based on defined roles and associated permission lists which have been assigned to individual profiles. The ICF has defined the segregation of duties in detail. Atlas roles have also been defined in a way that does not allow violation of segregation of duties as defined in the ICF. UNFPA is reviewing exception reports and dashboard indicators that monitor activities of certain Atlas profiles. As noted above, a review of Atlas controls by KMPG is ongoing. 40.UNFPA, together with Atlas partners, has introduced a number of audit trails in Atlas financials on the basis of the recommendations of external consultants. The audit trails perform the function of recording all access to relevant data fields whether for the purpose of reading, writing, deleting or modifying the data with appropriate time and date stamp as well as the user-ID linked to these actions. No person can have access rights to modify the audit trail. This is the normal way audit trails work. 41.Information security and controls in UNFPA are evolving. The controls and security in UNFPA country offices where no adequate level of technology personnel exist are at risk of being low. For this reason, UNFPA information technology standards advocate that no application will be developed and hosted in country offices. All applications will be hosted at headquarters with appropriate access rights to staff in all locations. This model ensures that security around applications is tight and data is centrally located and has appropriate disaster recovery and data backup procedures established. UNFPA has also made available the e-Files system to enable staff all over the world to store their local data and documents on central servers at headquarters. This helps reduce the vulnerability of data and computers in country offices. Like all other data on the headquarters servers, e-Files are protected with the backup and disaster recovery process. 8
  9. 9. 42.The headquarters servers are backed up daily, and the backups are transmitted under encryption to two different external sites. Furthermore, the anticipated disaster recovery site at UNICC (United Nations International Computing Centre) in Geneva is in the process of being completed. This site will have the ability to go live if any of the servers in New York fail for some reason. UNFPA is also working with the Chief Information Technology Officer (CITO) at the United Nations through High-Level Committee on Management information and communication technology network to explore the possibility of using a common disaster recovery site located in Brindisi, Italy. 5. External risks 43.UNFPA is strongly committed to staff security and has in place a small global and regional UNFPA security team that works closely with and is an integrated part of the United Nations Security Management System. The UNFPA security team advises and provides support to offices in order for them to conform with the United Nations system-wide agreed security standards. In parallel with the increased security risks with which the United Nations in general and UNFPA in particular is faced, as evidenced by the Algiers bombing, UNFPA staff at all levels have been made aware of the risks and the need to mitigate and manage these risks. IV. OVERVIEW OF FOLLOW-UP ON IMPLEMENTATION OF INTERNAL AUDIT FINDINGS Institutionalized follow-up process 44.The UNFPA follow-up process for internal audit recommendations, as is the case with external audit recommendations, is institutionalized and systematic. The first step is the accountability of the head of the organizational unit that has been audited to ensure that all audit recommendations are closed within a certain deadline. The second step is that on a quarterly basis the UNFPA Operations Committee reviews the status of implementation based on updated reports from the enhanced internal audit recommendation database (CARDS II). Latest status 45.With reference to the annex, it is important to note that for those internal audit recommendations issued in 2005 and 2006, which are older than 18 months, 95 per cent of the recommendations are closed, 4 per cent are in progress and the status is unknown for 1 per cent. Last year, the comparable figures for 2004 and 2005 were 84 per cent closed, 14 per cent in progress and 2 per cent unknown. This clear improvement is a reflection of the significant effort that UNFPA has undertaken to clear out and close old audit recommendations. This effort will continue until all recommendations issued have been closed and special attention will be given to those audit recommendations issued in 2007, where follow-up is still in progress partly because most of the reports were issued during the second half of 2007. Even so, 84 per cent of all recommendations issued in 2005, 2006 and 2007 are closed at this stage (i.e., as of 15 April 2008), with 15 per cent in progress and 1 per cent with status unknown. In comparison, in April 2007, recommendations from 2004, 2005 and 2006 were 72 per cent closed, 15 per cent in progress and 13 per cent with status unknown. V. CONCLUSION 46.UNFPA management is strongly committed to continuously improving and addressing issues raised by internal auditors, external auditors and the Audit Advisory Committee with a view to making UNFPA an 9
  10. 10. even more efficient and effective organization that assists countries in implementing the ICPD Programme of Action and achieving the MDGs. 10
  11. 11. Annex Status of Implementation of Internal Audit Recommendations as per 15 April 2008 Year Recommendations (%) Total Closed In Status Progress Unknown 1 2005 100% 98% % 0% 2006 100% 94% 5% 1% 2007 100% 42% 56% 2% All 3 years 100% 84% 15% 1% Note: “Status Unknown” means that no entry has been made by the unit audited in the recommendation tracking database. It does not necessarily mean that no action has been taken by the unit. Similarly, “In progress” data are based on the latest information entered in the database. Since the last entry the recommendation may in fact have been closed. Older than Recommendations (%) 18 months Total Closed In Status Progress Unknown 4 100% 95% % 1% Note: “Status Unknown” means that no entry has been made by the unit audited in the recommendation tracking database. It does not necessarily mean that no action has been taken by the unit. Similarly, “In progress” data are based on the latest information entered in the database. Since the last entry the recommendation may in fact have been closed. 1 4 11