World Food Program: Stronger Controls Needed in High-Risk Areas
Highlights
What GAO Found
The design of the United Nations (UN) World Food Program's (WFP) internal controls related to delivery and monitoring of food assistance generally reflects principles for internal controls and enterprise risk management developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). WFP has developed an internal control framework that has, like the COSO internal control framework, five components: internal environment, risk management, control activities, information and communication, and monitoring. However, the design of some of WFP's controls has weaknesses that could expose WFP to risks such as waste, fraud, and abuse. For example, WFP's Executive Board oversight is limited, and it does not fully utilize the WFP Audit Committee to assist in overseeing the effectiveness of WFP's risk management and internal control processes. Also, WFP has designed risk management policies but has not developed detailed guidance to instruct staff in addressing risks, especially at the country level where WFP is most vulnerable. Additionally, as recommended by COSO, WFP has established control activities that address risks to its objectives--for example, policies and procedures designed to help ensure tracking of food assistance from delivery at the port-of-entry to distribution to beneficiaries. However, weaknesses in the design of its commodity tracking system, including lack of capacity to track food in implementing partners' custody, limit WFP's ability to account for all food in these partners' custody. Further, WFP has developed detailed policies for monitoring distribution of food assistance to beneficiaries, in line with COSO principles, but has not provided guidance that instructs staff to consider risk when determining needed levels of monitoring, including in high-risk areas where WFP staff have limited access.
In the areas of Ethiopia, Kenya, and Somalia that GAO selected for its review, WFP has implemented procedures as designed for tracking and monitoring food assistance in its custody from port-of-entry to beneficiaries. However, WFP's ability to account for food in the custody of implementing partners is constrained by the lack of tracking through its commodity tracking system, lack of timely reporting by some partners, and a limited number of monitors. In addition, security restrictions have limited WFP monitors' access to partners' warehouses and distribution sites in some high-risk areas. For example, in six districts in the southeast area of Ethiopia, WFP has not monitored implementing partners' distribution sites since May 2011. Some of these factors may also limit WFP's ability to provide accurate reporting of food assistance losses. Because its system does not track food in implementing partners' custody and because of WFP's restricted access to some sites, its calculation of food losses relies in part on partners' distribution reports. However, these reports are sometimes late and inaccurate. Although operating in Somalia is inherently challenging, WFP reported an average loss rate of 0.25 percent for Somalia from 2007 through 2011, compared with 0.41 percent for WFP's operations globally. Moreover, despite concerns expressed by some WFP donors and Executive Board members, no external evaluation of WFP’s food loss data has been conducted since a 2006 review by WFP’s External Auditor. In that report, the Auditor noted that inadequate reporting of losses not only presents risks to the effectiveness of WFP’s aid efforts and the achievement of its objectives but also presents reputational risks in terms of donor confidence.
Why GAO Did This Study
In 2011, WFP provided about $4 billion in food assistance--including U.S. contributions of about $1.2 billion--to about 99 million beneficiaries in 75 countries. Many of these countries include high-risk areas where WFP staff have limited access. In 2009, a media report alleged that large amounts of WFP's food assistance were being diverted in one of these countries, Somalia. Subsequent external and internal audits found deficiencies in WFP's control of its Somalia operations. In response, WFP took steps to strengthen its controls, including adopting the COSO internal control framework. To assess WFP's ability to help assure that food reaches intended beneficiaries in high-risk areas, GAO examined the extent to which (1) the design of WFP internal controls related to delivery and monitoring of food assistance reflects COSO principles and (2) WFP has implemented as designed certain controls in selected high-risk areas. GAO reviewed COSO and other international principles; reviewed WFP policies, documents, and data; and interviewed WFP and U.S. officials. GAO conducted case studies of Ethiopia, Kenya, and Somalia.
Recommendations
GAO recommends that the Department of State work through WFP's Executive Board to ensure that management and the board take several actions to strengthen WFP's ability to manage risks inherent in some environments as well as utilize the Audit Committee more fully and report losses more accurately. WFP, State, and other relevant U.S. agencies agreed with GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of State | To strengthen WFP's ability to manage the risks inherent to operating in high-risk areas such as Somalia, the Secretary of State should work with WFP's Executive Board to develop a plan for more fully utilizing the WFP Audit Committee to assist the board in monitoring the effectiveness of WFP's risk management and internal control processes. |
State, USAID, and USDA agreed with the recommendation. In January 2014, a representative of the U.S. Mission to the United Nations Agencies in Rome informed us that the United States had advocated for and fully supported the Executive Board's decisions to make better use of the Audit Committee as outside experts on WFP oversight, including as it relates to advising the Executive Board and the Executive Director on WFP's risk management. In addition, according to a representative of the U.S. Mission to the United Nations Agencies in Rome, with urging from the United States, the Board had agreed to have members of the Audit Committee visit WFP field operations; such visits began in 2014. In the summary of the work of the annual session of the Executive Board for 2015, board members viewed the Audit Committee as a welcome source of additional assurance on WFP's work, including the Audit Committee's views regarding WFP's improved risk management. In addition, Board members mentioned the value of visits to WFP's field operations as a means of providing the Audit Committee members with insights into WFP's work. A representative of the U.S. Mission to the United Nations Agencies in Rome also informed us that, consistent with our recommendation, the process has been enhanced for the Board to consult with the Audit Committee during its official visits to WFP headquarters and that the United States consults directly with Audit Committee members on WFP performance relative to internal control systems, risk management, audit and oversight functions, and governance processes.
|
| Department of State | To strengthen WFP's ability to manage the risks inherent to operating in high-risk areas such as Somalia, the Secretary of State should work through WFP's Executive Board to ensure that WFP management provides comprehensive risk management guidance addressing key elements of the risk management process, such as identifying, assessing, and responding to risks. |
State, USAID, and USDA agreed with the recommendation. In January 2014, a representative of the U.S. Mission to the United Nations Agencies in Rome informed us that the United States has consistently urged WFP after weaknesses were identified in 2008 and in subsequent audit reports to complete necessary work on its risk management framework and that following the GAO report and new leadership at WFP in 2012, serious efforts to intensify and accelerate the work of addressing risk management have been undertaken at WFP. In 2014, WFP updated and developed new risk management guidance for staff that addresses key elements of the risk management process including on identifying and classifying risks, methodology for assessing the severity of risks, and a framework for responding to identified risks. The updated guidance also includes procedures for staff to follow in developing country risk registers, which capture key elements of the risk management process. Further, in 2016 WFP revised its Risk Appetite Statement, which reflects its overall approach to risk management, including its risk tolerance.
|
| Department of State | To strengthen WFP's ability to manage the risks inherent to operating in high-risk areas such as Somalia, the Secretary of State should work through WFP's Executive Board to ensure that WFP management revises WFP's monitoring guidance to specify that field monitoring activities should be risk based. |
In agency comments, State, USAID, and USDA agreed with this recommendation. Although the State Department has been successful in urging WFP to develop and update risk management guidance, it has not been successful in convincing WFP to specify in its guidance that field monitoring activities should be risk based. In our September 2012 report (World Food Program: Stronger controls needed in High-Risk Areas), we stated that WFP's organization-wide monitoring guidance does not clearly state that monitoring of warehouses and distribution sites should be based on risk, including risks to WFP's ability to distribute food to intended beneficiaries in high-risk areas. Since 2014, we have reviewed several of WFP's updated guidance on monitoring, but these still do not address our recommendation. According to a representative of the U.S. Mission to the United Nations Agencies in Rome, WFP recently reiterated its position that risk analysis should not be driving their monitoring and that every household and distribution point must have an equal chance of being monitored. We reported that, however, in 2006 WFP's external auditor recommended that WFP use statistical sampling approaches based on risk profiling and informed by implementing partner records, beneficiary concerns, and prior history, as a basis for focusing its monitoring resources. We maintain that risk based monitoring is a practical approach since WFP has a limited number of monitors.
|
| Department of State | To strengthen WFP's ability to manage the risks inherent to operating in high-risk areas such as Somalia, the Secretary of State should work through WFP's Executive Board to ensure that WFP management provides organization-wide guidance for addressing monitoring deficiencies in areas inaccessible to WFP monitors because of security restrictions. |
State, USAID, and USDA agreed with the recommendation. State and WFP have taken actions to implement this recommendation. In January 2014, a representative of the U.S. Mission to the United Nations Agencies in Rome informed us that the United States had urged WFP to develop and adopt guidance for third-party monitoring, and that WFP had drafted terms of reference for guidance on third-party monitoring, which it expected to develop and disseminate in 2014. At that time, the representative of the U.S. Mission to the United Nations Agencies in Rome also said that the United States would continue to urge WFP to develop and adopt guidance for third-party monitoring. In June 2014 WFP published organization-wide guidelines on third-party monitoring to address situations where WFP staff face serious access or security constraints. The guidelines include step-by-step instructions, from determining whether to use third-party monitoring to managing third-party entities.
|
| Department of State | To strengthen WFP's ability to manage the risks inherent to operating in high-risk areas such as Somalia, the Secretary of State should work through WFP's Executive Board to ensure that WFP management requires periodic external evaluations to assess and improve the reliability of data on food assistance losses. |
In agency comments, State, USAID, and USDA agreed with this recommendation. The State Department has worked through the executive board to implement this recommendation. In our we stated that although WFP takes steps to collect accurate loss data, several factors -- limited access to implementing partners' warehouses and distribution sites in some high-risk areas, lack of timely reporting by implementing partners, and limited beneficiary reporting -- weaken WFP's ability to verify implementing partners' reporting on food in their custody. We also stated that despite concerns expressed by WFP donors, executive board members, and WFP's external auditors, WFP had not engaged an external party to conduct an evaluation of WFP's loss reporting since the external auditor conducted its last evaluation in 2006. In September 2016, a representative of the U.S. Mission to the United Nations Agencies in Rome, on behalf of the State Department, informed us that it has successfully worked through the WFP's executive board to ensure that WFP?s external auditor include in its current work plan a performance audit on food assistance tracking and losses. The representative of the U.S. Mission to the United Nations Agencies also said that they will continue to work through the executive board to encourage additional periodic external evaluations.
|