FC 109/13 |
|
FC 109/13 |
Hundred and ninth Session |
Rome, 9 – 13 May 2005 |
Internal Controls Reporting |
III. INTERNAL CONTROL REPORTING IN OTHER UN ORGANIZATIONS
1. During the 107th session of the Finance Committee in May 2004, the issue of introducing formal internal control reporting in FAO was discussed. As noted during that session, the Organization would, in principle, have no objection to the introduction of such reporting which would be issued with the Audited Accounts (Cf. Report of the Hundred and Seventh Session of the Finance Committee, 10-18 May 2004, Document CL 127/14).
2. The Committee requested that the secretariat perform a study of what other organizations in the UN system were doing in relation to internal control reporting and that this be reviewed in the context of FAO Financial Regulations to ensure any action proposed was in accordance with current provisions. The Committee further requested that a paper be presented to a future session of the Finance Committee presenting the results of the abovementioned study and outlining current best practice in internal control reporting and the issues involved in introducing such reporting within the Organization. This document has been prepared in response to the above request.
3. Advice was sought from the Organization’s Legal Counsel regarding the compatibility of formal internal control reporting with the FAO Financial Regulations. In this regard Legal Counsel has confirmed that, while such reporting was not specifically envisaged under the Financial Regulations, no legal provision existed in the FAO Basic Texts which would constrain or limit the issuance of such a report.
4. As part of the study, other organizations in the UN system were contacted to obtain information on what these were doing in relation to internal control reporting. Whilst none of the organizations contacted has yet reached the stage of implementing formal internal control reporting, several are considering or are already working towards the implementation of such reporting.
Organization |
Response |
ILO |
ILO is not considering the introduction of formal internal control reporting at this stage but is following the developments with interest. |
WHO |
WHO currently has no formal internal control reporting but as the issue has been raised by the External Auditor it will be considered during the current biennium. Possible reporting may include text in either the Director General’s introduction to the Financial Report or as a separate section noting the Director General’s responsibility to maintain an internal control framework, an internal audit framework and related matters to do with accountability and fraud prevention policies. |
IMF |
While IMF currently has no formal internal control reporting, work is under way in their Finance Department to put in place internal control and reporting mechanisms that will provide a more documented basis for providing assurances on the quality of the controls applied to the finances of the IMF. |
IFAD |
During its session in March/April 2003, the IFAD Audit Committee requested that the internal control framework be fully documented and its adequacy assessed. The Secretariat agreed to put in place a process to assess the internal control framework and draw up an action plan for a review of the implementation of internal controls, follow-up of identified weaknesses and then report on progress each April. No decision has yet been reached to proceed with formal internal control reporting but a risk assessment and documentation of the control framework at a high level has been performed. |
IAEA |
IAEA currently has no formal internal control reporting. The reply received noted, however, that this is the first year of a new External Auditor and that requests for such reporting may come shortly. |
UNDP |
UNDP currently has no formal internal control reporting but their External Auditor recommended in the latest report that UNDP consider the disclosure of items in the financial report relating to oversight, performance reporting, social accounting issues, risk management, continuity and internal control. |
UNHCR |
UNHCR currently has no formal internal control reporting but their External Auditor has mentioned that this may be requested in the future. |
WFP |
WFP has committed to the introduction of a formal Statement of Internal Control but no decisions have yet been taken on scope of report, framework, timing or implementation planning. The Internal Audit department is currently carrying out an audit of internal controls at an overview level which will include some advice on possible ways forward. A basis for the reporting is expected to be provided also by the organization-wide risk management and training exercise currently underway. |
5. It is important to note that the introduction of formal internal control reporting within an organization requires a lengthy and intensive process consisting of several distinct stages including, among others:
6. Such a process necessarily involves significant initial investments in the form of both staff time and expert advice. Furthermore, the maintenance of the reporting system in the years following initial implementation, including regular update and testing as well as maintenance of formal documentation, require significant resources on a continuous basis.
7. Indeed, according to information received from one of the large accounting firms, the implementation and maintenance of formal internal control reporting, be it in line with that implemented by the World Bank or in accordance with the legislation and standards introduced in the US or UK, is onerous and costly. As an example, according to a survey carried out in the United States1 the average cost for implementing Section 404 of the Sarbanes-Oxley Act is estimated to amount to over US$ 3 million in the first year, including internal staff time of over 25,000 hours and an average increase in fees for external audit of approximately 50%. Costs for maintaining the reporting system are expected to decrease after the year of initial implementation but will remain significant.
8. In the case of FAO, which is a large and complex organization with a large number of decentralised offices, the likely cost of introducing formal internal control reporting of the sort envisaged by recent legislation for companies in some member countries would be high due to the significant amount of staff time and expert advice required. In view of the above, key decisions for FAO include:
9. The Finance Committee is invited to review the present document and provide such guidance as deemed appropriate.
____________________
1 FEI Survey on SOX Section 404 Implementation/July 2004. Copyright FEI, 2004.