RESTRICTED  
  
WT/BFA/W/626  
 
 1 May 2023 
(23-2938) Page: 1/6 
Committee on Budget, Finance and Administration    
 
  
 
 
 
 
 
 
 
 
 
 
 
 
OFFICE OF INTERNAL OVERSIGHT  (OIO)  
AUDIT AND EVALUATION PLAN 2023-2024 
AND LAUNCH OF  INTERNAL CONTROL FRAMEWORK  
 
 
  WT/BFA/W/626  
 
- 2 - 
 
  Table of Contents  
1   BACKGROUND  ................................ ................................ ................................ ............  3 
2   INTERNAL CONTROL FRAMEWORK  ................................ ................................ .............  3 
3   AUDIT AND EVALUATION PLAN 2023 -2024  ................................ ................................  4 
ANNEX 1 – LIST OF ACRONYMS  ................................ ................................ .......................  6 
 
 WT/BFA/W/ 626 
 
- 3 - 
 
  - 3 - 
 
1  BACKGROUND  
1.1.  The Office of Internal Oversight (OIO ) provides independent and objective assistance to the 
Director -General, in respect of the staff and resources of the WTO, through internal audit, 
investigation, inspection, evaluation, ethical culture reviews, and other integrity risk assessment 
activitie s. 
1.2.  The OIO aims to (i) promote financial and operational efficiency and transparency through 
sound practices and procedures; (ii) identify potential savings and recoveries; (iii) identify and deter 
the occurrence of fraud, waste, abuse and misconduct ; (iv) reinforce a culture of accountability and 
strengthen the ethical climate within the Secretariat ; and (v) ensure risk mitigation through a 
systematic analysis of the major risks confronting WTO assets and resources.  
1.3.  The Office has the authority to initiate , carry out and prepare reports as it deems necessary to 
fulfil its responsibilities with regard to its oversight functions. This report  summarises the recently 
launched Internal Control Framework for the WTO Secretariat and sets out the OIO's Audit and 
Evaluation Plan for 2023 -2024. 
2  INTERNAL CONTROL FRAMEWORK  
2.1.  The OIO developed the Internal Control Framework (ICF) which was introduced  to Staff on 
19 April 2023. It sets out the key principles, components and structure of the system of internal 
control at the WTO , based on the established COSO model .1 The purpose of internal controls is to 
help the WTO to achieve its strategic and operational objectives in an ethical, efficient, and effective 
manne r, providing reasonable assurance in line with established industry standards.  
2.2.   The ICF is an evolving framework which draws together  and builds on existing policies, 
guidelines and processes  across the Secretariat . Key pillars of the ICF are the Staff Regulations 
(including the WTO Standards of Conduct) , Staff Ru les, Financial Regulations and Financial Rules . 
2.3.  As part of the framework, the OIO is in the process of developing and enhancing ethical policies 
including to prevent, detect, and deter fraud, theft, corruption , and other forms of misconduct . Over 
the past six (6) months  since its last report to the Committee on Budget, Finance and Administration 
(CBFA) , the OIO has made several recommendations to strengthen specific controls following 
investigations and other oversight activity.  
2.4.  The WTO's gove rnance of the ICF is based on the Three Lines of Defense  Model , promulgated 
by the Institute of Internal Auditors  (IIA).2 The Secretariat's roles and responsibilities in internal 
control are set out as follows:  
First line of 
defence  Staff members who  perform the activities that create or handle risks. They are responsible for 
designing and implementing controls to manage risks in their activities.  
Within the Secretariat, a number of entities and functions play an essential role in enforcing 
the Intern al Control Framework, including the Contracts Committee, Information Technology 
and Security Steering Committee and other committees and boards covering specific topics . 
The Director -General is overall responsible for implementing the Internal Control Fram ework, 
with support from DDGs and Directors. All staff members have a responsibility to ensure 
internal controls are in place and report any issues or weaknesses in the system.  
Second 
line of 
defence  The Chief Risk and Compliance Officer (CRCO) and the Of fice of the Legal Counsel (OLC) form 
the second line of defence. They support the first line by providing expertise and monitoring 
to ensure risks are effectively managed.  
The CRCO will be responsible for implementing and maintaining an Enterprise -Wide Ris k 
Management system (ERM) and robust compliance programme at the WTO. The CRCO will 
develop, monitor and update the WTO's risk register and risk taxonomy, conflict of interest 
register, gifts and outside activities register, completion of mandatory trainin g register, and 
 
1 The COSO Internal Control – Integrated Framework , May 2013  is the model adopted by most 
international organisations. Available at www.coso.org . 
A model promulgated by the Committee of Sponsoring Organisations of the Treadway Commission 
(COSO), which was endorsed by the Internat ional Organization of Supreme Audit Institutions (INTOSAI) . 
2 The Institute of Inte rnal Auditors (IIA) Three Lines of Defense  Model in Effective Risk Management and 
Control , January 2013  WT/BFA/W/626  
 
- 4 - 
 
  other registers or systems to monitor compliance with organisational policies and procedures. 
The CRCO will also provide training and advice to staff in risk and compliance related areas.  
Third line 
of defence  The Office of Internal Oversight (OIO) assesses the effectiveness of internal controls and 
provides assurance that the control culture is robust in its design and operation.  
2.5.  In addition to the three lines of defence, the ICF recognises the role of the External Auditor in 
evaluating internal controls as an integral part of both financial and performance audits, delivering  
additional advice as appropriate.  
2.6.  At the Member level, the  ICF acknowledges the roles of the General Council (and Members 
committees) and the Committee on Budget, Finance and Administration  (CBFA) in overs eeing 
internal control, risk and financial reporting . 
3  AUDIT AND EVALUATION PLAN 2023 -2024 
3.1.  The OIO's  audit and evaluation plan is based on current risks identified by the OIO from cross 
Divisional data analysis and inputs from the Secretaria t, including  from the Director -General and 
senior management. It also allows for  ad hoc audits and evaluations to r espond to emerging risks . 
Table 1 Audit and Evaluation Work Plan 2023 -2024  
Audit /Evaluation  
subject  Audit Scope/Objective  2023 2024 
Sick Leave  • Assessment of compliance with the Sick, family -related, 
and compassionate leave Policy (2017).  
• Evaluation of the efficiency and effectiveness of the Policy 
and any other controls in place for recording, reporting, 
monitoring and managing certified and uncertified sick 
leave;  
• Assessment of accuracy and reliability of data on sick 
leave ; 
• Comparison of sick leave data with relevant statistics and 
benchmarks as appropriate;  
• Identification of measures for mitigating any identified 
risks.  X  
Outside activities  • Assessment of policies and processes relating to the 
declaration, risk assessment, management and 
monitoring of outside activities;  
• Review of re munerated outside activities , including 
management of Staff Assistance Fund ; 
• Identification of measures for mitigating any identified 
risks.  X  
Information 
Security 
Management 
System (ISMS) 
Governance  • Initial scoping exercise by the OIO;  
• Resource -permitting, evaluation by a certified third -party 
auditor of the effectiveness  and efficiency of the WTO's 
ISMS, including  against the elements of the IS O 27001  
security standard.  X X 
Gifts, hospitality 
and gratuities  • Assessment of policies , processes and systems related to  
acceptance of gifts, hospitality, and gratuities from 
vendors and other  outside parties .  X 
Implementation of 
the Gender 
Equality 
Framework  Review of milestones (particularly relating to sexual 
harassment) ahead of triennial review of the Framework.   X 
 
Ethics and 
compliance 
programme gap 
analysis  Assessment and evaluation of actual vs. desired elements of 
an effective ethics and compliance programme (including 
roles, responsibilities, standards, policies, processes, training 
and education, internal monitoring and auditing).   X 
Environmental 
Social Governance 
(ESG) gap analysis 
and evaluation  ESG Evaluation will s tart in 2024 with environmental 
sustainability p olicies and practices of the Secretariat in 
management of its facilities and operations  (including water 
and waste management, recycling, reduction of energy 
consumption and other conservati on and protection 
measures).   X  
Ad hoc audits , 
inspections , risk 
assessments and 
evaluations  To be determined - respond ing to emerging risks as the WTO's 
risk maturity evolves .  - - WT/BFA/W/626  
 
- 5 - 
 
  3.2.  The OIO will continue to liaise with the External Auditors and will work with the Chief Risk and 
Compliance Officer to align its audits plans with a systematic and objective -centric risk framework, 
in accordance  with the International Professional Practices Framework ( IPPF).  The OIO will also 
continue  to monitor the implementation of internal and External Audit recommendation s, which it 
will report on in its activity report to the CBFA towards the end of the year.  
  WT/BFA/W/626  
 
- 6 - 
 
  ANNEX 1 – LIST OF ACRONYMS  
CBFA   Committee on Budget, Finance and Administration  
COSO   Committee of Sponsoring Organisations of the Treadway Commission  
CRCO  Chief Risk and Compliance Officer   
ESG  Environmental Social Governance  
ERM  Enterprise -Wide Risk Management  
ICF  Internal Control Framework  
IIA  Institute of Internal Auditors  
INTOSAI  International Organization of Supreme Audit Institutions  
IPPF  International Professional Practices Framework  
ISMS  Information Security Management System  
OIO  Office of Internal Ov ersight  
OLC  Office of the Legal Counsel  
WTO  World Trade Organization  
 
__________