RESTRICTED  
  
WT/BFA/W/484  
 
5 June 2019  
(19-3864) Page: 1/20 
Committee on Budget, Finance and Administration    
 
  
 
 
 
 
 
 
 
 
 
 
 
ANNUAL REPORT  
ON THE ACTIVITIES OF THE OFFICE OF INTERNAL OVERSIGHT  (OIO)   
2018-2019 
 
 
  WT/BFA/W/484  
 
- 2 - 
 
  Table of Contents  
 
1   BACKGROUND  ................................ ................................ ................................ ............  3 
2   INDEPENDENT STAT US OF THE OIO  ................................ ................................ ...........  3 
3   BUDGET AND STAFF ING ................................ ................................ .............................  3 
3.1   Budget  ................................ ................................ ................................ .............  3 
3.2   Staffing  ................................ ................................ ................................ ............  4 
4   ACTIVITIES CONDU CTED BY THE OIO SINC E JUNE 2018  ................................ ............  4 
4.1   Build thrust on the WTO internal control and internal justice mechanisms  .................  5 
4.2   Conduct internal investigations  ................................ ................................ ............  6 
4.3   Complete the  OIO's Internal Audit Plan for 2018 -2019 ................................ ...........  7 
4.4   Provide support and advice to management, staff and stakeholders  .........................  8 
5   INTERNAL OVERSIG HT ACTIVITY FOR 2019 -2020  ................................ .....................  8 
 
ANNEX 1 - INTERNAL A UDIT PLAN FOR 2018 - 2019  ................................ .....................  10 
ANNEX 2 - INTERNAL A UDIT PLAN FOR 2019 - 2020  ................................ .....................  11 
ANNEX 3 - STATUS OF INTERNAL AUDIT RECOM MENDATIONS (1 JUNE 2 019)  ..............  12 
ANNEX 4 – INTERNAL C ONTROL FRAMEWORK FOR  THE WTO SECRETARIAT  .................  13 
ANNEX 5 - LIST OF AC RONYMS  ................................ ................................ .....................  20 
 
 
 WT/BFA/W/ 484 
- 3 - 
 
  1  BACKGROUND  
1.1.  The Office of Internal Oversight (OIO), established in November  2015, is in charge of 
conducting i nternal audits, investigations and any other form s of assessment that may be needed  
in respect of management, staff and resources of the WTO ; and to provide fo r a professional, 
independent, objective and documented assessment of management practices, expenses, budgetary 
control and allegations of misconduct.  
1.2.  Pursuant to t he Administrative Memorandum No.9741, the OIO shall report annually to the 
Committee on Budg et, Finance and Administration ( CBFA) providing , for information, an overview 
of the activities conducted during the year  and indicating any circumstances that it considers may 
have affected its independence or otherwise impeded its ability to fulfil its f unctions.  
1.3.  In the first section of this report, t he Head of the OIO confirms the independence of the internal 
oversight function at the WTO . The second section of the document is dedicated to the budget and 
staffing of the OIO. The third section of the docu ment provides details on the activities conducted 
by the OIO during the year. Finally, the priorities of the OIO for 201 9-2020 are described in the last 
section of the report .  
2  INDEPENDENT STATUS OF THE OIO  
2.1.  OFFICE(15)/101, consistent with t he International Standards for the Professional Practice of 
Internal Auditing (hereafter referred to as the  IIA Standards )2 require s the OIO to remain 
independent and free from interference when performing its work, and to confirm its independence  
to a level within the organization that allows the internal oversight activity to fulfil its responsibilities.   
2.2.  Based on this, the Head of the OIO is required to confirm to the Director -General and to the 
CBFA, every year,  that the OIO remains  functionally and operat ionally independent from the 
Secretariat and from  WTO Members in the conduct of its  duties .  
2.3.  In this framework , the Head of the OIO certifies that no circumstances have affected, in fact 
or appearance, the independence of the OIO or impeded its ability to effectively fulfil its functions 
and responsibilities in an unbiased, objective and independent manner . Neither the Director -General 
nor any other WTO senior official  have tried to influence or otherwise interfered with the work of the 
OIO. 
2.4.  The OIO has received full and unrestricted access to all WTO records and staff members . The 
Head of the OIO ha s also been granted  direct and unrestricted access to the Director -General, senior 
management and the Chair of the CFBA.  
3  BUDGET AND STAFFING  
3.1.  In accordance wit h IIA Standard 2030, Resource Management,  the Head of the OIO must 
ensure that internal oversight resources are appropriate, sufficient, and effectively deployed to 
achieve the Internal Oversight work plan.  
3.1  Budget  
3.2.  The OIO has its own operational budget , which  was determined by the Director -General, upon 
the entry into function of the Head of the OIO  (i.e. September 2016) . The budget allocated to the  
OIO for 2018 and 201 9 is detailed in Table 1 – Budget and actual costs of the OIO (in CHF), along 
with the actual costs incurred during the period (up to 30 April 201 9). The OIO budged for 2019 
remains unchanged, when compared to 2018.  
                                                
1 Administrative Memorandum No.974  - Office of Internal Oversight, OFFICE(15)/101, 
30 November  2015.  
2 The International Standards for the Professional Practice of Internal Auditing , promulgated by the 
Institute of Internal Auditors (IIA), provide a principle -focused and mandatory framework for performing and 
promoting internal auditing – For more details : https://na.theiia.org/standards -guidance . WT/BFA/W/484  
 
- 4 - 
 
  Table 1 - Budget and actual costs of the OIO (in CHF) 
  2019  2018  
Account Description  Budget  Actuals  Budget  Actuals  (30 April)  
Staff / Salary (including pension)    410,900    111,553  410,900  329,912 
Short -Term Staff   -     37,249   -   61,303  
Special Service Agreements     15,000   -  15,000   -  
Air & Rail Transportation       8,000       4,253  8,000    8,307  
TOTAL   433,900   153,055  433,900  399,522  
 
3.3.  The OIO consumed  92 percent of its annual budget in 201 8, and 35 per cent of the budget  in 
2019 (up to 30 April 201 9).  
3.2  Staffing  
3.4.  The OIO is currently composed of the Head of Office (Grade 10) and an Administrative Assistant 
(Grade 4).  An investigator (G rade 7) was hired on short -term contracts in order to provide support 
with on -going investigations.  
3.5.  The need for additional resources for the O IO has been recognised. Taking into account 
benchmarks provided by the United Nations Joint Inspection Unit (JIU) and other International 
Organizations regarding internal oversight staffing, the Administration has decided to reinforce the 
OIO with at least  one additional Internal Oversight professional.  
3.6.  Looking forward, t he position of Investigator (Grade 7) was published on 15 May 2019 (Vacancy 
Notice No. EXT/F/19 -26 – Application deadline: 12 June 2019) , and t he selection process is expected 
to be final ized in Q3 2019.  
3.7.  Also, taking into consideration the increasing number of investigation cases brought in front of 
the Joint Appeals Board (JAB), the OIO requested to have access to legal advisory services , as 
needed . In order not to jeopardize its independ ence, the OIO is currently preparing  a procedure for 
such consultation s with the Legal Counsel to the Administration . 
4  ACTIVITIES CONDUCTED BY THE OIO SINCE JUNE 201 8 
4.1.  Based on a risk -based approach  and consultations with Senior Management , the OIO identified 
the following priorities  for 201 8-2019:3 
 
• Build thrust on the WTO internal controls and internal justice mechanisms ;  
• Conduct internal investigations;  
• Complete the ass ignments included in the O IO's I nternal Audit Plan for 201 8-2019; and 
• Provide support and advice to management, staff and stakeholders.  
  
                                                
3 See document WT/BFA/W/451 – Annual report on the activities of the Office of Internal Oversight 
2017-2018, 12 June 2018. 
 WT/BFA/W/484  
 
- 5 - 
 
  4.1  Build thrust on the WTO internal control and internal justice mechanisms  
Define the Internal Control Framework:  
4.2.  In accordance with Financial Reg ulation 4 , which  stipulates that the  WTO financial regulations 
shall be reviewed by the CBFA at least every four (4) years , the CBFA recently reviewed  the Financial 
Regulation 38 . The revised Financial Regulation 38  states that  ''the Director -General shall  maintain 
[…] an internal control  system which shall ascertain the accomplishment of established operational 
objectives; compliance with policies, procedures, rules and regulations; and safeguarding of 
assets ''.4 
4.3.  In line with the  revised Financial Regulation 38, t he OIO  and the Administration and General 
Services Division (AGSD) prepared a document defining the  Internal Control Framework5 in place at 
the WTO . The objective of this Internal Control F ramework is to identify the diff erent internal control 
actors and processes at the WTO, to provide reasonable assurance to the Director -General with 
regards to  the achievement of WTO objectives, and to guide  the WTO Secretariat in the 
establishment of internal controls, in order to ensur e that (a) o perations are executed in an  ethical , 
economical,  efficient , and effective manner;  (b) accountability obligations are fulfilled;  (c) WTO 's 
assets and resources are safeguarded against loss, misuse or damage ; and (d) operations are 
conducted in c ompliance with applicable regulations, rules , policies  and administrative memoranda.  
 
4.4.  The WTO Internal Control Framework is annexed to this report (see Annex 4 - Internal Control 
Framework for the WTO Secretariat ). The Framework is an evolvi ng document, which will need to 
be periodically updated.  
 
Reinforce the i nternal justice mechanism  and promote a harmonious working environment : 
 
4.5.  The WTO conducted, in 2018, a detailed Job Satisfaction Survey , aimed at  gauging the 
satisfaction of staff members at the WTO and identify ing areas for improvement . The Survey showed 
that there is a need to enhance staff's trust on the internal justice system, so as to increase 
confidence to report breaches of the Standards of Conduct . According to the Survey, m ore than 20% 
of the staff members did not feel comfortable to report breache s of the Standards of Conduct to 
supervisors or senior management.  
 
4.6.  With the results of the Survey in mind, t he OIO participated to several initiatives aiming at 
promoting  an ethical culture  and environment  at the WTO, and at enhancing staff members' 
knowledge of the WTO internal justice mechanisms :  
 
a. The OIO publicized  the anti -harassment policy6, release in April 2018, which promotes 
an efficient working environment  at the WTO , free from discrimination, harassment and 
abuse of authority.  
 
b. The OIO participated in the elaboration of an e -learning course aiming at creating a 
more harmonious an d safe work environment at the WTO  (''Respect&Ha rmony@WTO ''). 
The online course is divided into four modules : (1) Introduction to respect and  harmony  
at the WTO , (2) Understanding Prohibited Conduct, (3) The  Managers ' Role and  (4) 
Summary and Assessment . The course explains what constitutes prohibited conduct at 
the WTO, with special focus on harassment and abuse of authority, and describes  the 
different options in place at the WTO for addressing grievances without fearing 
retaliation. The course will be released in Q3 2019, and will be mandatory for al l staff 
members, including managers.  
 
c. In order to enhance the visibility of the OIO , both internally and externally , the OIO 
developed  dedicated pages published on WTO's website and intranet:  
Website: https://www.wto.org/english/thewto_e/secre_e/div -oio_e.htm  
                                                
4 See document W T/BFA/W/478  – Review of selected financial regulations of the World Trade 
Organization, 18 April 2019 – Financial Regulation 38.  
5 The Internal Control Framework is based on the model proposed by the Committee of Sponsoring 
Organisations of the Treadway Commission (COSO) and the Three Lines of Defense model,  promulgated by the 
Institute of Internal Auditors  (IIA).  
6 Administrative Memorandum No. 985 - Right to Work in an Environment free from Discrimination, 
Harassment and Abuse of Authority,  OFFICE(18)/37, 30 April 2018.  WT/BFA/W/484  
 
- 6 - 
 
  Intranet: http://intranet/en/about_wto/divisions/oio/oio.htm      
 
d. Finally, the OIO prepared communication material ( leaflets ) explaining the mandate and 
role of the OIO. The communication material is  available in French, English and Spanish . 
 
4.2  Conduct internal investigations  
4.7.  The OIO is the exclusive entity at the WTO responsible for investigating allegations of violations  
of any WTO norm applicable to s taff members, irrespective of the nature of their contracts, and for 
transmitting to the Director -General7 the results of such investigations together with 
recommendatio ns on action to be taken.  
4.8.  Between June 201 8 and May 2019 , the OIO was contacted 30 times  for allegations of 
misconduct ('' intakes ''). The OIO analysed in detail  each of the 30 intakes . Whenever the intakes 
were related to workplace issues (e.g.: conditions  of employment, relations with supervisors or 
colleagues, performance management) and not to misconduct, the concerned persons were 
redirected to other channels available at the WTO for address ing grievances (such as the 
Intern al/External Mediators or Human Resources ).  
4.9.  The intakes recorded by the OIO were broadly recorded into the following five categories:  
• Procurement;   
• Fraud / Corruption;   
• Harassment / Sexual harassment;   
• Retaliation;  and  
• Abuse of authority, conflict of interest and other violations  of the WTO Standards of 
Conduct.   
 
4.10.   The intakes were mostly related to (1) abuse of authority, conflict of interest and other 
violations of the WTO Standards of Conduct (50%), and (2) Harassment / Sexual harassment (40%). 
The following chart summarizes the  intakes per category :  
Chart  1 – Allegations recorded per category  (June 2018 – May 2019)  
 
                                                
7 Or, in the case of an alleged violation by the Director -General, a Deputy Director -General, or a 
member of the Office of the Director -General, to the Chairs of the General Council and of the CBFA.  0
2
12
115
Procurement Fraud / Corruption Harassment / Sexual harassment Retaliation OtherWT/BFA/W/484  
 
- 7 - 
 
  4.11.   The OIO was involved in five (5) investigations  between June 2018 and May 2019. A summary 
of these investigations is provided in Table 2 - Summary of investigation  cases (Ju ne 2018 – 
May 2019). 
Table 2 - Summary of investigation cases (June 2018 – May 2019)  
Intake  
Number s Type of 
allegation  Investigation 
opened  Potential 
loss (CHF)  Status  Allegations 
Substantiated  Sanction 
applied  
26 Other  Yes 0 Closed  Yes Dismissal  
12/39  Harassment  (1) 0 Ongoing  - - 
32/40  
/43 Harassment  Yes 0 Closed  Yes Dismissal  
45/47  
/48/49  Harassment  Yes 0 Ongoing  - - 
22 Fraud  (2) 19'088  Ongoing  - - 
(1) Complement of  investigation conducted by an external investigator.  
(2) Investigation conducted by an external investigator.  
 
4.12.   Three investigations were/are related to harassment ( 60%), one to fraud ( 20%) and one to 
other type of misconduct (20%) . Two investigations were  assigned to external investigators, in order 
to avoid any perceived conflict of interest. The investigations were /are conducted in accordance with 
the WTO procedure for administrative investigations8 and the Uniform Guidelines for Investigations9.  
4.13.   The Di rector -General decided to adopt severe disciplinary measures for the two investigation  
cases  closed .   
4.14.   The Head of the OIO confirms that the Director -General, the Deputy Directors -General and 
the members of the Office of the Director -General (DGO) have not  been the subject of (or been 
involved in) the investigations.  
4.3  Complete the OIO's Internal Audit Plan for 201 8-2019 
4.15.   The OIO's risk -based Internal Audit Plan for 201 8-2019 was presented to the CBFA in 
June 201810 and is detailed in Annex 1 - Internal Audit Plan for 201 8-2019. 
4.16.   Administrative Investigations take precedence over the other official duties of the 
investigator.11 The number of intakes and investigations increased significantly in 2018 -2019,  which 
prevented the OIO from completing all  of the assignments included in the Internal Audit Plan for 
2017-2018.  
4.17.   However, t he OIO closely worked  with the Strategic Planning, Monitoring and Evaluation 
Section of the Institute for Training and Technical Cooperation (ITTC) in order to monitor the 
implementation  of the recommendations made in the Trade -Related Technical Assistance external 
evaluation .12 
4.18.   Also, the OIO continued to periodically monitor the implement ation of internal audit 
recommendations , based on input collected from the concerned Divisions.  The current status of the 
                                                
8 Provisional Procedure for Administrative Investigations and Disciplinary Actions , OFFICE(14)/17,  
16 October  2014.  
9  For more information on the Uniform Guidelines for Investigations, see: http://www.conf -int-
investigators.org/?page_id=415 . 
10 WT/BFA/W/451 – Annual report on the activities of the Office of Internal Oversight 2017 -2018, 
12 June 2018. 
11 Provisional Procedure for A dministrative Investigations and Disciplinary Actions , OFFICE(14)/17,  
16 October  2014. Par. 1.30.  
12 The OIO reported separately to the CBFA on this matter, on 20 March 2019 – See document 
WT/BFA/W/439 – Office of Internal Oversight – Status of Internal Au dit Recommendations , 5 March 2018.  WT/BFA/W/484  
 
- 8 - 
 
  audit recommendations is detailed in Annex 3 – Status of Internal Audit recommendations 
(1 June 2019).13  
4.4  Provide support and advice to management, staff and stakeholders  
4.19.   The OIO provided independent advice to the Director -General , senior m anagement  and staff 
members  to help t hem fulfil their responsibility towards the O rganisation and its Members. The OIO 
also provid ed assurance support to several Divisions in order to improv e the effectiveness of 
governance, risk management and control processes.    
4.20.   The OIO maintained f requent  contact s with the External Auditor (Bundesrechnungshof), the 
Internal Mediator , Human Resources, the Legal Counsel to the Administration  and the Director -
General's Office (DGO) . The OIO considers that the collaboration  and communication with these 
different functions has been very positive and constructive.  
4.21.   The Head of the OIO represented the WTO at the 19th Conference of International 
Investigators  (CII - Incheon, South Korea) and at the annual conference of the Heads of Internal 
Audit (HOIA  - Brussels, Belgium) .  
4.22.   Furthermore, t he OIO has also been an active member of the Representatives of Internal 
Audit Services (RIAS ), the Representativ es of Investi gations Services (RIS)  and the Ethics Network 
of Multilateral Organizations (ENMO) . These network s of heads of internal audit/ investigations /ethics  
services of International Organizations  meet in organized forums to share good practices and 
establish guidance for internal audit /investigations /ethics  in the international public sector.  
5  INTERNAL OVERSIGHT ACTIVITY FOR  2019-2020 
5.1.  The OIO's vision is to serve the WTO by delivering on its mandate with professional 
independence, impartiality, integrity, quality and efficiency.  
 
5.2.  In developing it activity plan for 2019 -2020, the OIO continued to consider risk assessment 
relevance , suggestions made by Senior Management  and International Professional Practices 
Framework (IPPF) requirements14.  The OIO's priorities for the 201 9-2020 are mainly derived from 
the WTO's Secretariat risk register  and input received from several WTO Senior Manage rs and CBFA  
Members .  
 
5.3.  The OIO identified the following priorities  for 201 9-2020: 
 
a. The OIO will complete the selection process for the Investigator (Grade 7), in order to 
increase  and reinforce the capacity and capability of the Office.  
 
b. The OIO will review the Provisional Procedure for Administrative Investigations and 
Disciplinary Actions15 and propose several amendments to further align the procedure 
to the Uniform Guidelines for  Investigations16 and to good practices applied in other 
International Organizations. The OIO will also recommend measures to reinforce the 
whistle blower protection mechanisms at the WTO. According to the 2018 Job 
Satisfaction Survey, more than 70% of staf f members felt that it was necessary to 
implement a stronger whistle blower protection policy at the WTO.  
 
c. A detailed Internal Oversight Charter, defining the framework within which the Internal 
Oversight function should operate at the WTO, will be prepar ed and submitted to the 
Director -General for approval.  
 
d. The OIO will continue to conduct outreach activities to promote an ethical culture at the 
WTO,  to increase the visibility of the OIO and to strengthen the mechanisms in place at 
                                                
13 Ibid. 
14 The IPPF, promulgated by the IIA, is a conceptual framework that organizes authoritative guidance to 
Internal Audit professionals.  
15 Provisional Procedure for Administrative Investigations and Disciplinary Acti ons, OFFICE(14)/17, 16 
October 2014.  
16 For more details: http://www.conf -int-investigators.org/?page_id=415 . WT/BFA/W/484  
 
- 9 - 
 
  the WTO for addressing grievances. The OIO will actively participate to  the roll-out of 
the mandatory online training '' Respect&Harmony@WTO '' and will continue to contribute 
to the induct ion programme for newcomers . 
 
e. The OIO will  conduct  the assignments included in the internal audit plan for 201 9-2020, 
as detailed in Annex 2 - Internal Audit Plan for 201 9-2020. The internal audit plan will 
be reviewed at least annually and  may need to be adapted in response to changing risks, 
priorities and expectations at the WTO.  
 
f. The OIO will continue conducting administrative investigations , as needed, and will 
further  collaborat e with other Services for the promotion and maintenance of  a culture 
of integrity and honesty at the WTO. The OIO ex pects the number of investigations to 
remain high in 2019 -2020, as a result of the policies recently adopted by the WTO and 
the roll -out of the '' Respect&Harmony@WTO '' training.  
 
g. The OIO will continue providing support and advice to management, staff and 
stakeholders on the effective discharge of their responsibilities  and will assist the 
Divisions in the implementation of  internal audit recommendations.  Furthermore, the 
OIO will continue providing informal and formal advice on initiatives, policies, 
agreements or project implementation.  
 
h. The OIO will continue networking with other International Organizations with the 
objective of sharing/learning good pr actices and of keeping appraised of the latest 
developments in internal audit, ethics and investigations. The OIO will continue 
participating in international professional forums ( i.e. Representatives of Internal Audit 
Services (RIAS) , Representatives of I nvestigative Services (RIS) and Ethics Network of 
Multilateral Organizations ( ENMO )),  in order to remain acquainted with trends and best 
practices impacting the internal oversight functions . 
 
i. Finally, the WTO and 10 other Geneva -based International Organisations (UNHCR, GAVI, 
ICRC, IFRC, ILO, IOM, ITU, WHO, WIPO and WMO) will host  the 20th Conference of 
International Investigators, to be held in Geneva on 4 -8 November 2019 
(http://www.conf -int-investigators.org/ ). More than 150 international investigators are 
expected to participate to the event. The objectives of the C onference  are to enable and 
enhance close cooperation and collegiality am ong investigative offices of participating 
organizations and to facilitate the exchange of information and the discussion of critical 
integrity issues and new developments. As part of this event, the WTO  will organize two 
training s on forensics and intervi ewing techniques ; and will host the annual investigation 
meeting of International Financial Institutions (IFIs) . 
 
5.4.  The OIO will report annually to the CBFA, providing an overview of its activities during the year 
and the status of the different assignments included in the internal oversight  plan. WT/BFA/W/484  
 
- 10 - 
 
  ANNEX 1 - INTERNAL AUDIT PLAN FOR 2018 - 2019  
Audit subject  Source  Audit  Scope/Objective  2018 2019 
Policies on gifts, 
gratuities and outside 
activities  Risk Register  
 Assessment of policies related to:  
- Acceptance of gifts, gratuities or other 
favours from vendors or outside parties;  
- Remunerated outside activities of staff 
members;  
- Manag ement of Staff Assistance Fund;  
- Post-employment obligations.  x  
Dependency 
Allowances  Management 
request  Assessment of internal controls for 
processing dependency allowances (and 
other allowances) . x  
Procurement  Risk Register  
 Assessment of processes and internal 
controls ; review of the implementation of 
the new Procurement Manual and of 
Chapter IX of the revised Financial Rules.   x  
Education Grant  Management 
Request  Assess compliance with Staff Regulations 
and Rules . Review of the economy, 
efficiency and effective ness of processes 
and controls .  x 
Information Security 
Governance  Risk Register  
Management 
Request  Gap analysis and roadmap for 
implementing the international standard 
ISO27001 (Information security 
management system).   x 
Access rights in 
Oracle E -Business 
Suite (Enterprise 
Resource Planning)  Risk Register  
IT Security audit  Review of security processes and 
measures, analysis of access 
rights/permissions and segregation of 
duties in Oracle (ERP).  x x 
Enterprise Risk 
Management  IIA Standards  Analysis of how risks are assessed, 
managed and mitigated at WTO (risk 
management process and register).   x 
Follow up of 
recommendations 
made in the 
Trade -Related 
Technical Assistance 
external evaluation  Risk Register  
Management 
Request  Independent review of the 
implementation of the recommendations 
stated in the WTO TRTA external 
evaluation report.  
 x x 
Follow up of audit 
recommendations  IIA Standards  Periodic review of the implementation of 
internal audit recommendations.  x x 
Ad hoc audits, if any  - To be determined  - - 
 
  WT/BFA/W/484  
 
- 11 - 
 
  ANNEX 2 - INTERNAL AUDIT PLAN FOR 2019 - 2020  
Audit subject  Source  Audit Scope/Objective  2019 2020 
Policies on gifts, 
gratuities and outside 
activities  Risk Register  
 Assessment of policies related to:  
-  Acceptance of gifts, gratuities and/or 
other favours received by staff 
members from service suppliers  or 
outside parties;  
-  Remunerated outside activities of staff 
members;  
- Manag ement of the Staff Assistance 
Fund;  
-  Post-employment obligations.  x   
Mapping of staff 
Allowances  Management 
request  Assessment of internal controls for 
processing staff allowances . x  
Procurement  Risk Register, 
Management 
request  Assessment of processes and internal 
controls ; review of the implementation of 
the new Procurement Manual and of 
Chapter IX of the revised Financial Rules.   x  
Education Grant  Management 
Request  Assess compliance with Staff Regulations 
and Rules . Review of the economy, 
efficiency and effective ness of processes 
and controls .  x 
SSA and Short -term 
contracts  Management 
Request  Assessment of policies  and practices 
related to Special Service Agreement 
(SSA) and Short -term contracts.   x 
Access rights in 
Oracle E -Business 
Suite (Enterprise 
Resource Planning)  Risk Register , 
IT Security audit  Review of security processes and 
measures, analysis of access 
rights/permissions and segregation of 
duties in Oracle (ERP).   x 
Information Security 
Governance  Risk Register , 
Management 
Request  Gap analysis on international standard 
ISO27001 (Information security 
management system).   x 
Follow up of 
recommendations 
made in the 
Trade -Related 
Technical Assistance 
external evaluation 
report  Risk Register , 
Management 
Request  Independent review of the 
implementation of the recommendations 
stated in the WTO TRTA external 
evaluation report.  
 x x 
Follow up of audit 
recommendations  IIA Standards  Periodic review of the implementation of 
internal audit recommendations.  x x 
Ad hoc audits, if any  - To be determined  - - 
   
  WT/BFA/W/484  
 
- 12 - ANNEX 3 - STATUS OF INTERNAL AUDIT RECOMMENDATION S (1 JUNE 201 9) 
 
OIO - STATUS OF INTERNAL AUDIT RECOMMENDATIONS  
Audit Activity  Report 
year Total number of 
recommendations  Number of  
High recommendat ions Status   
as of 01.0 6.2019  
  % Closed  WIP Open  
Sick Leave Management  2014 33 26 79% 32 1 0 
IT Security  2014 19 5 26% 11 6 2 
Home Leave Entitlements  2017 11 2 18% 9 2 0 
Totals  / Percentage  - 63 33 52%  83%  14%  3% 
 
 
Trade-Related Technical Assistance (T RTA) – STATUS OF RECOMMENDATIONS  
Activity  Report 
year Total number of 
recommendations  Implementation status as of 01.06.2019  
Closed 
(implemented)  Closed  
(without action)  WIP Open  
Trade -Related Technical 
Assistance evaluation  2016 28 18 3 7 0 
Totals / Percentage  - 28 64%  11%  25%  0% 
 
 
 
 
 
 WT/BFA/W/484  
 
- 13 - 
  
  ANNEX 4 – INTERNAL CONTROL FRA MEWORK  FOR THE WTO SECRETA RIAT  
 
1  PURPOSE AND DEFINITIO NS 
1.1.  The purpose of the Internal Control Framework is to provide reasonable assurance to the 
Director -General with regards to the achievement of WTO objectives, and to guide the WTO 
Secretariat in the establishment of internal controls, to ensure that:  
a. Operations are executed in an ethical, economical, efficient, and effective manner;  
b. Accountability obligations are fulfilled;    
c. Organization's assets and resources are safeguarded against  loss, misuse or damage; and  
d. Operations are conducted in compliance with applicable regulations, rules, policies and 
administrative memoranda.  
1.2.  Internal control,  in the context of this framework, is defined as ''a process, executed by an 
entity's governing  body, management, and other personnel, designed to provide reasonable 
assurance regarding the achievement of objectives relating to operations, reporting, and 
compliance'' .17 Internal control is:  
a. Geared towards the achievement of objectives in one or more  categories — operations, 
reporting, and compliance;  
b. A process consisting of ongoing tasks and activities — a means to an end, not an end in 
itself;  
c. Executed by people — not merely about policy and procedure manuals, systems, and forms, 
but about people and the actions they take at every level of an organization to effect 
internal control; and  
d. Able to provide reasonable assurance — but not absolute assurance, to senior management, 
the Director -General, and Members.  
1.3.  The internal financial control  for the WTO is set out in the Financial Regulations18, to provide 
an effective examination and review of financial transactions in order to ensure:  
a. The regularity of the receipt, custody and disposal of all funds and other financial resources 
of the WTO;  
b. The confor mity of obligations and expenditures with appropriations or other financial 
provisions voted by the General Council, or with the purposes and rules relating to trust 
funds and special accounts;  
c. The economic use of the resources of the WTO.  
2  THE COSO MODEL  
2.1.  The Internal Control Framework is a key tool for strengthening accountability to support 
management decisions and governance of the Organization. For establishing such framework, the 
WTO uses as reference the model promulgated by the Committee of Sponsorin g Organisations of 
                                                
17 Definition provided by the Institute of Internal Auditors (IIA) – https://na.theiia.org/standards -
guidance/topics/Documents/Executive_Summary.pdf . 
18 WT/L/156/R ev.3 – WTO Financial Regulations, Chapter XII Regulation 38 – Internal Control.  WT/BFA/W/484  
 
- 14 - 
  
  the Treadway Commission (COSO)19, which was endorsed by the International Organization of 
Supreme Audit Institutions (INTOSAI)20.   
2.2.  The COSO -based framework comprises five (5) interrelated key components and associated 
principles21, which a re inherent to the WTO activities:  
Figure 1: COSO Model  
 
2.3.  The five (5) interrelated components are defined as follows:  
1.  Control Environment  is the set of standards, processes, and structures that provide the 
basis for carrying out internal control across the Organization; it thus comprises the 
integrity, ethical values of the Organization, exercise of oversight responsibility, 
commitment to c ompetence and accountability, and structure, authority, responsibility.  
2.  Risk Assessment  involves a dynamic and iterative process for identifying and assessing 
risks to the achievement of objectives; thus, risk assessment forms the basis for 
determining  how risks will be managed, including risks of fraud.  Risk assessment includes 
identifying and assessing changes that could impact the system of internal controls.   
3.  Control Activities  are the actions established through policies and procedures to ens ure 
that management's directives mitigate risks and are carried out for achievement of 
objectives. Control activities include clear delegation of authority, required authorizations 
and approvals, verifications, reconciliations, reviews of operating perform ance, processes 
                                                
19 The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a private sector 
initiative dedicated to providing thought leadership through the development o f frameworks and guidance on 
enterprise risk management, internal control and fraud deterrence. For more details: www.coso.org . 
20 The International Organization of Supreme Audit Institutions (INTOSAI) provides an institu tionalised 
framework for Supreme Audit Institutions (SAIs), to promote development and transfer of knowledge, improve 
government auditing worldwide and enhance professional capacities, standing and influence of member SAIs in 
their respective countries. Th e INTOSAI takes into account all relevant and recent evolutions in internal control 
and incorporates the concept of the COSO report " Internal Control – Integrated Framework " in its (1) 
Guidelines for Internal Control Standards for the Public Sector (INTOSA I GOV 9100), (2) Guidance for 
Reporting on the Effectiveness of Internal Controls (INTOSAI GOV 9110), and (3) Internal Control: Providing a 
Foundation for Accountability in Government (INTOSAI GOV 9120). For more details: www.intosai.org . 
21 COSO Internal Control – Integrated Framework , May 2013.  Available at www.coso.org . 
WT/BFA/W/484  
 
- 15 - 
  
  and activities, security of assets, segregation of duties, staff supervision, and information 
systems controls.  
4.  Information and Communication  are necessary for the Organization to carry out internal 
control responsibilities to support t he achievement of its objectives. The organization 
communicates internally and externally and uses relevant quality information to support 
the functioning of internal controls.   
5.  Monitoring Activities are necessary for the Organization to ascertain whe ther each of the 
five components of internal control is present and functioning. Ongoing and/or separate 
evaluations are conducted, including communication of deficiencies.  
2.4.  The above -mentioned elements and related seventeen principles operate together in an 
integrated manner and are the basis of a sound and effective internal control structure (see Figure 
1: COSO Model ).   
3  COMPONENTS OF THE WT O INTERNAL CONTROL F RAMEWORK  
3.1.  The pillars of the WTO Internal Control Framework are the Financial Regulations22, Financial 
Rules23, Staff Regulations24 (including the WTO Standards of Conduct) and Staff Rules.  
3.2.  The framework is complemented by several internal policies (contained in administrative 
memoranda, practices and guidelines adopted and enforced by the WTO).   
3.3.  The Human Resources Division (HR D) and the Information Technology Solutions Division 
(ITSD) have developed a dedicated intranet site referencing all the applicable WTO Regulations, 
Rules, policies and guidelines – For more details: http://intranet/en/tasks/it/it_topics.htm .  
3.4.  These policies and guidelines cover areas such as25: 
a.  FINANCIAL  
• Delegation of authority;  
• Procurement and asset disposal;  
• Fixed assets;  
• Payments;  
• Record -keeping;  
• Treasury and cash management;  
• Travel.  
b.  HUMAN RESOURCES  
• Recruitment;  
• Staff benefits and entitlements;  
• Performance Management and promotions;  
• Training and Development;  
• Career Development and mobility.  
c. INFORMATION MANAGEMENT26  
• Acceptable use;  
• Pass phrase;  
• Mobile device security;  
• Information security;  
• Security and architecture assessment of information systems.  
                                                
22 WT/L/156/Rev.3 – Financial Regulations of the WTO, 27 February 2015.  
23 WT/L/157/Rev.2 – Financial Rules of the  WTO, 22 February 2017.  
24  OFFICE (16)/17 – WTO Staff Regulations, last amended on February 2016.  
25 Non-exhaustive list (the list may evolve).  
26 The Information Technology Solutions Division (ITSD) maintains a dedicated intranet site listing the 
WTO  polic ies and guidelines related to Information Management - http://intranet/en/tasks/it/it_topics.htm . WT/BFA/W/484  
 
- 16 - 
  
  d.  INTERNAL OVERSIGHT and RISK MANAGEMENT  
• Internal Oversight and Administrative investigations;  
• Right to Work in an Environment Free from Discriminati on, Harassment and Abuse of 
Authority;  
• Risk management.  
3.5.  The WTO is currently developing additional internal policies and guidelines, such as:  
• Anti-Fraud Policy;  
• Performance Management and Reward and Recognition;  
• Organizational Resiliency Management;  
• Information Confidentiality Classification Policy;  
• Access Management and Control Policy;  
• Incident Management Policy;  
• Guidelines on Ministerial Conference.  
3.6.  Finally, ITSD has adopted COBIT527 and ITIL28, which are specific internal control framew orks 
focussing on IT governance and security. Additionally, ITSD is currently considering adopting the 
ISO27000 family of standards29, a globally recognised framework for best -practice information 
security management.  
3.7.  While the COSO model applies to all asp ects of the Organization, the COBIT5 and ISO27000 
frameworks are more focused to IT management. The three models are inter -related and 
complementary (see Figure 2 – COSO, ISO27000 and COBIT models).  
Figure 2: COSO, ISO27000 and COBIT frameworks  
 
4  RESPONSI BILITIES ON INTERNAL CONTROL  
4.1.  The WTO's governance on the Internal Control Framework is based on the Three Lines of 
Defense Model , promulgated by the Institute of Internal Auditors  (IIA)30 and described in Figure 3 – 
The Three lines of Defense Model . 
 
 
 
 
                                                
27 COBIT5 is the leading good -practice framework for the governance and management of Information 
Technology (IT). This framework was created by the international professional association ISACA - 
http:// www.isaca.org/COBIT/pages/default.aspx . 
28 Information Technology Infrastructure Library (ITI L)  is a set of detailed practices for IT service 
management that focuses on aligning IT services with the needs of business - https://www.axelos.com/best -
practice -solutions/itil . 
29 The ISO27000 family of standards was developed and published by the International Organization for 
Standardization (ISO) and the Intern ational Electro -technical Commission (IEC) - 
https://www.iso.org/standard/66435.html . 
30 The Institute of Internal Auditors (IIA) Three Lines of Defense Model in Effective Risk Management 
and Control , January 2013.  
WT/BFA/W/484  
 
- 17 - 
  
  Figure 3: The Three Lines of Defense Model  
 
 
 
4.2.  At the WTO, the roles and responsibilities on internal control are defined as follows:   
a. The Director -General is responsible for the implementation of the WTO Financial and Staff 
Regulations.  This includes m aintaining Internal Control (Financial Regulation 38 – Internal 
Control ).   
In this role, the Director -General is assisted by the Deputy Directors -General and the 
Directors, to ensure the adequacy and effectiveness of the WTO's overall system of internal 
control.  
b. The first line of defense lies with the process owners whose activities create and/or manage 
the risks. The first line owns the risk, along with the design and execution of the 
organization's controls to respond to those risks.  
Each manager and st aff member is directly responsible for designing, implementing, 
supervising proper functioning of, maintaining and documenting the internal control 
system for those activities under his/her responsibility.  
Staff members fulfil a vital role  in implementing effective internal controls and are 
responsible for reporting problems or weaknesses on operational procedures, non -
compliance with the Code of Conduct, rules, regulations, directives, policies and 
procedures.  
c. The second line supports management by bringin g expertise, process excellence, and 
management monitoring alongside the first line, to help ensure that risk and control are 
effectively managed.  The functions of the second line of defense are separate from those 
in the first line of defense but are sti ll under the control and direction of senior 
management and typically perform some management functions.   
The second line is essentially composed by risk management and compliance functions 
focussing on monitoring controls. The legal Counsel for the Admin istration, the Security 
and Safety Section and the Occupational Health Service (OHS) are part of the second line 
of defense.  
WT/BFA/W/484  
 
- 18 - 
  
  d.  The third line of defense is primarily composed by the Office of Internal Oversight (OIO), 
which is an independent office repor ting directly to the Director -General and the Chairs of 
the Committee on Budget and Finance Administration (CBFA) and the General Council.  
4.3.  The following entities and functions at the WTO play an essential role to enforce the Internal 
Control Framework:  
a. General Council (and Members Committees)  
The General Council is the WTO’s highest -level decision -making body after the Ministerial 
Conference. The latter only meets every second year. Between those meetings, the 
General Council meets regularly to carry out the functions of the WTO. It is composed of 
representatives from all WTO Members. It meets also as the Dispute Settlement Body 
and the Trade Policy Review Body to oversee procedures for  settling disputes between 
Members  and to  analyze Members’ trade policies . 
The Committee on Budget, Finance and Administration (CBFA) reviews the WTO budget 
and the f inancial statement presented by the Director -General and makes 
recommendations about these matters to the General Council. The CBFA also discusses 
any financial and administrative matters which are referred to it by the General Council or 
the Director -General. The CBFA is composed of delegates of all WTO Members and meets 
between seven and ten times per year.   
b. External Auditor  
The External Auditor performs a key role in evaluating internal controls as an integral part 
of both financial and performance audits and provides additional advice as appropriate. 
The External auditor is appointed by the General Council to perform the audit of the 
financial statements of the WTO and of its Pension Plan in accordance with WTO Financial 
Regulation 44 fo r a six -year period non -renewable. The External Auditor is the Supreme 
Audit Institution of a Member of the WTO31. 
c. Office of Internal Oversight (OIO)  
The OIO was established on 30 November 201532 to provide independent and objective 
assistance to the Direct or-General, in respect of the staff and resources of the WTO, 
through internal audit, investigation, inspection, and evaluation activities. The Office has 
the authority to initiate, carry out and prepare reports as it deems necessary to fulfil its 
responsi bilities with regard to its oversight functions.  The OIO aims (1) to promote 
financial and operational efficiency and transparency through sound practices and 
procedures; (2) to identify potential savings and recoveries; and (3) to identify and deter 
the occurrence of fraud, waste, abuse and misconduct.   
d. Governance, Risk and Compliance (GRC)  
The Head of Governance, Risk and Compliance (GRC) is responsible for implementing and 
maintaining an Enterprise Wide Risk Management system (ERM) at the WTO, followin g the 
Integrated Framework proposed by the COSO. The ERM comprises the methods and 
processes used by the WTO to manage risks and seize opportunities related to the 
achievement of its objectives.  
e. Information Technology and Security Steering Committee (ITSSC )   
The ITSSC ensures executive strategic oversight and governance of Information Security 
within the WTO Secretariat. It is mandated to make decisions on: (1) Information 
Technology matters that impact upon the WTO Members, staff, and outreach targets, 
                                                
31 The 'Bundesrechnungshof', the Supreme Audit Institution of Germany was selected as External 
Auditor as from the audit of the 2014 accounts and for a period of six years, i.e., 2014 -2019.  
32 Office (15)/101 – Administrative Memorandum No. 97 4 – Office of Internal Oversight  –30 November 
2015.  WT/BFA/W/484  
 
- 19 - 
  
  including commitment of IT resources for IT projects and (2) Information Security, that 
is, confidentiality, integrity, and availability of information, including engagement of IT 
resources for Information Security projects33. 
f. Contracts Committee (CC)  
The Con tracts Committee (CC) renders advice on the procurement of goods, works and 
services valued at CHF 50,000 or above. It is responsible for ensuring that the proposed 
procurement actions are based, inter alia, on fairness, integrity and transparency, and as 
such are impartial and unambiguous. It also reviews requests on (1) waivers, (2) 
amendments, (3) related orders, and (4) major procurements, pursuant to WTO Financial 
Rule 9 - Procurement34. 
4.4.  The WTO has also established other committees and boards at the Se cretariat level to cover 
specific topics, such as the Appointment Board (AB) , the Joint Appeals Board (JAB) , the Joint 
Advisory Committee (JAC) , the Joint Committee on Catering  Services  (JCCS) , the Medical Insurance 
Management Committee (MIMC) , the Pension Plan Management Board (WTOPP) , the Promotions 
Boards  and the Crisis Management Team.  
5  LINK BETWEEN INTERNA L CONTROL AND ENTERP RISE RISK MANAGEMENT  
5.1.  Enterprise Risk Man agement (ERM) is part of the internal control system and the governance 
process of the WTO Secretariat. It consists of eight interrelated components35 which are integrated 
with the management process. These components are: (1) internal environment, (2) obje ctive 
setting, (3) event identification, (4) risk assessment, (5) risk response, (6) control activities, (7) 
information and communication, and (8) monitoring.  
5.2.  ERM is an iterative process in which almost any component can and does influence another.  
5.3.  In conformity with Financial Regulation 38 – Internal Control , the Director -General established 
a risk management system to identify and address internal and external risks to the Secretariat.  
5.4.  The Risk Management Policy for the Secretariat was first establish ed in December 201236. Since 
then, risks that could potentially affect achievement of the Secretariat's objectives are systematically 
identified, analysed and monitored. A risk register of the key risks faced by the Secretariat is 
regularly maintained and u pdated.  
5.5.  The management of risks ensures that appropriate risk responses and treatment plans are 
effectively carried out to reduce risk exposure to acceptable levels.  
5.6.  At the WTO, the Administration and General Services Division (AGSD) is responsible for 
maintaining the ERM system, but the responsibility for each identified risk lies on the shoulders of 
the concerned risk owners/managers.  
6  REVISION HISTORY  
6.1.  This WTO Internal Control Framework is an evolving document, which shall be periodically 
reviewed by the  Head of GRC . 
  
                                                
33 INT/SUB/DG/156, 4 May 2015.  
34 Office (09)/46 Rev.2 – Administrative Memorandum No. 965 – WTO Procurement Policy , 24 May 2017  
35 COSO ERM – Integrated Framework , September 2004 and Update to ERM Framework:  Enterprise 
Risk Management – Aligning Risk with Strategy and Performance , November  2016 Edition.  For more 
information: www.coso.org . 
36 Risk Management Policy for the WTO Secretariat , 19 December 2012 . WT/BFA/W/484  
 
- 20 - 
  
  ANNEX 5 - LIST OF ACRONYMS  
 
 
AB  Appointment Board  
AGSD   Administrations and General Services Division  
CBFA   Committee on Budget, Finance and Administration  
CC  Contracts Committee  
CHF  Swiss Franc (currency)  
COSO   Committee of Sponsoring Organisations of the Treadway Commission  
DGO  Director -General 's Office  
ENMO   Ethics Network of Multilateral Organizations  
ERM  Enterprise Risk Management  
ERP  Enterprise Resource Planning system  
GAVI  Global Alliance for Vaccines and Immunizati on 
GRC  Governance, Risk and Compliance  
HOIA   Heads of Internal Audit  Services  of International Organizations based  in Europe  
HRD  Human Resources Division  
ICRC  International Committee of the Red Cross  
IEC  International Electrotechnical Commission  
IFIs  International Financial Institutions  
IFRC  International Federation of Red Cross and Red Crescent Societies  
IIA  Institute of Internal Auditors  
ILO  International Labour Organization  
INTOSAI  International Organization of Supreme Audit Institutions  
IOM  International Organization for Migration  
IPPF  International Professional Practices Framework  
ISO  International Organization for Standardization  
ITIL  Information Technology Infrastructure Library  
ITSD  Information Technology Solutions Division  
ITSSC   IT and Security Steering Committee  
ITTC  Institute for Training and Technical Cooperation  
ITU  International Telecommunication Union  
JAB  Joint Appeals Board  
JAC  Joint Advisory Committee  
JCCS  Joint Committee on Catering Services  
JIU  United Nations Joint Inspection Unit  
LDIMD  Languages, Documentation and Information Management Division  
MIMC   Medical Insurance Management Committee  
N/A  Not Applicable  
OHS  Occupational Health Service  
OIO  Office of Internal Oversight  
RFP  Request for Proposal  
RIAS  Representatives of Internal Audit Services  
RIS  Representatives of Investigations Services  
SAI  Supreme Audit Institution  
SoD  Segregation of Duties  
SSA  Special Service Agreement  
TRTA  Trade -Related Technical Assistance  
UN  United Nations  
UNHCR  United Nation s High Commissioner for Refugees  
WIP  Work-in-progress  
WHO  World Health Organization  
WIPO   World Intellectual Property Organization  
WMO  World Meteorological Organization  
WTO  World Trade Organization  
WTOPP  WTO Pension Plan Management Board  
 
__________