RESTRICTED  
  
WT/BFA/W/ 586 
14 April  2022 
(22-3060) Page: 1/7 
Committee on Budget, Finance and Administration    
 
- 1 - 
 
OFFICE OF INTERNAL OVERSIGHT  (OIO)  
STATUS OF INTERNAL AUDIT RECOMMENDATIONS  
(March  2022) 
1.1.  The Office of Internal Oversight (OIO) provides for information to the Committee on Budget, 
Finance and Administration (CBFA)  the latest  status of implementation of the recommendations  
proposed in internal audit reports . 
1.2.  As requested by the Institute of Internal Auditors (IIA), the OIO maintains  a detailed follow -
up register to monitor the implementation of recommendations, and to ensure t hat management 
actions have been effectively implemented (IIA Standard 2500.A1 – Monitoring Process ). This follow-
up register is updated regularly, based on input collecte d from the concerned Divisions /Units . 
1.3.  The current status of the recommendations is summarized  in Annex 1 - Status of 
Recommendations (March  2022), and f urther details are provided in Annex 2 – Implementation 
Status of Outstanding OIO Recommendations  (March  2022) of this document.  
1.4.  As of March 2 022, the Administration has implemented 90% of the OIO recommendations . 
1.5.  The OIO will continue to closely monitor  the implementation of the se recommendation s and 
report  to the  CBFA  thereon . 
1.6.  Please note that the annual report of the activities of the OIO will be presented to the CBFA in 
September 20221.  
 
1 Pursuant to Administrative Memorandum No.974  (OFFICE(15)/101 – Office of Internal Oversight , 
30 November  2015), the OIO shall report annually to the CBFA, providing an overview of its activities during 
the year .  
  WT/BFA/W/ 586 
 
- 2 - ANNEX 1: STATUS OF RECOMMENDATIONS ( MARCH  2022) 
 
OIO - STATUS OF RECOMMENDATIONS (for more details, see Annex 2)  
Audit Activity  Report 
year Total number of 
recommendations  Number of  
high severity 
recommendations  Status  
as of 01.0 3.2021 Status   
as of 31.03.2022 
  % Closed1 WIP2 Open3 Closed  WIP Open  
Sick Leave Management  2014 33 26 79% 32 1 0 32 1 0 
IT Security  2014 19 5 26% 13 4 2 15 3 1 
Home Leave Entitlements  2017 11 2 18% 10 1 0 10 1 0 
Total/Percentage  - 63 33 43%  87% 10% 3% 90% 8% 2% 
 
 
 
1 "Closed" refers to recommendations that have been implemented.  
2 "WIP" (Work in progress) refers to progress being made in taking remedial action.  
3 "Open" refers to recommendations with no remedial action yet taken.   
  WT/BFA/W/ 586 
 
- 3 - ANNEX 2: IMPLEMENTATION STATUS OF OUTSTANDING OIO RECOMMENDATIONS (MARCH  2022)1 
A) SICK LEAVE MANAGEMENT  
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
26. The Medical Service and the Human Resources 
Division (HRD) should r econcile the data on sick 
leave recorded in Oracle with data in CHIMED to 
ensure that it is accurate, consistent and reliable for 
reporting to various stakeholders and that any 
variances are justified.  Medium  Q4 2018 In 2018 , the WTO decided to replace CHIMED by 
Préventiel, a software specialized in managing 
medical records and files (http://www.val -
solutions.fr/solutions/solution -preventiel/).  
 
Préventiel was implemented in Q4 2018 as a stand -
alone solution in order to secure the access to – and 
the confidentiality of – its information (only the 
Medical Service has access to Préventiel).  
 
In 2019, the WTO decided to implement a  new 
integrated system  to replace Oracle , called WISE 
(using Workday as the software platform) , to manage 
HRD processes. The implementation of the new 
system  began  in August 20 20 and went live in 
September  2021. 
 
Sick leave is now managed through Workday, but the 
Medical Service must manually insert the relevant 
information into Préventiel, which continues to house 
the medical files of staff members.  
 
An interface will be built between Workday  and 
Préventiel  to rec oncile the sick leave data recorded in 
both systems.  The interface is ready on the Workday 
side but  delivery of the interface by  Préventiel is still 
pending . W.I.P . The recommendation will 
be closed once the 
interface between 
Workday  and Préventiel  
has been finalized . 
Imple mentation is 
expected in Q3 2022.  
 
 
1 The Annex summarizes the status of the  recommendations that were outstanding as of 1 March 2021.   
  WT/BFA/W/ 586 
 
- 4 - B) IT SECURITY  
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
4: IT Security Governance: GOV 04 – Risk 
management  process.  
 
The Information Security function should regularly 
review the risk register to ensure that information 
security risks are adequately and promptly 
identified. Based on that review, the IT Security 
function should:  
 
1. Determine where an IT security response should 
be applied;  
 
2. Ensure that the appropriate IT security 
responses are included in the 'proposed mitigation 
measures' section;  
 
3. Ensure that the IT security responses are 
adequat ely implemented and are operational.  High Q3 2018  Information Security risks will be  included in 
the Enterprise Risk Management (ERM) yearly 
exercise, led by the WTO Risk Management 
Officer.  (The recruitment of a Risk  Management  
Officer is currently pendin g.) 
 
The IT  Security response to identified 
significant risks will be finalized and submitted  
to the IT Security Steering Committee  for 
validation and approval , as part of the results 
of the risk assessment (see recommendation 
GOV 05 - Inventory of WTO 's key information 
assets)  as soon as the updated Secretariat -
wide risk register is available (action pending 
the results of the Risk Management stream of 
the Secre tariat structural review).  
 W.I.P . The status of this 
recommendation 
remains unchanged , 
pending finalization of 
the Information Security 
risk register (or detailed 
WTO-wide risk register) 
and the implementation 
of recommendation 
GOV 05. 
5: IT Security Governance: GOV 05 (a) – Inventory 
of WTO's key information asset s. 
 
LDIMD  (now LDSD)  and ITSD should coordinate the 
creation and maintenance of an organization wide 
inventory of key information assets such as data, 
information, documents and pub lications. This 
inventory should include: definitions of the 
information asset owners' roles and 
responsibilities, the information asset classification 
level, and the basic requirements in terms of 
control and monitoring of the information asset . 
The defin ition should take into consideration each 
Division that develops or has access to key 
information assets . The IT Security function should 
perform a security risk assessment, based on the 
list of key information assets, to determine the 
level of protection required for each key 
information asset.  
 Medium  
 Q4 2018  ITSD partially agrees with the 
recommendation: the creation and 
maintenance of the inventory essentially 
requires input from the owners of information 
assets, i.e. core operational Divisions (as 
opposed to supporting Divisions, such as ITSD 
or LDIMD). Therefore, such task should be 
mandated and supervis ed by the Information 
Security Steering Committee (ITSSC) created 
as per GOV 01 recommendation.  
 
The Confidentiality Classification Policy was 
adopted and is now used as the basis for the 
organization -wide inventory of Key Information 
Assets.  
 
The inventor y of Key Information Assets is 
currently being done by Divisions, under the 
coordination of the Information Security Office . 
Most sensitive information assets have been 
identified, and all information essential for the W.I.P . The recommendati on will 
be closed upon 
completion of the 
inventory of Key 
Information Assets , 
which is scheduled for 
Q2 2022.  
 
  
  WT/BFA/W/ 586 
 
- 5 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
 risk assessment has already been coll ected by 
ITSD.  
 
A computer platform has been implemented to 
record  and maintain the results of the 
inventory. The system is available to all staff at 
http://kiai.cwr.wto.org to provide a baseline 
for classification of information produced by 
different Divisions.  
 
Unfortunately, the inventory process has been 
paused several times  due to (1) the COVID -19 
lockdown and associated emergency activities 
and radical changes in working methods and 
tools (2) other priorities related , inter alia , to 
cyber security , and (3)  leave period and 
unavailability of key personnel . 
  
6: IT Security Governance: GOV 06 – Information 
security policies structure.  
 
Review the structure and completeness of IT 
security policies, standards, guidelines and 
procedures; define and enforce the various IT 
policies including Security policies, IT Securit y Risk 
Assessment Policy, Disaster Recovery Policy, and 
Information Security Risk Assessment Policy that is 
aligned with the Risk Management Policy.  Medium  Q4 2018  Following the introduction of the overarching 
policy, the following policies and procedures 
have been developed  and issued : 
 
• Policy  on Architecture and Security 
Assessment of Information Systems,  
•    Information Security Policy,  
•    Access Control Policy , 
•    Incident Management Policy,  
•    Information Classification Policy , and  
•    Disaster Recovery Policy.  
 
The Information Security Risk Management 
Policy , which is the last outstanding p olicy in 
the framework recommended by the Internal 
Audit,  is pending the outcome of the Risk 
Management stream of the Secretariat 
structural review to ensure Secretariat -wide 
coherence and compatibility.  
 W.I.P . This recommendation 
remains work in progress 
pending the review and 
implementation of the 
Secretariat -wide Risk 
Management Policy 
(curren tly underway with 
the structural review) 
and will be closed  once 
the Information Security 
Risk Management Policy 
has been finalized and 
communicated  to 
concerned staff 
members . 
 
 
  
  WT/BFA/W/ 586 
 
- 6 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
9: IT Security Governance: GOV 08 – WTO's IT 
security strategy.  
WTO should formally define its IT Security 
function's strategy and objectives, taking into 
consideration the results of the key information 
assets and its risk assessment . 
The IT security strategy should be reviewed to 
ensure it is aligned with the organization's business 
objectives.  Medium  
  Q1 2019  The IT Security function's strategy and 
objectives have  been approved by the ITSSC as 
part of the overall ICT workplan , which includes 
a secti on addressing  "Resilience and reduction 
of risks including Cybersecurity risks" . 
 
 IMPLEMENTED  The re commendation 
was implemented and 
closed.  
10: IT Security Governance: GOV 09 – IT Security 
function's objectives alignment with an IT security 
strategy.  
IT Security function should develop a clear set of 
its objectives that should be aligned with the IT 
security Strategy in recommendation GOV. 8 
above.  Low Q1 2019  The IT Security strategy and objectives have  
been approved by the ITSSC as part of the 
overall ICT workplan  
 IMPLEMENTED  The re commendation 
was implemented and 
closed.  
15: IT Security Controls: ITSC -04 - Segregation of 
duties (SoD) control framework  
The WTO's Back -Office unit and the IT Security 
function should:  
1. Define a SoD framework, taking into 
consideration that the security requirements must 
be balanced with resource availability (e.g. a 
back-up person for a specific function must be 
attributed the appropriate access rights to per form 
back-up operations);  
2. Define a procedure for managing exceptions to 
the SoD framework. This procedure should include 
the formal documentation of deviations from the 
SoD framework and formal validation by the user's 
manager;  
3. Review the current con figuration /customization  
of the Enterprise Resource Planning ( ERP) 
software's roles and responsibilities (i.e.  Oracle 
roles/accesses ) against the SoD framework to 
ensure no conflicting rights are given to employees 
without prior validation from the user's manager.  Medium  Q1 2019  The ERP segregation of duties  (in Oracle)  will 
be addressed jointly by  HRD, AGSD and ITSD 
following the outcome of the ERP security audit .  
 OPEN  This recommendation 
will be implemented 
after the ERP security 
assessment  (OIO) .  
  
  WT/BFA/W/ 586 
 
- 7 - C) HOME LEAVE ENTITLEMENTS  
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  
 Status  OIO's comments  
1. The correct balance should be sought between 
the need to encourage use of the lump-sum and 
the need to ensure rational use of resources in 
order to achieve economy, efficiency and 
effectiveness in the process.  
Therefore, the OIO invites the Director of the 
Human Resources Division to closely monitor the 
costs and benefits to the WTO  of the lump -sum 
arrangement, taking into consideration the level of 
the cash incentives provided to staff by the lump -
sum procedure; and to adopt any necessary 
adjustments would the arrangements be 
considered excessive.  Medium  Q3 2018  The methodology used by the WTO (and several other 
Geneva -based International Organizations) to 
calculate the home leave lump sums was based on the 
''full-fare economy'' rates published by IATA through  
the Galileo system. IATA decided to abandon the ''full -
fare economy'' rates as from October 2018. Hence, 
the rates are no  longer  updated in Galileo since 
1 November  2018.  
A group of five International Organizations 
established a Working Group to propose a new 
methodology. The Working Group, supported by 
Carlson Wagonlit as consultant, submitted its 
conclusions in October 2018 .  
WTO Senior Management opted for the methodology 
used by the United Nations for calculating lump -sums  
and decided to compile all travel -related policies into 
one single Revised Travel Policy . This work was 
finalized in February 2021 , and the draft 
Administrative Memorandum was sent to the Joint 
Advisory Committee (JAC)  on 2 March 2021 for its 
review and a dvice to the D irector -General . 
 W.I.P. The recommendation 
remains Work -in-
Progress until the 
Administrative 
Memorandum, detailing 
the Revised Travel 
Policy, which includes 
the new methodology for 
calculating home -leave 
lump sums, is reviewed 
by the JAC, approved by 
the Director -General , 
and published . 
 
 
__________