RESTRICTED  
  
WT/BFA/W/ 545 
1 April 2021 
(21-2731) Page: 1/7 
Committee on Budget, Finance and Administration    
 
 
- 1 - 
 
OFFICE OF INTERNAL OVERSIGHT  (OIO)  
STATUS OF INTERNAL AUDIT RECOMMENDATIONS  
(March  2021) 
1.1.  The Office of Internal Oversight (OIO) provides for information to the Committee on Budget, 
Finance and Administration (CBFA)  the latest  status of implementation of the recommendations  
proposed in internal audit reports , and in the Trad e-Related Technical Assistance (TRTA) external 
evaluation report1, prepared by Saana  Consulting  on 31 October  2016.  
1.2.  As requested by the Institute of Inter nal Auditors (IIA), the OIO maintains  a detailed follow -
up register to monitor the implementation of recommendations, and to ensure that management 
actions have been effectively implemented (IIA Standard 2500.A1 – Monitoring Process ). This follow-
up register is updated regularly, based on input collecte d from the concerned Divisions /Units . 
1.3.  The current status of the recommendatio ns is summarized  in Annex 1 - Status of 
recommendations ( March 202 1), and further details are provided in Annex 2 - OIO recommendations 
pending to be closed  (March 202 1) of this document.  
1.4.  As of March 202 1, Management has implemented 89% of the OIO recommen dations ; and all 
the recommendations contained in the TRTA external evaluation report  have now been closed . 
1.5.  The OIO will continue closely monitor ing the implementation of the se recommendation s and 
reporting  to the CBFA  thereof . 
1.6.  Please note that the annual report of the OIO will be presented to the CBFA in June 20212.  
 
1 WT/COMTD/89 – WTO Trade -Related Technical Assistance External Evaluation , 2 December 2016. The 
main objective of the e valuation was "to independently assess the functioning of all WTO Trade -Related 
Technical Assistance (TRTA), analyse WTO TRTA delivery, best practices, and lessons learne d."  
2 Pursuant to t he Administrative Memorandum No.974  (OFFICE(15)/101 – Office of Internal Oversight , 
30 November  2015), the OIO shall report annually to the CBFA, providing an overview of its activities during 
the year .  
  WT/BFA/W/ 545 
 
- 2 - ANNEX 1: STATUS OF RECOMMENDATIONS ( MARC H 202 1) 
 
OIO - STATUS OF RECOMMENDATIONS (for more details, see Annex 2)  
Audit Activity  Report 
year Total number of 
recommendations  Number of  
high severity 
recommendations  Status  
as of 01.0 3.2020 Status   
as of 01.03.202 1 
  % Closed  WIP Open  Closed  WIP Open  
Sick Leave Management  2014 33 26 79% 32 1 0 32 1 0 
IT Security  2014 19 5 26% 13 4 2 13 4 2 
Home Leave Entitlements  2017 11 2 18% 9 2 0 10 1 0 
Appellate Body Members' 
and Panelists' costs  2020 14 0 0% 7 7 0 14 0 0 
Total/Percentage  - 77 33 43%  79% 18% 3% 89% 8% 3% 
 
 
 
TRTA - STATUS OF RECOMMENDATIONS  
Activity  Report 
year Total number of 
recommendations  Status  
as of  01.03.2020 Status  
as of  01.03.202 1 
Closed 
(imple -
mented)  Closed  
(without 
action)  WIP Open  Closed 
(imple -
mented)  Closed  
(without 
action)  WIP Open  
Trade -Related Technical 
Assistance evaluation  2016 28 24 3 1 0 25 3 0 0 
Total/ Percentage  - 28 86% 11%  3% 0% 89% 11% 0% 0%  
  WT/BFA/W/ 545 
 
- 3 - ANNEX 2: OIO RECOMMENDATIONS PENDING TO BE CLOSED  (MARCH 202 1) 
 
A) SICK LEAVE MANAGEMENT   
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
26. The Medical Service and the Human Resources 
Division (HRD) should r econcile the data recorded 
in Oracle with CHIMED on sick leave to ensure that 
it is accurate, consistent and reliable for reporting 
to various stakeholders ; and that any variances are 
justified.  Medium  Q4 2018 In 2018 , the WTO decided to replace CHIMED by 
Préventiel, a software specialized for managing 
medical records and files (http://www.val -
solutions.fr/solutions/solution -preventiel/).  
 
Préventiel was implemented in Q4 2018 and is now 
fully operational. It was implemente d as a stand -alone 
solution in order to secure the access to – and the 
confidentiality of – its information (only the Medical 
Service has access to Préventiel).  
 
While the medical files of staff members are now 
managed by the Medical Service in Préventiel,  sick 
leave continue s to be managed by HRD in Oracle. An 
interface was developed and implemented, in 
December 2018, to import sick leave from Oracle to 
Préventiel .  
 
However, i n 2019, the WTO decided to implement a  
new integrated system to manage HRD proce sses. 
The implementation of the new system , called WISE 
(using Workday as software platform),  is still ongoing.  
 
An interface will be built between WISE  and Préventiel 
and the sick leave data recorded in both systems  will 
be reconciled once the interface has been finalized.  
 W.I.P . The recommendation will 
be closed once the new 
HRD software (WISE) has 
been implemented, and 
its interface with 
Préventiel  has been 
finalized . 
  
  WT/BFA/W/ 545 
 
- 4 - B) IT SECURITY  
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
4: IT Security Governance: GOV 04 – Risk 
management  process.  
 
The Information Security function should regularly 
review the risk register to ensure that information 
security risks are adequately and promptly 
identified. Based on that review, the IT Security 
function should:  
 
1. Determine where an IT security response should 
be applied;  
 
2. Ensure that the appropriate IT security 
responses are included in t he 'proposed mitigation 
measures' section;  
 
3. Ensure that the IT security responses are 
adequately implemented and are operational.  
 High Q3 2018  Information Security risks will be  included in the 
Enterprise Risk Management (ERM) yearly exercise, 
led by t he WTO Risk Officer.  
 
The IT  Security response to identified significant risks 
will be submitted  to the IT Security Steering 
Committee  for validation and approval , as part of the 
results of the risk assessment (see recommendation 
GOV 05 - Inventory of WTO 's key information assets) .  
 
The process was delayed by the  COVID -19 lockdown 
and the associated emergency activities , as well as by  
radical changes in working met hods and tools.  
 
The recruitment process for a Compliance, Risk and 
Resilience Officer is underway.   
 
 W.I.P . The recommendation 
remains Work-in-
Progress , pending 
finalization of the 
Information Security risk 
register (or detailed 
WTO-wide risk register) 
and the implementation 
of recommendation GOV 
05. 
5: It Security Governance: GOV 05 (a) – Inventory 
of WTO's key information asset s. 
 
LDIMD and ITSD shoul d coordinate the creation 
and maintenance of an organization wide inventory 
of key information assets such as data, 
information, documents and publications. This 
inventory should include: definitions of the 
information asset owners' roles and 
responsibilit ies, the information asset classification 
level and the basic requirements in terms of control 
and monitoring of the information asset; the 
definition should take into consideration each 
Division that develops or has access to key 
information assets; The I T Security function should 
perform a security risk assessment, based on the 
list of key information assets, to determine the 
level of protection required for each key 
information asset.  
 Medium  
 Q4 2018  ITSD partially agrees with the recommendation: The 
creation and maintenance of the inventory essentially 
requires input from the owners of information assets, 
i.e. core operational Divisions (as opposed to 
supporting Divisions, such as ITSD or LDIMD). 
Therefore, such task should be mandated and 
supervised by the Information Security Steering 
Committee (ITSSC) created as per GOV 01 
recommendation.  
 
The Confidentiality Classification Policy was adopted 
and is now used as basis for the organization -wide 
invent ory of Key Information Assets.  
 
The inventory of Key Information Assets is currently 
being done by Divisions, under the co -ordination of 
the Information Security Office. Most sensitive 
information assets have been identified, and all W.I.P . The recommendation will 
be closed upon 
completion of the 
inventory of Key 
Information Assets . 
 
  
  WT/BFA/W/ 545 
 
- 5 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
 information essential for the risk assessment has 
already been collected by ITSD.  
 
A computer platform has been implemented to record  
and maintain the results of the inventory. The system 
is available to all staff at http://kiai.cwr.wto.org to 
provide a baseline for classificat ion of information 
produced by different Divisions.  
 
Unfortunately, the inventory process has been paused 
several times due to (1) leave period and 
unavailability of key personnel ; (2) the  COVID -19 
lockdown and associated emergency activities and 
radical c hanges in working methods and tools ; and (3) 
other priorities related to cyber security . 
 
6: IT Security Governance: GOV 06  – Information 
security policies structure.  
 
Review the structure and completeness of IT 
security policies, standards, guidelines and 
procedures; define and enforce the various IT 
policies including Security policies, IT Securit y Risk 
Assessment Policy, Disaster Recovery Policy, and 
Information Security Risk Assessment Policy that is 
aligned with the Risk Management Policy. Medium  Q4 2018  Following the introduction of the overarching policy, 
the following policies and procedures have been 
developed  and issued : 
 
• Policy on Architecture and Security Assessment of 
Information Systems ; 
• Information Security Policy ;  
• Access Control Policy ; 
• Incident Management Policy;  
• Information Classification Policy ; and  
• Disaster Recovery Policy. 
 
The Information Security Risk Management Policy , 
which is the last outstanding p olicy in the framework 
recommended by the Internal Audit,  will be circulated 
to ITSSC for comments and final validation.  
A session on Information Security w ill be scheduled in 
Q2 2021.  
Unfortunately, the process has  been paused due to 
the COVID -19 lockdown and associated emergency 
activities and radical changes in working methods and 
tools; as well as other priorities related to 
cyber security . W.I.P . This recommendation 
will be closed once  the 
Information Security 
Risk Management Policy 
has been finalized and 
communicated to 
concerned staff 
members . 
 
 
 
  
  WT/BFA/W/ 545 
 
- 6 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
9: IT Security Governance: GOV 08 – WTO's IT 
security strategy.  
WTO should formally define its IT Security 
function's strategy and objectives, taking into 
consideration the results of the key information 
assets and its risk assessment . 
The IT security strategy should be reviewed to 
ensure it is aligned with the organization's business 
objectives.  
 Medium  
  Q1 2019  The IT Security function 's strategy and objectives will 
be submitted to the ITSSC for approva l together with 
the results of the risk assessment exerci se. 
 
Unfortunately, the process has been paused due to 
the COVID -19 lockdown and associated emergency 
activities and radical changes in working methods and 
tools; as well as other priorities related to 
cybersecurity.  
 
 W.I.P . The status of the 
recommendation 
remains unchanged , 
pending the finalization 
of the IT Security 
function 's strategy and 
objectives . 
 
10: IT Security Governance: GOV 09 –IT Security 
function's objectives alignment with an IT security 
strategy.  
IT Security function should deve lop a clear set of 
its objectives that should be aligned with the IT 
security Strategy in recommendation GOV. 8 
above.  
 Low Q1 2019  The interim objectives of the IT Security function have 
been identified (but not  formally documented). The 
long-term objectives will be defined once the IT 
Security function 's strategy has been  defined 
(recommendation GOV 08).  OPEN  The status of the 
recommend ation 
remains unchanged  
pending finalization of 
the IT Security function's 
strategy and objectives . 
15: IT Security Controls: ITSC -04 - Segregation of 
duties (SoD) control framework  
The WTO's Back -Office unit and the IT Security 
function should:  
1. Define a SoD framework, taking into 
consideration that the security requirements must 
be balanced with resource availability (e.g. a 
back-up person for a specific function must be 
attributed the appropriate access rights to perform 
back-up operations);  
2. Define a procedure for managing exceptions to 
the SoD framework. This procedure should include 
the formal documentation of deviations from the 
SoD framework and formal validation by the user's 
manager;  
3. Review the current configuration of the ERP roles 
and responsibilities (i.e.  ERP profiles) against the 
SoD framework to ensure no conflicting rights be 
given to employees without prior validation from 
the user's manager.  
 Medium  Q1 2019  The ERP segregation of duties will be addressed jointly 
by HRD, AGSD a nd ITSD following the outcome of the 
ERP security audit .  
 OPEN  This recommendation 
will be implemented 
after the ERP security 
assessment  (OIO) .  
  
  WT/BFA/W/ 545 
 
- 7 - C) HOME LEAVE ENTITLEMENTS   
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  
 Status  OIO's comments  
1. The correct balance should be sought between 
the need to encourage use of the lump -sum and 
the need to ensure rational use of resources in 
order to achieve economy, efficiency and 
effectiveness in the process.  
Therefore, the OIO invites the Director of the  
Human Resources Division to closely monitor the 
costs and benefits to the WTO of the lump -sum 
arrangement, taking into consideration the level 
of the cash incentives provided to staff by the 
lump-sum procedure; and to adopt any necessary 
adjustments would  the arrangements be 
considered excessive.  Medium  Q3 2018  The methodology used by the WTO (and several other 
Geneva -based International Organizations) to 
calculate the home leave lump sums was based on the 
''full-fare economy'' rates published by IATA through  
the Galileo system. IATA decided to abandon the ''full -
fare economy'' rates as from October 2018. Hence, 
the rates are no  longer  updated in Galileo since 
1 November  2018.  
A group of five International Organizations 
established a Working Group to analyse and propose 
a new methodology. The Working Group, supported 
by Carlson Wagonlit as consultant, subm itted its 
conclusions in October 2018 .  
Finally, WTO Senior Management opted for the 
methodology used by the United Nations for 
calculating lump -sums and decided to compile all 
travel -related policies into one single document. This 
work was finalized in Fe bruary 2021, and the draft 
Administrative Memorandum is now being reviewed 
by the Joint Advisory Committee (JAC).  
 W.I.P. The recommendation 
remains Work -in-
Progress until the 
Administrative 
Memorandum, detailing 
the new methodology for 
calculating home -leave 
Lump Sums , is approved 
by the Director -General, 
and published . 
 
 
__________