RESTRICTED  
  
WT/BFA/W/451  
 
 15 June 2018  
(18-3623) Page: 1/28 
Committee on Budget,  Finance and Administration    
 
  
 
 
 
ANNUAL REPORT  
ON THE ACTIVITIES OF THE OFFICE OF INTERNAL OVERSIGHT  (OIO)   
2017 -2018  
 
 
  WT/BFA/W/451  
 
- 2 - 
 
  Table of Contents  
 
 
 
1   BACKGROUND  ................................ ................................ ................................ .............  3 
2   INDEPENDENT STATUS O F THE OIO  ................................ ................................ ............  3 
3   BUDGET AND STAFFING  ................................ ................................ ..............................  3 
3.1   Budget  ................................ ................................ ................................ ..............  3 
3.2   Staffing  ................................ ................................ ................................ .............  4 
4   ACTIVITIES CONDUCTED  BY THE OIO SINCE JUN E 2017  ................................ .............  4 
4.1   Solidify OIO's foundations  ................................ ................................ ....................  4 
4.2   Complete the OIO's Internal Audit Plan for 2017 -2018 ................................ ............  6 
4.3   Conduct internal investigations  ................................ ................................ .............  7 
4.4   Provide support and advice to management, staff and stakeholders  ..........................  8 
5   INTERNAL OVERSIGHT A CTIVITY FOR 2018 -2019  ................................ ......................  9 
 
ANNEX 1 - INTERNAL AUDIT PLAN FOR 2017 - 2018  ................................ ......................  10 
ANNEX 2 - INTERNAL AUDIT PLAN FOR 2018 - 2019  ................................ ......................  11 
ANNEX 3 - INTERNAL AUDIT QUALI TY SELF ASSESSMENT – 2018  ................................ . 12 
ANNEX 4 - STAT US OF INTERNAL AUDIT  RECOMMENDATIONS (1 J UNE 2018)  ...............  19 
ANNEX 5 - AUDIT RECOMMENDATION S PENDING TO BE CLOS ED (1 JUNE 2018)  ...........  20 
ANNEX 6 - LIST OF ACRONYMS  ................................ ................................ ......................  28 
 
 
 WT/BFA/W/451  
- 3 - 
 
  1  BACKGROUND  
1.1.  The Office of Internal Oversight (OIO), established in November  2015, is in charge of 
conducting i nternal audits, investigations and any other form s of assessment that may be needed  
in respect of management, staff and resources of the WTO ; and to provide for a professional, 
independent, objective and documented assessment of management practices, expenses, 
budgetary control and allegations of misconduct.  
1.2.  Pursuant to t he Administrativ e Memorandum No.9741, the OIO shall report annually to the 
Committee on Budget, Finance and Administration ( CBFA) providing , for information, an overview 
of its activities during the year , and indicating any circumstances that it considers may have 
affecte d its independence or otherwise impeded its ability to fulfil its functions.  
1.3.  In the first section of this report, t he Head of the OIO confirms the independence of the 
internal oversight activity at the WTO . The second section of the document is dedicated t o the 
budget and staffing of the OIO. The third section of the document details the activities conducted 
by the OIO during the year. Finally, the priorities of the OIO for 2018 -2019 are described in the 
last section of the report .  
2  INDEPENDENT STATUS OF TH E OIO  
2.1.  The International Standards for the Professional Practice of Internal Auditing (hereafter 
referred to as the  IIA Standards )2 require the OIO to remain independent and free from 
interference when performing its work, and to confirm its independence  to a level within the 
organization that allows the internal oversight activity to fulfil its responsibilities.  Therefore, t he 
Head of the OIO is required to report annually to the Director -General and to the CBFA, indicating 
any circumstances that may hav e affected his/her independence.1 
2.2.  The OIO is functionally and operationally independent from the Secretariat and from  WTO 
Members in the conduct of its  duties .  
2.3.  The Head of the OIO  certifies that no circumstances have affected, in fact or appearance, the 
independence of the OIO or impeded its ability to effectively fulfil its functions and responsibilities 
in an unbiased, objective and independent manner . Neither the Director -Genera l nor any other 
WTO senior official  have tried to influence or otherwise interfered with the work of the OIO.  
2.4.  The OIO has received full and unrestricted access to all WTO records and staff members . The 
Head of the OIO ha s been granted  direct and unrestrict ed access to the Director -General, senior 
management and the Chair of the CFBA.  
3  BUDGET AND STAFFING  
3.1.  In accordance with IIA Standard 2030, Resource Management,  the Head of the OIO must 
ensure that internal oversight resources are appropriate, sufficient, an d effectively deployed to 
achieve the Internal Oversight work plan.  
3.1  Budget  
3.2.  The OIO has its own operational budget , which  was determined by the Director -General, 
upon the entry into function of the Head of the OIO.  The budget allocated to the  OIO for 2017 and 
2018 is detailed in Table 1 – Budget and actual costs of the OIO (in Swiss Francs ), along with the 
actual costs incurred during the period (up to 30 April 2018) .  
                                                
1 Administrative Memorandum No.974  - Office of Internal Oversight, OFFICE(15)/101, 
30 November  2015.  
2 The International Standards for the Professional Practice of Internal Auditing , promulgated by the 
Institute of Internal Auditors (IIA), provide a principle -focused and mandatory framework for performing and 
promoting internal auditing – For more details : https://na.theiia.org/s tandards -guidance . WT/BFA/W/451  
 
- 4 - 
 
  Table 1 - Budget and actual costs of the OIO (in CHF) 
 2017  2018  
Account Description  Budget  Actual s Budget  Actual s  
(30 April)  
Staff / Salary (including pension)  410,900  350'568  410,900  115'291  
Special Service Agreements  15,000  0 15,000  0 
Air & Rail Transportation  8,000  7'068  8,000  0 
TOTAL  433,900  357'636  433,900  115'291  
 
3.3.  The OIO has consumed  82 percent of its budget in 2017 , and 27 per cent of the budget  in 
2018 (up to 30 April 2018). The Budgetary S urplus of budget was due to the difficulties 
encountered by the OIO for fully staffing the Office  (cf. infra) . 
3.2  Staffing  
3.4.  The OIO is currently composed of the Head of Office (Grade 10) and an Administrative 
Assistant (Grade 4).   
3.5.  Based on benchmarks provided by the United Nations Joint Inspection Unit (JIU)  and other 
International Organizations regarding internal overs ight staffing , and taking into consideration the 
mandate of the OIO  at the WTO , it was decided to reinforce the OIO with  at least one additional 
Internal Oversight professional . 
3.6.  Given the current ceilin g in the number of staff at the WTO and the necessity for the Human 
Resources Division (HRD) to prioritize the allocation of positions  among several requesting 
Divisions , the OIO decided to recruit  an Internal Auditor/Investigator from the International Labour 
Organization (ILO) , who was se conded to the WTO  for a period of six  months ( from August 2017 
to February 2018).  
3.7.  The WTO and the ILO agreed  to extend  the contract of the Internal Auditor/Investigator  
(from May 2018 to  December  2019), based on an interagency loan.  Unfortunately, in May 2 018, 
the OIO was informed that the ILO failed to reach an agreement internally with the incumbent on 
the terms of the interagency loan. 
3.8.  Also, the Administrative Assistant (Grade 4) of the OIO had a health accident in November 
2017 and has been on extended sick leave since then.  
3.9.  Given the above -mentioned circumstances,  the OIO did not have sufficient resources to 
achieve some of its engagement objectives  for 2017 -2018 (cf. infra) . The current resource 
limitation has impact ed the capacity of the OIO to  fully fulfil its mandate.  
3.10.   Nonetheless, t he head of the OIO will strive to complete, as soon as possible, the process 
for hiring an Internal Auditor/Investigator ( preferably at Grade 7  or above ). 
 
4  ACTIVITIES CONDUCTED BY THE OIO SINCE JUNE 2017  
4.1.  Using  a risk -based approach, the OIO identified the following objectives for 2017 -2018: (a) 
Solidify OIO's foundations; (b) complete the ass ignments included in the OIO's I nternal Audit Plan 
for 2017 -2018; (c) conduct internal investigations; and (d) provide support an d advice to 
management, staff and stakeholders3. 
 
4.1  Solidify OIO's foundations  
4.2.  The OIO focused its efforts o n reinforcing the regulatory framework in which it operates  and 
on further improving the protection of staff members' individual rights : 
                                                
3 See document WT/BFA/W/408 - Report on the OIO Activity Plan for 2017 -2018, 14 February  2017. 
 WT/BFA/W/451  
 
- 5 - 
 
   
a. The OIO reviewed the Provisional P rocedure for Admin istrative Investigations and 
Disciplinary Actions4 and proposed several amendments to further align the procedure 
to the Uniform Guidelines for Investigations5 and to good practices applied in other 
International Org anizations. The revised procedure is currently being reviewed by the 
Joint Advisory Committee (JAC)6. 
 
b. An Anti-Fraud Policy  has been drafted , defining what constitutes fraud, clarifying the 
responsibilities where fraud is at issue and outlin ing WTO's approach to fraud 
prevention and control. Additionally, the draft policy highlights WTO's commitment to 
'zero-tolerance  to fraud '. The draft policy is currently being reviewed by the JAC . 
 
c. The Anti -Harassment policy7, prepared by the Human Resources  Division  (HRD) , has 
recently been communicated to all staff members , promoting a more efficient working 
environment, free from discrimination, harassment and abuse of authority.  
 
4.3.  The OIO, jointly with the Administration and General Services Division (AGSD ), also worked 
on the establishment  of an Internal Control Framework8 at the WTO. The objective of this 
framework is  to provide reasonable assurance to the Director -General with regards to  the 
achievement of WTO objectives, and to guide  the WTO Secretariat  in the establishment of  internal 
controls, in order to ensure that (a) o perations are executed in an  ethical , economical,  efficient , 
and effective manner;  (b) accountability obligations are fulfilled;  (c) WTO 's assets and resources 
are safeguarded against  loss, misuse or damage ; and  (d) operations are conducted in c ompliance 
with applicable regulations, rules , policies  and administrative memoranda. The proposed Internal 
Control Framework is currently being reviewed by the Director -General.  
 
4.4.  Finally, the OIO conducted a Quality S elf-Assessment  exercise.  The objective of this exercise 
was to evaluate the conformance of the OIO activity with the IIA Standards. The results of the 
Quality Self -Assessment exercise are summarized in Annex 3 – Internal Audit Qual ity Self -
Assessment – 2018.  
 
4.5.  According to the results of the Quality Self -Assessment, the OIO activity fully complies with 
82% of the IIA Standards  (i.e. 40 out of 49 IIA Standards) , and partially complies with the nine 
(9) other IIA Standards .  
 
4.6.  The OIO i dentified the following areas of improvement in order to fully comply with all the IIA 
Standards:  
 
a. The Internal Oversight Charter , defining  the purpose, authority, and responsibility of 
the OIO , should be finalized  and approved (IIA Standard 1000 ). The OIO  has included 
the elaboration of this document in its list of priorities for 2018 -2019. 
 
b. The staff resources of the OIO should be sufficient  and effectively deploy ed (IIA 
Standards 2000, 2030 and 2230). As indicated above, the OIO has the intention to  
hire one Internal Auditor /Investigator  as soon as possible.  
 
c. The Quality Assurance program should be further developed (IIA Standards 1310, 
1311 and 1320) . An external quality assessment will be requested once the Office is 
fully operational and  its desired le vel of maturity is reached (within 2 -4 years).  
 
                                                
4 Provisional Procedure for Administrative Investigations and Disciplinary Actions , OFFICE(14)/17, 16 
October 2014.  
5 For more details: http://www.conf -int-investigators.org/?page_id=415 . 
6 The Joint Advisory Committee  (JAC)  advises the Director -General on issues related to the 
establishment of and changes in personnel policies,  conditions of work and general staff welfare, as well as the 
establishment or amendment of Staff Regulations, Staff Rules and Staff Administrative Memoranda.  
7 Administrative Memorandum No. 985 - Right to Work in an Environment free from Discrimination, 
Harassment and Abuse of Authority,  OFFICE(18)/37, 30 April 2018.  
8 The Internal Control Framework is based on the model proposed by the Committee of Sponsoring 
Organisations of the Treadway Commission (COSO) and the Three Lines of Defense model,  promulgate d by the 
Institute of Internal Auditors  (IIA).  WT/BFA/W/451  
 
- 6 - 
 
  d. The design, implementation, and effectiveness of the WTO’s ethics -related objectives, 
programs, and activities  should be evaluated (IIA Standard 2110 -A1). This evaluation 
is not perceived as a priority  at this stage, and will be considered when defining future 
internal audit plans.  
 
e. The effectiveness of risk management processes at the WTO should be evaluated (IIA 
Standard 2120). This evaluation has been included in the Internal Audit plan for 2019.  
 
4.7.  The OIO is committed to provide high quality professional services to its stakeholders . 
Therefore, the OIO will continue its efforts to achieve full compliance with the Code of Ethics and 
the IIA Standards , and will continue to closely monitor the relevance,  efficiency and effectiveness  
of its activities . 
 
4.2  Complete the OIO's Internal Audit Plan for 2017 -2018  
4.8.  The OIO's risk -based Internal Audit Plan for 2017 -2018 was presented to the CBFA in 
February  20179 and is detailed in Annex 1 - Internal Audit Plan for 2017-2018. 
4.9.  Taking into consideration stakeholders' priorities , constraints  and expectations , and pursuant 
to the intense  discussions held at the CBFA in 2017 around dependency allowances , the OIO 
decided to  modify the initial Internal Audit Plan  as follows : 
a. The audit of Dependency Allowances  was included in the plan for 2018.  
b. The audit of Enterprise Risk Management was postponed to 2019 (pending the 
recruitment of a Head of Head of Governance, Risk and Compliance who shall be in 
charge of maintaining the Se cretariat's Risk Register. The previous holder of this post 
has retired ; 
c. The audit of Information Security Governance (ISO27001) was also postponed to 
2019, in order to provide sufficient time for the Information Technology Solutions 
Division ( ITSD) to fin alize the implementation of the recommendations proposed in 
the audit of Information Security.  
 
4.10.   Due to resource limitations and the unexpected workload in terms of investigations, the OIO 
has not been in a position to fully complete the assignments include d in the Internal Audit Plan for 
2017-2018. The status of the internal audit engagements planned for 2017 -2018 is as follows:  
a. The audit of h ome leave entitlements  was finalized in June 201710.  Since then, the 
OIO has been closely working with HRD in the implement ation of  the 
recommendations made in the internal audit report and in the drafting of  a new home 
leave policy . As of June 2018, eight (8) out of the 11 recommendations included in the 
internal audit report have been fully implemented. Also, the new  home leave p olicy 
has been drafted and is currently being reviewed  / validated by other entities 
intervening in the process.  
b. The audits of Dependency Allowances and Gifts, Gratuities and Outside A ctivities  are 
currently ongoing. The field work has been fi nalized and both internal audit reports 
are currently being drafted. It is to be noted that t he audit of Dependency A llowances 
was not initially included in the 2017 -2018 Internal Audit P lan. The OIO is closely 
working with HRD to  design a dashboard to be used for monitoring the timely update 
of staff allowances  (including Dependency Allowances) , in accordance with the WTO 
Staff Regulations and Rules.  
c. The OIO and the Procurement Service have been closely collaborating with the 
identif ication , preventi on and dete ction of  potential fraud in procurement.  The audit of 
Procurement is scheduled for Q3 -Q4 2018.  
                                                
9  See d ocument WT/BFA/W/408 . 
10 See document WT/BFA/W/423.  WT/BFA/W/451  
 
- 7 - 
 
  d. The audit of Education Grant s will be conducted in 2019. However, the OIO closely 
worked with HRD in order to already implement necessary  internal controls . The 
Administrative Memorandum on Education Grant was revised in order to incorporate 
the changes proposed by the OIO11.  
e. The analysis of the access rights in Oracle E -Business Suite will be initiated  in Q4 
2018.  
f. The OIO  is working with the Strategic Planning, Monitoring and Evaluation Section of 
the Institute for Training and Technical Cooperation (ITTC) in order to monitor the 
implementation  of the recommendations made in the Trade -Related Technical 
Assistance external evaluation . The OIO will update the CBFA once the exercise is 
finalized.  
 
4.11.   Finally, the OIO continued to periodically monitor the implement ation of internal audit 
recommendations , based on input collected from the concerned Divisions.  The current status of 
the audit recommendations is detailed in Annex 4 – Status of Internal Audit recommendations 
(1 June 2018) .  
4.12.   The OIO decided to close 14 recommendations  since June 2017 , based on the supporting 
information received from the concerned D ivisions . As requested by the CBFA, t he audit 
recommendations still pending to be closed are detailed in Annex 5 – Audit recommendations 
pending to be closed (1 June 2018).  The OIO will continue closely monitor ing the implementation 
of the internal audit r ecommendations.  
 
4.3  Conduct internal investigations  
4.13.   The OIO is the exclusive entity at the WTO responsible for investigating allegations of 
violations  of any WTO norm applicable to s taff members, irrespective of the nature of their 
contracts, and for transmi tting to the Director -General12 the results of such investigations together 
with recommendations on action to be taken.  
4.14.   Since July 2017, the OIO has been contacted for 14 cases of alleged misconduct (intakes). 
The OIO analysed in details each of the intakes . Whenever the intakes were related to workplace 
issues (e.g.: conditions of employment, relations with supervisors or colleagues, performance 
management) and not misconduct, the concerned persons were redirected to other channels 
available at the WTO to a ddress grievances (such as the Intern al and/or the External Mediators or 
the Staff Welfare Officer ).  
4.15.   The OIO received formal complaints for five (5) of the above -mentioned intakes, and  carried 
out a preliminary assessment for each of these complaints ( before reaching the decision on the 
initiation (or not) of an investigation ). A summary of these complaints  is provided in Table 
2 - Summary of investigation cases (July 2017 – June 2018).  
Table 2 - Summary of investigation cases (July 2017 – June 2018)  
Intak e 
Number  Type of 
allegation  Investigation 
opened  Potential 
loss (CHF)  Status  Allegations 
confirmed  Sanction applied  
18 Misconduct  No 0 Closed  No - 
22 Fraud  Yes 19'088 
(reimbursed
) Appeal  Yes Salary reduction  
26 User Identity 
Theft Yes 0 Closed  Yes Dismissal  
27 Misconduct  No 0 Closed  No - 
30 Harassment  No 0 Closed  No - 
 
                                                
11 Administrative Memorandum  No. 961/REV.13 – Education Grant, Office(18)/35, 8 May 2018.  
12 Or, in the case of an alleged violation by the Director -General, a Deputy Director -General, or a 
member of the Office of the Director -General, to the Chairs of the General Council and of the CBFA.  WT/BFA/W/451  
 
- 8 - 
 
  4.16.   The Director -General decided to adopt disciplinary measure for two of the cases (fraud and 
user identity theft). All the defrauded amounts identified (19'088 CHF) were reimbursed to the 
WTO.  
4.17.   The Head of the OIO confirms that the Director -General, the Deputy Directors -General and 
the members of the Office of the Director -General (DGO) have not been the subject of 
investigations.  
4.18.   The OIO also participated in several initiatives aimin g at promoting  and maintain ing a 
culture of integrity and honesty at the WTO:  
a. A video module was developed with HRD to explain  the code of c onduct and the role of 
the internal o versight function at the WTO. This video module is now part of the  
induction material presented to recently -hired staff members.  
b. A Town Hall meeting was organised in November 2017 to discuss about the 
importance of Ethics in International Organizations  and how to take the lead in 
strengthening the ethical culture at the WTO.  
c. Another  Town Hall meeting  was organised in May 2018  to present to s taff members 
the different channels available at the WTO for addressing grievances .  
4.4  Provide support and advice to management, staff and stakeholders  
4.19.   The OIO provided independent advice to the Director -General , senior m anagement  and staff 
members  to help t hem fulfil their responsibility towards the O rganisation and its Members. The 
OIO provid ed assurance support to several Divisions in order to improv e the effectiveness of 
governance, risk management and control processes.    
4.20.   The OIO also maintained f requent  contact s with the External Auditor (Bundesrechnungshof), 
the Internal Mediator and the Legal Counsel to the Administration . The OIO considers that t he 
collaboration  and communication with these different functions has been positive and constructive.  
4.21.   The Head of the OIO represented the WTO at the 201 7 Conference of International 
Investigators ( 11-13 October  2017), and at the annual conference of the He ads of Internal Audit 
(HOIA) in Europe ( 18-20 April 2017).  
4.22.   Furthermore, t he OIO has also been an active member of the Representatives of Internal 
Audit Services (RIAS ), the Representatives of Investi gations Services (RIS)  and Ethics Network of 
Multilateral  Organizations (ENMO) . These network s of heads of internal audit/ investigations /ethics  
services of International Organizations  meet in organized forums to share good practices and 
establish guidance for internal audit /investigations /ethics  in the internati onal public sector.  
4.23.   The Head  of the OIO also participated in the panel for recruiting the Head of Financial 
Operations.  
4.24.   Finally, the Head of the OIO  participated in a peer coaching programme (six sessions), 
where managers from several International Organizations share expertise on how to improve 
management skills.  WT/BFA/W/451  
 
- 9 - 
 
  5  INTERNAL OVERSIGHT ACTIVITY FOR  2018 -2019  
5.1.  According to the IIA Standard 2010 – Planning , the Head of the OIO shall establish a risk -
based plan to determine the priorities of the internal oversight  activity.  
5.2.  The OIO's priorities for the 2018 -2019 are  mainly derived from the WTO's Secretariat risk 
register maintained by AGSD, input received from key senior managers and International 
Professional Practices Framework (IPPF) requirements13.  
5.3.  The OIO identified the following priorities  for 2018 -2019:  
 
a. As indicated before, the OIO will seek to hire and train additional professional 
resources in orde r to enhance and reinforce the capacity and capability of the Office.  
 
b. An Internal Oversight Charter will be prepared, defining the framework within which 
the Internal Oversight function should operate at the WTO. The Charter will be shared 
with the CBFA a fter the Director -General has approved it;  
 
c. Several initiatives will be conducted, aiming at enhancing the visibility of the O IO and 
explaining its mandate to staff members and external parties (e.g. dedicated page on 
WTO's website and intranet, information leaflet, participation to the induct ion 
programme for newcomers , etc.). 
 
d. The OIO will complete the assignments included in the internal audit plan for 2018 -
2019, as detailed in Annex 2 - Internal Audit Plan for 2018 -2019. The internal audit 
plan will be reviewed at least annually, and may need to be adapted in response to 
changing risks, priorit ies and expectations at the WTO.  
 
e. The OIO will continue conducting administrative investigations  and will further  
collaborat e with other Services for the promotion and maintenance of  a culture of 
integrity and honesty at the WTO. The OIO will continue working with the 
Procurement Service to raise awareness of  the risks related to procurement fraud and 
corruption. The OIO will also w ork with HRD, the recently appointed Staff Welfare 
Officer and the Mediator(s) in order to implement the anti -fraud and anti -harassment 
policies at the WTO . 
 
f. The OIO will continue providing support and advice to management, staff and 
stakeholders on the ef fective discharge of their responsibilities , and will assist the 
Divisions in the implementation of  internal audit recommendations.  
 
g. Finally, t he OIO will continue participating in international professional forums 
(i.e. Representatives of Internal Audit S ervices (RIAS) , Representatives of 
Investigative Services (RIS) and Ethics Network of Multilateral Organizations ( ENMO ) 
in order to remain acquainted with trends and best practices impacting the internal 
oversight functions . 
 
5.4.  The OIO will report annually t o the CBFA, providing an overview of its activities during the 
year and the status of the different assignments included in the internal oversight  plan. 
                                                
13 The IPPF, promulgated by the IIA, is a conceptual framework that organizes authoritative guidance to 
Internal Aud it professionals.  WT/BFA/W/451  
 
- 10 - 
 
  ANNEX 1 - INTERNAL AUDIT PLAN FOR 2017 - 2018  
Audit subject  Source  Audit Scope/Objective  2017  2018  
Management of Home 
Leave  Fraud case  
Management 
Request  Compliance with policy. Review of the 
economy, efficiency and effectiveness of 
processes and internal controls. 
Calculation of Home Leave entitlements. 
Analysis of cost variations and trends.  x  
Procurement  Risk Register  
CBFA 
 In 2017: The OIO  will focus on 
procurement fraud prevention (through 
workshops/trainings), since the External 
Auditors conducted an audit of 
procurement in 2015 and the revised 
WTO Financial Rules and new 
Procurement Manual are being 
implemented.  
In 2018: The internal aud it will include 
the assessment of processes and internal 
controls; and the review of the 
implementation of the new Procurement 
Manual and of Chapter IX of the revised 
Financial Rules.   x x 
Policies on gifts, 
gratuities and outside 
activities  Risk Registe r 
 Assessment of policies related to:  
- Acceptance of gifts, gratuities or other 
favours from vendors or outside parties;  
- Remunerated outside activities of staff 
members;  
- Management of Staff Assistance Fund;  
- Post-employment obligations.  x  
Education  Grant  Management 
Request  Compliance with policy. Review of the 
economy, efficiency and effectiveness of 
processes and controls. Calculation of 
allowances.   x 
Enterprise Risk 
Management  IIA Standards  Analysis of how risks are assessed, 
managed and mitigated at WTO (risk 
management process and register).   x 
Access rights in Oracle 
E-Business Suite 
(Enterprise Resource 
Planning)  
 Risk Register  
IT Security audit  Review of security processes and 
measures, analysis of access 
rights/permissions and segregation of 
duties in Oracle (ERP).   x 
Information Security 
Governance  Risk Register  
Management 
Request  Gap analysis and roadmap for 
implementing the international standard 
ISO27001 (Information security 
management system).   x 
Follow up of 
recommendations 
made in the 
Trade -Related 
Technical Assistance 
external evaluation  Risk Register  
Management 
Request  Independent review of the 
implementation of the recommendations 
stated in the WTO TRTA external 
evaluation report.  x x 
Follow up of audit 
recommendations  IIA Standards  Periodic review of the implementation of 
internal audit recommendations.  x x 
Ad hoc audits, if any  - To be determined  - - 
 
 
 WT/BFA/W/451  
 
- 11 - 
 
  ANNEX 2 - INTERNAL AUDIT PLAN FOR 2018 - 2019  
Audit subject  Source  Audit Scope/Objective  2018 2019 
Policies on gifts, 
gratuities and outside 
activities  Risk Register  
 Assessment of policies related to:  
- Acceptance of gifts, gratuities or other 
favours from vendors or outside parties;  
- Remunerated outside activities of staff 
members;  
- Manag ement of Staff Assistance Fund;  
- Post-employment obligations.  x  
Dependency 
Allowances  Management 
request  Assessment of internal controls for 
processing dependency allowances (and 
other allowances) . x  
Procurement  Risk Register  
 Assessment of processes and internal 
controls ; review of the implementation of 
the new Procurement Manual and of 
Chapter IX of the revised Financial Rules.   x  
Education Grant  Management 
Request  Assess compliance with Staff Regulations 
and Rules . Review of the economy, 
efficiency and effective ness of processes 
and controls .  x 
Information Security 
Governance  Risk Register  
Management 
Request  Gap analysis and roadmap for 
implementing the international standard 
ISO27001 (Information security 
management system).   x 
Access rights in Oracle 
E-Business Suite 
(Enterprise Resource 
Planning)  
 Risk Register  
IT Security audit  Review of security processes and 
measures, analysis of access 
rights/permissions and segregation of 
duties in Oracle (ERP).  x x 
Enterprise Risk 
Management  IIA Standards  Analysis of how risks are assessed, 
managed and mitigated at WTO (risk 
management process and register).   x 
Follow up of 
recommendations 
made in the 
Trade -Related 
Technical Assistance 
external evaluation  Risk Register  
Management 
Request  Independent review of the 
implementation of the recommendations 
stated in the WTO TRTA external 
evaluation report.  
 x x 
Follow up of audit 
recommendations  IIA Standards  Periodic review of the implementation of 
internal audit recommendations.  x x 
Ad hoc audits, if any  - To be determined  - - 
 WT/BFA/W/451  
 
- 12 - 
 
  ANNEX 3 - INTERNAL AUDIT QUALITY SELF ASSESSM ENT – 2018  
IIA-
Standard  Statement  Fully 
compliant  Partially 
Compliant  Not 
Compliant  
1000 The purpose, authority, and responsibility of the internal 
audit activity must be formally defined in an internal audit 
charter, consistent with the Mission of Internal Audit and 
the mandatory elements of the International Professional 
Practices Framework (the Core Principles for the 
Professional Practice of Internal Au diting, the Code of 
Ethics, the Standards, and the Definition of Internal 
Auditing). The chief audit executive must periodically 
review the internal audit charter and present it to senior 
management and the board for approval.    x   
1100 The internal audit activity must be independent, and 
internal auditors must be objective in performing their 
work.  x     
1110 The chief audit executive must report to a level within the 
organization that allows the internal audit activity to fulfil 
its responsibilities. The chief audit executive must confirm 
to the board, at least annually, the organizational 
independence of the internal audit activity.  x     
1111 The chief audit executive must communicate and interact 
directly with the board.  x     
1112 Where the chief audit executive has or is expected to have 
roles and/or responsibilities that fall outside of internal 
auditing, safeguards must be in place to limit impairments 
to independence or objectivity.  x     
1120 Internal auditors must have an impartial, unbiased 
attitude and avoid any conflict of interest.  x     
1130 If independence or objectivity is impaired in fact or 
appearance, the details of the impairment must be 
disclosed to appropriate parties. The nature of the 
disclosure will depend upon the impairment.  x     
1210 Proficiency: Internal auditors must possess the knowledge, 
skills, and other competencies needed to perform their 
individual responsibilities. The internal audit activity 
collectively must possess or obtain the knowledge, skills, 
and other competencies needed to perform its 
responsibilities.  x     
1220 Due Professional Care: Internal auditors must apply the 
care and skill expected of a reasonably prudent and 
competent internal auditor. Due professional care does  not 
imply infallibility.  x     
1230 Internal auditors must enhance their knowledge, skills, 
and other competencies through continuing professional 
development.  x     
1300 The chief audit executive must develop and maintain a 
quality assurance and improvement program that covers 
all aspects of the internal audit activity.  x     
1310 The quality assurance and improvement program must 
include both internal and external assessments.    x   
1311 Internal assessments must include:  
- Ongoing monitoring of the performance of the internal 
audit activity; and  
- Periodic self -assessments or assessments by other 
persons within the organization with sufficient knowledge 
of internal audit practices.  
 x   WT/BFA/W/451  
 
- 13 - 
 
  IIA-
Standard  Statement  Fully 
compliant  Partially 
Compliant  Not 
Compliant  
1312 External assessments must be conducted at least once 
every five years by a qualified, independent assessor or 
assessment team from outside the organization. The chief 
audit executive must discuss with the board:  
- The form and frequency of external assessments; and  
- The qualifications and independence of the external 
assessor or assessment team, including any potential 
conflict of interest.  Not 
applicable      
1320 The chief audit executive must communicate the results of 
the quality assurance and improvement program to senior 
management and the board. Disclosure should include:  
- The scope and frequency of both the internal and 
external assessments.  
- The qualifications and independence of the assessor(s) or 
assessment team, including potential conflicts of interest.  
- Conclusions of assessors.  
- Correc tive action plans.    x   
1321 Indicating that the internal audit activity conforms with the 
International Standards for the Professional Practice of 
Internal Auditing is appropriate only if supported by the 
results of the quality assurance and improvement  
program.  x     
1322 When non -conformance with the Code of Ethics or the 
Standards impacts the overall scope or operation of the 
internal audit activity, the chief audit executive must 
disclose the non -conformance and the impact to senior 
management and the board  x     
2000 The chief audit executive must effectively manage the 
internal audit activity to ensure it adds value to the 
organization.    x   
2010 The chief audit executive must establish a risk -based plan 
to determine the priorities of the internal audit activity, 
consistent with the organization’s goals.  x     
2010.A1  Assurance: The internal audit activity’s plan of 
engagements must be based on a documented risk 
assessment, undertaken at least annually. The input of 
senior management and the board must be considered in 
this process.  x     
2010.A2  Assurance: The chief audit executive must identify and 
consider the expectations of senior management, the 
board, and other stakeholders for internal audit opinions 
and other conclusions.  x     
2020 The chief audit executive must communicate the internal 
audit activity’s plans and resource requirements, including 
significant interim changes, to senior management and the 
board for review and approval. The chief audit executive 
must also communicat e the impact of resource limitations.  x     
2030 The chief audit executive must ensure that internal audit 
resources are appropriate, sufficient, and effectively 
deployed to achieve the approved plan.    x   
2040 The chief audit executive must establish policies and 
procedures to guide the internal audit activity.  x     
2050 The chief audit executive should share information and 
coordinate activities with other internal and external 
providers of assurance and consulting services. The chief 
audit executive should consider relying upon the work of 
other internal and external assurance and consulting 
service providers.  x     WT/BFA/W/451  
 
- 14 - 
 
  IIA-
Standard  Statement  Fully 
compliant  Partially 
Compliant  Not 
Compliant  
2050 The chief audit executive should ensure proper coverage 
and minimize duplication of efforts.  x     
2060 The chief audit executive must report periodically to senior 
management and the board on the internal audit activity’s 
purpose, authority, responsibility, and performance 
relative to its plan and on its conformance with the Code 
of Ethics and the Standards .  x     
2060 Reporting must also include significant risk and control 
issues, including fraud risks, governance issues, and other 
matters that require the attention of senior management 
and/or the board.  x     
2070 When an external service provider serves as the internal 
audit activity, the provider must make the organization 
aware that the organization has the responsibility for 
maintaining an effective internal audit activity.  Not 
applicable      
2100 The internal audit activity must evaluate and contribute to 
the improvement of the organization’s governance, risk 
management, and control processes using a systematic, 
disciplined, and risk -based approach. Internal audit 
credibility and value are enhanced when auditors are 
proactive and their evaluat ions offer new insights and 
consider future impact.  x     
2110 The internal audit activity must assess and make 
appropriate recommendations to improve the 
organization’s governance processes for:  
- Making strategic and operational decisions.  
- Overseeing risk management and control.  
- Promoting appropriate ethics and values within the 
organization.  
- Ensuring effective organizational performance 
management and accountability.  
- Communicating risk and control information to 
appropriate areas of the organiza tion. 
- Coordinating the activities of, and communicating 
information among, the board, external and internal 
auditors, other assurance providers, and management.  x     
2110.A1  Assurance: The internal audit activity must evaluate the 
design, implementation, and effectiveness of the 
organization’s ethics -related objectives, programs, and 
activities.    x   
2110.A2  Assurance The internal audit activity must assess whether 
the information technology governance of the organization 
supports the organization’s strategies and objectives.  x     
2120 The internal audit activity must evaluate the effectiveness 
and contribute to the improvement of risk management 
processes.    x   
2200 Internal auditors must develop and document a plan for 
each engagement, including the engagement’s objectives, 
scope, timing, and resource allocations. The plan must 
consider the organization’s strategies, objectives, and risks 
relevant to the engagement.  x     WT/BFA/W/451  
 
- 15 - 
 
  IIA-
Standard  Statement  Fully 
compliant  Partially 
Compliant  Not 
Compliant  
2201 In planning the engagement, internal auditors must 
consider:  
- The strategies and objectives of the activity being 
reviewed and the means by which the activity controls its 
performance.  
- The significant risks to the activity’s objectives, 
resources, and operations and the means by which the 
potential  impact of risk is kept to an acceptable level.  
- The adequacy and effectiveness of the activity’s 
governance, risk management, and control processes 
compared to a relevant framework or model.  
- The opportunities for making significant improvements to 
the activity’s governance, risk management, and control 
processes.  x     
2210 Engagement Objectives must be established for each 
engagement.  x     
2220 The established Engagement Scope must be sufficient to 
achieve the objectives of the engagement.  x     
2230 Internal auditors must determine appropriate and 
sufficient resources to achieve engagement objectives 
based on an evaluation of the nature and complexity of 
each engagement, time constraints, and available 
resources.    x   
2240 Internal auditors must develop and document work 
programs that achieve the engagement objectives.  x     
2300 Internal auditors must identify, analyse, evaluate, and 
document sufficient information to achieve the 
engagement’s objectives.  x     
2310 Internal auditors must identify sufficient, reliable, relevant, 
and useful information to achieve the engagement’s 
objectives.  x     
2320 Internal auditors must base conclusions and engagement 
results on appropriate analyses and evaluations.  x     
2330 Internal auditors must document sufficient, reliable, 
relevant, and useful information to support the 
engagement results and conclusions.  x     
2340 Engagements must be properly supervised to ensure 
objectives are achieved, quality is assured, and staff is 
developed.  x     
2400 Internal auditors must communicate the results of 
engagements.  x     
2410 Communications must include the engagement’s 
objectives, scope, and results.  x     
2410.A1  Assurance: Final communication of engagement results 
must include applicable conclusions, as well as applicable 
recommendations and/or action plans. Where appropriate, 
the internal auditors’ opinion should be provided. An 
opinion must take into account the expectations of senior 
management, the board, and other stakeholders and mus t 
be supported by sufficient, reliable, relevant, and useful 
information.  x     
2410.A2  Assurance: Internal auditors are encouraged to 
acknowledge satisfactory performance in engagement 
communications.  x     
2410.A3  Assurance: When releasing engagement results to parties 
outside the organization, the communication must include 
limitations on distribution and use of the results.  x     
2420 Communications must be accurate, objective, clear, 
concise, constructive, complete, and timely.  x     WT/BFA/W/451  
 
- 16 - 
 
  IIA-
Standard  Statement  Fully 
compliant  Partially 
Compliant  Not 
Compliant  
2421 If a final communication contains a significant error or 
omission, the chief audit executive must communicate 
corrected information to all parties who received the 
original communication.  x     
2430 Indicating that engagements are “conducted in 
conformance with the International Standards for the 
Professional Practice of Internal Auditing” is appropriate 
only if supported by the results of the quality assurance 
and improvement program.  x     
2431 When non -conformance with the Code of Ethics or the 
Standards  impacts a specific engagement, communication 
of the results must disclose the:  
- Principle(s) or rule(s) of conduct of the Code of Ethics or 
the Standard(s) with which full conformance was not 
achieved.  
- Reason(s) for non -conformance.  
- Impact of non -conformance on the engagement and the 
communicated engagement results.  x     
2440 The chief audit executive must communicate results to the 
appropriate parties.  x     
2440.A1  Assurance: The chief audit executive is responsible for 
communicating the final results to parties who can ensure 
that the results are given due consideration.  x     
2440.A2  Assurance: If not otherwise mandated by legal, statutory, 
or regulatory requirements, prior to releasing results to 
parties outside the organization the chief audit executive 
must:  
- Assess the potential risk to the organization.  
- Consult with senior management and/or legal counsel as 
appropriate.  
- Control dissemination by restricting the use of the 
results.  x     
2450 When an overall opinion is issued, it must take into 
account the strategies, objectives, and risks of the 
organization; and the expectations of senior management, 
the board, and other stakeholders. The overall opinion 
must be supported by sufficient, reliable, relevant, and 
useful information.  
 
The communication will include:  
- The scope, including the time period to which the opinion 
pertains.  
- Scope limitations.  
- Consideration of all related projects, including the 
reliance on other assurance providers.  
- A summary of the information that s upports the opinion.  
- The risk or control framework or other criteria used as a 
basis for the overall opinion.  
- The overall opinion, judgment, or conclusion reached.  Not 
applicable      
2500 The chief audit executive must establish and maintain a 
system to monitor the disposition of results communicated 
to management.  x     
2500.A1  Assurance: The chief audit executive must establish a 
follow -up process to monitor and ensure that management 
actions have been effectively implemented or that senior 
management has accepted the risk of not taking action.  x     
2600 When the chief audit executive concludes that 
management has accepted a level of risk that may be 
unacceptable to the organization, the chief audit executive 
must discuss the matter with senior management. If the 
chief audit executive determines that the matter has not 
been resolved, the chief audit executive must 
communicate the matter to the board.  x     WT/BFA/W/451  
 
- 17 - 
 
  For consulting  engagements:  
 
IIA-
Standard  Statement  Fully 
compliant  Partially 
Compliant  Not 
Compliant  
1000 The nature of consulting services must be defined in the internal 
audit charter.    x   
1130 Internal auditors may provide consulting services relating to 
operations for which they had previous responsibilities  x     
1130 If internal auditors have potential impairments to independence 
or objectivity relating to proposed consulting services, disclosure 
must be made to the engagement client prior to accepting the 
engagement.  x     
1210 The chief audit executive declines the consulting engagement or 
obtain competent advice and assistance if the internal auditors 
lack the knowledge, skills, or other competencies needed to 
perform all or part of the engagement.  x     
1220 Internal auditors must exercise due professional care during a 
consulting engagement by considering the:  
- Needs and expectations of clients, including the nature, timing, 
and communication of engagement results.  
- Relative complexity and extent of work needed to a chieve the 
engagement’s objectives.  
- Cost of the consulting engagement in relation to potential 
benefits.  x     
2010 The chief audit executive should consider accepting proposed 
consulting engagements based on the engagement’s potential to 
improve management of risks, add value, and improve the 
organization’s operations. Accepted engagements must be 
included in the plan.  x     
2120 During consulting engagements, internal auditors must address 
risk consistent with the engagement’s objectives and be alert to 
the existence of other significant risks.  x     
2120 Internal auditors must incorporate knowledge of risks gained 
from consulting engagements into their evaluation of the 
organization’s risk management processes.  x     
2120 When assisting management in establishing or improving risk 
management processes, internal auditors must refrain from 
assuming any management responsibility by actually managing 
risks.  x     
2130 Internal auditors must incorporate knowledge of controls gained 
from consulting engagements into evaluation of the 
organization’s control processes.  x     
2201 Internal auditors must establish an understanding with 
consulting engagement clients about objectives, scope, 
respective responsibilities, and other client expectations. For 
significant engagements, this understanding must be 
documented.  x     
2210 Consulting engagement objectives must address governance, 
risk management, and control processes to the extent agreed 
upon with the client.  x     
2210 Consulting engagement objectives must be consistent with the 
organization's values, strategies, and objectives.  x     
2220 In performing consulting engagements, internal auditors must 
ensure that the scope of the engagement is sufficient to address 
the agreed -upon objectives. If internal auditors develop 
reservations about the scope during the engagement, these 
reservations must be discussed with the client to determine 
whether to continue with the engagement.  x     WT/BFA/W/451  
 
- 18 - 
 
  IIA-
Standard  Statement  Fully 
compliant  Partially 
Compliant  Not 
Compliant  
2220 During consulting engagements, internal auditors address 
controls consistent with the engagement’s objectives and be 
alert to significant control issues.  x     
2240 Work programs for consulting engagements may vary in form 
and content depending upon the nature of the engagement.  x     
2330 The chief audit executive develops policies governing the 
custody and retention of consulting engagement records, as well 
as their release to internal and external parties. These policies 
are consistent with the organization’s guidelines and any 
pertinent regulatory or other requirements.  x     
2410 Communication of the progress and results of consulting 
engagements will vary in form and content depending upon the 
nature of the engagement and the needs of the client.  x     
2440 The chief audit executive  is responsible for communicating the 
final results of consulting engagements to clients.  x     
2500 The internal audit activity monitors the disposition of results of 
consulting engagements to the extent agreed upon with the 
client.  x      
  WT/BFA/W/451  
 
- 19 - ANNEX 4 - STATUS OF INTERNAL AUDIT RECOMMENDATION S (1 JUNE 201 8) 
 
 
STATUS OF AUDIT RECOMMENDATIONS  
Audit Activity  Report 
year*  Total number of 
recommendations  Number of High 
recommendations  Implementation status as of 
01.06.2017  Implementation status as of 
01.06.2018  
        % Closed  WIP Open  Closed  WIP Open  
Sick Leave Management  2014 33 26 79% 30 0 3 31 2 0 
IT Security  2014 19 5 26% 5 10 4 10 7 2 
Home Leave Entitlements  2017 11 2 18% 0 0 11 8 1 2 
Totals  - 63 33 52%  56%  16%  28%  78% 16% 6% 
  *  All the recommendation s included in internal audit reports issued in 2009 -2013 have been implemented and closed . 
 
 
 
   
  WT/BFA/W/451  
 
- 20 - ANNEX 5 - AUDIT RECOMMENDATION S PENDING TO BE CLOS ED (1 JUNE 2018)  
A SICK LEAVE MANAGEMEN T  
 
Audit recommendation  Implementation status as reported by the implementing 
Division  Status  Severity  OIO's comments  Deadline  
26. The Medical Service and HRD 
should r econcile the data recorded in 
Oracle with CHIMED on sick leave to 
ensure that it is accurate, consistent 
and reliable for reporting to various 
stakeholders ; and that any variances 
are justified.  CHIMED is made to record the work done by the Medical 
Service  (e.g. how many medical certificates are received). It 
provides a broad idea of the number of days under Sick Leave 
but it is not efficient for obtaining statistics on Sick Leave (e.g. 
it does not allow calculating hours  or half days of absence). 
Therefore the system need s to be modified  / replaced . 
 
A new software - Préventiel - has been identified and selected  
by the Medical Service and HRD . The implementation of 
Préventiel is planned for 2018. As part of the implementa tion 
project, the data recorded in Oracle will be reconciled with the 
information contained  in Préventiel.  
 W.I.P  Medium  The recommendation will be 
closed once the 
implementation project of 
the new software - 
Préventiel – will be 
completed . 30/12/2018  
28. ITSD should provide HRD with a 
solution to facilitate ownership, 
accountability, management and 
reporting of data; and provide 
appropriate training to HRD staff to 
ensure their independence in using 
the solution.  ITSD, HRD and LDIMD are now using the n ew functionality 
developed in Oracle for Divis ional Assistants to report sick 
leave (directly in the system ). This functionality will be 
extended to other Divisions in 2018.  
 W.I.P  Medium  The recommendation will be 
closed once the Oracle 
functionality is e xtended to 
all Divisions.  30/12/2018  
 
    
  WT/BFA/W/451  
 
- 21 - B HOME LEAVE ENTITLEMENTS  
 
Audit recommendation  Implementation status as reported by the impl ementing 
Division  Status  Severity  OIO's comments  Deadline  
1. The correct balance should be 
sought between the need to 
encourage use of the lump -sum and 
the need to ensure rational use of 
resources in order to achieve 
economy, efficiency and 
effectiveness in the process.  
Therefore, the OIO invites the 
Director of the Human Resources 
Division to closely monitor the costs 
and benefits to the WTO of the 
lump-sum arrangement, taking into 
consideration the level of the cash 
incentives provided to staff by the 
lump-sum procedure; and to adopt 
any necessary adjustments would 
the arrangements be considered as 
excessive.  Management concurs with the recommendation and will 
endeavour to closely monitor the lump -sum entitlements 
granted.  OPEN  Medium  First follow -up to be 
conducted in October 2018.  30/09/ 2018 
 
10. The Director of HRD  should 
prepare a detailed Home Leave 
policy considering the above -
mentioned recommendations. This 
policy should be communicated to 
all employees of the WTO.   HRD has drafted the new Home Leave and Family Visit Policy 
(draft), which incorporates the above -mentioned 
recommendations. The draft policy was submitted to the OIO 
for review and enhancements are being discussed by AGSD 
(Travel Unit), HRD and the OIO. T he policy will be issued once 
reviewed by the Joint Advisory Committee (JAC) and approved 
by the Director General. . WIP High The recommendation is 
considered as WIP until final 
approval by the Director -
General and communication 
of the new policy to the staff 
members.  31/12/2018  
11. The MobileXpense  system should 
be configured taking into account 
the recommendations  made in the 
internal audit report . [Extract  – the 
recommendation provides further 
details on the controls to be 
implemented] . The suggestion that these controls should specifically be don e 
in MobileXpense is too prescriptive.   The feasibility of adding 
new functionalities on MobileXpense has to be discussed with 
the Director of ITSD. He may come up with other alternatives 
to take action based on this recommendation.  
MobilXpense is also re ferred to in the report of the External 
Auditors, since they undertook a performance audit of travel in 
2017/18.  OPEN  Medium  - 31/12/2018  
   
  WT/BFA/W/451  
 
- 22 - C IT SECURITY  
 
Audit recommendation  Implementation status as reported by the impl ementing 
Division  Status  Severity  OIO's comments  Deadline  
4: It Security Governance: GOV 04 – 
Risk management process.  
 
The Information Security function 
should regularly review the risk 
register to ensure that information 
security risks are adequately and 
promptly identified. Based on that 
review, the IT Security function 
should:  
1. determine where an IT security 
response should be applied;  
2. Ensure that the appropriate IT 
security responses are included in the 
'proposed mitigation measures' 
section;  
3. Ensure that the IT security 
responses are adequately 
implemented and are operational.  
 Information Security risks were included in the Enterprise Risk 
Management (ERM) yearly exercise, led by the WTO Risk 
Officer (in 2017).  
 
This recommendation will be implemented after  
recommendation s GOV 05 (Inventory of WTO key information 
assets) and GOV 06  (Information security policies structure ). 
 
 
 
 
 
 WIP High The status of the 
recommendation remains 
unchanged , pending  
finalization of the IT risk 
register  and implementation 
of recommendation s GOV 05 
and GOV 06.  31/12/2018 
5: It Security Governance: GOV 05 
(a) – Inventory of WTO's key 
information asset.  
 
The LDIMD and ITSD  to coordinate 
creation and maintenance of an 
organization wide inventory of key 
information assets such as data, 
information, documents and 
publications. This inventory should 
include: definitions of the information 
asset owners' roles and 
responsibilitie s, the information asset 
classification level and the basic 
requirements in terms of control and 
monitoring of the information asset; 
the definition should take into 
consideration each Division that 
develops or has access to key 
information assets; The IT Security 
function should perform a security The organization -wide inventory of key information assets 
inventory will be conducted once the classification policy is 
adopted (scheduled for Q3 2018).  WIP 
 Medium  The Information Security 
Office  will work on inventory 
of key information assets.  
 31/12/2018    
  WT/BFA/W/451  
 
- 23 - Audit recommendation  Implementation status as reported by the impl ementing 
Division  Status  Severity  OIO's comments  Deadline  
risk assessment, based on the list of 
key information assets, to determine 
the level of protecti on required for 
each key information asset.  
 
6: It Security Governance: GOV 06  – 
Information security policies 
structure.  
 
Review the structure and 
completeness of IT security policies, 
standards, guidelines and procedures; 
define and enforce the various IT 
policies including Security policies, IT 
security risk assessment policy, 
Disaster Recovery policy, and 
Information Security risk assessment 
policy that is aligned with the risk 
management policy.  
 ITSD has significantly progressed in the establishment of the IT 
Security policies  structure : 
a. Information Security policy: finalized (29 September 2017);  
b. Access Control policy: finalized (to be released soon);  
c. Incident Management policy: drafting in progress;  
d. Information Classification policy: To be submitted for review 
to Directors  in May -June 2018, with planned adoption in July;  
e. IT Risk Assessment poli cy: To be drafted after final adoption 
of Confidentiality Classification  policy ; 
f. Disaster Recovery policy: pending ; 
g. Acceptable Use policy: under revision . 
 WIP Medium  The Information Security 
Office is working on the 
establishment  of the 
Information Security policies 
structure.  31/12/2018  
 
IT Risk 
Assessment 
policy: 
31/03/2019  
8: It Security Governance: GOV 07 – 
IT Security reporting to the WTO 
Management (Part II).  
 
Additionally, the IT Security function 
should:  
• Define and implement a set of 
metrics to be applied to the 
information security processes, based 
on the results of the risk assessment 
of key information assets;  
• Develop a comprehensive and 
consistent set of measures (Key 
Performance Indicator/ Key Risk 
Indicator) to drive its reporting 
activity, based on the defined 
metrics.  The ITSSC approved the project submitted by t he Information 
Security Office to create a  Security Operations Cent re. The 
Request for Proposal (RFP) for the Security Operations Centre 
will be rel eased in June 2018 (to be implemented by end 
2018). Once established, the Security Operations Centre will 
define  the objective information for determining  the Key 
Performance Indicators.  WIP Medium  The Security Operations 
Centre Project , to be created 
in Q4 2018,  will be in charge 
of identifying  the Key 
Performance Indicators.  31/03/2019    
  WT/BFA/W/451  
 
- 24 - Audit recommendation  Implementation status as reported by the impl ementing 
Division  Status  Severity  OIO's comments  Deadline  
9: It Security Governance: GOV 08 – 
WTO's IT security strategy.  
WTO should formally define its IT 
Security function's strategy and 
objectives, taking into consideration 
the results of the key information 
assets and its risk assessment;  
The IT security strategy should be 
reviewed to ensure it is aligned with 
the organization's business 
objectives.  
 The interim IT action plan for 2019 was approved by the ITSSC  
on 3 May 2018. The IT Security function’s strategy and 
objectives w ill be finalized upon completion of recommendation 
GOV 04 ( Risk management process ). WIP Medium  The status of the 
recommendation remains 
unchanged.  
 31/03/2019  
10: It Security Governance: GOV 09 
–IT Security function's objectives 
alignment with an IT security 
strategy.  
IT Security function should develop a 
clear set of its objectives that should 
be aligned with the IT security 
Strategy in Gov . 8 above.  The interim objectives of the IT Security function have been 
identified (but not formally documented ). The long term 
objectives will be defined once the IT Security function’s 
strategy  is defined (recommendation GOV 08).  OPEN  Low The status of the 
recommendation remains 
unchanged.  31/03/2019  
12: IT Security Controls: ITSC -01: – 
Security configuration of the ERP 
system.  
 
The Security function should:  
 Define a comprehensive and 
complete ERP system security 
baseline, based on the input of the 
Back-Office unit and the Oracle 
guidelines for system security;  
 Perform a comprehensive IT 
security review of the ERP 
configuration, including the 
application layer, the database layer, 
the operating system layer, the 
network layer and the storage layer.  
 Back-Office unit shou ld: 
• Change the default Oracle Database 
user profiles' security settings or All specific technical vulnerabilities of ITSC -01 have been 
addressed during the migration of the ERP system to the new 
version (completed Feb 2015).  
 
Vendor best practices ("Secure Configuration Guide for Oracle 
E-Business Suite Release 12") were adopted as a security 
configuration baseline.  
 N/A High The OIO decided to include 
this topic on its Internal Audit 
plan for 2018 /2019.  This 
recommendation will be 
subject to a separate internal 
audit.  -   
  WT/BFA/W/451  
 
- 25 - Audit recommendation  Implementation status as reported by the impl ementing 
Division  Status  Severity  OIO's comments  Deadline  
assign a new, stronger security profile 
to all Oracle Database users;  
• Change the default Oracle Database 
users' password setting and force 
password changes for the 228 users 
who still have the default password 
set. These settings should be aligned 
with the Windows password policy in 
place.  
• Review the list of the E -business 
and Oracle Database user accounts 
and remove the user accounts if they 
are not used;  
• Perform a comprehen sive security 
review of the ERP including the 
business processes controls required 
for the protecti on of the WTO's 
financial data.  
 
14: IT Security Controls: ITSC -03 – 
User account management  
Review users' access rights and 
restrict these to a minimum. 
Additionally, IT Security unit should 
periodically review the  user accounts 
and access rights to the information 
processing systems and applications 
to ensure they are appropriate and in 
line with the list of WTO's staff. This 
review should be initiated by the IT 
Security function and completed by 
the units responsi ble for those 
systems.  
Finally, a form should be developed 
for the creation, modification and 
removal of user accounts within the 
systems (e.g.  Windows Active 
Directory). This form should be 
formally reviewed and signed off by 
the business process owner and the 
Human Resources Division.  
 User account management procedures are addressed in the  
Access Control policy, which has been finalized and will be 
adopted in Q3 2018.   
 WIP Medium  The status of the 
recommendation remains 
unchanged  until final 
adoption of Access Control 
policy . 
 30/09/2018    
  WT/BFA/W/451  
 
- 26 - Audit recommendation  Implementation status as reported by the impl ementing 
Division  Status  Severity  OIO's comments  Deadline  
15: IT Security Controls: ITSC -04 – 
Segregation of duties (SoD) control 
framework  
The WTO's Back -Office unit and the IT 
Security function should:  
1. Define a SoD  framework, taking 
into consideration that the security 
requirements must be balanced with 
resource availability (e.g. a back -up 
person for a specific function must be 
attributed the appropriate access 
rights to perform back -up 
operations);  
2. Define a pro cedure for managing 
exceptions to the SoD framework. 
This procedure should include the 
formal documentation of deviations 
from the SoD framework and formal 
validation by the user's manager;  
3. Review the current configuration of 
the ERP roles and responsib ilities 
(i.e. ERP profiles) against the SoD 
framework to ensure no conflicting 
rights be given to employees without 
prior validation from the user's 
manager.  The ERP segregation of duties will be addressed jointly by  HRD, 
AGSD and ITSD , following the outco me of the ERP security 
audit ( recommendation  ITSC-01). OPEN  Medium  This recommendation will be 
implemented after the audit 
of ERP security.  31/03/2019  
17: IT Security Controls: ITSC -06 – 
ERP system logs management and 
monitoring  
The IT Security function should 
provide input on which modifications 
should be logged, taking into account 
the evidence requirements for 
incident management, the 
requirements for data privacy, the 
legal and regulatory environment and 
the protection measure s for the 
collected evidence (e.g. storing the Operating system logs were shipped to a centralized logging 
facility. ERP application logs will be collected once the Security 
Operations Centre is established.  WIP Low The status of the 
recommendation remains 
unchanged.  31/12/2018    
  WT/BFA/W/451  
 
- 27 - Audit recommendation  Implementation status as reported by the impl ementing 
Division  Status  Severity  OIO's comments  Deadline  
ERP application log files remotely on a 
different server that is only accessible 
to the IT Security function).  
Secondly, the Back -Office unit should 
enable the audit log feature in the 
ERP for all the ERP modu les that 
process key information, such as 
financial resources, payment 
information or vendor creation. 
Further, the log file should be kept in 
a separate database from the ERP 
where it`s access should be restricted 
to the IT Security function to ensure 
preservation of evidence in the event 
of an investigation or forensic 
analysis (e.g. in a suspected fraud 
activity investigation).  
 
 WT/BFA/W/451  
 
- 28 - 
  
  ANNEX 6 - LIST OF ACRONYMS  
 
 
AGSD   Administrations and General Services Division  
CBFA   Committee on Budget, Finance and Administration  
CHF  Swiss Franc (currency)  
COSO   Committee of Sponsoring Organisations of the Treadway Commission  
DGO  Director -General 's Office  
ENMO   Ethics Network of Multilateral Organizations  
ERM  Enterprise Risk Management  
ERP  Enterprise Resource Planning system  
HOIA   Heads of Internal Audit  Services  of International Organizations based  in Europe  
HRD  Human Resources Division  
IIA  Institute of Internal Auditors  
ILO  International Labour Organization  
IPPF  International Professional Practices Framework  
ISO  International Organization for Standardization  
ITSD  Information Technology Solutions Division  
ITSSC   IT and Security Steering Co mmittee  
ITTC  Institute for Training and Technical Cooperation  
JAC  Joint Advisory Committee  
JIU  United Nations Joint Inspection Unit  
LDIMD  Languages, Documentation and Information Management Division  
N/A  Not Applicable  
OIO  Office of Internal Oversight  
RFP  Request for Proposal  
RIAS  Representatives of Internal Audit Services  
RIS  Representatives of Investigations Services  
SoD  Segregation of Duties  
TRTA  Trade -Related Technical Assistance  
WIP  Work-in-progress  
WTO  World Trade Organization  
 
 
__________