RESTRICTED  
  
WT/BFA/W/517  
 
19 May  2020 
(20-2923) Page: 1/12 
Committee on Budget, Finance and Administration    
 
- 1 - 
 
OFFICE OF INTERNAL OVERSIGHT  (OIO)  
STATUS OF INTERNAL AUDIT RECOMMENDATIONS  
(April  2020) 
 
 
1.1.  The Office of Internal Oversight (OIO) provides for information to the Committee on Budget, 
Finance and Administration (CBFA)  the latest  status of implementation of the recommendations  
proposed in internal audit reports , and in the Trad e-Related Technical Assistance (TRTA) external 
evaluation report1, prepared by Saana  Consulting  on 31 October  2016.  
1.2.  Please note that t he annual report of the OIO will be pr esented to the CBFA in June 20 202.  
1.3.  As requested by the Institute of Internal Auditors (IIA), the OIO maintains  a detailed follow -
up register to monitor the implementation of recommendations, and to ensure that management 
actions have been effectively implemented (IIA Standard 2500.A1 – Monitoring Process ). This 
follow-up register is updated regularly, based on input collecte d from the concerned Divisions.  
1.4.  The current status of the recommendations is summarized  in Annex 1 of this document  - Status 
of recommendations ( March 2020 ). Further details are provided in Annex 2 - OIO recommendations 
pending to be closed  (March 2020) , and Annex 3  - Status of recommendation s contained in the WTO 
Trade -Related Tec hnical Assistance evaluation report  pending to be closed (March 2020)  - of this 
document.  
1.5.  As of March 2020 , Management has implemented 79% of the OIO recommendations  and 97% 
of the recommendations contained in the TRTA external evaluation report.  
1.6.  The OIO will continue closely monitor ing the implementation of the se recommendation s and 
reporting  to the CBFA  thereof . 
 
1 WT/COMTD/89 – WTO Trade -Related Technical Assistance External Evaluation , 2 December 2016. The 
main objective of the e valuation was "to independently assess the functioning of all WTO Trade -Related 
Technical Assistance (TRTA), analyse WTO TRTA delivery, best practices, and lessons learned. "  
2 Pursuant to t he Administrative Memorandum No.974  (OFFICE(15)/ 101 – Office of Internal Oversight , 
30 November  2015), the OIO shall report annually to the CBFA, providing an overview of its activities during 
the year .  
  WT/BFA/W/517  
 
- 2 - ANNEX 1: STATUS OF RECOMMENDATIONS ( MARC H 2020 ) 
 
OIO - STATUS OF RECOMMENDATIONS (for more details, see Annex 2)  
Audit Activity  Report 
year Total number of 
recommendations  Number of  
high severity 
recommendations  Status  
as of 01.02.2019  Status   
as of 01.03.2020  
  % Closed  WIP Open  Closed  WIP Open  
Sick Leave Management  2014 33 26 79% 32 1 0 32 1 0 
IT Security  2014 19 5 26% 11 6 2 13 4 2 
Home Leave Entitlements  2017 11 2 18% 9 2 0 9 2 0 
Appellate Body Members' 
and Panelists' costs1 2020 14 0 0% - - - 7 7 0 
Total/Percentage  - 77 33 43%  83%  14%  3% 79%  18%  3% 
 
TRTA - STATUS OF RECOMMENDATIONS (for more details, see Annex 3)  
Activity  Report 
year Total number of 
recommendations  Status  
as of  11.02.2019  Status  
as of  01.03.2020  
Closed 
(imple -
mented)  Closed  
(without 
action)  WIP Open  Closed 
(imple -
mented)  Closed  
(without 
action)  WIP Open  
Trade -Related Technical 
Assistance evaluation  2016 28 18 3 7 0 24 3 1 0 
Total/ Percentage  - 28 64%  11%  25%  0% 86% 11%  3% 0% 
 
1 The internal audit report OIO/IA/2020 -01 was issued in March 2020. While no follow -up of the implementation of the recommendations has been done, the OIO has received 
evidence that several recommendations have already been implemented. The information provided in the table is just indicative . A formal follow -up exercise will be conducted in Q3 
2020 to confirm the status of the recommendations.   
  WT/BFA/W/517  
 
- 3 - ANNEX 2: OIO RECOMMENDATIONS PENDING TO BE CLOSED  (MARCH 2020)  
 
A) SICK LEAVE MANAGEMENT   
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
26. The Medical Service and the Human Resources 
Division (HRD) should r econcile the data recorded 
in Oracle with CHIMED on sick leave to ensure that 
it is accurate, consistent and reliable for reporting 
to various stakeholders ; and that any variances are 
justified.  Medium  Q4 2018 The WTO decid ed, in 2018 , to replace CHIMED by 
Préventiel, a software specialized for managing 
medical records and files (http://www.val -
solutions.fr/solutions/solution -preventiel/).  
 
Préventiel was implemented in Q4 2018 and is now 
fully operational. It was implement ed as a stand -alone 
solution in order to secure the access to – and the 
confidentiality of – its information (only the Medical 
Service has access to Préventiel).  
 
While the medical files of staff members are now 
managed by the Medical Service in Préventiel , sick 
leaves continue to be managed by HRD in Oracle. An 
interface was developed and implemented, in 
December 2018, to import sick leaves from Oracle to 
Préventiel .  
 
In 2019, the WTO decided to implement an integrated 
system to manage HRD processes. The 
implementation of the new system is ongoing.  
An interface will be built between the new system and 
Préventiel (for sick leaves) and t he data recorded in 
both systems  will be reconciled once the interface has 
been finalized.  
 W.I.P  The recommendation will 
be closed once the 
implementation project 
of the  new HRD software 
and its interface with 
Préventiel  have be 
finalized . 
  
  WT/BFA/W/517  
 
- 4 - B) IT SECURITY  
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
4: It Security Governance: GOV 04 – Risk 
management process.  
 
The Information Security function should regularly 
review the risk register to ensure that information 
security risks are adequately and promptly 
identified. Based on that review, the IT Security 
function should:  
 
1. Determine where an IT security response should 
be applied;  
 
2. Ensure that the appropriate IT security 
responses are included in the 'proposed mitigation 
measures' section;  
 
3. Ensure that the IT security responses are 
adequately implemented and are operational.  
 High Q3 2018  Information Security risks were included in the 
Enterprise Risk Managemen t (ERM) yearly exercise, 
led by the WTO Risk Officer (in 2017).  
 
The IT security response to identified significant risks 
will be submitted in Q1 -Q2 for the IT Security Steering 
Committee's  validation and approval , as part of the 
results of the risk assess ment (see recommendation 
GOV 05 - Inventory of WTO 's key information assets) .  
 W.I.P  The recommendation 
remains Work-in-
Progress , pending 
finalization of the 
Information Security risk 
register (or detailed 
WTO-wide risk register) 
and the implementation 
of recommendation GOV 
05. 
5: It Security Governance: GOV 05 (a) – Inventory 
of WTO's key information asset.  
 
LDIMD and ITSD should  coordinate the creation 
and maintenance of an organization wide inventory 
of key information assets such as data, 
information, documents and publications. This 
inventory should include: definitions of the 
information asset owners' rol es and 
responsibilities, the information asset classification 
level and the basic requirements in terms of control 
and monitoring of the information asset; the 
definition should take into consideration each 
Division that develops or has access to key 
information assets; The IT Security function should 
perform a security risk assessment, based on the 
list of key information assets, to determine the 
level of protecti on required for each key 
information asset.  
 Medium  
 Q4 2018  ITSD partially agree s with the recommendation:  The 
creation and maintenance of the inventory essentially 
require s input from the owners of information assets, 
i.e. core operational divisions (as opposed to 
supporting divisions, such as ITSD or LDIMD). 
Therefore, such task shou ld be mandated and 
supervised by the Information Security Steering 
Committee  (ITSSC) created as per GOV 01 
recommendation.  
 
The Confidentiality C lassification Policy was adopted 
and is now used as basis for the organization -wide 
inventory of key information assets.  
 
The inventory of key information assets is currently 
being finalised by Divisions , under the co-ordination 
of the Information Security Office.  The e stima ted 
progress is 60%, which include s all most sensitive W.I.P  The recommendation will 
be closed upon 
completion of the 
inventory of Key 
Information Assets . 
 
  
  WT/BFA/W/517  
 
- 5 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
 information assets. Completion of the exercise is 
planned by Q1 -Q2 2020.  
 
All essential information for the risk assessment has 
already been collected  by ITSD . The results of the risk 
assessment will b e circulated to ITSSC members by 
Q1-Q2 2020.  
6: It Security Governance: GOV 06  – Information 
security policies structure.  
 
Review the structure and completeness of IT 
security policies, standards, guidelines and 
procedures; define and enforce the various IT 
policies including Security policies, IT security risk 
assessment policy, Disaster Recovery policy, and 
Information Security risk as sessment policy that is 
aligned with the risk management policy.  Medium  Q4 2018  Following the introduction of the overarching policy, 
the following policies and procedures have been 
developed:  
 
• Policy on Architecture and Security Assessment of 
Information Systems ; 
 
• Information Security Policy ;  
 
• Access Control Policy ; 
 
• Incident Management policy ;  
 
• Information Classification Policy ; and  
 
• Disaster Recovery policy.  
 
The Information Security Risk Management Policy 
draft will be circulated to ITSSC for comments in 
February  2020, for final validation at Q1 -2020 ITSSC 
meeting. This will be the last policy in the framework 
recommended by the audit; its adoption would allow 
closing the recommendation.  W.I.P  The Information Security 
Office is working on the 
finalization of the 
Information Security 
policies structure . This 
recommendation will be 
closed once the 
mentioned policies have 
been finalized and 
communicated to 
concerned staff 
members . 
 
9: It Security Governance: GOV 08 – WTO's IT 
security strategy.  
WTO should formally define its IT Security 
function's strate gy and objectives, taking into 
consideration the results of the key information 
assets and its risk assessment;  
The IT security strategy should be reviewed to 
ensure it is aligned with the organization's business 
objectives.  
 Medium  
  Q1 2019  The IT Security function’s strategy and objectives will 
be submitted to the ITSSC  for approval in Q1-Q2 2020 
ITSSC, together with the results of the first risk 
assessment exercise.  W.I.P  The status of the 
recommendation 
remains unchanged , 
pending finalization of 
the IT Security function’s 
strategy and objectives . 
  
  WT/BFA/W/517  
 
- 6 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
10: It Security Governance: GOV 09 –IT Security 
function's objectives alignment with an IT security 
strategy.  
IT Security function should develop a clear set of 
its objectives that should be aligned with the IT 
security Strategy in recommendation GOV. 8 
above.  
 Low Q1 2019  The interim objectives of the IT Security function have 
been identified (but not  formally do cumented). The 
long-term objectives will be defined once the IT 
Security function’s st rategy has been  defined 
(recommendation GOV 08).  OPEN  The status of the 
recommendation 
remains unchanged  
pending finalization of 
the IT Security function's 
strategy and objectives . 
15: IT Security Controls: ITSC -04 – Segregation of 
duties (SoD) control framework  
The WTO's Back -Office unit and the IT Security 
function should:  
1. Define a SoD framework, taking into 
consideration that the security requirements must 
be balanced with resource availability (e.g. a 
back-up person for a specific function must be 
attributed the appropriate access rights to perform 
back-up operations);  
2. Define a proc edure for managing exceptions to 
the SoD framework. This procedure should include 
the formal documentation of deviations from the 
SoD framework and formal validation by the user's 
manager;  
3. Review the current configuration of the ERP roles 
and responsibi lities (i.e.  ERP profiles) against the 
SoD framework to ensure no conflicting rights be 
given to employees without prior validation from 
the user's manager.  
 Medium  Q1 2019  The ERP segregation of duties will be addressed jointly 
by HRD, AGSD and ITSD follo wing the outcome of the 
ERP security audit .  
 OPEN  This recommendation 
will be implemented 
after the ERP security 
assessment  (OIO) .  
 
 
   
  WT/BFA/W/517  
 
- 7 - C) HOME LEAVE ENTITLEMENTS   
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  
 Status  OIO's comments  
1. The correct balance should be sought between 
the need to encourage use of the lump -sum and 
the need to ensure rational use of resources in 
order to achieve economy, efficiency and 
effectiveness in the proces s. 
Therefore, the OIO invites the Director of the 
Human Resources Division to closely monitor the 
costs and benefits to the WTO of the lump -sum 
arrangement, taking into consideration the level 
of the cash incentives provided to staff by the 
lump-sum procedure ; and to adopt any necessary 
adjustments would the arrangements be 
considered excessive.  Medium  Q3 2018  The methodology used by the WTO (and several other 
Geneva -based International Organizations) to 
calculate the home leave lump sums was based on the 
''full-fare economy'' rates published by IATA through  
the Galileo system. IATA decided to abandon the ''full -
fare economy'' rates as from October 2018.  Hence, 
the rates are no  longer  updated in Galileo since 1 
November  2018.  
A group of five International Organizations 
established a Working Group to analyse and propose 
a new methodology. The Working Group, supported 
by Car lston Wagonlits as consultant, submitted its 
conclusions in October 2018, and proposed to use a 
new fare to be calculated a s an average of restricted 
and flexible fares available at 3 -4 different dates of 
the year. The new fare would be updated on a 
quarterly basis for all participatin g International 
Organizations.  
The new methodology for calculating lump -sums will 
be include d in the new Home Leave Policy (see 
Recommendation 10), which is now ready for review 
by the J oint Advisory Committee (JAC) .  This review 
should take place in the Spring of 2020.  
 W.I.P The recommendation 
remains Work -in-
Progress until the new 
methodology for 
calculating home -leave 
Lump Sums is adopted.  
10. The Director of HRD should prepare a detailed 
Home Leave policy  considering the [above -
mentioned]  recommendations. This policy should 
be communicated to all employees of the WTO.   High Q4 2017  HRD and AGSD have d rafted the new Home Leave and 
Family Visit Policy, which incorporates the 
recommendations  made in the OIO report . The new 
policy will be iss ued to all staff members once it has 
been reviewed by the Joint Advisory Committ ee (JAC)  
and approved by the Director -General.  
 W.I.P The recommendation 
remains Work -in-
Progress until finalization 
of the policy and its 
communication to all 
staff members.  
 
 
  
  WT/BFA/W/517  
 
- 8 - D) APPELLATE BODY MEMBERS' AND PANELISTS' COSTS   
The internal audit report OIO/IA/2020 -01 was issued in March 2020. While no follow -up of the implementation of the recommendations has been done, the 
OIO has received evidence that several recommendations have already been implemented.  The following table is just indicative of the actions already 
implemented. A formal follow -up ex ercise will be conducted in Q3 2020.  
Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by 
the implementing Division  Status  OIO's comments  
1. Taking into consideration the evolution of 
practices at the Appellate Body, the OIO invites the 
Director General to consider bringing the need to 
revise the ABM's remuneration package to the 
attention of WTO Members . Medium  
 Q3 2020  - (IMPLEMENTED)  Members have full 
control and the decision -
making power over the 
remuneration system for 
AB Members and 
panelists. The Director -
General and the 
Secretariat stand ready 
to assist Members if they 
were to decide to review 
the current remuneratio n 
system . 
2. The ABS, with the support of the Information 
Technology Solutions Division (ITSD), should 
analyse the possibility of conducting certain 
procedural steps and AB meetings through 
videoconference without compromising the 
confidentiality of the appeal proceedings. The 
ABMs should consider carrying out appeal process 
steps not requiring their physical presence in 
Geneva through videoconference in order to 
reduce costs.  Medium  Q3 2020  - (W.I.P ) Because of the COVID -
19 crisis, in March 2020, 
the ABS extensively used 
videoconferencing for the 
finalization of appeal 
proceedings.   
3. Relevant ABS staff members should be further 
informed of the additional controls required by the 
revised WTO Official Travel Policy and, in 
particular, on the additional elements of 
information to be captured in the revised Travel 
Claim Form.  Medium  Q2 2020  - (IMPLEMENTED)  The Travel Claim Form 
was modified by the ABS 
and AGSD, in order to 
incorporate the 
additional controls 
required by the revised 
WTO Official Travel 
Policy .  
  WT/BFA/W/517  
 
- 9 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by 
the implementing Division  Status  OIO's comments  
4. Each year, the ABS should collect copies of the 
most recent health insurance certificates from the 
ABMs. These documents should be systematically 
filed in a dedicated binder.  Low Q2 2020  - (W.I.P ) The ABS asked the ABMs 
for a copy of their Health 
Insurance Certificates, in 
addition to the annual 
written confirmations.  
5. When converting the number of hours worked 
(both at home/in transit and in Geneva) into days 
(on the basis of 8 hours per day), only the total 
number of days should be rounded to the nearest 
unit. Low Q2 2020  - (IMPLEMENTED)  The methodology and 
form ha ve been adjusted 
according to what was 
recommended.  
6. The Statement of Accounts Form should be 
modified to segregate more clearly (i) the time 
worked in Geneva for official AB meetings (with 
DSA entitlement) and (ii) the time worked in 
Geneva not in the framework of official AB 
meetings (without DSA entitlement). The ABMs, 
ABS staff and the Finance Unit should be properly 
informed of these modifications.  Medium  Q2 2020  - (IMPLEMENTED)  The Statement of 
Account Form was 
modified, in accordance 
with the 
recommendation.  
7. The Finance Unit should ensure that terminal 
expenses paid to ABMs are always accurate.  Low 
 Q2 2020  - (W.I.P)  AGSD has adopted 
stronger review 
processes for all travel 
expense claims 
submitted . 
8. The Legal Affairs Division should send a copy of 
the Claim for Time Worked (containing the 
guidelines for preparation time worked) to the 
Panelist at the same time that the Special Service 
Agreement (SSA).  Low Q2 2020  - (IMPLEMENTED)  The Legal Affairs Division 
modified its processes. 
The Claim for Time 
Worked form is now sent 
to the Panelists along 
with the SSA.   
  WT/BFA/W/517  
 
- 10 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by 
the implementing Division  Status  OIO's comments  
9. Whenever a Claim for Time Work in which the 
number of hours declared by the Panelist exceeds 
the guidelines provided in the Form is approved, 
the Director of the Division should systematically 
detail in the Memorandum of Payment the reasons 
of the approval. The Directors of the Legal Affairs 
Division and the Rules Division may consider 
establishing tolerance margins (for exampl e: up to 
20% above the expected time provided in the 
Guidelines) within which the excess time declared 
by the Panelist would remain acceptable (without 
justification).  Low Q2 2020  - (W.I.P)  Whenever the number of 
hours declared by  
Panelist s exceeds the 
guidelines provided in 
the Form , Directors 
justify in writing the 
reasons of the approval.  
10. The Legal Affairs and the Rules Divisions should 
review the Guidelines included in the Claim for Time 
Worked Form.  
Ideally, the number of days provided in the 
Guidelines should be indicative of the expected 
work time. Taking into consideration the 
unpredi ctable and complex nature of panel work, 
the Legal Affairs and the Rules Divisions may 
decide to adjust the Guidelines and to determine 
the most adequate and reasonable numbers of 
days to be referenced in the Guidelines for each 
step of the Dispute, based on historical data.  Low Q2 2020  - (W.I.P)  The Guidelines provided 
to Panelists are currently 
being reviewed.  
11. Also, the Guidelines provided to Panelists 
should clearly request the latter to inform the 
Director of the concerned Division, in writing, as 
soon as the actual days spent in preparation time 
exceeds the number of days provided in the 
Guidelines.  Low Q2 2020  - (W.I.P)  The Guidelines provided 
to Panelists are currently 
being review ed. 
12. Relevant staff members of the Legal Affairs and 
the Rules Divisions should be further informed of 
the additional controls required by the revised WTO 
Official Travel Policy and, in particular, on the 
additional elements of information to be captured 
in the revised Travel Claim Form.  Medium  Q2 2020  - (IMPLEMENTED)  The Travel Claim Form 
was modified by LAD, 
RULES and AGSD, in 
order to incorporate the 
controls required by the 
revised WTO Official 
Travel Policy .  
  WT/BFA/W/517  
 
- 11 - Audit recommendation  Severity  Initial 
deadline  Implementation status as reported by 
the implementing Division  Status  OIO's comments  
13. Persons processing Panelists' payments should 
be properly trained and the bank accounts of the 
beneficiaries should be regularly and systematically 
checked.  Medium  Q2 2020  - (W.I.P)  AGSD reinforced the 
controls to ensure that 
bank accounts  are 
systematically checked,  
14. An analysis should be done by the Budget and 
Finance Units (AGSD) to explore the possibility of 
systematically sending travel -related payment 
details to Panelists and ABMs.  Medium  Q2 2020  - (IMPLEMENTED)  A copy of the travel 
claim, with the detailed 
amounts, is now  sent to 
the beneficiary by email 
within 30 days.  
 
 
  
  WT/BFA/W/517  
 
- 12 - ANNEX 3: STATUS OF RECOMMENDATIONS CONTAINED IN  
THE WTO TRADE -RELATED TECHNICAL ASSISTANCE EVALUATION REPORT  
PENDING TO BE CLOSED (MARCH 2020)  
 
 
TRTA  recommendation  Severity  Initial 
deadline  Implementation status as reported by the 
implementing Division  Status  OIO's comments  
21. In consultation with Human Resources and 
delivering Divisions, ensure that a coherent system 
of training for trainers and trainer -evaluation is put 
in place and applied as needed  N/A Q4 2018  Nine (9) sessions of the Training of Trainers  (ToT)  
course were conducted in 2017  and one (1) session in 
2019. More than 73  persons from several Divisions 
(i.e. AGSD, DEV, ERSD,  IPD, ITTC, LAD, LDMID, MAD 
and TPRD) were invited to these training sessions.  
 
HRD wil l keep encouraging staff to take the ToT course 
and will monitor the level of participation.  W.I.P  The recommendation 
remains ''Work -in-
Progress'' pending the 
adoption of a mechanism  
for systematically 
assessing the 
performance of trainers.  
 
 
__________