RESTRICTED  
  
WT/BFA/W/423  
 
11 July 2017  
(17-3718) Page: 1/27 
Committee on Budget, Finance and Administration    
 
   
OFFICE OF INTERNAL OVERSIGHT AND ITS ACTIVITIES  
FOR THE PERIOD FROM 1 MARCH 2016 TO 30 JUNE 2017  
 
_______________  
 
Table of Contents  
 
 
1   BACKGROUND  ................................ ................................ ................................ .............  2 
2   INDEPENDENT STATUS OF THE OIO  ................................ ................................ ............  2 
3   BUDGET AND STAFFING  ................................ ................................ ..............................  2 
A. Budget  ................................ ................................ ................................ ....................  3 
B. Staffing  ................................ ................................ ................................ ...................  3 
4   INTERNAL AUDIT ACTIVITY  ................................ ................................ ........................  4 
A. Internal Audit Plan for 2017 -2018................................ ................................ ...............  4 
B. Follow -up of audit recommendations  ................................ ................................ ...........  4 
C. Audit of Home Leave Entitlements  ................................ ................................ ..............  5 
D. Procurement  ................................ ................................ ................................ ............  7 
5   INVESTIGATIONS ACTIVITY  ................................ ................................ ........................  8 
A. Detective measures  ................................ ................................ ................................ .. 8 
B. Preventive measures  ................................ ................................ ................................ . 9 
6   OTHER ACTIVITIES  ................................ ................................ ................................ ... 10 
 
ANNEX 1  INTERNAL AUDIT PLAN FOR 2017 -2018 (FEBRUARY 2017)  ............................  11 
ANNEX 2  STATUS OF AUDIT RECO MMENDATIONS (20 JUNE  2017)  ................................  12 
ANNEX 3  AUDIT RECOMMENDATION S ON SICK LEAVE PEND ING TO BE CLOSED  ............  13 
ANNEX 4  AUDIT RECOMMENDATION S ON IT SECURITY  PENDING  TO BE CLOSED  ..........  16 
ANNEX 5  STAFF RULES 104.7 AN D 109.3  ................................ ................................ ....... 24 
ANNEX 6  AUDIT RECOMMENDATIONS ON HOME LEAVE ENTITLEMENTS  ........................  25 
 WT/BFA/W/423  
- 2 - 
 
  1  BACKGROUND  
1.1.  The Administrative Memorandum No.9741 indicates that the Office of Internal Oversight 
(OIO) shall report annually to the Committee on Budget, Finance and Administration ( CBFA), 
providing an overview of its activities during the year . This document presents  for information to 
the CBFA t he reporting of internal audit activities carried out by  the OI O for the period  March  2016 
to June 2017. 
1.2.  It is to be recalled that the OIO was established in November  2015, following the 
recommendations of the External Auditors and the conclusions of the Working  Group on Rules in 
the Strategic Review that there was a need to reinforce the independent status of the Office of 
Internal Audit (OIA) and expand its responsibilities to include investigations.  
1.3.  The current Governance, Risk and Compliance Manager  was appoi nted Head ad interim of the 
OIO in December  2015 and remained in charge of the O ffice until the arrival of the current  Head of 
the OIO, Mr Benoit de Schoutheete , who took office on 1 September  2016. 
1.4.  The OIO assists the Director -General in fulfilling his in ternal oversight responsibilities in 
respect of management of staff and resources of the WTO . The OIO is in charge of conducting 
internal audits, investigations and any other form of assessment that may be needed in respect of 
management, staff and resourc es of the WTO ; and to provide for a professional, independent, 
objective and documented assessment of management practices, expenses, budgetary control and 
allegations of misconduct.  
1.5.  In the first section of this report, the Head of the OIO confirms the ind ependence of the 
Internal Oversight activity at WTO . The second section of the report presents the staffing and 
budget of the OIO . The subsequent sections provide detail s of the  Internal Audit s, Investigation s 
and other activities conducted by the OIO  since March  2016. 
2  INDEPENDENT STATUS OF THE OIO  
2.1.  The International Standards for the Professional Practice of Internal Auditing (hereafter 
referred to as the  IIA Standards )2 require the OIO to remain independent and free from 
interference when performing its work, and to confirm its independence  to a level within the 
organization that allows the internal oversight activity to fulfil its responsibilities.  
2.2.  In line with the above -mentioned S tandards , the Head of the OIO and other OIO staff are 
functionally and oper ationally independent from the Secretariat and from WTO Members in the 
conduct of their duties, and the Head of the OIO is required to  report annually to the 
Director -General and to the CBFA, indicat ing any circumstances that may have affected his/her 
independence.1 
2.3.  The Head of the OIO certifies that no circumstances have affected, in fact or appearance, the 
independence of the OIO or impeded its ability to effectively fulfil its functions and responsibilities 
in an unbiased, objective and independent manne r. Neither the Director -General nor any other 
WTO staff member have tried to influence or otherwise interfered with the work of the OIO.  
2.4.  The OIO has received full and unrestricted access to all WTO records and staff members . The 
Head of the OIO has direct and unrestricted access to the Director -General, senior management 
and the Chair of the CFBA.  
3  BUDGET AND STAFFING  
3.1.  In accordance with IIA Standard 2030, Resource Management,  the Head of the OIO must 
ensure that internal oversight resources are appropriate, sufficient, and effectively deployed to 
achieve the Internal Oversight work plan.  
                                                
1 Administrative Memorandum No.974, Office of Internal Oversight, OFFICE(15)/101, 
30 November  2015.  
2 The International Standards for the Professional Practice of Internal Auditing , promulgated by th e 
Institute of Internal Auditors (IIA), provide a principle -focused and mandatory framework for performing and 
promoting internal auditing – See: https://na.theiia.org/standards -guidance . WT/BFA/W /423 
- 3 - 
  A. Budget  
3.2.  The OIO has its own operational budget . This operational budget is determined by the 
Director -General, upon the entry into function of the Head of the OIO, further to a 
recommendation of the latter.  
3.3.  The General Council approved the budgets for the biennium 2016 -20173 on 
30 November  2015. The budget allocated to the  OIO for 20174 and the actual costs incurred (up to 
21 June 2017) are detailed in Table 1 – Budget and a ctual costs of the OIO (in CHF). The OIO has 
consumed so far 30 % of its annual budget (21/06/2017).  
Table 1 Budget and actual costs of the OIO (in CHF) 
Account Description  Budget 2017  Actual costs  
(21/06/2017)  % 
Staff / Salary (inc luding pension)  410,900  129,931  32% 
Special Service Agreements  15,000  0 0% 
Air & Rail Transportation  8,000  1,732  22% 
TOTAL  433,900  131,663  30%  
 
3.4.  The Head of the OIO shall assess , every year,  the resources needed to achieve the Internal 
Oversight activi ty plan . The budget of the OIO for 2018 will be determined taking in consideration 
this assessment  and WTO's constraints . It is to be reminded that the operational budget of the 
OIO may not be diminished throughout the tenure of the Head of the OIO, unless  otherwise 
agreed between the Head of the OIO, the Director -General and the Chairs of the General Council 
and of the CBFA.  
B. Staffing  
3.5.  The OIO is currently composed of the Head of Office (Grade 10) and an Administrative 
Assistant (Grade 4).  
3.6.  The Head of the  OIO assessed the appropriate staffing level for the Office  based on t he 
benchmarks provided by the Joint Inspection Unit (JIU)  and taking into consideration WTO's 
constraints , and concluded that one additional Internal Oversight professional (Grade 6) should be 
hired in 2017.  
3.7.  Given the current ceilin g in the number of staff at WTO  and the necessity for the Human 
Resources Division to prioritize the allocation of additional resources among several requesting 
Divisions , the OIO first explored  the option of i nternal mobility , and then analysed  the poss ibility of 
contracting a short -term staff member for the period required to initiate and complete the 
recruitment process for the  Internal Oversight p osition  (Grade 6).  
3.8.  The OIO identified a suitable candidate, wh o has extensive experience in investigations and 
internal audit and has worked several years for International Organizations . The selected 
candidate will join the OIO in August  2017, for a n initial  period of 6 months.  
3.9.  In accordance with the IIA Standards, the Head of the OIO will continue assessing the 
staffing requirement of the office, and report to the CBFA, annually.  
                                                
3 Document W T/GC/M/160.  
4 Document WT/BFA/W/408.  WT/BFA/W/423  
- 4 - 
  4  INTERNAL AUDIT ACTIVITY  
A. Internal Audit Plan for 2017 -2018 
4.1.  The OIO's risk -based Internal Audit Plan for 2017 -2018, presented to the CBFA  in 
February  20175, is mainly derived from the WTO's Secretariat risk register maintained by AGSD, 
input from senior management, and International Professional Practices Framework (IPPF) 
requirements . The Internal Audit plan for 2017 -2018 is detailed in An nex 1 - Internal Audit Plan 
for 2017 -2018 ( February  2017). 
4.2.  The internal audit plan will be reviewed at least annually, and may need to be adapted in 
response to changing risks, priorities and expectations at WTO.  
4.3.  When conducting its activities, t he OIO str ives to achieve full compliance with the Code of 
Ethics and the Standards for the Professional Practice of Internal Auditing promulgated by the 
Institute of Internal Auditors.  
4.4.  Since March  2016, t he OIO conducted a comprehensive  review of all the internal a udit 
recommendations pending to be closed since 2013, completed the audit of Home Leave 
Entitlements and worked with the  Procurement Service in order to reinforce relevant internal 
controls.  
B. Follow -up of audit r ecommendations  
4.5.  The recommendations propose d by the OIO are aimed to strengthen accountability 
mechanisms, internal controls, compliance, value -for-money, and good governance  in the WTO 
Secretariat . The timely implementation of these recommendations facilitate s changes for 
improvements in organizat ional efficiency and effectiveness.  
4.6.  The OIO developed a detailed Follow -up Register to closely monitor the implementation of 
the recommendations proposed in internal audit reports . This Follow -up Register is updated 
regularly , based on input collected from  the concerned Divisions.  
4.7.  The current status of the audit recommendations is de tailed in Annex 2 - Status of Audit 
recommendations (2 0 June 2017). 
4.8.  The OIO has decided to close 79 recommendations, based on the supporting information 
received from the concer ned Divisions : 
 All the recommendations related to Mission Travel (2009), Payroll (2010), ITTC 
Administrative and Logistical Support Activities (2010), Cleaning and Maintenance 
Services (2011), Security and Safety Activities (2011), Consultants and Related 
Service Providers (2012) and Tangible Assets and Consumables (2013) have been 
closed ; 
 30 out of the 33 (91%) recommendations related to Sick Leave Management (2014)  
have been implemented ; and 
 5 out of the 19 (26%) recommendations related to IT Security (20 14) have been 
closed.  
4.9.  The audit recommendations related to Sick Leave Management and IT Security  still pending 
to be closed are detailed in Annexes 3 and 4  – Audit recommendations pending to be closed.  
4.10.   As indicated in Figure 1  – Implementation s tatus of re commendations  (20 June 2017), 92% 
of the audit r ecommendations have been closed.6 
                                                
5 Document WT/BFA/W/408 - Office of Internal Oversight – Report on the Activity Plan for 2017 -2018, 
14 February  2017.  
6 Excluding the 11 recommendations proposed in the report on Home Leave Entitlements (June  2017).  WT/BFA/W /423 
- 5 - 
  Figure 1 Implementation s tatus of recommendations  (20 June  2017)  
 
 
4.11.   The OIO will continue to closely monitor the implementation of the internal aud it 
recommendations.  
C. Audit of Home Leave Entitlements  
4.12.   At the WTO, an internationally -recruited staff member whose recognized home is not 
situated in Switzerland is entitled for home leave once every two years . The purpose of the home 
leave is to permit t he staff member to spend a certain period of annual leave in his/her own 
country in order to maintain contact with it.  
4.13.   Since 1997, the WTO offers the option for staff members to receive a lump -sum in lieu of 
the statutory Home Leave entitlements . The lump -sum received is the equivalent of 80 % of the 
full economy class airfare for the authorized travel by the most direct route (or, for dependent 
children under 21 years of age, 67 % of the calculated amount) .7 
4.14.   The audit of Home Leave entitlements was included in the Internal Audit Plan for 2017 -2018 
endorsed by the Director -General . The objectives of the  internal audit were to analyse the costs of 
the Home Leave entitlements at the WTO, to assess the efficiency and effectiveness of the process 
for administering  these entitlements, and to review the compliance of a sample of transactions 
with the applicable policies, procedures and regulatory framework (and in particular Staff Rules 
104.7 – Definition of Home , and 109.3 – Home Leave , detailed in Annex 5 – Staff R ules 104.7 and 
109.3 ). 
4.15.   The audit was carried out in accordance with the International Audit Standards prescribed 
by the Institute of Internal Auditors (IIA)8, and covered transactions recorded between 
January  1st, 2015 and December  31st, 2016.  
4.16.   As indicated  in Table 2 – Number of Home Leave requests, travellers and costs, the Human 
Resources Staff Services and the Travel Unit processed 172 Home Leave requests in 2016, 
                                                
7 The lump -sum calculation is based on IATA's fares published in the Galileo system.  
8 For more details: 
https://na.theiia.org/standards -guidance/mandatory -guidance/Pages/Standards.aspx.  
Closed
92%open
3%
WIP
5%WT/BFA/W/423  
- 6 - 
  concerning 459 travellers (including entitled staff members, spouses and dependent children ), for 
a total cost of 1,412,514 CHF.  
4.17.   The total cost of Home Leave entitlements at the WTO tends to slowly decrease since 2012, 
and the average cost per traveller has fallen by almost 12 % in 5 years, from 3,744 CHF per 
traveller in 2012 to 3,077 CHF in 201 6. 
Table 2  Number of Home Leave requests, travellers and costs  
Home Leave Year  Number of HL 
requests  Number of 
travellers  Amount paid (in 
CHF)  Average cost per 
traveller (in CHF)  
2012 188 504 1,887,122  3,744  
2013 198 414 1,497,183  3,616  
2014 185 530 1,858,730  3,507  
2015 180 408 1,326,096  3,250  
2016 172 459 1,412,514  3,077  
 
4.18.   The OIO selected 11 destinations around the world and, for each destination, compared the 
calculated lump -sum amount with the average flexible economy class airfare proposed by the  
airlines flying to the selected destination . The OIO observed that the calculated lump -sum amounts 
are significantly higher than the projected costs of regular travel.  
4.19.   Furthermore, the OIO analysed the variation of the lump -sum payments made in 2015, 
2016 and 2017, and observed that the lump -sum amounts fluctuate significantly for destinations in 
Europe and Africa, but remain relatively stable for long -distance flights (except for Canberra and 
Washington).  
4.20.   The OIO prepared a detailed flowchart describing t he process for managing Home Leave 
entitlements at the WTO . This flowchart has been used as reference for identifying roles, 
responsibilities and relevant internal controls.  
4.21.   Finally, the OIO analysed a sample of 45 Home Leave requests submitted to HRD betw een 
January  2015 and December  2016; and measured the compliance of each of the selected 
transactions against the specific criteria  derived from the regulatory f ramework.  
4.22.   Based on the sample testing, the OIO concluded that the guidelines given to staff memb ers 
by HRD and AGSD sometimes deviated from WTO's Staff Rules and were not always properly or 
consistently understood and applied . Additionally, several internal controls were not always in 
place to ensure the efficient and effective processing of Home Lea ve entitlements.  
4.23.   The OIO worked closely with the HR Staff Services and the Travel Unit  (Financial Services)  
to align the guidelines given to staff members to the Staff Rules and to incorporate the necessary 
internal controls in the template (excel file) us ed by both units to manage the Home Leave 
entitlements . The revised template has been successfully implemented as from May 1st, 2017, and 
is now actively used by both Units.  
4.24.   Based on the analysis and  the findings  made during the audit , the OIO proposed  the 
following recommendations to the Human Resources Division : 
 To closely monitor the costs and benefits to the WTO of the lump -sum arrangement, 
taking into consideration the level of the cash incentives provided to staff by the 
lump-sum procedure ; and to ado pt any necessary adjustments would the 
arrangements be considered excessive;  
 To analyse if the Home Leave entitlement of one staff member who se nationality 
differs from the granted country of Home leave is acceptable and justified ; and to 
adopt corrective measures if deemed necessary;  WT/BFA/W /423 
- 7 - 
   To assess the advantages and disadvantages of adopting the simplified approach used 
by the United Nations for calculating the number of travel days allocated to 
compensate the time spent travelling ; 
 To ensure that staff member s spend at least two calendar weeks in the country of 
home leave (travel time excluded), whether the country is located in Europe or not ; or 
change the policy if deemed appropriate;  
 To establish a rule requesting the partial refund of the lump -sum paid, wo uld the travel 
claim (and supporting documents) not be submitted within 30 days  upon return from 
Home Leave;  
 To establish a formal authorization procedure for when staff members postpone and/or 
advance the home leave entitlements ; or when the destination d iffers from the entitled 
city of Home Leave ; 
 To request staff members to confirm, each time they submit Home Leave requests, 
that they have not benefited from Home Leave entitlements from other organizations 
in the  last two years;  
 To introduce a separate l ump-sum calculation for children under 2 years of age;  
 To request the reimbursement of the lump -sum paid whenever a Home Leave journey 
is cancelled or postponed by the staff member for more than 30 calendar days;  
 To prepare and communicate to all staff mem bers a detailed Home Leave policy 
considering the above -mentioned recommendations ; and 
 To configure the MobileXpense system taking into account the above -mentioned 
recommendations.  
4.25.   HRD and AGSD Management have  accepted the recommendations  contained in the report . 
The audit recommendations and related management comments are detailed in Annex 6 - Audit 
recommendations on Home leave entitlements . 
D. Procurement  
4.26.   The OIO decided to focus this year on procurement fraud prevention, s ince the External 
Auditors con ducted an audit of procurement in 2015 and the revised Financial Rules and new 
Procurement Manual have re cently been enforced at the WTO.  
4.27.   The OIO and the Procurement Service have been closely collaborating, with the objective of 
identifying, preventing and  deterring potential fraud in procurement.  
4.28.   The OIO provided support to the Procurement Service for developing the new Procurement 
Manual . This Manual highlights the importance of ethics, confirms WTO's zero -tolerance with 
regards to fraud and corruption, a nd alerts staff on potential conflicts of interest (all staff members 
involved in the procurement process shall avoid conflicts of interest or the appearance of conflicts 
of interest).  
4.29.   The OIO also organized a workshop with the entire Procurement Service, to discuss about 
red-flags for identifying potential fraud in each phase of the procurement cycle.  
4.30.   Finally, t he OIO is currently preparing a h andbook  about fraud in procurement . This 
handbook will be distributed by the Procurement Service to staff member s involved in the 
procurement cycle.  WT/BFA/W/423  
- 8 - 
  5  INVESTIGATIONS ACTIVITY  
5.1.  The OIO is the exclusive entity at the WTO responsible for investigating allegations of 
violations of any WTO norm applicable to Staff members, irrespective of the nature of their 
contracts, and fo r transmitting to the Director -General9 the results of such investigations together 
with recommendations on action to be taken.  
5.2.  The OIO has adopted several detective and preventive investigation measures . While 
detective measures  are designed to identify f raud and misconduct cases after they have occurred, 
preventive measures are designed to discourage these practices from occurring.  
A. Detective measures  
5.3.  The OIO has developed an Intake Re gister , where every allegation of misconduct (intake)  
communicated to  the OIO is systematically documented and recorded . The Intake Register is used 
to closely monitor each of the investigation cases.  
5.4.  Since March  2016, t he OIO  has received  17 reports of possible misconduct (intakes) . The 
summary of these intakes is provided  in Table 3 - Summary of investigation cases.  
Table 3 Summary of investigation cases   
Intake  
Number  Formal 
Complaint  Type of 
allegation  Investigation 
opened  Potential 
loss (CHF)  Status  Allegations 
confirmed  Sanctions 
recommended  
1 Yes Misconduct  Yes - Closed Yes Yes 
2 Yes Fraud  Yes 7,176 
(recovered)  Closed  Yes Yes 
3 Yes Misconduct  Yes - Closed  Yes Yes 
4 No - - - - - - 
5 No - - - - - - 
6 No - - - - - - 
7 Yes Misconduct  Yes - Closed  Yes Yes 
8 No - - - - - - 
9 Yes Theft Yes - Closed  No No 
10 No - - - - - - 
11 No - - - - - - 
12 Yes Harassment  Yes - Closed  No No 
13 No - - - - - - 
14 Yes Harassment  No - - - - 
15 No - - - - - - 
16 No - - - - - - 
17 Yes Discrimination  Pre- 
assessment  - Pending  - - 
 
5.5.  The majority of the intakes  received by the OIO ar e related to misconduct, harassment or 
discrimination  (see Figure 2 – Type of allegations received by the OIO ). 
5.6.  The identified cases of fraud and/or theft (25 % of the intakes ) did not generate  direct  
financial losses for the WTO.  
                                                
9 Or, in the case of an alleged violation by the Director -General, a Dep uty Director -General, or a 
member of the Office of the Director -General, to the Chairs of the General Council and of the CBFA.  WT/BFA/W /423 
- 9 - 
  Figure 2 Type of allegatio ns received by the OIO  
 
 
5.7.  The OIO analysed in details each of the intakes  received and, whenever deemed necessary, 
carried out a preliminary assessment before reaching the decision on the initiation  (or not)  of an 
investigation.  
5.8.  Whenever the intakes were related to workplace issues (e.g. : conditions of employment, 
relations with supervisors or colleagues, performance management) and not misconduct, the 
concerned persons were redirected to other channels available at the WTO to add ress grievances 
(such as the Internal and/or the External mediation).  
5.9.  The OIO decided to open s ix administrative investigations  and conducted the m in accordance 
with the WTO 's procedure for administrative i nvestigations .10 On four of these investigations, t he 
OIO concluded that the allegations were confirmed beyond reasonable doubt , and recommended 
sanctions and/or corrective measures .11 
5.10.   The Head of the OIO confirms that t he Director -General, the Deputy Directors -General and 
the members of the Office of the D irector -General (DGO) have not been the subject  of (or been 
involved in) the investigations . 
B. Preventive measures  
5.11.   The role of the OIO is not only to conduct investigations, but also to promote and maintain a 
culture of integrity and honesty at the WTO.  
5.12.   Therefore, t he OIO and the Legal Counsel to the Administration have drafted an Anti -Fraud 
Policy . The objectives of this draft policy are to define  what constitutes fraud and presumptive 
fraud, to clarify  the responsibilities where fraud is at issue and to outline WTO's approach to fraud 
prevention and control . Additionally, the draft policy highlights WTO's 'zero -tolerance' approach to 
fraud, meaning that WTO staff members and other officials, external collaborators, contractors, 
                                                
10 OFFICE(14)/17 - Provisional Procedure for Administrative Investigations and Disciplinary Actions , 
16 October  2014.  
11 The OIO is  also currently conducting the pre -assessment of a complaint for discrimination, in order to 
determine if there is sufficient ground to initiate an administrative investigation.  
Misconduct, 3, 
(37.50%)
Harassment, 2, 
(25%)Discrimination, 1, 
(12.50%)Fraud, 1,
(12.50%)Theft, 1,
(12.50%)WT/BFA/W/423  
- 10 - 
  suppliers of goods and serv ices, delegates and other parties are not to engage in fraud . The draft 
policy is currently being reviewed by the Director -General . 
5.13.   The OIO has also worked with the Human Resources Division (HRD) to develop a video 
module presenting  the Code of Conduct and  the Internal Oversight function at the WTO . This video 
module will be part of the induction project currently being developed by HRD for newcomers.  
5.14.   Finally, the OIO participated in September  2016 to a Town Hall meeting to present to Staff 
members the chan nels existing at the WTO for  resolving disputes . Another Town Hall meeting is 
currently being prepared , to discuss about  Ethics  (e.g.: WTO's Code of Conduct and how to take 
the lead in strengthening the ethical culture at the WTO).  
6  OTHER ACTIVITIES  
6.1.  Frequen t contact s have been established  with the External Auditor (Bundesrechnungshof), 
the Internal Mediator and the Legal Counsel to the Administration . The OIO considers that the 
collaboration  and communication with these different functions has been positive and constructive.  
6.2.  The OIO also collaborated with  the Governance, Risk, and Compliance Manager for 
developing a draft Internal Control framework  at the WTO . The purpose of this framework  is to 
provide assurance to the Director -General regarding the achievem ent of WTO's objectives, 
ensuring that (i) operations are executed in an ethical , economical, efficient and effective manner, 
(ii) accountability obligations are fulfilled, (iii) WTO's assets and resources are adequately 
safeguarded, and (iv) operations ar e conducted in compliance with applicable regulations, rules 
and policies.  
6.3.  The Head of the OIO represented the WTO at the 2016 Conference of International 
Investigators, organised by the International Anti -Corruption Academy (IACA) in Vienna 
(3-7 October  2016), and at the annual conference of the Heads of Internal Audit (HOIA) in Europe, 
hosted by the European Stability Mechanism in Luxemb ourg (27 -28 April 2017).  
6.4.  The OIO is also an active member of the Representatives of Internal Audit Services (RIAS ) 
and the Representatives of Investi gations Services (RIS) networks . These network s of heads of 
internal audit/ investigations services of International Organizations  meet in organized forums to 
share good practices and establish guidance for internal audit /invest igations  in the international 
public sector.  
6.5.  Finally, t he OIO is currently reviewing the Internal Oversight Charter, which constitutes the 
framework within which the Internal Oversight function of the WTO will operate ; and the 
procedure  for administrative investigations and disciplinary actions . 
6.6.  The OIO will continue to provide an annual update on its activities to the CBFA.   
  WT/BFA/W/42 3 
- 11 - 
 
ANNEX 1  INTERNAL AUDIT PLAN FOR 2017 -2018 (FEBRUARY 2017)  
Audit subject  Source  Audit Scope/Objective  2017  2018  
Management of Home Le ave  Fraud case  
Management Request  Compliance with policy . Review of the economy, efficiency and effectiveness of 
processes and internal controls . Calculation of Home Leave entitlements . Analysis 
of cost variations and trends.  x  
Procurement  Risk Regist er 
CBFA 
 In 2017 : The OIO will focus on procurement fraud prevention (through 
workshops/trainings), since the External Auditors conducted an audit of 
procurement in 2015 and the revised WTO Financial Rules and new Procurement 
Manual are being implemented.  
In 2018 : The internal audit will include the assessment of processes and internal 
controls ; and the review of the implementation of the new Procurement Manual 
and of Chapter IX of the revised Financial Rules.   x x 
Policies on gifts, gratuities and 
outside  activities (including Conflict 
of interest)  Risk Register  
 Assessment of policies related to:  
- Acceptance of gifts, gratuities or other favours from vendors or outside parties;  
- Remunerated outside activities of staff members;  
- Management of Staff Assi stance Fund;  
- Safeguards for preventing potential conflicts of interest of staff members, 
interns, panellists, appellate body members and WTO Experts (e.g. : Statement of 
Financial Disclosure);  
- Post-employment obligations.  x  
Education Grant  Management Request  Compliance with policy . Review of the economy, efficiency and effectiveness of 
processes and controls . Calculation of allowances.   x 
Enterprise Risk Management  IIA Standards  Analysis of how risks are assessed, managed and mitigated at WTO (risk 
management process and register).   x 
Access rights in Oracle E -Business 
Suite (Enterprise Resource 
Planning)  Risk Register  
IT Security audit  Review of security processes and measures, analysis of access rights/permissions 
and segregation of duties in Oracle  (ERP).   x 
Information Security Governance  Risk Register  
Management Request  Gap analysis and roadmap for implementing the international standard ISO27001 
(Information security management system).   x 
Follow up of recommendations 
made in the Trade -Related 
Technical Assistance (TRTA) 
external evaluation  Risk Register  
Management Request  Independent review of the implementation of the recommendations stated in the 
WTO TRTA external evaluation report (Saana Consulting, 31  October  2016) . 
Special focus on the Mo nitoring and Evaluation function.  x x 
Follow up of audit 
recommendations  IIA Standards  Periodic review of the implementation of internal audit recommendations.  x x 
Ad hoc audits, if any  - To be determined  - -   
  WT/BFA/W/42 3 
- 12 - 
 
ANNEX 2  STATUS OF AUDIT RECO MMENDATIONS (2 0 JUNE 2017)  
 
 
Audit ActivityAudit 
yearTotal number of 
recommendations
% Closed WIP Open Closed WIP Open
Mission Travel 2009 23 21 91% 20 3 0 23 0 0
Payroll 2010 25 21 84% 21 3 1 25 0 0
ITTC Administrative and Logistical Support Activities 2010 12 9 75% 11 1 0 12 0 0
Cleaning and Maintenance Services 2011 31 24 77% 28 3 0 31 0 0
Security and Safety Activities 2011 21 19 90% 20 1 0 21 0 0
Consultants and Related Service  Providers 2012 26 24 92% 12 7 7 26 0 0
Tangible Assets and Consumables 2013 19 10 53% 1 1 17 19 0 0
Sick Leave Management 2014 33 26 79% 0 0 0 30 0 3
IT Security 2014 19 5 26% 0 0 0 5 10 4
Total  as at 01.06.17 209 159 76% 72% 12% 16% 92% 5% 3%SUMMARY OF AUDIT ACTIVITY
Number of High 
recommendationsImplementation status as of 
31.12.2013Implementation status as of 
01.06.2017
  
  WT/BFA/W/42 3 
- 13 - 
 
ANNEX 3  AUDIT RECOMMENDATION S ON SICK LEAVE PEND ING TO BE CLOSED  
Audit recommendation  Audit 
category  Implementation status as 
reported by the 
implementing Division  
(8 February  2017)  Status  OIO's comments  
SENIOR MANAGEMENT      
3. Instruct an evaluation of the service 
rendered by the Occupational Health 
Service (OHS) to determine if it is efficient, 
effective, still meets the needs of WTO and 
that WTO is getting value -for-money from 
all the services provided . Subsequently 
review the worki ng hours of the 
Occupational Doctor, if necessary.  Operational   A survey was sent to all staff 
to assess OHS service  
 The Director of HRD is 
monitoring the services 
provided by the OHS 
through monthly meetings 
with the OHS Doctor.  
 The OHS doctor works at th e 
WTO 1.5 days per week . The 
hours of the OHS Nursing 
staff have been adjusted to 
ensure coverage at all times 
when the doctor is 
unavailable.  
 First Aid courses have been 
offered for staff at the WTO.  
 A further review of the OHS 
unit will be completed in 
2017. W.I.P   The Occupational Health Service (OHS) was established on 
1 March  2009. D ocument Office (09)/16, dated 
25 February  2009, and refers to a restructured Medical 
Service.  
 A staff survey was conducted in July 2015. Survey feedback 
results showed that there is still a confusion or 
misconception of the services offered by the OHS.  
 Some staff members are still not aware that medical care or 
follow -up examinations that are not related to occupational 
health will be the responsibility of one's attending phy sician.  
 The current OHS, however, (1) continues to provide medical 
examinations and advice to staff related to their work, (2) 
help to maintain and/or reinstate employees in a workplace 
suitable for their health and their physical and mental 
abilities, (3)  advise management and staff on matters 
relating to health, hygiene and safety at work, (4) contribute 
to promoting health in general, pension -related medical 
examinations, prior to retirement, during pregnancies, and 
via talks or intranet information, and  (5) contributes to 
delivering first aid during the OHS' opening hours.  
 In view of the above, it is therefore further recommended 
that: (1) HRD organizes regular information and dialogue 
meetings to assist staff members familiarize themselves 
with the role  and responsibilities of the OHS and (2) HRD 
conducts a follow -up survey, to facilitate full evaluation and 
assessment on the WTO staff needs and expectations and 
the realignment of the OHS and its resources.  
 HRD plays a key role in assisting the organizat ion to provide 
Duty of Care and take steps to ensure occupational health, 
safety, and wellbeing of its staff.  
 
08/02/2017 : A vacancy notice was published in March  2017 
for hiring a doctor on Fixed Term contract (50% time) . The 
recruitment process is expect ed to be completed in Q3 2017.  
   
  WT/BFA/W/42 3 
- 14 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the 
implementing Division  
(8 February  2017)  Status  OIO's comments  
OHS AND HRD      
26. Reconcile data that is recorded in Oracle 
and CHIMED on sick leave to ensure that it 
is accurate, consistent and reliable for 
reporting to various stakeholders and that 
any variances are justified.  Operational  CHIMED is made to record the 
work done by OHS staff (e.g. 
how many medical certificates 
are received) . It provides a 
broad idea of the number of 
days under Sick Leave but it is 
not efficient for obtaining 
statistics on Sick Leave (e.g. it 
does not allow calculating 
hours or half days of absence) . 
Therefore the system will need 
to be modified . W.I.P  The data recorded in the Oracle and the CHIMED programme 
remains unreconciled . This recommendation will be integrated 
with recommendation no. 28, i.e., a s part of the 2nd phase of 
the IT Improvement Plan . The second phase of the IT 
Improvement Plan is envisaged to materialize in 2017.  
08/02/2017 : CHIMED will be upgraded in 2017 by ITSD (and 
has been included in ITSD plan for 2017).   
  WT/BFA/W/42 3 
- 15 - 
 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the 
implementing Division  
(8 February  2017)  Status  OIO's comments  
ITSD      
28. Directors/supervisors should provide 
HRD with a solution to facilitate ownership, 
accountability, management and reporting  
of data ; and provide appropriate training to 
HRD staff to ensure their independence in 
using the solution.  System  
 After the upgrade of the OEBS 
to version 12 
(December  2014), a project 
will be launched to enhance the 
management of absences : 
Inclusion of all staff categories 
entitled to absences, 
Improvement of the production 
of lists and statistics.  
2. A utomation of the 
management of sick leave and 
the creation of an interface 
between the OEBS and  the 
system CHIMED used by OHS.  
 
A version in Test is avail able to 
the users . Upon validity, this 
will be put into Production. 
(24/02/16)  
 
The project will require 
external expertise, with 
completion date expected in in 
2017.  W.I.P  First Phase of Improvement Plan:  
 The set -up in Oracle E -Business Suite (OEBS) of L eave 
Management includes annual leave, certified sick leave, 
uncertified absences, maternity and paternity leave.  
 Until 2015, Leave Management in the Oracle system included 
permanent staff, fixed -term staff and L -posts.  
 IT Team extended the Leave Managemen t population to staff 
under temporary contracts which was previously managed 
and controlled manually by HRD and the Divisions.  
 With the integration of temporary staff and interns, the 
parameters were defined.  
 Training of HRD staff by IT was carried in February. 
 Management and control of absences improved, including 
reporting and statistical analysis and evaluation.  
 Test was implemented and the first phase of the 
improvement plan is closed.  
Second Phase of Improvement Plan  (2017)  
 The CHIMED system used by OH S is for certified sick leave.  
 HRD inputs sick leave data in the Oracle system.  
 Data validation and reconciliation between the two systems 
will be achieved with the second phase of improvement.  
 The shared folders of certified sick leave between CHIMED 
and HRD would be automated.  
 The automation of sick leave and the creation of Interface 
will enhance control and will result to reliable reporting.  
08/02/2017 : CHIMED will be upgraded in 2017 by ITSD (and 
has been included in ITSD plan for 2017)    
  WT/BFA/W/42 3 
- 16 - 
 
ANNEX 4  AUDIT  RECOMMENDATIONS ON IT SECURITY  PENDING TO BE CLOSED  
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
SENIOR MANAGEMENT      
2: It Security Governance : GOV-02 – 
Definit ion of the overarching IT security 
policy . 
 
Once the information security policy and 
framework is defined : 
- Develop a high -level IT security policy 
covering all the activities performed by the 
IT Security function and based on the 
WTO's information securi ty risk 
environment . This policy should consider 
information assets in a broader business 
context to drive its IT security activities;  
- Define a process to periodically review this 
policy . The reviews should be based on:  
(i) scheduled (e.g. annual) review s, and 
(ii)occurrence -based reviews (e.g. following 
a major change to the IT environment, 
reported IT security incidents, results of 
assessments of IT security or changes to 
the information assets);  
Communicate the policy to all staff via staff 
memo and pu blish it on the Intranet  
- Formally approve the policy and enforce it 
within the whole organization.  
 Operational  Agree with the recommendation . 
 W.I.P  19 June 2017: 
The policy has been approved by the Director General, and is in 
process of validation/ preparation for circulation to all staff.  
ITSD      
3: It Security Governance : GOV-03 – IT 
Security function 's staffing requirements . 
 
Review the organization staffing 
requirements for IT security and take 
appropriate actions based on this review 
(e.g. hiring  or outsourcing).  Define a 
process for periodic evaluation of the IT 
Security function 's resource needs, based Operational  Agree with recommendation  W.I.P  19 June 2017: 
An IT Security Analyst post was published first as a call for 
expression of interest, then as an internal vacancy, but did  not 
receive any application.  An external vacancy (IT Security 
Analyst  – Grade 7)  was then published and received a number 
of applicat ions. Three candidates were short -listed for further 
interviews  and testing,  and a  suitable candidate was identified . 
However the candidate declined the offer.  
A second  external vacancy (IT Security Analyst – Grade 8) was  
  WT/BFA/W/42 3 
- 17 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
on the identified risks, strategy and 
objectives defined for the IT Security 
function.  published and a suitable candidate  was identified . The person 
will enter into office on 01 July 2017. 
4: It Security Governance : GOV-04 – Risk 
management process . 
The Information Security function should 
regularly review the risk register to ensure 
that information security risks are 
adequately and promptly identified . Based 
on that review, the IT Security function 
should:  
1. determine where an IT security response 
should be applied;  
2. Ensure that the appropriate IT security 
responses are included in the 'proposed 
mitigation measures ' section; 
3. Ensure that the IT security responses are 
adequately implemented and are 
operational.  Operational  Agree with recommendation  W.I.P  19 June 2017: 
The a nalysis of the Organization -wide risk register from the 
Information Security point of view was submitted to the ITSSC, 
along with proposed mitigation measures . To ensure 
completeness and coherence of the response, this  audit 
recommendation will also be covered through the  introduction 
of a comprehensive Infosec Risk Management process.  
 
The first itera tion of Infosec Risk Management was planned to 
start in Q1 2016, with critical risks and treatment measures 
identified in Q2 2016, to be implemented starting Q3 2016.  
 
However, t he initiation of the comprehensive information 
security risk management proces s has been delayed by the 
preparation to the 10th Ministerial Confer ence, and the 
Conference itself, and by the lengthy recruitment process  (cf. 
recommendation 3),  since the original plan was made with the 
assumption that a new staff member would join the 
Organi zation already in May -June 2016. 
5: It Security Governance : GOV-05 (a) – 
Inventory  of WTO 's key information asset.  
 
The LDIMD and ITSD to coordinate creation 
and maintenance of an organization -wide 
inventory of key information assets such as 
data, i nformation, documents and 
publications . This inventory should include : 
definitions of the information asset owners ' 
roles and responsibilities, the information 
asset classification level and the basic 
requirements in terms of control and 
monitoring of the information asset ; the 
definition should take into consideration 
each Division that develops or has access to 
key information assets ; The IT Security 
function should perform a security risk 
assessment, based on the list of key Operational  ITSD partially agree with the 
recommendation:  
Creation and maintenance of the 
inventory essentially require input 
from the owners of information 
assets, i.e. core operational divisions 
(as opposed to supporting divisions, 
such as ITSD or LDIMD) . Therefore, 
such task should be mandated and 
supervised by the Information 
Security steering body created as 
per GOV -01 recommendations.  W.I.P  19 June 2017: 
The key information assets in ventory process has been initiated 
in 2016, but has not been completed, due to lengthy process  to 
recruit additional IT Security personnel, as recommended 
above.    
  WT/BFA/W/42 3 
- 18 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
information assets, to determ ine the level of 
protection required for each key information 
asset.  
6: It Security Governance : GOV-06 – 
Information security policies structure . 
 
Review the stru cture and completeness of 
IT security policies, standards, guidelines 
and procedures ; define and enforce the 
various IT policies including Security 
policies, IT security risk assessment policy, 
Disaster Recovery policy, and Information 
Security risk assess ment policy that is 
aligned with the risk management policy.  Operational  Agree with recommendation  W.I.P  Following the introduction of the overarching Policy, the 
following policies and procedures will be defined : 
• Information Classification Policy,  
• Policy on Architecture and Security Assessment of information 
systems , 
• Access Management and Control Policy (ITSSC) + specific 
procedures (Infosec function + ITSD),  
• Incident Management (Infosec function + ITSD, approved by 
ITSD Director),  
• Disaster Recov ery / Business Continuity (Infosec function + 
ITSD, approved by ITSD Director), to be implemented along 
with the Disaster • Recovery Framework (as per the IT Strategy 
2016-2019).  
• Cryptography standard (Infosec function + ITSD)  
• Secure Development Standa rd (Infosec function + ITSD)  
 
The Overarching Information Security Policy is in late stages of 
development.  
 
The Policy on Architecture and Security Assessment of 
Information Systems has been developed and validated by the 
ITSSC, and approved by the Direct or-General.  The document 
has been circulated to all staff (OFFICE (15)/64) , on 
28 July 2015. 
 
The Access Management and Control Policy was introduced with 
ITSSC in Q4 2016 . Further works on the policy are planned for 
2017, with the tentative completion dat e by end 2017.  
 
The final draft of the Confidentiality Classification Policy has 
been approved by ITSSC and has been submitted to the Joint 
Advisory Committee for review and recommendations.  
  
  WT/BFA/W/42 3 
- 19 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
8: It Security Governance : GOV-07 – IT 
Security reporting to th e WTO Management 
(Part II) . 
 
Additionally, th e IT Security function 
should:  
• Define and implement a set of metrics to 
be applied to the information security 
processes, based on the results of the risk 
assessment of key information assets;  
• Develop a comp rehensive and consistent 
set of measures (Key Performance 
Indicator/ Key Risk Indicator) to drive its 
reporting activity, based on the defined 
metrics.  Operational  Agree with recommendation  OPEN  Security metrics / KPIs will be defined (approved by ITSSC, 
following the information assets inventory and risk assessment 
exercise.  
 
19 June 2017: 
Delays are due to the lengthy process for recruit ing additio nal 
personnel . 
9: It Security Governance : GOV-08 – WTO's 
IT security strategy . 
WTO should formally define it s IT Security 
function 's strategy and objectives, taking 
into consideration the results of the key 
information assets and its risk assessment;  
The IT security strategy should be reviewed 
to ensure it is aligned with the 
organization 's business objectives.  
 Operational  Agree with recommendation  OPEN  19 June 2017: 
The Strategy proposal (subject to review at the outcome of risk 
management exercise) will be presented to ITSSC for review 
and validation in July 2017. 
10: It Security Governance : GOV-09 –IT 
Securi ty function 's objectives alignment 
with an IT  security strategy . 
IT Security function should develop a clear 
set of its objectives that should be aligned 
with the IT security  Strategy in Gov -8 
above.  Operational  Agree with recommendation  OPEN  19 June 2017: 
Cf. Recommendation 9 . Delays are due to the lengthy process 
for recruiting additional personnel.    
  WT/BFA/W/42 3 
- 20 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
12: IT Security Controls : ITSC-01: – 
Security configuration of the ERP system . 
 
The Security function should:  
 Define a comprehensive and complete ERP 
system security baseline, based on the 
input of the Back -Office unit and the Oracle 
guidelines for system  security;  
 
 Perform a comprehensive IT security 
review of the ERP configuration, including 
the application layer, the database layer, 
the operating system lay er, the network 
layer and the storage layer.  
 Back-Office unit should:  
• Change the default Oracle Database user 
profiles ' security settings or assign a new, 
stronger security profile to all Oracle 
Database users;  
• Change the default Oracle Database users ' 
password setting and force password 
changes for the 228 users who still have the 
default password set . These settings should 
be aligned with the Windows password 
policy in place.  
• Review the list of the E -business and 
Oracle Database user accounts and r emove 
the user accounts if they are not used;  
• Perform a comprehensive security review 
of the ERP including the business processes 
controls required for the protect ion of the 
WTO's financial data.  
 System  Agree with the recommendation  
 W.I.P  All specific technical vulnerabilities of ITSC -01 have been 
addressed during the migration of the ERP system to the new 
version (completed Feb 2015).  
 
Vendor best practices ("Secure Configuration Guide for Oracle 
E-Business Suite Release 12") were adopted as a security  
configuration baseline.  
 
 
19 June 2017: 
The OIO has  decided to  include the  security audit of the ERP 
system in its internal audit plan for 2017 -2018.  
 
14: IT Security Controls : ITSC-03 – User 
account management  
Review users ' access rights and restrict 
these to a minimum . Additionally, IT 
Security unit should periodically review the 
user accounts and access rights to the 
information processing systems and 
applications to ensure they are appropriate 
and in line with the list of WTO 's staff . This Operational  Agree with the recommendation  
 W.I.P  19 June 2017: 
The drafting of an Access Management and Control policy is i n 
progress (next draft  review planned for July 2017 ITSSC 
meeting).   
  WT/BFA/W/42 3 
- 21 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
review shou ld be initiated by the IT Security 
function and completed by the units 
responsible for those systems.  
Finally, a form should be developed for the 
creation, modification and removal of user 
accounts within the systems ( e.g. Windows 
Active Directory) . This f orm should be 
formally reviewed and signed off by the 
business process owner and the Human 
Resources Division.  
15: IT Security Controls : ITSC-04 – 
Segregation of duties (SoD) control 
framework  
The WTO 's Back -Office unit and the IT 
Security function should:  
1. Define a SoD framework, taking into 
consideration that the s ecurity requirements 
must be balanced with resource availability 
(e.g. a back -up person for a specific 
function must be attributed the appropriate 
access rights to perform back -up 
operations);  
2. Define a procedure for managing 
exceptions to the SoD framew ork. This 
procedure should include the formal 
documentation of deviations from the SoD 
framework and formal validation by the 
user's manager;  
3. Review the current configuration of the 
ERP roles and responsibilities ( i.e. ERP 
profiles) against the SoD fram ework to 
ensure no conflicting rights be given to 
employees without prior validation from the 
user's manager.  Operational  Agree with the recommendation  
 OPEN  19 June 2017: 
ERP segregation of duties will be addressed with HR, AGSD and 
ITSD following the out come of the ERP security audit (see 
ITSC-01 above).    
  WT/BFA/W/42 3 
- 22 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
16: IT Security Controls : ITSC-05 – 
Monitor ing of privileged users actions.  
Create nominative accounts for the 
administrators ; design and implement a 
process to monitor privileged users ' actions 
in the system.  System  Agree with the recommendation  
 W.I.P  As from January  2015, any newly deployed Linux system use 
Active Directory (AD) authentication and authorisation 
mechanisms (standard configuration procedures developed by 
IT Security for operational unit s). 
As per the industry best practices, AD accounts are nominative, 
and privileged credentials are separate from regular.  
Activity logs / alerts from important Linux -based systems are 
progressively integrated in the centralised log management 
system.  
 
17: IT Security Controls : ITSC-06 – ERP 
system logs management and monitoring  
The IT Security function should provide 
input on which modifications should be 
logged, taking into account the evidence 
requirements for incident management, the 
requirements for da ta privacy, the legal and 
regulatory environment and the protection 
measures for the collected evidence (e.g. 
storing the ERP application log files 
remotely on a different server that is only 
accessible to the IT Security function).  
Secondly, the Back -Office unit should 
enable the audit log feature in the ERP for 
all the ERP modules that process key 
information, such as financial resources, 
payment information or vendor creation . 
Further, the log file should be kept in a 
separate database from the ERP where  it`s 
access should be restricted to the IT 
Security function to ensure preservation of 
evidence in the event of an investigation or 
forensic analysis (e.g. in a suspected fraud 
activity investigation).  System  Agree with the recommendation  
 W.I.P  The Log feature was enabled on the ERP. 
Activity logs collection from ERP will be studied as part of SIEM 
(Security Informatio n and Event Management) upgrade.  
Due to technical difficulties ERP audit logs cannot be shipped to 
the present log management server . Additional connectors will 
be required.  
  
  WT/BFA/W/42 3 
- 23 - 
 
Audit recommendation  Audit 
category  Implementation status as 
reported by the implementing 
Division  
(19 June  2017)  Status  OIO's comments  
18: IT Security Controls : ITSC-07 –Security 
patch management.  
The IT Security function should:  
1. Formalize quarterly patch and update 
processes;  Perform a full technical security 
review o f key servers to ensure any 
Windows weaknesses are not exploited;  
2. Develop and implement an emergency 
patch and update management process (for 
important Security Updates) to ensure the 
patch level of infrastructure components is 
adequately controlled outside of the regular 
patch and u pdate process.  System  Agree with the recommendation  
 W.I.P  Formal regular server patching procedures are documented.  
 
ITSD is planning to d ocument the emergency patching exercise 
(which is now done on ad -hoc basis initiated by IT Security).  
 
 WT/BFA/W/422  
- 24 - 
  ANNEX 5  STAFF RULES 104.7 AND 1 09.3 
Rule 104.7 - Definition of home  
(a) For the purpose of the Staff Regulations and Staff Rules, a staff member's home shall be 
determined at the time of appointment.  Unless there are compelling reasons to make an 
exception, a staff m ember's home shall be deemed to be in the country of which the staff 
member is a national at the time of the appointment.  The location of the home within the staff 
member's home country shall be the place with which the staff member has the closest 
residen tial or family ties.  In the absence of clear indications, the capital will be designated.  
(b) Notwithstanding paragraph (a) above, the home of locally recruited staff members as defined in 
Staff Rule 103.1(a) shall be deemed to be Geneva.  
(c) The determina tion of a staff member's home shall remain unchanged for the duration of the staff 
member's service unless the Director -General decides that there are compelling reasons to effect 
a change.  
Rule 109.3 - Home leave  
(a) An internationally -recruited staff mem ber whose recognized home is not situated in the country 
of the duty station shall be eligible for home leave once every two years and for the payment of 
the costs of travel to the country of the recognized home.  The purpose of such travel is to permit 
the staff member to spend a certain period of annual leave in the home country with a view to 
maintaining contact with it.  Home leave shall include, in addition to a reasonable period of 
annual leave taken for the purpose, travel time to compensate for the jo urney from the duty 
station to the recognized home and return, based on a route and means of transport approved 
by the Director -General.  
(b) Travel expenses, as provided for in Staff Rule  112.5, shall be paid in respect of travel on home 
leave, except that  the subsistence allowance shall not be paid for any travel time exceeding that 
allowed under paragraph (a) above.  Subject to paragraph (d) below, travel expenses shall be 
paid in respect of the staff member, spouse, and dependent children for whom an allo wance is 
payable.  In normal circumstances,  the spouse and dependent children shall travel  with the staff 
member.  
(c) If both husband and wife are staff members or if the spouse is a staff member of another 
organization offering home leave, and each is elig ible for home leave, they shall have the choice 
either of exercising their own home leave entitlement or of accompanying the spouse.  A staff 
member who chooses to accompany the spouse shall be granted travel time appropriate to the 
travel involved.  Depende nt children may accompany either parent.  
(d) The first home leave shall fall due in the second calendar year following the year in whic h the 
staff member was appointed, or became eligible for home leave, provided that the staff member 
has completed at leas t eighteen months of service.  
(e) For compassionate reasons or should the exigencies of the service so require, travel may be 
authorized before or after the home leave year, provided that no home leave shall begin earlier 
than 12 months after the appointme nt of a staff member or 12 months after return from any 
previous home leave;  and home leave shall in no case be carried forward into a calendar year in 
which a new entitlement arises.(f ) 
(f) A staff member shall normally be required to spend at least two c alendar weeks in the country of 
home leave.  
(g) A staff member may be required to take home leave in conjunction with official travel, due 
regard being paid to personal convenience.  
(h) Home leave shall not be granted to a staff member whose service is not  expected to continue at 
least six months beyond the second anniversary of the date of appointment;  or the estimated 
date of return from a proposed home leave.  
 
   
  WT/BFA/W/42 3 
- 25 - 
 
ANNEX 6  AUDIT RECOMMENDATIONS ON HOME LEAVE ENTITLEMENTS  
# Description  Severity  Responsible 
Division  Due 
date Management Comments  of implementing 
Divisions  
1 The correct balance should be sought between the need to encourage use 
of the lump -sum and the need to ensure rational use of resources in 
order to achieve economy, efficiency and effective ness in the process.  
Therefore, the OIO invites the Director of the Human Resources Division 
to closely monitor the costs and benefits to the WTO of the lump -sum 
arrangement, taking into consideration the level of the cash incentives 
provided to staff by t he lump -sum procedure ; and to adopt any necessary 
adjustments would the arrangements be considered as excessive.  Medium  HRD 31/06/18  Management concurs with the 
recommendation and will endeavour to 
closely monitor the lump -sum entitlements 
granted.  
 
2 The Director of HRD should analyse if the Home Leave entitlement and 
destination of the concerned staff member is acceptable and justified and, 
would compelling reasons exist to effect a change in the Home Leave 
entitlement and/or destination of the incumbent , seek a decision from the 
Director -General.  High HRD 31/12/17  Management will review this particular case 
and, would it be needed, bring it to the 
attention of the Director -General for a 
decision.  
 
3 The Director of HRD should assess the advantages and d isadvantages of 
adopting, at the WTO, the simplified approach used by the United Nations 
to calculate Home Leave travel days.  Low HRD 31/12/17  Management agrees to assess whether the 
UN method for calculating travel time 
should be implemented at the WTO.  
 
4 Each time a Home Leave request is submitted to HRD, the HR Staff 
Services Focal Point should ensure that the concerned staff member has 
the intention to spend at least two calendar weeks in the country of home 
leave (travel time excluded), whether the c ountry is located in Europe or 
not. 
If deemed necessary, the Director of HRD may decide to modify the WTO 
Staff Rules 109.3 – Home Leave, in order to reduce the minimum number 
of days the staff members are required to stay in the Home Leave 
country.  Medium  HRD 31/12/17  Management supports the uniform 
application of the rule and will make 
proposals to the Director -General on this 
matter.  
 
5 In view of facilitating the processing of Home Leave requests, the 
Director of HRD should enforce the requirement for staff members to 
submit home leave requests at least one month prior to departure . The 
Home Leave requests should be treated by the HR Staff Services at 
least 15 calendar days prior to departure.  
To encourage staff members to submit the Travel Claims on ti me, the Low HRD /AGSD  31/12/17  Management supports this 
recommendation . However, caution has to 
be exercised in this regard . It ought to be 
borne in mind that any measure taken 
should not be unduly punitive . It is unclear 
how a partial refund would be better than 
consistent and persistent reminders being   
  WT/BFA/W/42 3 
- 26 - 
 
# Description  Severity  Responsible 
Division  Due 
date Management Comments  of implementing 
Divisions  
Directors of HRD, in consultation with the Director of AGSD, should 
consider the option of establishing a Rule requesting the partial refund of 
the lump -sum paid, would the travel claim (and supporting documents) 
not be submitted within one month u pon return from Home Leave.  sent to the concerned staff members.  From 
the audit recommendation, there is no 
mention made of the steps taken by either 
HRD (Staff Services) or AGSD (Finance) to 
follow up in the case of a staff member who 
does not submit his/her travel claims on 
time. Furthermore, during deliberations on 
the revision of the financial rules in 2016 
the question of these types of measures 
was extensively discussed . The conclusion 
was that any measure wou ld have to be 
applied on every sphere of the rules and 
that making that a stipulation would create 
undue staff issues . As a result, the financial 
rules did not prescribe any punitive 
measures . Therefore, if this 
recommendation is applied then we would 
be breaching the financial rules.  
6 The Director of HRD should establish a formal procedure for authorizing 
staff members to postpone and/or advance the home leave entitlements.  
Advancing two consecutive Home Leaves should not be authorized.  
The term ''compa ssionate reasons'' (translated as ''raisons de convenance 
personnelle '' in French) should be clarified.  
The Director of HRD should ensure Home Leave requests are not 
authorized when less than 12 months have elapsed between return from 
one home leave and de parture on the next.  
The Director of HRD should analyse the most adequate approach to deal 
with the Home Leave entitlements of staff members on Special Leave 
Without Pay.  Medium  HRD 31/12/17  Management concurs with this 
recommendation and will look into wa ys of 
implementing it.  
 
7 The HR Staff Services Focal Points should request staff members to 
confirm, each time they submit a Home Leave request, that they have 
not benefited from Home Leave entitlement outside the WTO in the last 
two years.  Medium  HRD 31/12/17  Management concurs to request staff 
members to confirm that their spouses do 
not benefit from Home Leave benefits in 
other Organizations.  
 
8 The Director of HRD should introduce a separate lump -sum calculation for 
children under 2 years of age.  Medium HRD 31/12/17  Management fully concurs with this 
recommendation.  
   
  WT/BFA/W/42 3 
- 27 - 
 
# Description  Severity  Responsible 
Division  Due 
date Management Comments  of implementing 
Divisions  
9 The Director or HRD should ensure that the reimbursement of the 
lump-sum amount is requested whenever a Home Leave journey is 
cancelled or postponed by the staff member for more than 30 days . The 
lump-sum should be recalculated whenever the Home Leave is cancelled 
or postponed for more than 30 calendar days.  Medium  HRD 31/12/17  Management fully concurs with this 
recommendation.  
10 The Director of HRD should prepare a detailed Home Lea ve policy 
considering the above -mentioned recommendations . This policy should be 
communicated to all employees of the WTO.  High HRD 31/12/17  Management agrees to review the Home 
Leave policy for consideration by the 
Director -General.  
11 The MobileXpense system should be configured taking into account the 
above -mentioned recommendations . In particular, the system should 
incorporate the following controls:  
 Confirmation of the Home Leave option chosen by staff 
member (lump -sum or reimbursement of actual expe nses),  
 Confirmation that the spouse does not benefit from home 
leave  entitlements in another organiz ation,  
 Actual country and city of destination (if different from 
entitled Home Leave country and/or city),  
 Exact dates/hours of travel for staff member, spo use and 
dependent children,  
 Number of days spent in country of Home Leave (automatic 
check),  
 Age of dependent children entitled to Home Leave (automatic 
check),  
 Minimum number of months (12) elapsed between return 
from one home leave and departure on the n ext (automatic 
check),  
 Minimum number of months of service (18) at the date of 
Home Leave departure (automatic check),  
 Minimum number of months (6) of employment contract at 
date of return from  Home Leave (automatic check).  
The system should provide a warn ing message to the HR Staff Services 
whenever at least one of the above -mentioned controls is not fulfilled.  Medium  HRD /ITSD  31/06/18  Management concurs with this 
recommendation . However, this 
concurrence is confined to the need to 
establish the controls above . The suggestion 
that these controls should specifically be 
done in MobileXpense is too prescriptive.  
The feasibility of adding new functionalities 
on MobileXpense has to be discussed with 
the Director of ITSD . He may come up with 
other alternatives t o take action based on 
this recommendation.  
 
__________