RESTRICTED  
  
WT/BFA/W/ 439 
 
5 March  2018 
(18-1297) Page: 1/12 
Committee on Budget, Finance and Administration    
 
 WT/BFA/W/422  
- 1 - 
 
OFFICE OF INTERNAL OVERSIGHT  (OIO)  
STATUS OF INTERNAL AUDIT RECOMMENDATIONS  
(FEBRUARY 2018)  
1.1.  Some Members requested that the Committee on Budget, Finance and Administration ( CBFA) 
be provided with an update of the implementation of the recommendations propo sed in the audit 
report of Home Leave entitlements1 in early 2018.  
1.2.  This document presents for information to the CBFA the  current status of implementation of 
the internal audit recommendations. Please note that t he annual report of the Office of Internal 
Oversight (OIO)  will be presented to the CBFA in June 20182.  
1.3.  As requested by the Institute of Internal Auditors (IIA), the OIO has established a follow -up 
register to monitor and ensure that management actions have been effectively implemented or 
that seni or management has accepted the risk of not taking action (IIA Standard 2500.A1 – 
Monitoring Process ). This follow-up register is updated regularly, based on input collected from the 
concerned Divisions.  
1.4.  The recommendations proposed by the OIO are aimed to strengthen accountability 
mechanisms, internal controls, compliance, value -for-money, and good governance  in the WTO 
Secretariat. The timely implementation of these recommendations facilitates changes for 
improvements in organizational efficiency and effec tiveness.  
1.5.  The current status of the audit recommendations is detailed in Annex 1 of this document  - 
Status of Audit recommendations ( February  2018). 
1.6.  Based on the supporting information received from  the concerned Divisions , 12  
recommendations  have been suc cessfully closed since June 2017. As of February 2018, 
Management has implemented 75% of the internal audit recommendations :  
 31 out of the 33 (9 4%) recommendations related to Sick Leave Management have been 
implemented;  
 8 out of the 19 (42%) recommendati ons on IT Security  are now closed ; and 
 8 out of the 11 (72%) recommendations on Home Leave Entitlements  have been closed.  
1.7.  The audit recommendations still pending to be closed  are detailed in Annex  2 - Audit 
recommendations pending to be closed.  
1.8.  The OIO wou ld like to commend the work done by the Human Resources Division (HRD)  for 
prompt ly implemen ting the recommendations contained in the internal audit report on Home 
Leave Entitlements. Furthermore, HRD has prepared a  new Home Leave and Family Visit Policy, 
which incorporates the recommendations  proposed by the OIO . The new policy is currently in the 
last phases of its finalization . 
                                                
1 Report OIO-IA-2017-01 - Home Leave Entitlement s, 20 June 2017 . 
2 The Administrative Memorandum No.974  (OFFICE(15)/101 – Office of Internal Oversight , 
30 November  2015) indicates that the Office of Internal Oversight (OIO) shall report annually to the CBFA, 
providing an overview of its activities durin g the year .  WT/BFA/W/439  
 
- 2 - 
  
  1.9.  The OIO will continue closely monitor ing the implementation of the internal audit 
recommendations.  
 
_______________  
 
    
   WT/BFA/W/439  
 
- 3 - ANNEX 1:  STATUS OF AUDIT RECO MMENDATIONS (FEBRUAR Y 2018 ) 
 
 
 
STATUS OF AUDIT RECOMMENDATIONS  
Audit Activity  Report 
year Total number of 
recommendations  Number of High 
recommendations  Implementation status as 
of 01.06.2017  Implementation status as 
of 01.0 2.2018  
        % Closed  WIP Open  Closed  WIP Open  
Sick Leave Management  2014 33 26 79% 30 0 3 31 2 0 
IT Security  2014 19 5 26% 5 10 4 8 9 2 
Home Leave Entitlements  2017 11 2 18% 0 0 11 8 1 2 
Totals  - 63 33 52%  56%  16%  29%  75%  19%  6% 
 
   
   WT/BFA/W/439  
 
- 4 - ANNEX 2: AUDIT RECOMMEN DATIONS PENDING TO B E CLOSED  
 
A) SICK LEAVE MANAGEMENT  
Audit recommendation  Audit 
category  Implementation status as reported 
by the implementing Division  
(11 January 2018 ) Status  OIO's comments  
26. The Medical Service  and HRD should r econcile 
the data re corded in Oracle with CHIMED on sick 
leave to ensure that it is accurate, consistent and 
reliable for reporting to various stakeholders ; and 
that any variances are justified.  Operational  CHIMED is made to record the work 
done by the Medical Service  (e.g. h ow 
many medical certificates are received) . 
It provides a broad idea of the number 
of days under Sick Leave but it is not 
efficient for obtaining statistics on Sick 
Leave (e.g. it does not allow calculating 
hours or half days of absence) . 
Therefore the sys tem need s to be 
modified  / replaced . 
 
A new software - Préventiel - has been 
identified and selected  by the Medical 
Service  and HRD . The implementation of 
Préventiel is planned for Q1 -Q2 2018. As 
part of the implementation project, the 
data recorded in Ora cle will be 
reconciled with the information 
contained  in Préventiel.  
 W.I.P  The recommendation will be closed when the  
implementation project of the  new software - 
Préventiel – will be completed . 
28. ITSD should provide HRD with a solution to 
facilitate o wnership, accountability, management 
and reporting of data ; and provide appropriate 
training to HRD staff to ensure their independence 
in using the solution.  System  
 ITSD, HRD and LDIMD are now using 
the new functionality developed in 
Oracle for Divis ional Assistants to report 
sick leave (directly in the system ). This 
functionality will be extended to other 
Divisions in 2018.  
 W.I.P  The recommendation will be close d once the 
Oracle functionality is extended to all Divisions.  
   
   WT/BFA/W/439  
 
- 5 - B) IT SECURITY  
Audit recommen dation  Audit 
category  Implementation status as reported 
by the implementing Division  
(18 January 2018 ) Status  OIO's comments  
4: It Security Governance: GOV 04 – Risk 
management process.  
 
The Information Security function should regularly 
review the risk register to ensure that information 
security risks are adequately and promptly 
identified. Based on that review, the IT Security 
function should:  
1. determine where an IT security response 
should be applied;  
2. Ensure that the appropriate IT security 
respo nses are included in the 'proposed mitigation 
measures' section;  
3. Ensure that the IT security responses are 
adequately implemented and are operational.  
 Operational  Agree with the recommendation.  
 
Information Security risks were included 
in the Enterpri se Risk Management 
(ERM) yearly exercise, led by the WTO 
Risk Officer (in 2017).  
 W.I.P  The status of the r ecommendation remains 
unchanged until finalization of the IT risk 
register .  
5: It Security Governance: GOV 05 (a) – 
Inventory of WTO's key informat ion asset.  
 
The LDIMD and ITSD to coordinate creation and 
maintenance of an organization wide inventory of 
key information assets such as data, information, 
documents and publications. This inventory should 
include: definitions of the information asset 
owners' roles and responsibilities, the information 
asset classification level and the basic 
requirements in terms of control and monitoring 
of the information asset; the definition should 
take into consideration each Division that 
develops or has access to k ey information assets; 
The IT Security function should perform a security 
risk assessment, based on the list of key 
information assets, to determine the level of 
protecti on required for each key information 
asset.  
 Operational  ITSD partially agree with the  
recommendation:  Creation and 
maintenance of the inventory essentially 
require input from the owners of 
information assets, i.e. core operational 
divisions (as opposed to supporting 
divisions, such as ITSD or LDIMD). 
Therefore, such task should be 
mandated  and supervised by the 
Information Security steering body 
created as per GOV 01 
recommendations.  
 
19 June 2017: The key information 
assets inventory process has been 
initiated in 2016, but has not been 
completed, due to lengthy and 
ultimately unsuccessful attempt to 
recruit additional IT Security personnel, 
as recommended in high priority 
findings.  
 
18 January 2018: The recruitment 
process of the Information Security 
Analyst has been finalised. The W.I.P  19 June 2017: Recommendation unchanged, 
pending recruitment of Information Security 
Analyst.  
18 Janu ary 2018: The Information Security 
Analyst will work on the implementation of the 
recommendation.  
   
   WT/BFA/W/439  
 
- 6 - Audit recommen dation  Audit 
category  Implementation status as reported 
by the implementing Division  
(18 January 2018 ) Status  OIO's comments  
incumbent (already a WTO staff 
member) started full -time as  from 01 
January 2018. The incumbent will allow 
progressing with the inventory process 
and the implementation of the internal 
audit recommendations.  
 
6: It Security Governance: GOV 06  – Information 
security policies structure.  
 
Review the structure and completeness of IT 
security policies, standards, guid elines and 
procedures; define and enforce the various IT 
policies including Security policies, IT security risk 
assessment policy, Disaster Recovery policy, and 
Information Security risk assessment policy that is 
aligned with the risk management policy.  
 Operational  Agree with recommendation . 
 
19 June 2017: The Access Management 
and Control Policy has been introduced 
with ITSSC in Q4 2016. Further works 
on the policy are planned for 2017, with 
the tentative completion date by end 
2017. The final draft of th e 
Confidentiality Classification Policy has 
been approved by ITSSC and has been 
submitted to the Joint Advisory 
Committee for review and 
recommendations. This is a necessary 
step, as the policy enforcement would 
affect staff rules and responsibilities.  
 
18 January 2018: The Information 
Security Policy was finalised on 29  
September 2017. The Access Control 
Policy was approved by the ITSSC and 
will be submitted to the Director -
General for final approval.  
 W.I.P  31 July 2016: A combined IT Security and 
Informa tion Security risk assessment policy will 
be included and prepared.  A dry run will 
initially be carried out on the risk management 
process.  
 
18 January 2018: The Information Security 
Policy was communicated to all staff members.  
8: It Security Governan ce: GOV 07 – IT Security 
reporting to the WTO Management (Part II).  
 
Additionally, the IT Security function should:  
• Define and implement a set of metrics to be 
applied to the information security processes, 
based on the results of the risk assessment of key 
information assets;  
• Develop a comprehensive and consistent set of 
measures (Key Performance Indicator/ Key Risk 
Indicator) to drive its reporting activity, based on 
the defined metrics.  Operational  Agree with recommendation . 
 
The Information Security  Office has 
submitted for approval to the ITSSC the 
Security Operations Cent re Project, 
which will provide, inter alia, the 
objective information for defining the 
Key Performance Indicators.  W.I.P  The Security Operations Cent re Project would 
be in charge o f identifying  the Key Performance 
Indicators.    
   WT/BFA/W/439  
 
- 7 - Audit recommen dation  Audit 
category  Implementation status as reported 
by the implementing Division  
(18 January 2018 ) Status  OIO's comments  
9: It Security Governance: GOV 08 – WTO's IT 
security strategy.  
WTO should formally define its IT Security 
function's strategy and objectives, taking into 
consideration the results of the key information 
assets and its risk assessment;  
The IT security strategy should be reviewed to 
ensure it is aligned with the organization's 
business objectives.  
 Operational  Agree with recommendation . 
 
The IT Security function’s strategy and 
objectives were submitted to - and 
approved by - the ITSSC.  W.I.P  The status of the re commendation remains 
unchanged (t he OIO has not received copy of 
the document submitted to tie ITSSC ). 
10: It Security Governance: GOV 09 –IT Security 
function's objectives alignment with an IT security 
strategy.  
IT Security function should develop a clear set of 
its objectives that should be aligned with the IT 
security Strategy in Gov . 8 above.  Operational  Agree with recommendation . 
The objectives of the IT Security 
function have been identified b ut not 
formally documented. This will be done 
by the new Information Security 
Analyst.  OPEN  The status of the recommendation remains 
unchanged.  
12: IT Security Controls: ITSC -01: – Security 
configuration of the ERP system.  
 
The Security function should:  
 Define a  comprehensive and complete ERP 
system security baseline, based on the input of 
the Back -Office unit and the Oracle guidelines for 
system security;  
 Perform a comprehensive IT security review of 
the ERP configuration, including the application 
layer, the da tabase layer, the operating system 
layer, the network layer and the storage layer.  
 Back-Office unit should:  
• Change the default Oracle Database user 
profiles' security settings or assign a new, 
stronger security profile to all Oracle Database 
users;  
• Ch ange the default Oracle Database users' 
password setting and force password changes for 
the 228 users who still have the default password 
set. These settings should be aligned with the 
Windows password policy in place.  Operational  Agree w ith recommendation . 
 
All specific technical vulnerabilities of 
ITSC-01 have been addressed during 
the migration of the ERP system to the 
new version (completed Feb 2015).  
 
Vendor best practices ("Secure 
Configuration Guide for Oracle 
E-Business Suite Relea se 12") were 
adopted as a security configuration 
baseline.  
 Not 
Applica
ble  19 June 2017:  The OIO has decided to include 
the security audit of the ERP system in its 
internal audit plan for 2017 -2018.  
 
18 January 2018: The OIO decided to include 
this topic on its Internal Audit plan for 
2018/2019 .  This recommendation will be 
subject to a separate internal audit.    
   WT/BFA/W/439  
 
- 8 - Audit recommen dation  Audit 
category  Implementation status as reported 
by the implementing Division  
(18 January 2018 ) Status  OIO's comments  
• Review the list of the E -business a nd Oracle 
Database user accounts and remove the user 
accounts if they are not used;  
• Perform a comprehensive security review of the 
ERP including the business processes controls 
required for the protecti on of the WTO's financial 
data. 
 
14: IT Security Controls: ITSC -03 – User account 
management  
Review users' access rights and restrict these to a 
minimum. Additionally, IT Security  unit should 
periodically review the user accounts and access 
rights to the information processing systems and 
applications to ensure they are appropriate and in 
line with the list of WTO's staff. This review should 
be initiated by the IT Security function  and 
completed by the units responsible for those 
systems.  
Finally, a form should be developed for the 
creation, modification and removal of user 
accounts within the systems (e.g.  Windows Active 
Directory). This form should be formally reviewed 
and signed off by the business process owner and 
the Human Resources Division.  
 Operational  Agree with the recommendation . 
 
The Access Control Policy was approved 
by the ITSSC and will be submitted to 
the Director -General for final approval.  
 W.I.P  The status of the recommendation remains 
unchanged.  
15: IT Security Controls: ITSC -04 – Segregation 
of duties (SoD) control framework  
The WTO's Back -Office unit and the IT Security 
function should:  
1. Define a SoD framework, taking into 
consideration that the security requ irements must 
be balanced with resource availability (e.g. a 
back-up person for a specific function must be 
attributed the appropriate access rights to perform 
back-up operations);  
2. Define a procedure for managing exceptions to 
the SoD framework. This pr ocedure should include 
the formal documentation of deviations from the 
SoD framework and formal validation by the Operational  Agree with the recommendation . 
 
The ERP segregation of duties will be 
addressed with HR, AGSD and ITSD 
following the outcome of the ERP 
security a udit (see ITSC -01 above).  OPEN  This recommendation will be implemented after 
the ERP security assessment. Next follow -up: 
31 December 2018.    
   WT/BFA/W/439  
 
- 9 - Audit recommen dation  Audit 
category  Implementation status as reported 
by the implementing Division  
(18 January 2018 ) Status  OIO's comments  
user's manager;  
3. Review the current configuration of the ERP 
roles and responsibilities (i.e.  ERP profiles) against 
the SoD framework to ens ure no conflicting rights 
be given to employees without prior validation 
from the user's manager.  
16: IT Security Controls: ITSC -05 – Monitoring of 
privileged users actions.  
Create nominative accounts for the 
administrators; design and implement a process 
to monitor privileged users' actions in the system.  System  Agree with the recommendation . 
 
Activity logs / alerts from important 
Linux -based systems are progressively 
integrated in the centralised log 
management s ystem.  
 W.I.P  The status of the recommendation remains 
unchanged.  
 
17: IT Security Controls: ITSC -06 – ERP system 
logs management and monitoring  
The IT Security function should provide input on 
which modifications should be logged, taking into 
account the  evidence requirements for incident 
management, the requirements for data privacy, 
the legal and regulatory environment and the 
protection measures for the collected evidence 
(e.g. storing the ERP application log files remotely 
on a different server that i s only accessible to the 
IT Security function).  
Secondly, the Back -Office unit should enable the 
audit log feature in the ERP for all the ERP 
modules that process key information, such as 
financial resources, payment information or 
vendor creation. Further , the log file should be 
kept in a separate database from the ERP where 
it`s access should be restricted to the IT Security 
function to ensure preservation of evidence in the 
event of an investigation or forensic analysis (e.g. 
in a suspected fraud activit y investigation).  System  Agree with the recommendation . 
 W.I.P  The Log feature was enabled on the ERP.  
Activity logs collection from ERP will be studied 
as part of SIEM (Security Information and Event 
Management) upgrade.  
Due to technical difficulties ERP audit logs 
cannot be shipped to the present log 
management server. Additional connectors will 
be required.  
 
18 January 2018: The status of the 
recommendation remains unchanged.    
   WT/BFA/W/439  
 
- 10 - Audit recommen dation  Audit 
category  Implementation status as reported 
by the implementing Division  
(18 January 2018 ) Status  OIO's comments  
18: IT Security Controls: ITSC -07 –Security patch 
management.  
The IT Security function should:  
1. Formalize quarterly patch and update 
processes; Perform a full technical security review 
of key servers to ensure any Windows weaknesses 
are not exploited;  
2. Develop and implement an emergency patch 
and update management process (for i mportant 
Security Updates) to ensure the patch level of 
infrastructure components is adequately controlled 
outside of the regular patch and update process.  System  Agree with the recommendation . 
 W.I.P  Procedures of regular security patching are 
documented and followed.  This ensures 
continuous mitigation of newly discovered 
security vulnerabilities across the Secretariat 
Information and Communication Technologies 
(ICT) systems.  
Emergency (out of cycle) patching is presently 
done on ad -hoc basis and remains  to be 
documented.  
 
18 January 2018: The status of the 
recommendation remains unchanged.  
 
 
C) HOME LEAVE ENTITLEMENTS  
Audit recommendation  Audit 
category  Implementation status as reported 
by the implementing Division  
(11 January 2018 ) Status  OIO's comment s  
1. The correct balance should be sought between 
the need to encourage use of the lump -sum and 
the need to ensure rational use of resources in 
order to achieve economy, efficiency and 
effectiveness in the process.  
Therefore, the OIO invites the Director  of the 
Human Resources Division to closely monitor the 
costs and benefits to the WTO of the lump -sum 
arrangement, taking into consideration the level 
of the cash incentives provided to staff by the 
lump-sum procedure; and to adopt any 
necessary adjustment s would the arrangements 
be considered as excessive.  Operational  - OPEN  Follow -up to be done in September 2018.  
   
   WT/BFA/W/439  
 
- 11 - Audit recommendation  Audit 
category  Implementation status as reported 
by the implementing Division  
(11 January 2018 ) Status  OIO's comment s  
10. The Director of HRD should prepare a 
detailed Home Leave policy considering the 
above -mentioned recommendations. This policy 
should be com municated to all employees of the 
WTO.   Operational  HRD has drafted the new Home Leave 
and Family Visit Policy (draft), which 
incorporates the above -mentioned 
recommendations. The draft policy was 
submitted to the OIO for review. The 
policy will be issued  once reviewed by 
the Joint Advisory Board and a pproved 
by the Director General.  
 WIP The recommendation is considered as WIP until 
final approval by the Director -General and 
communication to the staff members.  
11. The MobileXpense system should be 
config ured taking into account the above -
mentioned recommendations. In particular, the 
system should incorporate the following controls:  
• Confirmation of the Home Leave option chosen 
by staff member (lump -sum or reimbursement of 
actual expenses),  
• Confirmation  that the spouse does not benefit 
from home leave entitlements in another 
organisation  
• Actual country and city of destination (if 
different from entitled Home Leave country 
and/or city),  
• Exact dates/hours of travel for staff member, 
spouse and dependen t children  
• Number of days spent in country of Home 
Leave (automatic check),  
• Age of dependent children entitled to Home 
Leave (automatic check),  
• Minimum number of months (12) elapsed 
between return from one home leave and 
departure on the next (automa tic check),  
• Minimum number of months of service (18) at 
the date of Home Leave departure (automatic 
check),  
• Minimum number of months (6) of employment 
contract at date of return from Home Leave 
(automatic check).  System  The suggestion that these contro ls 
should specifically be done in 
MobileXpense is too prescriptive.   The 
feasibility of adding new functionalities 
on MobileXpense has to be discussed 
with the Director of ITSD. He may come 
up with other alternatives to take action 
based on this recommend ation.  OPEN  Follow -up to be done in July 2018.    
   WT/BFA/W/439  
 
- 12 - Audit recommendation  Audit 
category  Implementation status as reported 
by the implementing Division  
(11 January 2018 ) Status  OIO's comment s  
The system should provide a warning message to 
the HR Staff Services whenever at least one of 
the above -mentioned controls is not fulfilled.      
 
 
 
__________