RESTRICTED  
  
WT/BFA/W/ 320 
 
4 February  2014 
(14-0649) Page: 1/4 
Committee on Budget, Finance and Administration   
 
 WTO  SECRETARIAT  RISK MANAGEMENT SYST EM 
1  BACKGROUND  
1.1.  This document presents  for information to the Committee on Bud get, Finance and 
Administration  the key elements of the  risk management system  that has been implemented  by 
the WTO Secretariat  at the end of 20 12.  
1.2.  Risk management is a best practice in the area of governance and plays a key role in the 
internal control system of any organization.  
1.3.  The Secretariat  is generally  faced with limited risks in its day -to-day operations given the 
nature of its mandate, especially when compared to financial institutions or large project -based  
organizations .   
1.4.  The Secretariat implemented a risk management system dedicated for the Building Project in 
2008. A risk management policy for the entire Secretariat has been establi shed at the end of 2012  
with the objective to reinforce its internal governance structure . 
2  RISK MANAGEMENT APPR OACH  
2.1.  The Secretariat defines a risk as an event that may or may not occur and could have a 
detrimental impact upon the achievement of the Secreta riat's objectives if it were to occur.  
2.2.  The Secretariat adopted  a risk management policy based on the following key principles:  
 The management of risks is an integral part of the Secretariat's governance process.  
 Risks that could potentially affect achievem ent of the Secretariat's objectives are identified, 
analysed and monitored. A risk register of the key risks faced by the Secretariat is 
maintained and regularly reviewed and updated.  
 Appropriate risk mitigation measures are implemented to reduce risk expo sure to acceptable 
levels.  
3  RESPONSIBILITIES  
3.1.  The Deputy Director -General in charge of Administration is responsible to:  1) Supervise the 
Secre tariat's risk management system ; 2) Submit to the Director -General at least annually a 
report with the key  risks fa ced by the Secretariat ; and 3) Alert the Senior Management at any time 
of serious and/or imminent risks that are identified.  
3.2.  A Risk Officer  has been appointed and  he is responsible to:  1) Consult regularly staff across 
the Secretariat to iden tify, analyse and monitor risks ; and 2) Maintain the Secretariat's risk 
register.  
3.3.  Any staff member wishing to bring a perceived risk to the attention of the Secretariat can 
contact the Risk Officer or the Deputy Director -General in charge of Administration.  
3.4.  A Risk Owne r is assigned for each risk included in the risk register. The Risk Owner is usually 
the division that manages directly the risk and is best place d to execute a mitigation plan.  WT/BFA/W/ 320 
 
- 2 - 
 
  4  RISK MANAGEMENT PROC ESS 
4.1.  The purpose of the risk management process is to ensur e that risks are addressed at the 
earliest possible time and that action plans are developed to reduce the likelihood of a risk 
adversely affecting achievement of the Secretariat's objectives.  
4.1  Risk Identification  
4.2.  The identification of risks takes place th roughout the year. Risks can be identified by any staff 
and reported to the Risk Officer. The Risk Officer regularly meets with management and staff to 
discuss and identify risks that the Secretariat is potentially facing.  
4.2  Risk Analysis  
4.3.  The Risk Officer, after consulting with the Risk Owner, propose s a score for each risk 
according to the following formula:  Likelihood x Impact = Score.  
Risk Scoring Matrix  Impact  
if the 
event 
occurs  High (3)  Moderate  3 High 6 Critical  9 
Moderate (2) Low 2 Moderate  4 High 6 
Low (1)  Low 1 Low 2 Moderate  3 
 Low (1)  Moderate (2)  High (3)  
Likelihood  of the event occurring  
 
4.4.  The analysis of  a risk event is assessed based on the likelihood of the risk event occurring 
and the impact should the risk event occur s. The likeliho od and impact are assessed on three 
levels: Low, Moderate or High.  
Risk Likelihood  
Low  An event may occur at some time  
Moderate  An event will probably occur in  many circumstances  
High An event is expected to occur in most circumstances  
 
4.5.  The impact of a particular event is measured based on the potential damage to the 
credibility, reputation and the capacity of the Organization to fulfil its mandate.  
Risk Impact  
Low Less significant impact on main activities, reputation, or funding status  
Moderate  Significant impact on main activities, reputation, or funding status  
High Serious impact on main activities, reputation, or funding status  
 
4.6.  The scoring process includes a certain amount of subjectivity. Therefore the risk score only 
provides an indication of the relative importance of each risk identified.  
4.7.  The risks that have a score of 6 (high) and 9 (critical) may involve a substantial financial risk 
to the organization.  
4.8.  The Risk Officer also categorizes each risk according to one of the following type:  financial , 
management , occupational safety and health in the workplace (OSH) , compliance (with regulations 
such as the WTO Financial Rules & Regulations, Staff Rules & Regulations, or Procurement Policy 
and Procedures ), political  or technological . 
4.9.  The Risk Register provides the risk score and type for each identified risk.  WT/BFA/W/ 320 
 
- 3 - 
 
  4.3  Risk Monitoring  
4.10.  The monitoring of risk requires first determining actions that can be taken to mitigate risks. 
The following are possible risk treatment options  or mitigating measures:  avoid (prevent) , accept , 
reduce likelihood , reduce impact  or transfer . 
4.11.  The Risk Officer then maintains and regularly updates a register of major risks faced by the 
Secretariat.  
4.12.  The Deputy Director -General in charge of Administration reviews and endorses the r isk 
register, including the actions taken to mitigate risk. He/She submits to the Director -General at 
least annually a report with the key risks faced by the Secretariat. He/She also alerts Senior 
Management at any time of serious and/or imminent risks tha t are identified.   
5  PROGRESS UPDATE   
5.1.  During the first year of implementation the organizational -wide risk management system, t he 
Secretariat identified some  60 risk issues.  
5.2.  Management has reviewed the risk register and the risk management policy. The polic y has 
been slightly  updated to provide greater clarification in the risk management approach to be used.  
5.3.  The Deputy Director -General presented the risk register  as it stands at the end of 2013  to the 
Director -General  in January 2014.  
6  CRITICAL RISKS IDENT IFIED AT THE END OF 2 013 
6.1.  The comprehensive risk register remains an internal management tool and is not designed to 
become an official document publicly available. The Secretariat is ready to share it with Members 
that may ask for it. The Secretariat is pre senting in the table below  only the critical risks ; those 
risks that have a both a high likelihood of occurring and a high impact if they occur. They have the 
highest risk score of 9. Out of the 60 risks contained in the risk  register at the end of 2013 , the 
following 6 risks are considered as critical .   
Critical Risks identified at the end of 2013  
FINANCIAL RISKS  
1. Inability to finance the actuarial deficit of the WTO Pension Plan  
2. Inability to finance the actuarial deficit of the After Service Healt h Insurance (ASHI)  
TECHNOLOGICAL RISKS  
3. Targeted skilled cyber -attack, advanced persistent threat  
4. Loss or theft of mobile devices (laptops, smartphones, removable storage) containing highly 
sensitive information  
5. Compromise of a staff member's p assword, remote access to the WTO internal information  
6. Human engineering attacks tricking staff members into revealing sensitive internal information  
 
6.2.  The two financial risks are related to the funding situation of the pension plan and health 
insuranc e. They were already identified as part of the financial statement presented in the last 
three years. The Committee on Budget, Finance and Administration will examine those issues in 
more details in the course of 2014.  
6.3.  The four technological risks are all related to IT security. The Secretariat has reinforced its 
human and technological resources in the area of IT security in 2013 and will continue in 2014 to 
reduce the likelihood of an event occurrence  and its impact.   WT/BFA/W/ 320 
 
- 4 - 
 
  7  NEXT STEPS   
7.1.  The Secretariat will con tinue in 2014 to further develop its risk management capabilities 
throughout the Secretariat in order to more comprehensively and rapidly identify the risks that it 
faces.  
7.2.  The Secretariat will continue to provide an annual update on risk management to the  
Committee on Budget, Finance and Administration. It will also propose to include references to risk 
management as part of the foreseen revision of Financial Regulations.   
 
__________