RESTRICTED  
  
WT/BFA/W/389  
 
4 April 2016  
(16-1913)  Page: 1/38  
Committee on Budget, Fina nce and Administration    
 
 OFFICE OF INTERNAL OVERSIGHT AND ITS ACTIVITIES  
FOR THE PERIOD FROM 1 DECEMBER 2015 TO 29 FEBRUARY 2016   
 
1  BACKGROUND 
1.1.  This document presents for information to the Committee on Budget, Finance and 
Administration (1) the establishment of the Office of Internal Oversight (OIO) on 
30 November 2015 and (2) the  reporting of audit activities carried out by the Office of Internal 
Audit (OIA) for the period January to December 2014 and the progress on implementation of recommendations from 1 December 2015 to 29 February 2016. 
1.2.  Following the recommendations of the Exte rnal Auditors, the conclusions of the Working 
Group on Rules in the Strategic Review and the Jo int Working Group on Rules, there was a need to 
reinforce the independent status and expand the responsibilities of the OIA to include 
investigations within the WTO.   
1.3.  It is to be recalled that the OIA was established in March 2008.  The WTO Internal Audit 
Charter
1 was presented to the CBFA in July 2008. Th e functions exercised by the OIA are to be 
assumed by the OIO.   
1.4.  The OIO's terms of reference – its function al and independent status, its scope of work, the 
channels for submission of reports, and the authority vested in the OIO to fulfil its responsibilities - 
are presented from Sections 2 to 7 of this document.   
1.5.  The OIO presents from Sections 8 to 10 the internal audit activities, as follows:   
a. Status of audit activities as at 31 December 2013; 
b. New audit activities conducted as at 31 December 2014, namely: 
i.  A review of sick leave management and related circumstances 
ii. IT security audit which was outsourced to an external service provider 
c. Follow-up audits to verify actions taken by management to implement outstanding 
recommendations from previous audits; 
d. Ongoing audit on IT security;  
e. OIO Work Plan on internal audit; and 
f. OIO next activities.    
 
                                               
1 WT/BFA/W/175 dated 28 July 2008   WTO Internal Audit Charter. 
 WT/BFA/W/389 
 
- 2 - 
 
  2  SCOPE OF WORK OF THE OFFI CE OF INTERNAL OVERSIGHT  
2.1  Overview of Functions and Objectives     2.1.  The OIO assists the Director-General in fulf illing his internal oversight responsibilities in 
respect of management of staff and resources of the WTO by conducting investigations, audit, and 
other forms of assessment and reporting to the Director-General.    
2.2.  The OIO has the authority, ex officio or upon request, to initiate, carry out and prepare 
reports on investigations, audits, inspections and other evaluations, as it deems necessary to fulfil 
its responsibilities with regard to its oversight f unctions, consistently with the highest standards in 
oversight and with best practices in the field of oversight in international organizations. 
2.3.  The OIO aims: 
a. To promote financial efficiency and transparency through sound practices and 
procedures;   
b. To identify potential savings and recoveries;   
c. To identify and deter the occurrence of fraud, waste, abuse and misconduct;  
d. To reinforce a culture of accountability and strengthen the ethical climate within the WTO 
Secretariat; 
e. To ensure risk mitigation through a systematic analysis of the major risks confronting 
WTO assets and resources. 
2.2   Internal Investigations  2.4.   The OIO is the exclusive entity responsible for investigating allegations of violations of any 
WTO norm applicable to Staff members, irrespective of the nature of their contracts, and for 
transmitting to the Director-General
2 the results of such investigations together with 
recommendations on action to be taken. 
2.5.    Any such investigations must take place only on the basis of published investigation 
procedures.  Current provisional procedures for administrative investigations and disciplinary 
actions shall be further developed and finalised by the OIO and submitted to the Joint Advisory 
Committee, which shall make a recommendation to the Director-General. 
2.6.   The OIO shall not be involved in any way in the adoption of disciplinary measures taken 
further to an investigation conducted by the OIO.    
2.3   Internal Audit   2.7.  The OIO, in accordance with the relevant provisions of the Financial Regulations and Rules of 
the WTO and any other relevant norm, reviews the effectiveness of the use of financial resources 
of the WTO to implement activities within the Organization's mandates, ascertains compliance with the above norms as well as with the approved recommendations of external auditors, and 
undertakes management audits, reviews and surveys to recommend improvements to the 
structure of the Organization and its responsiveness to the requirements of its mandates.  It also monitors the effectiveness of the internal control systems of the Organization. 
2.4   Other Evaluations and Inspections  
2.8.  The OIO evaluates the efficiency and effectiv eness of the implementation of the mandates of 
the Organization, be it by the WTO itself or by publ ic or private entities mandated for this purpose.  
It conducts evaluations of activities with the purpose of establishing analytical and critical 
                                               
2 Or in the case of an alleged violation by the Dire ctor-General, a Deputy Director-General, or a member 
of the Office of the Director-General, the Chairs of the General Council and of the CBFA. WT/BFA/W/389 
 
- 3 - 
 
  assessments of the implementation of the Organiza tion's mandates.  It examines whether changes 
are required, the continued relevance of administ rative procedures, and whether the activities 
correspond to the WTO mandates as reflected in the approved budgets and the strategic and work plans of the Organization.  
2.5   Support and Advice to Management   
2.9.  The OIO may, upon request, advise managers on the effective discharge of their 
responsibilities, provide assistance to managers in implementing recommendations, and ascertain 
whether programme managers are given methodol ogical support.  The OIO may also encourage 
self-evaluation. 
3  INDEPENDENT STATUS OF THE OFFICE OF INTERNAL OVERSIGHT  3.1  Operational Independence 
3.1.  The OIO is an operationally independent office inside the WTO Secretariat. The Head of the 
OIO and other OIO staff will be functionally and operationally independent from the Secretariat and from WTO Members in the conduct of their duties. 
3.2.  The Head of the OIO and other OIO staff members are WTO staff members, subject to the 
WTO Staff Regulations and Rules as other WTO staff.  In the exercise of their duties, they may neither seek nor accept any instruction from any person or entity outside the OIO, whether this 
person or entity is within or outside the WTO. 
3.3.  An OIO staff member reports exclusively to the Head of the OIO. The term of office of an OIO 
staff member is non-renewable mandate of 5 years.  
3.4.    Neither the Director-General nor any other WTO staff member may seek to influence or 
otherwise interfere with the work of the OIO.  The Head of the OIO and other OIO staff must, at all 
times, ensure that their conduct is compatible with the objectivity and independence required by their functions. 
3.5.   The OIO shall coordinate with and seek the views of the WTO External Auditor on the OIO 
yearly audit plan, and other aspects of the OIO functions as necessary.  The Director-General may also request the opinion of the External Auditor on  the quality, cost and benefits of the services 
provided by the OIO.  On the basis of this opinion, the Director-General may initiate consultations 
with the Head of the OIO to agree on modification s or improvements in the services of the OIO.  
3.2  Appointment and Dismissal  3.6.  The Head of the OIO is appointed by the Di rector-General, after consultation with the Chairs 
of the General Council and of the CBFA.  The Head of the OIO must have the training and expertise 
generally required by comparable international organizations with oversight offices. 
3.7.   The term of office of the Head of the OIO will be five (5) years and will not be renewable 
under any circumstances.   His/her employment contract may be terminated for misconduct only 
as a result of a disciplinary investigation. Termination of his/her contract for any other reason is subject to the explicit agreement of the Chai rs of the General Council and of the CBFA. WT/BFA/W/389 
 
- 4 - 
 
  3.3  Disciplinary Measures  
3.8.  Should the need arise to investigate any allegation of misconduct on the part of an OIO staff 
member, including the Head of the OIO, the Director-General shall refer the matter to the WTO External Auditor.  The External Auditor will either investigate the matter itself or, if the matter at 
issue so requires, appoint an outside investigator reporting to it.  In carrying out an investigation, 
the External Auditor or the outside investigator, as the case may be, shall apply the WTO procedures for investigations and disciplinary matters mutatis mutandis . 
3.9.  The Director-General may apply disciplinary sanctions to the Head of the OIO or OIO staff 
member only on the basis of detailed written reco mmendations of the WTO External Auditor.  In 
such a case, the Director-General shall inform the Chairs of the General Council and of the CBFA for information that such sanctions have been applied. 
4  PROFESSIONAL STANDARDS  
4.1.  OIO staff members govern themselves by adherence to all relevant standards and best 
practices which are accepted and applied by other international organizations comparable to the 
WTO and abide by other relevant professional standards. 
5  REPORTING, FOLLOW-UP AND IMPLEMENTATION  5.1.  Following the completion of each audit, evaluation, inspection or investigation, the OIO shall 
submit a report to the Director-General, and to other staff members as appropriate.  If the 
Director-General, a Deputy Director-General or a me mber of the Office of the Director-General is 
the subject of the report, the OIO shall also submit  its report to the Chairs of the General Council 
and of the CBFA.   
5.2.  Upon receiving a report from the OIO, the Director-General will decide upon the 
implementation of the recommendations contained in that report.  The OIO shall provide a yearly summary report to the Director-General on the implementation of recommendations made by the 
OIO over that year, with a copy to the External Auditor of activities.  When a recommendation 
could not be implemented or could be implemented only in part, reasons should be provided by 
the services concerned.  
5.3.  The OIO shall report annually to the CBFA, pr oviding an overview of its activities during the 
year.  In respect to internal investigations, the OIO's reporting shall be limited to a summary of the number of internal investigations conducted.  The OIO may in that report indicate any circumstances that it considers may have affected its independence or otherwise impeded its 
ability to fulfil its functions.   
6   AUTHORITY VESTED IN THE OIO FOR THE PERFORMANCE OF ITS FUNCTIONS   6.1.   In the performance of its functions an d responsibilities, and in compliance with the 
applicable international standards, the OIO is authorised to: 
a. have full and unrestricted access to all WTO records (irrespective of their status and 
location), premises and property, as well as to all personnel (including the Director-
General and members of his office), and re quire all necessary assistance from them; 
b. have access to all third parties performing services delegated to them by the WTO, in 
accordance with contractual terms; 
c. require any staff member of the Organization to supply such information and 
explanations as may be needed; 
d. Be available to all staff who wishes, in good faith, to report on fraud or other forms of 
misconduct.  The OIO shall in all cases respect a staff member's wish for 
confidentiality and take appropriate action to protect that staff member. WT/BFA/W/389 
 
- 5 - 
 
  6.2.  Nothing shall require a WTO staff member to  breach his/her confidentiality obligations in 
respect to information protected by WTO dispute settlement procedures, or to reveal information protected by medical or legal privilege or provided  in confidence to the Staff Counsellor, Mediator 
or Staff Council member in the performance of his/her duties. 
6.3.  To ensure its impartiality and credibility, the OIO may not perform any operational duty or be 
involved in any activity which may be subject to any form of evaluation or audit, or which has been evaluated or audited by the OIO.  
7  STAFF RESPONSIBILITIES    
7.1.  The establishment of the OIO does not in any way relieve staff members of the 
responsibilities assigned to them.  Responsibility for accountability, complying with WTO norms applicable to all staff, regardless of contract status, rests with the respective staff members, 
supervisors and management. 
7.2.  The Director-General shall: 
a. Promptly inform the OIO of suspected cases of fraud or other misconduct involving 
WTO funds, records, property and staff; and  
b. Protect any staff member from retaliation or threat thereof for cooperation with the 
OIO. 
8  REPORT ON THE STATUS OF INTERNAL AUDIT ACTIVITIES   
8.1  Status of Audit Activiti es as at 31 December 2013 
8.1.  The 2013 annual internal audit report
3 was presented to the CBFA in July 2014 by the former 
Office of Internal Audit.   
8.2.  The Table presented on the next page highlights the seven (7) open audit activities with 
outstanding recommendations.  
                                               
3 WT/BFA/W/327 dated 29 April 2014.   Annual Report of the Office of Internal Audit (OIA) January – 
December 2013 (Y2013). WT/BFA/W/389 
 
- 6 - 
 
  Table 1  Summary of Open Audits as at 31 December 2013  
SUMMARY OF AUDIT ACTIVITY 
Audit Activity Audit year Total number of 
recommendations Significant % 
Significant 
Mission Travel 2009 23 21 91% 
Payroll 2010 25 21 84% 
Institute for Training and 
Technical Cooperation (ITTC) Administrative and Logistical Support Activities 2010 12 9 75% 
Cleaning and Maintenance 
Services 2011 31 24 77% 
Security and Safety Activities  2011 21 19 90% 
Consultants and Related Service  
Providers 2012 26 24 92% 
Tangible Assets and Consumables 2013 19 10 53% 
Total  as at 31.12.13   157 128 80% 
SUMMARY OF SIGNIFIC ANT RECOMMENDATIONS 
 Implementation status as at 31.12.2013 
Audit Activity Closed WIP Open Total 
Mission Travel 18 3 0 21 
Payroll  19 1 1 21 
Institute for Training and 
Technical Cooperation (ITTC) 
Administrative and Logistical 
Support Activities 8 1 0 9 
Cleaning and Maintenance 
Services 23 1 0 24 
Security and Safety Activities 18 1 0 19 
Consultants and Related Service 
Providers 11 6 7 24 
WTO Tangible Assets and 
Consumables 1 0 9 10 
Total as at 31.12.13 98 13 17 128 
% 77% 10% 13% 100% 
  
Audit Category Closed WIP Open Total % 
Operational  60 6 10 76 59% 
Compliance 22 4 3 29 23% 
System 8 2 4 14 11% 
Financial  6 1 0 7 5% 
Strategic 2 0 0 2 2% 
Total  98 13 17 128 100% 
8.2  New Audit Activities as at 31 December 2014    
8.3.  Based on the OIA biennial audit plan 2014-20154, the following activities were carried out 
during Y2014: 
a. A  review of sick leave management and related circumstances 
                                               
4 WT/BFA/W/327 dated 29 April 2014.  Annual Report of  the Office of Internal Audit (OIA) January – 
December 2013 (Y2013). 
 WT/BFA/W/389 
 
- 7 - 
 
  b.  An assessment of  IT security 
8.2.1  Audit Of Sick Leave Manage ment and Related Circumstances   
8.2.1.1  Background  8.4.  The objective of the audit was to assess the existing framework governing the recording, 
reporting, monitoring and general management of Certified Sick Leave (CSL) and Uncertified Sick 
Leave (UNCSL) at WTO for the period 2009 to 2 013 and 2014 where relevant and to identify 
opportunities for improving the Organization's discharge of its duty of care  to ensure a healthy 
workforce.  
8.5.  For better statistical analysis, these have been analysed separately.  CSL entails staff being 
absent solely due to illness and supported by a medical certificate. UNCSL does not require a medical certificate or prior approval and can be taken for 'other related circumstances' other than 
illness including personal obligations and family-related emergencies. 
8.6.  In addition, the audit did not cover the following: maternity and paternity leave; 
compensation in the event of service-incurred illne ss or injury under Annex 3 of the Staff Rules, 
neither did it cover any invalidity and disability aspects; activities related to WTO pension plan; 
activities related to WTO medical insurance scheme; OHS activities except those related to 
managing sick leave. The accuracy of staff entitl ements related to CSL was tested to the extent 
possible.  
8.7.  A questionnaire on sick leave management was given to staff of divisions with the highest 
rates of absenteeism due to sick leave compri sing 338 staff in total with a 33% (112 staff) 
response rate. Results of the questionnaire have been incorporated in this report where relevant. 
8.2.1.2  Summary Of Significant Audit Observations   
8.8.  A trend analysis was carried out to understan d the patterns of staff absence due to sick leave 
covering Regular and Fixed-Term staff  including L posts. Other categories constituting Short-Term 
staff and Interns were not  analysed because no data on them is recorded in  Oracle E-Business 
Suite (OEBS). 
8.9.  Analysis of Sick Leave 
a. Certified and Long-Term Sick Leave 
On average, for the audited period 2009 to 2013, 48% of Regular and Fixed–Term staff  
took CSL at least once in each calendar year for a duration ranging from 0.25 to 246.5 
working days ; for 19% of the staff, CSL was of long-term duration as illustrated in  the 
graph on the next page.  For purposes of this report, sick leave is considered to be of 
long-term duration if it is at least 21 consecutive working days.  Overall, the number of staff on long-term CSL  increased by 45% from 44 staff in Y2009 to 64 staff in Y2013.  
3% of expected total working days were lost to CSL. WT/BFA/W/389 
 
- 8 - 
 
  Graph 1   Number of Staff on Long-Term Sick Leave 2009 – 2013  
Data Source: HRD and ITSD  
During OIA meetings with Divisions, various reasons were cited for taking CSL, some of 
which result in long-term illness including: work conflicts and frictions between staff; 
stress; bullying, harassment, among others. These were underscored by various respondents to the questionnaire on sick leave management.  It is therefore important to monitor and manage staff on sick leave to ensure that causes are dealt with in a 
timely manner to avert long-term sickness and to detect any abuse in the use of sick 
leave.  
b. Uncertified Sick Leave  
On average, 73% of Regular and Fixed–Term staff took UNCSL at least once in each 
calendar year ranging from 0.25 to 8 working days. The overall high percentage of staff 
taking UNCSL can obviously be attributed to the purposes to which it can be applied, not 
only because of illness but also for family-related emergencies. Such flexibility in use is 
prone to abuse and needs to be monitored and managed. 
Additional analysis indicates that from 2009 to 2013, on average for each calendar year, 
1% of all expected working da ys were lost to UNCSL. 
c. By Category (Occupation, Gender , Type of Contract, Age)  
In general, as illustrated in the graphs on the next page, absence due to CSL and UNCSL 
is attributed more  to: female staff  than male staff; staff on regular contract  than those 
on fixed-term contract; and staff in age brackets 40-49 and 50+;  staff below  30 were 
noted to significantly take less sick leave with only 9-12 staff taking CSL and 10-16 staff 
taking UNCSL at least once in a calendar year. Furthermore, absence due to CSL is 
attributed more to  support staff  while professional staff  slightly outnumber support staff 
in taking UNCSL. It is therefore important for management to understand the 
demographics and to put in place an appropriate strategic plan to monitor and manage any foreseeable problems affecting th e health and well-being of staff. 
WT/BFA/W/389 
 
- 9 - 
 
  Graph 2    Analysis of Sick Leave by Category 2009 – 2013  
 
Data Source: HRD and ITSD  
 
d. By Division  
Taking into account  the Full-Time Equivalent work activity (FTE, 100%, 80% etc.) of 
each staff, the total expected annual working days per staff and the total number of sick 
leave days per staff, the average percentage  of working days lost due to sick leave 
(absence rate) per Division, was derived as illustrated in the graph below.  
Graph 3   Average Absence Rate by Division 2009 - 2013 
 
Data Source: HRD and ITSD  
 
8.10.  Recording of Sick Leave 
a. In order to manage the trends and patterns of sick leave and provide solutions to 
promote the overall well-being of staff, it is important to have accurate and consistent 
information. The audit noted partial data ownership, consistency and accuracy in sick leave data. Although HRD records sick leave data into Oracle, it requires ITSD’s 
intervention to integrate, analyse and extract data for various HRD needs which impacts WT/BFA/W/389 
 
- 10 - 
 
  the accuracy and integrity of data. On the other hand, the Occupational Health Service 
(OHS) equally records sick leave data, howe ver, a comparison of the two databases 
revealed significant variations which further impacts the overall reliability and integrity of information on sick leave and which could in turn affect any subsequent decisions by 
management.  
8.11.  Monitoring and Managing Sick Leave 
a. There are no detailed procedures and clear definition of roles and interaction between 
key stakeholders involved in the monitoring of staff members on sick leave as noted by 
the audit team and reiterated by some resp ondents. Nevertheless, follow-up and contact 
with staff on long-term sick leave is important as it may help in the early recovery and 
back-to-work of affected staff. T here is no detailed guidance or strategic plan on how 
staff on long-term sick leave should be monitored and managed, neither is there an 
early intervention plan. T he audit learnt that OHS and th e Staff Counsellor follow-up with 
staff members on long-term sick leave depending on whether or not concerned staff are 
willing to stay in contact with the Organization. It was also noted that in some cases, 
follow-up is either not available, insufficient, not systematic or not well coordinated.  
b. Although the Administrative Memorandum on  sick leave mentions that managers are 
encouraged to conduct back-to-office meetings with staff members who have been 
absent for prolonged periods, there is no guid ance or training currently offered on what 
and how this should be done and no indication on how the different stakeholders (supervisors, HRD, OHS) may interact in or der to have useful and effective back-to-
office meetings.  
c. Effective absence management requires the combined effort of key stakeholders, 
supported by a good information base but th ere is no evidence that all stakeholders, 
HRD, OHS, Divisions and Staff Counselor meet together to discuss cases of sick leave 
which are of concern. In the absence of these regular meetings, scheduling and planning to ensure continuity in the work of staff who are on sick leave may be challenging for 
divisions. In addition, absence of meetings  between OHS and Divisions may impact the 
duration of sick leave of staff as some divisions may be in a better position to provide solutions to the causes of absence and to facilitate a quick return-to-work of affected staff, most of all, if work-related.  
d. The lead time between paying a staff member salary and the time involved to receive 
reimbursement from insurance was found to be as long as 707 days, close to 2 years' delay. As at 31 December 2013, the amount receivable from insurance per entries in 
Oracle was CHF 131,857.  Late claims and receivables from insurance negatively impact 
the cash flow of the Organization.  
8.2.1.3  Summary of Significant Audit Recommendations  
8.12.  Management needs to take appropriate, timely, and informed decisions to prevent and 
detect abuse of sick leave and to institute measures to deal with work-related health problems before staff illness becomes long-term or turns into disability.  It is therefore necessary to make available  a comprehensive policy on sick leave management, with defined roles and responsibilities 
of different stakeholders and incorporating long-term sick leave and return-to-work guidelines to 
streamline the whole process and ensure a healthy workforce. 
8.13.  The OIA provided thirty-three (33) re commendations, twenty-nine (29) of which are 
significant in ranking. The significant audit recommendations - operational, compliance, system, 
and financial under the audit category - are illustrated in the table on the next page. WT/BFA/W/389 
 
- 11 - 
 
  Table 2  Audit of sick leave mana gement and related circumstances 
AUDIT OF SICK LEAVE MANAGEMENT AND RELATED CIRCUMSTANCES 
   
 TOTAL NUMBER OF ALL RECOMMENDATIONS     33 
  Implementation status as at 31.12.2014   
            
  Closed WIP Open     
Number of recommendations 0 0 33     
Total % as at  31.12.2014 0% 0% 100%     
            
SIGNIFICANT RECOMMENDATIONS BY AUDIT CATEGORY   
 NUMBER OF SIGNIFICANT RECOMMENDATIONS     29 
       
  Implementation status as at 31.12.14   
 Audit Category Closed WIP Open Total % 
Operational  0 0 19 19 66% 
Compliance 0 0 7 7 24% 
System 0 0 2 2 7% 
Financial  0 0 1 1 3% 
Total number of significant recommendations 0 0 29 29 100% 
Total % as at 31.12. 14 0% 0% 100% 100%   
8.14.  A summary of the 29 significant recommendations, action plans by respective Divisions, 
persons responsible for implementing the audit recommendations, and expected completion dates 
can be consulted in Annex 1 .  
8.2.2  Audit of IT Security  8.2.2.1  IT Security Assessment  
8.15.  After a competitive bidding process in line with WTO procurement guidelines, PwC was 
retained to carry out an audit of the WTO IT Security.   
8.16.  The objectives of the audit exercise were  to assess the effectiveness of its IT security 
governance model; to assess the design and the oper ating efficiency of its IT security controls and 
to evaluate the maturity level of the WTO’s IT security practices compared with the international standards for information security. 
8.17.  The scope covered includes: the review of the WTO IT security governance model, the 
review of the IT Security function’s activities, th e evaluation of a number of IT security controls 
and a maturity assessment based on the ISO 27001 information security standard. The following 
did not constitute the scope of the audit: a detailed assessment of all WTO systems configuration 
and the vulnerabilities that could affect th em across the whole WTO system and network 
environment; a risk assessment of all the WTO management and functional units; and an attack simulation to assess the robustness of the WTO IT systems and security controls. 
8.2.2.2  Summary of Significant Audit Recommendations  
8.2.2.2.1  IT Security Governance Review 8.18.  The WTO’s IT Security function has identifi ed and prioritised the key operational risks facing 
the WTO information systems. It performs the ac tivities to provide adequate control over the 
identified risks. However, a number of IT security  governance gaps that could result in the WTO’s 
information assets being put at risk without an adequate control being implemented were observed during the audit exercise.  
a. The WTO’s IT security scope is incomplete and does not cover comprehensively the 
overall security of the WTO’s information assets. Consequently, the respective responsibilities related to information security are not formally defined. Limiting the WT/BFA/W/389 
 
- 12 - 
 
  scope of security to IT technical security, and not having the wider concept of 
“Information Security” results in applying indistinctively the same level of security to all data and information managed by the WTO. Further, different types of information require different levels of security and confidentiality, and therefore different levels of 
effort applied to protect information against threats. 
b. The absence of an overarching IT security policy is another important IT security 
governance gap. The current IT security polici es do not follow a consistent structure and 
seem to be developed in reaction to changes within the organization and incidents, 
rather than according to a defined strategi c approach. The lack of an overarching IT 
security policy increases the risk of a misalignment between the IT security practices and the organization’s strategy and changes. Finall y, adopting a reactive approach to actual 
threats leads to the sub-optimal utilisation of IT security resources and puts the 
organization at risk. 
c. In comparison with similar organizations, the current WTO’s IT security staff is not 
adequate with the organization’s needs for the protection of its information assets. 
Additionally, it was noted that there is no pe riodic evaluation of the required resources 
for managing IT and information security at the WTO. With the current level of 
resources, it would be difficult for the IT Security function to fulfil its mission within the 
organization.  Therefore, with the limited reso urces available, WTO’s security is currently 
restricted to core areas (i.e. infrastructure, key systems) and would not necessarily be able to respond quickly enough to a threat (e.g. virus spread, cybe r-attack, or advanced 
persistent threat), thus increasing the time and cost necessary to recover from such a 
threat.  Finally, the lack of resources in the IT Security function limits its ability to merely reacting to threats, instead of being proactive and following a defined strategy 
and plan. 
d. In addition, a number of important security policies are missing, namely: an incident 
management policy, access management and control policy, an information classification 
policy, and a disaster recovery policy. An in complete set of IT security policies could 
expose the WTO to increased security risks be cause of wilful or accidental behaviour by 
WTO employees. 
e. There is no formal process defined for performing an Information Security and IT 
Security risk assessment. IT security objectives should be based on a comprehensive 
information security risk management process.  
8.2.2.2.2  IT Security Controls Assessment 
8.19.  Deficiencies were noted in the IT security controls over the ERP system (Oracle E-Business 
Suite), including the absence of segregation of duties controls, and deficiencies in the user accounts and access-rights provisioning processes with an increased risk that some WTO staff can 
cumulate access rights and therefore could perform unauthorised end-to-end operations over time.  
 
8.2.2.2.3  IT Security Maturity Assessment  
8.20.  It was observed that a number of organiza tional and operational controls already exist and 
that some activity has already taken place to formalise the current state of IT Security at the WTO. 
This includes, in particular, operations management, physical and environmental security and 
assets management.       
8.21.   It was, however, identified that a significant number of gaps exist between the ISO 27001 
'information security management systems (ISMS) ' standard requirements and the activities in 
place at the WTO. These gaps particularly concern the absence of a comprehensive and formal ISMS and the absence of an information security  performance evaluation, governance model and 
documented information. A number of opportunities  were identified for improvements focused on 
‘quick wins’ and achievable objectives, which would allow the WTO to enhance its Information Security framework and significantly reduce its IT environment risk exposure, while progressing 
towards ISO 27001 certification.   WT/BFA/W/389 
 
- 13 - 
 
  8.22.  The OIA provided twenty-five (25) recommendations, seven (7) of which are significant in 
ranking. The significant audit recommendations, un der the operational and system audit category, 
are illustrated in the table below.   
 Table 3  Audit of IT Security 
IT SECURITY AUDIT 2014  
      
 TOTAL NUMBER OF ALL RECOMMENDATIONS         25 
  Implementation status as at 31.12.14   
            
  Closed WIP Open     
Number of recommendations 0 0 25     
Total % as at 31.12.14 0% 0% 100%     
            
SIGNIFICANT RECOMMENDATIONS BY AUDIT CATEGORY  
 NUMBER OF SIGNIFICANT RECOMMENDATIONS         7 
            
  Implementation status as at 31.12.14   
 Audit Category Closed WIP Open Total % 
Operational  0 0 5 5 71% 
Compliance 0 0 0 0 0% 
System 0 0 2 2 29% 
Financial  0 0 0 0 0% 
Total number of significant recommendations 0 0 7 7 100% 
Total % as at 31.12.14 0% 0% 100% 100%   
 
8.23.  A summary of the 7 significant recommendations can be consulted in Annex 2 . 
8.3   Closed Audit Activities as at 31 December 2014   8.24.  Following the establishment of OIO on 30 November 2015, the Office focused on seven (7) 
"open" audits as at 31 December 2013.  All ou tstanding recommendations on 3 audit activities 
were implemented in Y2014, namely: ITTC Administrative and Logistical Support Activities, 
Cleaning and Maintenance Services, and Security and Safety Activities.   
ITTC ADMINISTRATIVE AND LOGI STICAL SUPPORT ACTIVITIES 
8.25.  One follow-up audit pertaining to ITTC administrative and logistical support activities was 
carried out to assess the implementation status of the outstanding significant audit recommendation which is of operational  type
5.  It relates to enhancing controls in the use of Short 
Term contracts in ITTC.  Two staff on short-term  c o n t r a c t  i n  E - L e a r n i n g  o f  I T T C  t h a t  w e r e  
previously earmarked for termination have been hired through competition to take-up Fixed-Term L-post positions for purposes of implementing the E-Learning Strategy.  All the recommendations under this audit, with significant and moderate ranking, were closed in 2014. 
CLEANING AND MAINTENANCE SERVICES 
8.26.  The only pending item was the staff sati sfaction survey under compliance category to 
provide more insight into the quality of cleaning services
6.  Following the satisfaction survey 
conducted in November 2014, 75% of staff members were satisfied with the services provided by 
                                               
5 Annex D ITTC Administrative an d Logistical Support Activities  - WT/BFA/W/327 dated 29 April 2014.   
Annual Report of the Office of Internal  Audit (OIA) January–December 2013 (Y2013). 
 
6 Annex E Cleaning and Maintenance Services  - WT/BFA/W/327 dated 29 April 2014.    
Annual Report of the Office of Internal  Audit (OIA) January–December 2013 (Y2013). 
 WT/BFA/W/389 
 
- 14 - 
 
  the new cleaning service provider.  With satisfactory survey results on quality control, this item is 
closed. 
SECURITY AND SAFETY ACTIVITIES 8.27.  The outstanding recommendation, which is of operational  category, relating to the 
requirement to have WTO investigation guidelines
7, was implemented and closed in 2014.  A 
"procedure for investigations and disciplinary actions" was issued on October 2014 and posted in the Online Administrative Manual as a Notice to the Staff. These guidelines complemented the 
policy on the use of video surveillance that is an integral part of security and safety at the WTO. 
8.4    Status of Follow-up Audits as at 29 February 2016 8.28.  At the end of year 2014, six (6) audit activities remained "open", namely: Mission Travel, 
Payroll, Consultants and Related Service Provider s, Tangible Assets and Consumables, Managing 
Sick Leave and Related Circumstances, and IT Security. 
8.29.  The OIO performed five (5) follow-up audits to verify the corrective actions taken by the 
management and staff to address reported issues from completed audit reviews.  The collaboration 
and assistance extended by the management an d staff contributed to significant additional 
efficiencies. 
MISSION TRAVEL 
8.30.  As at 31 December 2013, there were 3 outstanding significant recommendations
8 to be 
carried out by management.  
8.31.  Two significant recommendations belong to operational category, which were closed in 
2014.  This concerns the revised travel policy which was approved by senior management and the 
JAC, and issued in November 2014.  The revised travel policy aims to: enhance procedures and 
guidelines for the planning and reimbursement of official travel and related expenses; improve accountability, result in more efficient use of the WTO financial resources and more effective 
expense control.   
8.32.  The system  based recommendation, which is to provide a reliable tool to the OIA for 
extracting and analysing data independently and accurately, was dependent on the upgrade 
project of the Oracle ERP system.  In February 2015, this recommendation was partially 
implemented by Information Technology Solutions Di vision (ITSD) using the Qlikview tool for data 
extraction and specific reports. 
8.33.  In November 2015, ITSD started working on a new solution for travel and expense 
management needs.   New software called Mobile Xpense is scheduled to be operational in June 
2016.  This will include the following phases for WTO travel purposes: (1) travel request, (2) approval, (3) travel claim reimbursement, and (4) st andard reporting. Upon approval of the travel 
request, the Purchase Orders relating to air tick ets and per diem allowance will be created through 
Interface.  The travel claim reimbursements including advance recoveries will be accounted through Interface and the execution of payments through the Oracle Payables Module.   
8.34.  This new software solution will provide complete information on travel activities.  A set of 
standard reports will be available to support and facilitate informed decision-making, which closes this recommendation. 
                                               
7 Annex F Security and Safety Activities  - WT/BFA/W/327 dated 29 April 2014.    
Annual Report of the Office of Internal  Audit (OIA) January–December 2013 (Y2013). 
 
8  Annex B Mission Travel  - WT/BFA/W/327 dated 29 April 2014.   Annua l Report of the Office of Internal 
Audit (OIA) January–December 2013 (Y2013). 
 WT/BFA/W/389 
 
- 15 - 
 
  PAYROLL 
8.35.  As at 31 December 2013, there were 2 outstanding significant recommendations9 under 
operational  category.    
a. One significant audit recommendation concerns short-term contracts. The Director of 
Human Resources Division (HRD) has endo rsed the administra tive memorandum 
containing guidelines on the use of short-term contracts, including the criteria for assessing the need for renewal and the acceptable number of renewals, and putting in 
place controls to ensure that short-term contracts are used as intended. The 
administrative memo is under review by le gal counsel and will be released by summer 
this year. The guidelines already are practiced. Staff members on short-term contracts are eligible to apply for externally advertised vacancies but are no longer eligible for 
internal competitions as specified in a recently published administrative memorandum on 
vacancy notices.   
 
b. Another significant recommendation relates to the need to sensitize staff on WTO's core 
values and ethical behaviour. The audit recommendation pertains to an awareness 
training to address the treatment of sensitive and confidential information. HRD published a training manual and is available on the Intranet. As there is a necessity to 
train staff on a regular basis, HRD prepared the terms of reference for an E-Training on 
Standards of Conduct, in conjunction with the Learning Management Systems project.  A tender procurement process will be undertaken in summer this year with a view to the E-learning program going live by early 2017.  This enhanced Ethics training project will 
be revisited and will be included in the Audit Work Plan of the OIO.  
CONSULTANTS AND RELATED SERVICE PROVIDERS    8.36.  Thirteen (13) significant recommendations
10 remained pending for implementation as at 
31 December 2013, under financial (1), operational (4), compliance (6), and system (2).  
8.37.  In 2014, two recommendations were closed, namely:  
a. There has been operational improvement carried out by HRD in controlling and 
managing the movement of consultants and other staff (interns, short-term on daily or 
monthly appointment) between different types of employment contracts and the 
remuneration.  
b. HRD complied with the terms and conditions  of the IT Framework Agreement and the 
Learning Framework Agreement through competitive bidding process to achieve 
efficiency gains for the Organization. 
8.38.  Actions taken on the remaining significant recommendations falling under the above-
mentioned audit categories are described below:  
a. Financial  
i. Travel expenses pertaining to consultants, staff on short-term and regular/fixed-term 
appointments, are now identifiable for better analysis and decision-making by 
management.  
b. Operational and Compliance 
i. Special Service Agreements entered into  with consultants and related service 
providers are signed by the subscribers and the respective Divisions of the WTO.  No 
                                               
9  Annex C Payroll Audit  - WT/BFA/W/327 dated 29 April 2014.   Annua l Report of the Office of Internal 
Audit (OIA) January–December 2013 (Y2013). 
 
10 Annex G Consultants and Related Service Providers  - WT/BFA/W/327 dated 29 April 2014.    
Annual Report of the Office of Internal  Audit (OIA) January–December 2013 (Y2013). 
 WT/BFA/W/389 
 
- 16 - 
 
  payments are executed unless the contracts are properly signed and therefore 
binding. 
ii. HRD takes more ownership in the recruitment process of individual consultants and 
related service providers.  HRD prepared the revised guidelines on the use of 
individual consultants that were submitted to the legal counsel for review.  These 
guidelines contain the competitive selection process, contractual terms and conditions, and responsibilities of Directors of Divisions. Considering that the 
expected release of the enhanced guidelines' is before the end of this year, this area 
will be revisited to allow ample time for full implementation, to assess contract administration and compliance, to verify and assure that controls are in place, and to 
ensure value-for-money for the WTO.  
c. System  
i. HRD uses Excel software as an internal control mechanism to track individual 
consultants, which contains accurate and up to date data and is shared with the 
Procurement Service.   
ii. ITSD has integrated the population of Interns into the Human Resources 
Management System (HRMS) and are paid through the Oracle Payroll system. 
iii. There are two interrelated recommendations concerning a central database for 
consultants, panellists and Appellate Body members.   There is a delay in the implementation of a central register on this population as ITSD only completed the Oracle ERP Upgrade project in January 2016.  The new timeline on the development 
of the central database and integration into HRMS is envisaged by the ITSD team in 
year 2017 to manage the IT Project Plan priorities. HRD will further review and revise if necessary the existing Guidelines on Panellists and Appellate Body 
members. In view of these elements, this area needs to be revisited and included in 
the Audit Work Plan of the OIO. 
TANGIBLE ASSETS AND CONSUMABLES  
8.39.  Nine (9) significant outstanding recommendations
11 remained as at 31 December 2013, 
under operational (6) and system (3) categories. 
8.40.  Two operational  and one system recommendations were implemented in year 2014.   
a. Inventory and equipment belonging to the Security and Safety Section (SSS) that were 
previously registered in a stand-alone SSS database have been incorporated in the main 
inventory database called the Solution Facility Management (SFM) database managed by AGSD for better accountability, management and tracking.   
b. The broken door to the entrance of the securi ty control room has been replaced in order 
to safeguard video surveillance equipment. 
c. Security system controls at the ITSD data centre have been improved by activating 
badge readers and enhancing the video surveillance to provide a more secure 
environment. 
                                               
11  Annex A WTO Tangible Assets and Consumables  - WT/BFA/W/327 dated 29 April 2014.    
Annual Report of the Office of Internal  Audit (OIA) January–December 2013 (Y2013). 
 WT/BFA/W/389 
 
- 17 - 
 
  8.41.  Actions taken on the remaining significant recommendations falling under the above-
mentioned audit categories are described below:  
a. Operational  
i. The guidelines on Fixed Assets were approved in November 2014 by the Director of 
AGSD to streamline and facilitate the management and ensure proper accountability 
of assets.  The guidelines included the artwork and heritage assets under the responsibility of the Facility Management team. 
ii. AGSD and ITSD teams have reconciled inventory data and further improved the 
registration methods upon receipt of deliver y of goods, in accordance with the Fixed 
Assets guidelines.  Procedures are adhered on obsolete, lost, damaged or stolen computer equipment under the Asset Disposal policy.  
b. System  
i. Two inventory databases, the Service Desk Express (SDE) used by ITSD and the 
Solution Facility Management (SFM) used by AGSD, are used for registering, 
managing, tracking, and keeping an audit tra il of the physical location and existence 
of assets of the WTO.   
ii. ITSD and AGSD teams agreed that the best solution to merge the two databases is 
to select suitable external software that can be linked with the Oracle ERP.   This 
software will facilitate improvement of the process for inventory tagging, registering, depreciating, and reporting all tangible assets. 
iii. The financial implication of this single database project is estimated at CHF 40,000 to 
enhance the inventory management and in-house control of WTO tangible assets. 
This project of integrating the two database s into one database is foreseen to be 
completed by the first quarter of 2017.  In th is regard, this area will be revisited and 
included in the Audit Work Plan of the OIO.   
MANAGING SICK LEAVE AND RELATED CIRCUMSTANCES 8.42.  Twenty-nine (29) significant recommendations as at 31 December 2014 are presented in 
Annex I.  Steps taken to address significant issues and deficiencies are enumerated below:  
a. Operational    
i. The Sick Leave Management Committee (SLMC) was created on April 2015 to 
oversee cases of long-term sick leave and work-related illnesses or injury.  The SLMC 
is composed of HRD Director, Occupational Health Physician, Staff Counsellor, Head 
of HR Operations and Staff Services, and HRD focal point in charge of sick leave.  The SLMC meets on a monthly basis to discuss sick leave cases and to ensure that 
monthly statistics on absences are sent to Divisions concerned.  The long-term sick 
leave cases decreased by 50% from year 2015 to early 2016. 
ii. The Director of HRD issued in Septembe r 2015 an administrative memorandum on 
promotion of amicable resolution of disputes between staff members and between 
staff members and the administration (good offices, mediation, conciliation). A Mediator was selected and appointed from within the Secretariat effective October 2015 for a two-year period. 
iii. The new Office of Internal Oversight was established on 30 November 2015 and an 
Interim Head of the Office was appointed on 1 December 2015. 
iv. Staff have been made aware of sick leave policies and procedures through the WTO 
Employee Newsletter, which was sent to everyone's email address and published on 
the Intranet.      WT/BFA/W/389 
 
- 18 - 
 
  v. The Director of HRD has endorsed the dr aft of an updated policy on Sick Leave 
Management which was already submitted to the Legal Counsel for review.  The draft policy contains a clarification on the administration of different types of sick leave, including guidelines and procedures.    Considering that the expected release of the 
policy is 4th quarter of this year, this area will be revisited to allow ample time for 
full implementation, for assurance of internal controls and accountability mechanisms, and for assessment of compliance. 
vi. The Occupational Health Service (OHS) do es regular awareness campaigns through 
email communication, intranet use, and various workshops for staff members.  When necessary, the OHS physician and/or Director of HRD hold meetings with Division Directors and supervisors to discuss and assist in dealing with sick leave concerns 
and return-to-work situations. 
It is to be recalled that the Occupational Health Service (OHS) was established on 1 
March 2009.  WTO office document dated 25 February 2009 refers to a restructured 
Medical Service.  OHS report s to the Director of HRD. 
  
A staff survey was conducted in July 2015; however, feedback results indicated a 
misconception of the services offered by th e OHS.  In this regard, it is further 
recommended that (1) HRD organizes regular information and dialogue meetings to assist staff members familiarize themselves with the role and responsibilities of the OHS and (2) HRD conducts a follow-up surv ey to facilitate full evaluation and 
assessment on the WTO staff needs and ex pectations and the realignment of the 
OHS and its resources. 
  
HRD plays a key role in assisting the organization to provide duty of care  and take 
steps to ensure occupational health, safety, and wellbeing of its staff. 
 
b. Compliance 
i. HRD reinforced the monitoring of sick leave and complied with relevant Staff Rules 
and Regulations.    
ii. The OHS adheres to appropriately using an external medical practitioner to 
corroborate medical certificates and ensure objectivity and independence in 
assessing the medical condition of staff, pr event and detect any abuse of sick leave, 
and determine cases of early return-to-work situations. 
c. System 
i. There are 2 interrelated recommendations concerning the Oracle database used by 
HRD and the CHIMED tool used by OHS.   The Oracle Leave Management system 
contains all types of absences while OHS inputs only certified sick leave data in the 
CHIMED system. 
ii. ITSD team proposed two action plans to st rengthen the management of sick leave.  
The first phase involves integration of short-term staff in the Oracle Leave 
Management system.  This includes staff on monthly and daily contracts, as well as 
Interns.  This phase was completed, including HRD training and testing.   
iii. The second phase includes automation of sick leave data and the interface between 
the Oracle and CHIMED databases.  This enhancement is necessary to validate and 
to reconcile the data on sick leave and to provide reliable reporting, and efficiency gains.   
iv. Based on IT Project Work Plan and Priorities, the second phase is envisaged in early 
2017 with the assistance of an external consul tant. The financial implication of this IT 
project is estimated at less than CHF 30,000. WT/BFA/W/389 
 
- 19 - 
 
  d. Financial  
i. Calculation of sick leave is applied consistently according to the agreed methodology 
with the insurance company.  Claims on receivables from the insurance company are now submitted on a timely basis and followed-up regularly. 
8.43.  In summary, the OIO will revisit and will in clude in the Audit Work Plan the following areas: 
(1) updated policy on Sick Leave Management, (2) a performance audit on OHS, and (3) automation of sick leave data and interf ace between OEBS and CHIMED databases. 
8.5  Ongoing Audit Activity  
IT SECURITY     8.44.  Subsequent to a competitive bidding process and in accordance with WTO procurement 
guidelines, the OIA retained the services of PwC, an external auditing service provider, to conduct 
an IT security audit covering WTO's IT security governance, IT risk management and operations.  
A maturity assessment of the IT security function was also performed and compared with the international standards for information security.   
8.45.  Seven (7) significant open recommendations as at 31 December 2014 are presented in 
Annex 2 of this document.   A follow-up audit will be performed by the OIO in the coming months 
and will coordinate with the External Auditor on the audit of IT Security. 
8.46.  The External Auditor started a performance audit on IT Governance in Y2014
12 and will 
continue to monitor the improvement of WTO's IT Security. 
9   OFFICE OF INTERNAL OVERSIGHT WORK PLAN ON INTERNAL AUDIT    
9.1  The areas earmarked for audit are risk area s derived from the WTO organization-wide risk 
register maintained by AGSD or Internatio nal Professional Practices Framework (IPPF) 
requirements. 
9.2  The OIO presents its Audit Work Plan in Anne x 3, which contains audit subjects presented by 
the OIA to the CBFA13.  These audit areas are: (1) resource management (output planning and 
reporting), (2) results based management for Trade Related Technical Assistance (TRTA), and (3) enterprise risk management (ERM).  
9.3  The OIO will revisit audit areas, namely: (1) Ethics and Standards of Conduct Training, (2) 
Guidelines on Short-Term Contracts (3) Guidelines on Overtime and Compensation Time, (4) Guidelines on Consultants, Panellists, Appellate Body Members, including ITSD central database, (5) Policy on Sick Leave Management, (6) Automati on of sick leave data and Interface between 
Oracle E-Business Suite and OHS CHIMED database s, (7) Occupational Health Service, and (8) 
Merger of Two databases into One database on Tangible Assets. 
9.4   The Audit Work Plan was communicated an d coordinated with the External Auditor.  
10  NEXT STEPS   
10.1.  The OIO is an independent office whose mandate is to assist the Director-General in fulfilling 
his internal oversight responsibilities in respect of the resources and staff of the Organization. The 
office aims to strengthen accountability mechan isms, internal controls, compliance, value-for-
money, and good governance  in the WTO Secretariat. The implementation of recommendations 
would facilitate changes for improvements in organizational efficiency and effectiveness. 
                                               
12 WT/BFA/W/368 dated 16 June 2015    Report of the Independent External Auditor on the Audit of the 
Financial Statements of the World Trade Organization (WTO) for the Year Ended 31 December 2014. 
13 WT/BFA/W/327 dated 29 April 2014    Annual Report of the Office of Internal Audit (OIA) January – 
December 2013 (Y2013). WT/BFA/W/389 
 
- 20 - 
 
  10.2.  The OIO will provide a WTO Internal Oversi ght Charter to the Director-General and to the 
CBFA.  This will constitute the framework within which the Internal Oversight function of the World 
Trade Organization will operate.    
10.3.  The OIO will draft working procedures which will govern the organization and operations of 
the OIO within its mandate and authority.  Those pr ocedures will comply with best practices in the 
field of oversight in international organizations.   These working procedures will be communicated 
to the Director-General and to the CBFA and published in the WTO's Online Administrative Manual 
before their entry into force. 
10.4.  The OIO will continue to provide an annual update on its activities to the Committee on 
Budget, Finance and Administration.      
 
_______________ 
   
 WT/BFA/W/389  
 
- 21 -  ANNEX 1 SUMMARY OF SIGNIFICANT AUDIT RECOMMENDATIONS ON SICK LEAVE MANAGEMENT AND RELATED CIRCUMSTANCES 
Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
SENIOR MANAGEMENT       
1. Nominate a Joint Task 
Force/working group  to:- 
 
Develop a robust and well 
documented policy on sick leave 
management with detailed 
procedures and clear definition of 
roles and interaction between key 
stakeholders. The policy should also 
incorporate comprehensive 
guidelines on long-term sick leave, 
back-to-office meetings and other 
aspects of health and safety at 
WTO.  
 
Staff should be made aware of the 
policy and procedures. 
 
 
Look into the possibility of 
distinguishing family emergencies 
from short-term illnesses that do 
not require a medical certificate for 
better management and statistical 
analysis of absenc es due to illness. 
This might entail categorizing 
family-related emergencies under a 
different type of leave other than 
Uncertified sick leave; 
 
Subsequently review and update 
appropriate Staff Rules and Operational This is being reviewed and considered in 
liaison with relevant groups that are 
working on the WTO strategic review.  By 31.12.14 OPEN To assess status at the next 
follow-up audit in January 2015.  
  WT/BFA/W/389  
 
- 22 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
Regulations, and office documents.  
2. Formally designate an individual or 
committee to effectively oversee the operations of OHS. The 
designated individual/committee 
should also; 
 
Put in place a well-coordinated strategic plan for managing and following-up staff on long-term sick leave and provide management with feedback on its effectiveness 
and impact;  
 
Study and understand the causes and increases in absence due to illness so that appropriate solutions are put in place and appropriate action is taken to reprimand staff abusing the use of sick leave;  Ensure that OHS proposals and recommendations are effectively implemented; 
 
Etc.  
 Operational  This will be reviewed in depth in order to 
come up with the most appropriate solution. By 31.12.14 OPEN 
To assess status at the next 
follow-up audit in January 2015. 
3. Instruct an evaluation of the 
service rendered by OHS to 
determine if it is efficient, effective, 
still meets the needs of WTO and 
that WTO is getting value-for-
money from all the services 
provided. Subsequently review the 
working hours of the Occupational 
Doctor, if necessary.  Operational  To be discussed with the External 
Auditor   OPEN To assess status in Y2015.  
  WT/BFA/W/389  
 
- 23 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
4. As recommended by the 
Management working group on WTO’s  Strategic review, a number of issues that give rise to unwarranted absence due to sick leave e.g. unresolved work conflicts, could be solved by establishing an office of Ombudsman to provide a mediation and reconciliation platform for affected staff.  Operational  As already reported to the CBFA in 
September and in accordance with International standards, the office of an 
official mediator will be established
. 
 By  
31.03.2015 OPEN To assess status in Y2015. 
5. Establish a formal  Investigations 
office under the proposed Office of 
Internal oversight to handle 
problematic cases that give rise to 
a culture of absence, disobedience 
and insubordination. Operational As already reported to the CBFA in 
September, We will institute a wider 
mandate for the role of Internal Auditor 
to incorporate the additional functions of 
Evaluation and Investigation. This will 
happen when the mandate of our current 
Internal Auditor comes to an end in 
March 2015. 
 April 2015 OPEN To assess status in Y2015. 
HRD      
6. Take over full ownership and 
independent management of data 
that is recorded in Oracle from 
ITSD and periodically report useful 
and comprehensive information to 
Divisions including trends and 
patterns in the use of sick leave 
such as specific recurrent cases of 
sick leave at the approach of 
weekends; during or after annual 
leave or public holidays etc. to curb 
tendencies of abuse. Operational This will be further explored after the 
ERP upgrade.  Bernie 
Sheehan 
with focal 
point and 
ITSD  - 
April 2015 OPEN OIA in consultation with ITSD 
believes and recommends that 
this can be implemented earlier 
with ITSD's assistance since it is 
not dependent on the ERP 
upgrade. 
7. Data on  sick leave that is recorded 
in Oracle should cover all categories Operational This will be further explored after the ERP upgrade. Bernie 
Sheehan OPEN 
Noted, although OIA recommends 
that this should commence earlier  
  WT/BFA/W/389  
 
- 24 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
of staff including Short-Term staff 
and Interns for better tracking, more accurate, comprehensive statistical and trend analysis and better informed de cision making by 
management. 
 with focal 
point and ITSD  – end of 
2015 since it is not dependent on the 
ERP upgrade. 
8. Organize meetings with Directors 
and supervisors as necessary, to 
provide any required guidance on 
sick leave administrative 
procedures.  Operational This is already happening and more 
meetings and sessions will take place in 
the future.  Bernie 
Sheehan 
with OHS.   
April 2015 OPEN  Noted, to be verified during 
follow-up audits in Y2015. 
9. Remind staff of their 
responsibilities, obligations and the requirement for accountability and compliance with the procedures concerning sick leave. 
 As part of this process, send a reminder 
to Administrative Assistants to complete 
and submit weekly sick lists to HRD on a timely basis. The lists should include all staff known to be absent due to sick 
leave in order to promote data accuracy and accountability by staff.  Operational This message will be drafted and sent 
out shortly. Also more detailed instructions will be provided to Admin. Assistants stressing the importance of this data being completed accurately and on a timely basis. Bernie 
Sheehan with focal points –  Dec. 
2014 OPEN
 Noted, to be verified during the 
next follow-up audit in January 2015. 
10. Reinforce the monitoring of sick 
leave and comply with relevant 
staff Rules and Regulations notably 
charging to annual leave: any 
excess UNCSL days beyond the 
entitled 7 days; all other days for 
which staff are purportedly off sick, 
but which remain unaccounted for.  Compliance This issue will be explored further to 
identify problem and will be monitored 
more closely.  Bernie 
Sheehan 
with focal 
points –  Dec. 
2014 OPEN  Compliance with relevant Staff 
Rules and Regulations will be 
assessed during follow-up audits.  
  WT/BFA/W/389  
 
- 25 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
11. Review sick leave entitlements 
communicated to staff for accuracy and consistency to reflect the correct sick leave days and have them properly approved and re-published on the intranet. Compliance The entitlements will be reviewed and a communication will be published.  Bernie 
Sheehan with focal points  – April 
2015 OPEN
 To be verified during follow-up 
audits in Y2015. 
12. Ensure consistency in the 
methodology that is used to 
compute sick leave entitlements 
especially when de aling with cases 
of freezing annual leave 
entitlements. 
 Compliance The issue will be researched to ensure 
the methodology is correct.  Bernie 
Sheehan and 
focal points  
– Dec. 2014 OPEN  Noted for follow-up in January 
2015. 
13. Submit any outstanding claims 
arising from sick leave entitlements to insurance for payment on a timely basis and similarly follow-up 
any receivables that are due from 
insurance.  
If necessary send reminders to insurance.  Financial Claims will be proc essed in a timely 
manner and reminders sent to Insurance when necessary.  Bernie 
Sheehan and focal points – April 2015 OPEN
 To be verified during follow-up 
audits in Y2015. 
14. To promote transparency with 
reference to Staff Rule 110.3(v)-
(vi), Staff should receive 
communication  concerning the 
status of their sick leave 
entitlements on an annual basis at 
least for cases with 150 days and 
above.  Operational Staff members will receive an annual 
status of their sick leave entitlements 
when necessary.  Bernie 
Sheehan and 
focal points 
– April 2015 OPEN  OIA to assess implementation 
status during Y2015. 
OHS       
  WT/BFA/W/389  
 
- 26 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
15. Systematically submit reports on 
sick leave to senior management 
on an annual basis or as necessary, 
to ensure timely action is taken to 
mitigate any identified problems. 
The reports should have useful, 
consistent and comprehensive data 
and should distinguish between 
work-related and non-work-related 
absences to facilitate informed 
decision making by  management.    
 Operational OHS will be able to provide reports 
including causes of sick-leave when the 
necessary statistics tool will be effective. MBO OPEN  Noted, however, senior 
m a n a g e m e n t  s h o u l d  b e  a b l e  t o  
h a v e  a n  i n d i c a t i o n  o f  w h a t  t h e  
problems are even without the 
tool and well before an annual 
report since OHS receives medical 
certificates directly from staff 
(even medical reports when 
necessary). OHS should therefore 
find a way of providing senior 
management with regular 
feedback on staff health matters. 
16. Publish OHS annual reports on the 
intranet in an acceptable format to promote transparency and as a way of increasing awareness of OHS activities. Operational OHS is currently work ing on this subject 
with the intranet colleagues. MBO by the 
end of 2014 OPEN  Noted for follow-up in January 
2015. 
17. Carry out awareness campaigns 
and workshops on: occupational 
health and the role of OHS; when 
and for what staff may consult the 
Service; the extent to which OHS 
handles medical care etc. in order 
to overcome the disconnect 
between staff expectations and the 
mandated role of OHS. Operational OHS has been/is already working on this 
subject. 
 
The information about OHS activities, 
when and for what staff can consult 
OHS, etc. is already available on WTO 
intranet website. This includes the letter 
from DG Lamy explaining the change 
from “medical service” to OHS in 2009. 
 
Dr.MBO is currently  working with the 
intranet colleagues to create a better 
view of the information and to improve 
the OHS pages. 
 
At each hiring visit, for the past 6 years, 
both the doctor and the nurse explained 
the roles and activities of OHS and what 
staff can expect from OHS. MBO 
By the end of 
2014 
 OPEN  Noted, however it might not be 
enough to do so through the 
intranet, OHS could for instance 
also use the opportunity to do so 
when conducting workshops plus 
requesting for some time from 
Directors during their Divisional 
meetings to give a brief to staff 
on the role of OHS and to take 
questions and give the required 
answers.  
  WT/BFA/W/389  
 
- 27 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
18. Comply with Staff Rule 110.3 (iv) 
by appropriately using an external medical practitioner to corroborate medical certificates in order to: have a second opinion; ensure objectivity and independence in assessing the medical condition of staff; prevent and detect any abuse of sick leave; and determine cases of early return-to-work.  Compliance  MBO OPEN   
19. In compliance with the Staff Rules 
and Regulations, clarify to staff the 
criteria used to determine staff 
qualifying for periodic medical 
examinations by OHS and the 
procedure to be followed for the 
remaining staff including the 
frequency and by whom medical 
examinations are to be carried out, 
and outline the process of ensuring 
that this is complied with by all 
staff. Compliance This is explained on the intranet pages. 
OHS will try to provide better 
information on the website. OHS and 
intranet staff OPEN  In addition to using the intranet, 
OHS should also use other means 
to educate staff on this and other 
OHS matters as already indicated 
above. 
20. Identify, at an early stage, long-
term cases which may give rise to disability and recommend them to the pension plan for action. Compliance  MBO OPEN   
21. Ensure that meetings are held with 
Divisions on a regular basis and as 
needed to discuss staff on sick 
leave and absence patterns of 
concern. Operational  Since spring 2014, OHS is organizing 
meetings with Directors and HR focal 
points to discuss about collaborators on 
LTSL or collaborators at work with health 
problems and general health issues. OHS 
suggests making these meetings on a 
regular basis, 3 times a year for all 
divisions. MBO WIP Noted, to be verified in January 
2015.  
  WT/BFA/W/389  
 
- 28 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
 More time (more than 30% activity) is 
required for the doctor to enlarge the 
process and make it regular and 
periodic. DG should make it clear to 
divisions that this collaboration is 
mandatory. 
 
OHS AND HRD       
22. Organize formal training and 
workshops for Directors and 
Supervisors on how to: respond to 
the needs of staff who have 
medical issues that may impact 
their performance or lead to 
significant absences; conduct back-
to-work meetings with staff who 
have been absent for prolonged 
periods in order to reintegrate them 
into the work environment and help 
them adapt to work. Operational  OHS suggested this several times to 
HRD. I explained several times that I 
have a medical specialization on this 
very subject (both as an Occupational 
Physician and as a psychotherapist). 
They never answered positively. 
 MBO and 
Bernie 
Sheehan 
 OPEN Noted, for further follow-up in 
Y2015. 
23. Reconcile data that is recorded in 
Oracle and Chimed on sick leave to ensure that it is accurate, consistent and reliable for reporting to various stakeholders and that any variances are justified. 
 Operational  CHIMED stats tool is made to record the 
work done by OHS staff e.g. how many medical certificates are input by the admin. It provides a broad idea of the number of days under SL but is not efficient to perform stats on SL e.g. it does not allow calculating hours or half days of absence.  The numbers of medical certificates may differ through the OHS reports because a few certificates (up to 20-30 of them) are given to OHS by collaborators much after the time the stats are done  MBO and 
Bernie Sheehan  OPEN 
In order to have accurate 
information, OIA advises that OHS liaises with ITSD to see if Qlikview, the business intelligence tool which is to extract and analyse OHS data can be programmed to provide the required information (calculate hours, half days etc.). OHS s h o u l d  a l s o  b e  a b l e  t o  p r o d u c e  reports not only on an annual basis but quarterly for instance.  
  WT/BFA/W/389  
 
- 29 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
24. Enhance coordination and 
strengthen monitoring the use of 
sick leave by staff to prevent 
abuse; study sick leave trends for 
example staff taking CSL during 
annual leave. Operational   MBO and 
Bernie 
Sheehan 
 OPEN  
ITSD      
25. Provide HRD with a solution to 
facilitate ownership, accountability, 
management and reporting of data; 
provide appropriate training to HRD 
staff to ensure their independence 
in using the solution.  System After the upgrade of the OEBS to version 
12 (due early December 2014), a project 
will be launched to enhance the 
management of absences: Inclusion of 
all staff categories entitled to absences, 
Improvement of the production of lists 
and statistics, Automation of the 
management of sick leave and the 
creation of an interface between the 
OEBS and the system CHIMED used by 
OHS. Philippe 
Dalmas  
30 Jun 2015 
 OPEN 
 Noted for audit follow-up in 
Y2015. 
26. Provide OHS with a solution to 
analyse data using the OHS software (CHIMED) and to provide statistics on sick leave to management. The IT Administrator of the envisaged solution should sign an oath of confidentiality in order to comply with the confidentiality required in handling data on sick leave that is recorded in CHIMED.  
 System W e  h a v e  p r o p o s e d  t o  O H S  t o  u s e  Qlikview to analyse the data and to provide statistics on sick leave. The objective is to provide the same level of statistics that was done in the past with the capability to de velop new analysis. 
The data explored comes from CHIMED and will be anonymous (no staff name). Currently, I am the IT Administrator and I agree to sign an oath of confidentiality. Philippe 
Perreard  DEC-14  OPEN 
Noted, for audit follow-up in 
January 2015. 
DIRECTORS        
  WT/BFA/W/389  
 
- 30 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
27. Take initiative in monitoring staff 
on sick leave and with guidance from HRD, take appropriate action to prevent abuse of sick leave by staff in different Divisions.  Operational   OPEN  
28. Directors/supervisors should 
participate in training to be 
organised on sick leave 
management and how to conduct 
back-to-office me etings for staff 
who have been absent for 
prolonged periods. Subsequently, 
conduct back-to-office meetings 
with staff upon their  return from 
sick leave, as necessary 
 Operational   OPEN  
ALL STAFF       
29. Comply with staff Rules and 
Regulations by consistently ; 
reporting all absences to 
Administrative Assistants/line 
managers for more accurate 
recording and better monitoring of 
staff on sick leave; submitting 
medical certificates after the 
stipulated days ; reporting any 
prolonged absence to Directors and 
using sick leave as required to 
avoid abuse.  
 Compliance   OPEN  
 
  
 WT/BFA/W/389  
 
- 31 - ANNEX 2 IT SECURITY AUDIT- IMPLEMENTATION STAT US OF OUTSTANDING SIGN IFICANT RECOMMENDATIONS 
Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
SENIOR MANAGEMENT      
1. Create a working group, whose 
mandate will be to define the governance 
arrangements necessary to appropriately 
manage information security at the WTO. 
Such working group should typically include 
representatives of di visions who own or 
manage key information (i.e. information 
that generates value for the WTO, value 
being reputation, political, financial, human 
or other) for the WTO.  
As a starting point for this working group, 
we recommend the working group to 
perform a detailed review of information key 
to WTO. This review should at least include :  
a. the understanding of each key 
information lifecycle, from its 
creation to its disposal; 
b. The required confidentiality, 
integrity and availability level to 
be applied to the information 
(the results of this second point 
should be incorporated in WTO’s 
risk register whenever 
applicable). 
 The results of this estimation would then be 
used by the working group to recommend to Operational Agree with the recommendation Q1 2015  OPEN    
  WT/BFA/W/389  
 
- 32 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
WTO’s management: 
c. The type of steering committees 
that the WTO needs to manage 
the information security (e.g. 
information security could be 
managed through the existing IT 
steering committee, or through 
an Information steering 
committee or through an 
independent information security 
steering committee); 
d. The format and participants to 
the steering committee (e.g. a 
DDG leading the steering 
committee, with a representation 
of the different divisions who own 
or manage key information 
assets); 
e. The scope, powers and objective 
of the steering committee, 
including the performance 
measures of the steering 
committee. 
2. Once the type and format of the 
steering committee is defined and agreed by 
WTO’s management, we recommend that the steering committee: 
f. Defines an information security 
governance framework (e.g. an Information Security Management System as defined Operational Agree with the recommendation 
 Q1 2015  OPEN  
  
  WT/BFA/W/389  
 
- 33 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
in ISO 27001), which could be 
included in an overarching information security policy; 
g. Defines the necessary roles and 
responsibilities to manage information security and IT security within the overarching information security environment. Typically, the present IT security function’s role and responsibilities should be 
reviewed and potentially 
redefined, extended or incorporated into the broader information security scope, for it to be aligned with the newly defined information security governance framework; 
ITSD      
3. Once the information security policy 
and framework is defined, ITSD should:  
h. Define a high-level IT security 
policy covering all the activities performed by the IT Security function and based on the WTO’s information security risk environment. This policy should consider information assets in a broader business context to drive its IT security activities; Operational Agree with recommendation Q3 2015  OPEN  
  
  WT/BFA/W/389  
 
- 34 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
i. Define a process to review 
periodically this policy. The reviews should be based on  scheduled reviews (e.g. annually) and  occurrence-based reviews (e.g. following each major change to the IT environment, reported IT security incidents, results of assessments of IT security or changes to the information assets); 
j. Communicate the policy to the 
WTO employees via email and publish the policy on its internal website so that it is accessible to all WTO employees; 
k. Approve formally the policy and 
enforce it within the whole organization. 
4. We recommend that the WTO ITSD: 
l. Review the organization staffing 
requirements for IT security and 
take appropriate actions based 
on this review (e.g. hiring or 
contracting with external service 
providers); 
m. Define a process for the periodic 
evaluation of the IT Security 
function’s resource needs, based 
on the identified risks and the 
strategy and objectives defined Operational Agree with recommendation Q3 2015  OPEN   
  WT/BFA/W/389  
 
- 35 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
for the IT Security function. 
IT SECURITY FUNCTION      
5. We recommend that the Information 
Security function (defined following the 
recommendation under GOV-01) reviews the 
risk register on a regular basis to ensure 
that the risks related to information security 
are adequately identified.  
Based on that review, the WTO IT Security 
function: 
n. Review, on a regular basis, the 
information security risks 
identified, and determines where 
an IT security response should be 
applied; 
o. Ensure that the appropriate IT 
security response is included in 
the ‘proposed mitigation 
measures’ section; and 
p. Ensure that the IT security 
response is implemented and 
operational. Operational Agree with recommendation    
6. We recommend that the WTO’s IT 
Security function: 
q. Define a comprehensive and 
complete ERP system security System Agree with recommendation Q2 2015 OPEN    
  WT/BFA/W/389  
 
- 36 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
baseline, based on  the input of 
the Back-Office unit and the Oracle guidelines for system security; 
r. Perform a comprehensive IT 
security review of the ERP configuration, including the application layer, the database layer, the operating system layer, the network layer and the storage layer. 
BACK-OFFICE SYSTEM SECTION      
7. Additionally, we recommend that the 
WTO’s Back-Office unit: 
s. Change the default Oracle 
Database user profiles’ security settings or assign a new, stronger security profile to all Oracle Database users; 
t. Change the default Oracle 
Database users' password setting and force password changes for the 228 users who still have the default password set. These settings should be aligned with the Windows password policy in place at the WTO. 
u. Review the list of the E-business 
and Oracle Database user System Agree with recommendation Q2 2015 OPEN  
  
  WT/BFA/W/389  
 
- 37 - Significant Audit recommendation and Audit category 
(31 December 2014) Implementation status as reported by the 
implementing Division as at 31 December 2014  Audit implementation status and OIA 
Comments as at 31 December 2014  
 
Audit recommendation Audit 
category Status update Person 
responsible 
+ expected 
completion 
date Status Audit comments 
accounts and remove the user 
accounts if they are not used; 
v. Perform a comprehensive 
security review of the ERP including the business processes controls required for the protection of the WTO’s financial data; 
 
 WT/BFA/W/389 
 
- 38 - 
 
  ANNEX 3  AUDIT WORK PLAN 2016-2018 
 
Audit subject Source Audit  Scope/Objective Year/Time 
of Audit 
Follow-up Audit   
IT  Security   Previous audit 
recommendations Implementation status of previous outstanding 
audit recommendations    Ongoing 
2016 
Resource Management 
(Output Planning and 
Reporting) *  AGSD Global Risk 
Register  Alignment of resources to 
activities/outputs according to 
Organizational needs 
 The process of:  
o Allocating and accounting for 
work done by staff in different 
WTO Divisions to output areas 
and activities;  
o Allocating  expenditure to output 
areas and activities  
Data quality and accuracy    
RBM (Results Based 
Management) for Trade Related Technical Assistance (TRTA) AGSD Global Risk 
Register  Methodology of :- 
o Defining TA Activity objectives 
o Identifying Performance 
Indicators 
o Demonstrating Outcomes of 
TRTA activities 
RBM Monitoring & Evaluation (M&E)     
Enterprise Risk Management 
(ERM)  IIA Audit Standard 
2120  Risk Management Policy- adequacy and 
compliance 
 Process of : 
o identifying and assessing risks 
o Aligning with objectives of the 
Organization and risk appetite 
o Communicating  risk information 
o Monitoring and controlling or 
responding to risks   
 
Ethics and Standards of 
Professional Conduct Training  AGSD Global Risk 
Register  Ethics Program, Accountability 
Mechanisms,  Management Control, Compliance, Adequacy, and Effectiveness Assessment  
 
Guidelines on Short- Term 
Contracts 
 
Guidelines on Overtime and 
Compensatory Time 
 
Guidelines on Consultants, 
Panellists, Appellate Body 
Members, including ITSD 
Central Database 
 Previous audit 
recommendations 
 Management, Internal Controls, 
Accountability, Compliance assessment 
  
Policy on Sick Leave 
Management Previous audit 
recommendation  Management, Internal Controls, 
Accountability, Compliance assessment  
Occupational Health Service   
(OHS) Previous audit 
recommendation  Performance audit  (e conomy, efficiency, 
effectiveness assessment)    
Automation of Sick Leave 
Data and Interface between Oracle E-Business Suite (OEBS) and OHS CHIMED Databases Previous audit 
recommendation  Management monitoring and control, 
accountability, efficiency assessment  
One Database on Tangible 
Assets  Previous audit 
recommendation  Management monitoring and control, 
accountability, efficiency assessment  
Ad hoc audits, if any   To be determined  
*Dependent on status/availability of audit resour ces- to be re-assessed during the year.    
 
__________