RESTRICTED  
  
WT/BFA/W/361   
 
 
28 May 2015  
(15-2765)  Page: 1/5  
Committee on Budget, Finance and Administration   
 
 WTO SECRETARIAT RISK MANAGEMENT SYSTEM 
1  BACKGROUND 
1.1.  A risk management policy for the entire Se cretariat has been established at the end of 2012 
with the objective of strengthening its internal governance structure and its internal control 
system. This is in line with the best practices of any organization.  
1.2.  The policy - its purpose, approach, resp onsibilities and accountabilities, process - is 
presented as an Annex to this document.  
1.3.  References to risk management were includ ed in the revised Financial Regulations approved 
by the General Council in early 2015. 
1.4.  This document presents for information to the Committee on Budget, Finance and 
Administration the key elements of the risk  management system implemented by the WTO 
Secretariat at the end of 2014.  
1.5.  The Secretariat is faced with limited risks in its activities in comparison to project-based 
organizations and financial institutions.  
2  CRITICAL RISKS IDENTIFIED AT THE END OF 2014 
2.1.  During the second year of implementati on of the organizational-wide risk management 
system, the Secretariat identified some 16 new risk issues in the compliance, financial, and 
management categories. 
2.2.  Management has reviewed the risk register that now contains 75 risk issues and the updated 
evaluations following mitigation actions taken in 2014 with regard to some 30 risks.  
2.3.  The Deputy Director-General in charge of Administration presented to the Director-General 
the risk register as it stands at the end of 2014.  
2.4.  The comprehensive risk register remains an internal management tool and is not designed to 
become an official and publicly available docume nt. The Secretariat is presenting in the table 
below only the critical risks; those risks that have both a high likelihood of occurring and a high 
impact if they occur. They have the highest risk score of 9 which may entail a substantial financial risk to the organization. Out of the 75 risks contai ned in the risk register at the end of 2014, the 
following 3 risks are considered as critical.   
Critical Risks identified at the end of 2014 
FINANCIAL RISKS 
1. Inability to fully fund the actuar ial deficit of the WTO Pension Plan 
2. Inability to fully fund the actuarial defici t of the After Service Health Insurance (ASHI) 
TECHNOLOGICAL RISKS  
3. Targeted skilled cyber-attack, advanced persistent threat 
 
2.5.  The two financial risks relate to the difficu lty of fully funding the pension plan and the after 
service health insurance (ASHI) to meet its long term commitments.  It was decided during the WT/BFA/W/361 
 
- 2 - 
 
  February 2014 meeting of the CBFA to create a working group for ASHI to evaluate the funding 
situation and measures to reduce the risk exposure. 
2.6.  The Committee on Budget, Finance and Administ ration will continue to examine these issues.  
The WTO Pension Plan Management Board and the working group on ASHI will present the 
recommendations for remediation in the course of 2015. 
2.7.  A financial risk concerning a rise in the Swiss franc exchange rate against other major 
currencies bringing difficulties for Members' contributions was already identified in year 2013 with 
a low risk score.   This year, the risk was evaluated high, as the event occurred in 15 January 
2015 when the Swiss National Bank announced that it discontinued its strategy of holding the exchange rate threshold of 1.20 Swiss francs per Euro. The Secretariat communicated to the 
Committee on Budget, Finance and Administration on 2 February 2015 the impact of a strong 
Swiss franc currency
1.   
2.8.  A technological risk remains a critical issue in the area of IT security. The identified 
technological risk, the "targeted skilled cyber-attack, advanced persistent threat" remains a critical 
risk.  Treatment measures are in progress to redu ce the likelihood of an event occurrence and its 
impact.  
3  RISK MANAGEMENT PROCESS    
3.1.  In conformity with the risk manageme nt policy, the Risk Officer performed some 30 
qualitative interviews with key members of management in 2014. 
3.2.  The cross-divisional consultations enabled proactive discussions on the overview of the risk 
management system, the identification and re-a ssessment of a number of the risks faced by the 
Organization, the risk treatment and monitoring.  
3.3.   Some risks previously identified have materialized and were effectively addressed.  3.4.  The critical risks identified at the end of  2013 in the technological category were addressed, 
namely: (1)  loss or theft of mobile devices (laptops, smartphones, removable storage) containing 
highly sensitive information, (2) compromise of a staff member's password, remote access to the WTO internal information, (3) human engineering attacks tricking staff members into revealing 
sensitive internal information.   
3.5.  Appropriate actions were taken and operational controls were put in place to reduce the risk 
exposure in the IT Security domain.  Newly deployed laptops are systematically encrypted.  Encryption is also enforced on smartphones conne cted to the Organization's IT resources.    
3.6.  Concerning disclosure of a staff member's pa ssword, the second factor of authentication was 
implemented and enforced for remote access.  This risk is now closed. 
3.7.  With regard to human engineering attacks,  IT Solutions Division conducted an awareness 
programme for IT personnel in year 2014 to reduce the impact.  A comprehensive Computer-
Based Training (CBT) course on Information Security is planned for the entire staff of the organization. 
3.8.  The Information Technology Steering Committee meets regularly, including to discuss risk 
controls and solutions. 
4  NEXT STEPS  4.1.  The Secretariat will continue in 2015 to further develop its risk management capabilities 
throughout the organization in order to capture and to report significant risks in a timely manner.  
Regular monitoring of the risk landscape will help  identify emerging risks.  Risk treatment and 
control options will be evaluated on a cost–reward perspective. 
                                               
1  WT/BFA/W/350.  Information on Recent Currency Fluctuations and Potential Impact on the Financial 
Management of the WTO Secretariat. WT/BFA/W/361 
 
- 3 - 
 
  4.2.   The organization's risk management adds value to governance and to sound decision making 
of management. 
4.3.  The Secretariat will continue to provide an annual update on risk management to the 
Committee on Budget, Finance and Administration.  
 
 
 
 
 WT/BFA/W/361 
 
- 4 - 
 
  ANNEX 
RISK MANAGEMENT POLICY FOR THE WTO SECRETARIAT  
 
5  PURPOSE 
5.1.  This policy establishes the risk management system for the WTO.  Risk management is part 
of the internal control system established by the Secretariat. 
5.2.  A risk in the context of th is policy is an event that may or may not occur and could have a 
detrimental impact upon the achievement of the Secretariat's objectives if it were to occur. 
6  RISK MANAGEMENT APPROACH 6.1.  The Secretariat adopted a risk management policy based on the following key principles: 
a. The management of risks is an integral part of the Secretariat's governance process. 
b. Risks that could potentially affect achievement of the Secretariat's objectives are 
identified, analysed and monitored. A risk register of the key risks faced by the Secretariat is maintained and regularly reviewed and updated. 
c. Appropriate risk mitigation measures are implemented to reduce risk exposure to 
acceptable levels. 
7  RESPONSIBILITIES 
7.1.  The Deputy Director-General in charge of Administration is responsible to: 1) Supervise the 
Secretariat's risk management system; 2) Submit to the Director-General at least annually a report with the key risks faced by the Secretariat; and 3) Alert the Senior Management at any time of serious and/or imminent risks that are identified. 
7.2.  The Risk Officer is responsible to: 1) Consult regularly staff across the Secretariat to identify, 
analyse and monitor risks; and 2) Maintain the Secretariat's risk register. 
7.3.  Any staff member wishing to bring a perceived risk to the attention of the Secretariat can 
contact the Risk Officer or the Deputy Director-General in charge of Administration.  
7.4.  A Risk Owner is assigned for each risk includ ed in the risk register. The Risk Owner is usually 
the division that manages directly the risk and is best placed to execute a mitigation plan. 
8  RISK MANAGEMENT PROCESS 
8.1.  The purpose of the risk management proce ss is to ensure that risks are addressed at the 
earliest possible time and that action plans are developed to reduce the likelihood of a risk adversely affecting achievement of the Secretariat's objectives. 
8.1  Risk Identification  
8.2.  The identification of risks takes place throug hout the year. Risks can be identified by any staff 
and reported to the Risk Officer. The Risk Offi cer regularly meets with management and staff to 
discuss and identify risks that the Secretariat is potentially facing.  
8.2  Risk Analysis 8.3.  The Risk Officer, after consulting with th e Risk Owner, will propose a score for each risk 
according to the following formula:  Likelihood x Impact = Score. WT/BFA/W/361 
 
- 5 - 
 
  Risk Scoring Matrix Impact  
if the 
event High (3) Moderate 3 High 6 Critical 9 
Moderate (2) Low 2 Moderate 4 High 6 
Low (1) Low 1 Low 2 Moderate 3 
 Low (1) Moderate (2) High (3) 
Likelihood  of the event occurring 
 
8.4.  The analysis of a risk event is assessed ba sed on the likelihood of the risk event occurring 
and the impact should the risk event occurs. Th e likelihood and impact are assessed on three 
levels: Low, Moderate or High. 
Risk Likelihood 
Low  An event may occur at some time 
Moderate An event will probably occur in many circumstances 
High An event is expected to occur in most circumstances 
 
8.5.  The impact of a particular event is me asured based on the potential damage to the 
credibility, reputation and the capacity of  the Organization to fulfil its mandate. 
Risk Impact 
Low Less significant impact on main activities, reputation, or funding status  
Moderate Significant impact on main activities, reputation, or funding status 
High Serious impact on main activities, reputation, or funding status 
 
8.6.  The scoring process includes a certain amount  of subjectivity. Therefore the risk score only 
provides an indication of the relative  importance of each risk identified. 
8.7.  The risks that have a score of 6 (high) and 9 (critical) may involve a substantial financial risk 
to the organization. 
8.8.  The Risk Officer also categorizes each risk according to one of the following type: financial, 
management, occupational safety and health in the workplace (OSH), compliance (with regulations such as the WTO Financial Rules & Regulations, Staff Rules & Regulations, or Procurement Policy 
and Procedures), political or technological. 
8.9.  The Risk Register provides the risk  score and type for each identified risk. 
8.3  Risk Monitoring 
8.10.  The monitoring of risk requires first determ ining actions that can be taken to mitigate risks. 
The following are possible risk treatment options or mitigating measures: avoid (prevent), accept, reduce likelihood, reduce impact or transfer. 
8.11.  The Risk Officer then maintains and regularl y updates a register of major risks faced by the 
Secretariat. 
8.12.  The Deputy Director-General in charge of  Administration reviews and endorses the risk 
register, including the actions taken to mitigate risk. He/She submits to the Director-General at 
least annually a report with the key risks faced by the Secretariat. He/She also alerts Senior 
Management at any time of serious and/or imminent risks that are identified.  
 
__________