RESTRICTED  
  
WT/BFA/W/ 414 
 
 
21 March  2017 
(17-1517) Page: 1/6 
Committee on Budget, Finance , and Administration   
 
 WTO  SECRETARIAT  RISK MANAGEMENT SYST EM 
1  BACKGROUND  
1.1.  This document presents to the Committee on Budget, Finance , and Administration the key 
elements of the risk management system implemented by the WTO Secretariat for the year 2016.   
1.2.  Risk management is an iterative process  which contributes significantly in strengthening the 
areas of governance and effective and efficient internal co ntrols of the Organization.    
1.3.  A risk management policy for the entire Secretariat was established in December 2012 and is 
presen ted as an Annex to this document.   
2  CRITICAL RIS KS IDENTIFIED AT YEA R-END 2016  
2.1.  The Secretariat identified five (5)  new risk issues under  compliance , management,  and 
political  categories.  
2.2.  Management has reviewed the ri sk register , which  now contains some 60  risk issues , and the 
updated risk assessment following mitigation action s and controls implemented in 2016 .  
2.3.  The Deputy Director -General in charge of Administration presented  to the Director -General  
the current risk register in December 2016.  
2.4.  The compreh ensive risk register remains an internal management tool and is not designed to 
be an official and publicly available document. The Secretariat is pre senting in the table below the 
critica l risks; in other words, a high li kelihood of  the risk event occurri ng and the serious  impact 
should the risk event  occur. These important risks may represent also a substantial financial risk to  
the O rganization, which have the highest risk score of 9.  Out of the total  risks contained in the 
risk register at the end of 2 016, only  2 risks are considered "critical " and have remained "critical" 
since year 2013.    
Critical Ris ks Identified at Year -End 2016  
 
FINANCIAL RISK  
Inability  to fully fund the actuarial deficit of the After Service Health Insurance (ASHI)  
TECHNOLOGIC AL RISK  
Targeted skilled cyber -attack, advanced persistent threat  
 WT/BFA/W/414  
 
- 2 - 
 
  2.1   Financial Risk  
2.5.  The critical  financial ris k concerns the difficulty of  adequately  funding the after service  health 
insurance  (ASHI)  in light of its long term obligations . A Working Group  was created in February 
2014 and presented  a first report  to the CBFA  on analysis of the ASHI situation and its 
recommendations1. The second document  included  terms of reference  to establish  a Monitoring  
Group to keep track of the Secretariat 's progress  on the development of  a long -term sustainable 
approach on managing ASHI L iabilities2.    
2.6.  The Secretariat developed and submitted a strategy for managing health insurance liabilities  
to the CBFA3. The strategy covered cost controls and funding changes to imp rove the financial 
situation of the Medical Plan .  It also addressed  governance and administration, human resources 
needs, actuarial monitoring, baseline metrics, and creation of a F und.  
2.7.  The Secretariat will continue further evaluation of cost control, co st sharing and prevention 
measures,  and is pursuing a  'partial' funding approach . Performance metrics will be used to 
support monitoring and reporting  a key part of the strategy. A new Working Group was created to 
develop a specific proposal for an ASHI F und as part of the implementation of the new strategy . 
2.8.  These actions by the Secretariat, and noted by the CBFA, represent substantial progress in 
beginning to mitigate this critical risk.   
2.2  Technological Risk  
2.9.  With growing reliance on Information and Commun ications Technology (ICT), information 
security risks are amongst key concerns world -wide. The technology and cyber threat landscape 
are rapidly evolving and require a constant effort to protect the  sensitive information assets of the 
Organization as well as the Secretariat's ability to fulfil its mandate .   
2.10.   Under  the strategic governance of the Information Technology and Security Steering 
Committee  (ITSSC) , information security measures – both technological and operational – are 
implemented and continuousl y improved upon so as to defend the Organization's assets against 
potential sophisticated threats. Such u p-to-date tools and processes are intended to reduce the 
likelihood of a major security incident that could impact the Organization's activities.   
2.11.   Recruitment of an additional information security professional in 2017 should also allow for 
implementation of  key security measures to  further  mitigate this critical risk.   
3  RISK MANAGEMENT PROC ESS  
3.1.  In conformity  with the risk management policy, the Risk Offi cer carried out qualitative 
discussions  in 2016  with senior management . 
3.2.  The cross -divisional consultations facilitated  proactive discussion s on the risk management 
system , the identification  and re -assess ment of  a number of the risks faced by the Organizat ion, 
risk response , and monitoring.  
3.3.  Some twenty (20 ) risks are now  considered  "closed ", following  treatment  actions and 
remediation efforts  that addressed  the likelihood of an event occurrence and its impact.   
4  NEXT STEPS   
4.1.  The focus of good risk management  is the identification and effective treatment of risks.  
Good risk management leads to good governance.  
                                                
1 WT/BFA/W/370  dated 28 July 2015 . Report of the Working Group on After Service Health Insurance 
(ASHI).  
2  WT/BFA/W/375  dated 21 October 2015 . Working Gro up on ASHI Strategy Development – Proposed 
Terms of Reference.  
3  WT/BFA/W/406 /Rev.1 dated 14 February 2017 . WTO Secretariat Strategy for Managing the WTO 
Medical Plan and its After Service Health Insurance Liabilities . WT/BFA/W/414  
 
- 3 - 
 
  4.2.  The S ecretar iat will continue to expand  its knowledge and to further develop its risk 
management capabili ties for identifying, assessing , and managing risks in an efficient and timely 
manner. Reduction of risks, improvement  of processes  and controls, and identification of potential 
efficiencies and cost savings  all contribute to organizational improvement.  
4.3.  Consistently monitoring  new emerging risks and evolving threat landscape s and their 
potential impact on the O rganization  are more important than ever .  
4.4.  The Secretariat will continue to provide an annual update on risk management to the 
Committee on Budget, Finance , and Administration.  
 
 
_______________  
 
 WT/BFA/W/414  
 
- 4 - 
 
  ANNEX  
  
 Version 1.1  
 07 March 2014  
 
RISK MANAGEMENT POLI CY FOR THE WTO SECRE TARIAT  
1 PURPOSE  
1.1. This policy establishes the risk management system for the WTO.  Risk management is part 
of the internal control system established by the Secretariat.  
1.2. A risk in the context of this policy is an event that may or may not occur and could have a 
detrimental impact upon the achievement of the Secretariat's objectives if it were to occur.  
2 RISK MANAGEMENT APPR OACH  
2.1. The Secre tariat adopted  a risk man agement policy based on the following key principles:  
 
a. The management of risks is an integral part of the Secretariat's governance process.  
b. Risks that could potentially affect achievement of the Secretariat's objectives are 
identified, analysed and monitor ed. A risk register of the key risks faced by the 
Secretariat is maintained and regularly reviewed and updated.  
c. Appropriate risk mitigation measures are implemented to reduce risk exposure to 
acceptable levels.  
3 RESPONSIBILITIES  
3.1. The Deputy Director -General in charge of Administration is responsible to: 1) Supervise the 
Secretariat's risk management system; 2) Submit to the Director -General at least annually a 
report with the key risks faced by the Secretariat; and 3) Alert the Senior Management at any  time 
of serious and/or imminent risks that are identified.  
3.2. The Risk Officer is responsible to: 1) Consult regularly staff across the Secretariat to 
identify, analyse and monitor risks; and 2) Maintain the Secretariat's risk register.  
3.3. Any staff m ember wishing to bring a perceived risk to the attention of the Secretariat can 
contact the Risk Officer or the Deputy Director -General in charge of Administration.  
3.4. A Risk Owner is assigned for each risk included in the risk register. The Risk Owner is usually 
the division that manages directly the risk and is best place d to execute a mitigation plan.  
4 RISK MANAGEMENT PROC ESS 
4.1.   The purpose of the risk management process is to ensure that risks are addressed at the 
earliest possible time and that actio n plans are developed to reduce the likelihood of a risk 
adversely affecting achievement of the Secretariat's objectives.  
4.1  Risk Identification  
4.2.  The identification of risks takes place throughout the year. Risks can be identified by any staff 
and reported to  the Risk Officer. The Risk Officer regularly meets with management and staff to 
discuss and identify risks that the Secretariat is potentially facing.  WT/BFA/W/414  
 
- 5 - 
 
  4.2  Risk Analysis  
4.3.  The Risk Officer, after consulting with the Risk Owner, will propose  a score for each ris k 
according to the following formula:  Likelihood x Impact = Score.  
Risk Scoring Matrix  Impact  
if the 
event 
occurs  High (3)  Moderate 3  High 6  Critical 9  
Moderate (2)  Low 2  Moderate 4  High 6  
Low (1)  Low 1  Low 2  Moderate 3  
 Low (1)  Moderate (2)  High (3)  
Likelihood  of the event occurring  
 
4.4.  The analysis of  a risk event is assessed based on the likelihood of the risk event occurring 
and the impact should the risk event occur. The likelihood and impact are assessed on three 
levels: Low, Moderate or High.  
Risk Likelihood  
Low  An event may occur at some time  
Moderate  An event will probably occur in many circumstances  
High An event is expected to occur in most circumstances  
 
4.5.  The impact of a particular event is measured based on the potential damage to the 
credibility, reputation and the capacity of the Organization to fulfil its mandate.  
Risk Impact  
Low Less significant impact on main activities, reputation, or funding status  
Moderate  Significant impact on main activities, reputation, or funding status  
High Serious impact on main activities, reputation, or funding status  
 
4.6.  The scoring process includes a certain amount of subjectivity. Therefore the risk score only 
provides an indication of the relative importance of each risk identified.  
4.7.  The risks that h ave a score of 6 (high) and 9 (critical) may involve a substantial financial risk 
to the organization.  
4.8.  The Risk Officer also categorizes each risk according to one of the following type:  financial , 
management , occupational safety and health in the workplac e (OSH) , compliance (with regulations 
such as the WTO Financial Rules & Regulations, Staff Rules & Regulations, or Procurement Policy 
and Procedures ), political  or technological . 
4.9.  The Risk Register provides the risk score and type for each identified risk.  
4.3  Risk Monitoring  
4.10.   The monitoring of risk requires first determining actions that can be taken to mitigate risks. 
The following are possible risk treatment options  or mitigating measures: avoid (prevent), accept, 
reduce likelihood, reduce impact or transfer.  
4.11.   The Risk Officer then maintains and regularly updates a register of major risks faced by the 
Secretariat.  
4.12.   The Deputy Director -General in charge of Administration reviews and endorses the risk 
register, including the actions taken to mitigate risk. He/She s ubmits to the Director -General at WT/BFA/W/414  
 
- 6 - 
 
  least annually a report with the key risks faced by the Secretariat.  This report is discussed in the 
Senior Management Meeting.   He/She also alerts Senior Management at any time of serious and/or 
imminent risks that are id entified.  
__________