GAO

United States General Accounting Office

Report to Congressional Committees

April 2000 WORLD BANK

Management Controls 

Stronger, but 

Challenges in Fighting 

Corruption Remain

GAO/NSIAD-00-73

Page 1 GAO/NSIAD-00-73 World Bank Management Controls

Contents

Letter 3

Appendixes Appendix I: Chronology of Major World Bank Efforts to Strengthen 

Management Control System 36

Appendix II: Implementation Status of the World Bank’s 

Anticorruption Action Plan 37

Appendix III: The Committee of Sponsoring Organizations of the 

Treadway Commission’s Management Control Framework 40

Appendix IV: World Bank Management Control Structure 43

Appendix V: Management Controls in the World Bank’s Project

Lending 44

Appendix VI: Objectives, Scope, and Methodology 47

Appendix VII: Comments From the Department of the Treasury 49

Appendix VIII: Comments From the World Bank 52

Appendix IX: GAO Contacts and Staff Acknowledgments 57

Table Table 1: The Status of the Action Plan, as of December 1999 37

Figure Figure 1: Anticorruption Risk Assessments Among the World Bank’s

10 Largest Borrowers 23

Figure 2: Milestones in the World Bank’s Efforts to Strengthen its 

Management Control System, 1995-2000 36

Abbreviations

COSO Committee of Sponsoring Organizations of the Treadway 

Commission
Page 2 GAO/NSIAD-00-73 World Bank Management Controls
Page 3 GAO/NSIAD-00-73 World Bank Management Controls

United States General Accounting Office

Washington, D.C. 20548

National Security and

International Affairs Division

B-282152 Letr

April 6, 2000

The Honorable Mitch McConnell

Chairman

The Honorable Patrick Leahy

Ranking Minority Member

Subcommittee on Foreign Operations

Committee on Appropriations

United States Senate

The Honorable Sonny Callahan

Chairman

The Honorable Nancy Pelosi

Ranking Minority Member

Subcommittee on Foreign Operations, Export Financing

 and Related Programs

Committee on Appropriations

House of Representatives

The World Bank1

 lends billions of dollars each year to help countries 

alleviate poverty and promote economic and social progress. The Bank 

provides loans that support specific projects as well as loans that support 

broader economic and social reform. In addition to making loans, the Bank 

provides advice and technical assistance to borrowing countries. The 

World Bank currently manages a portfolio of approximately 1,500 projects 

valued at about $121 billion.2

The Bank operates in a difficult and challenging environment in countries 

where transparency (openness) and accountability are often lacking, and 

corruption—broadly defined as the abuse of public office for private gain—

1

The “World Bank” and “Bank” refer to the World Bank Group of institutions. The World 

Bank Group is made up of the original “World Bank”—the International Bank for 

Reconstruction and Development—as well as the International Development Association, 

the International Finance Corporation, the Multilateral Investment Guarantee Agency, and 

the International Center for the Settlement of Investment Disputes. Our review focused on 

the lending operations of the International Bank for Reconstruction and Development and 

the International Development Association.

2

Project lending totaled about $13.6 billion, about 47 percent, of the Bank’s total lending 

commitments for fiscal year 1999.
B-282152

Page 4 GAO/NSIAD-00-73 World Bank Management Controls

sometimes flourishes. The Bank must satisfy its dual mandate of providing 

development assistance in these environments and exercising its fiduciary 

responsibility, including ensuring that corruption is minimized in the 

projects it finances.

In 1996, the President of the Bank elevated the discussion of corruption by 

identifying it as a significant deterrent to development and made a pledge 

to address it more directly with its borrowers. Following the President’s 

announcement, the World Bank adopted an anticorruption strategy in 1997 

and introduced an anticorruption action plan in January 1999.3

 (See app. I 

for a chronology of Bank anticorruption efforts and app. II for a detailed 

description of this plan.) 

One of the Bank’s major goals was to create an operating system that would 

help ensure that funds are used as intended and spent in accordance with 

good management practices. The Bank’s anticorruption strategy is aimed at 

improving its systems of management controls, particularly in the areas of 

procurement and financial management, and ensuring that it is consistent 

with the standards of effective management control. These standards were 

defined by the Committee of Sponsoring Organizations of the Treadway 

Commission and were adopted by the Bank in 1995.4

The Congress has directed GAO to review the Bank’s progress in 

strengthening measures to prevent corruption.5

 In conducting our work, 

our objective was to determine whether the outcomes from the Bank’s 

management initiatives would collectively provide reasonable assurances 

that project funds are spent as intended. To do this, we focused on 

examining the progress the Bank has made in meeting the five standards 

3

The action plan was the result of a number of initiatives flowing from various units within 

the Bank. Several items, such as a major financial management improvement initiative, were 

already underway at the time the action plan was announced. The relative significance of 

steps in the action plan varies as does their ease of implementation. (See app. II.) 

4

The National Commission on Fraudulent Financial Reporting, known as the “Treadway 

Commission,” was created in 1985 by the joint sponsorship of the American Institute of 

Certified Public Accountants, the American Accounting Association, the Institute of Internal 

Auditors, the Institute of Management Accountants, and the Financial Executives Institute. 

5

Public Law 105-277, 112 Stat. 2681-167 (Oct. 21, 1998). The Congress also mandated that we 

review the Bank’s personnel procedures, especially regarding the protection of individuals 

who have alleged that mismanagement, fraud, and abuse of Bank funds have occurred. For 

our assessment of Bank personnel practices, see World Bank: Status of Grievance Process 

Reform (GAO/NSIAD-99-66, May 13, 1999).
B-282152

Page 5 GAO/NSIAD-00-73 World Bank Management Controls

for effective management control. These standards deal with 

(1) organizational structures, managerial capacity, and systems necessary 

to establish a sound management control environment; (2) risk assessment; 

(3) policies and procedures for ensuring that management directives are 

carried out; (4) monitoring progress in achieving desired outcomes; and 

(5) dissemination and communication of information.

We did not make a complete assessment of the Bank’s management control 

system but focused on Bank efforts to improve controls that the Bank had 

identified as weak. We limited our scope to reviewing Bank controls over 

project lending, which cover about one-half of the Bank’s operations. To 

gain a first-hand view of how these controls are implemented in the field, 

we also visited four countries that are large Bank borrowers. As agreed 

with the Bank, we did not name these countries in this report or identify 

the Bank-financed projects we reviewed.6

 Appendix VI contains a more 

detailed description of our scope and methodology.

Results in Brief In its efforts to address corruption concerns, the Bank has undertaken an 

ambitious and systematic effort to identify and correct key weaknesses in 

its system of management controls. The Bank has made significant 

progress in meeting each of the five standards of an effective management 

control system. However, challenges remain and further action will be 

required before the Bank can provide reasonable assurance that project 

funds are spent according to the Bank’s guidelines. Surmounting some of 

these challenges—particularly in building borrower managerial capacity 

for implementing Bank projects—will be onerous and will require a longterm effort because problems of corruption and weak management are 

often endemic to the economic development environment in which the 

Bank operates. 

Summarized below is the status of the Bank efforts in meeting each of the 

five standards of an effective management control system.

• Organizational structure, managerial capacity, and systems. We focused 

on Bank efforts to improve internal oversight mechanisms, project 

management, and public institutions in borrowing countries. The Bank 

6

We reviewed 12 randomly selected projects for 12 different countries approved between 

November 1, 1998, and July 1, 1999, and a judgmental sample of 6 ongoing projects approved 

prior to November 1998.
B-282152

Page 6 GAO/NSIAD-00-73 World Bank Management Controls

has added new oversight committees and staff to better monitor Bank 

operations and borrower procurement and financial management 

practices. For example, the Bank has established a new fraud and 

corruption hotline and hired about 90 new procurement and financial 

management specialists. However, many of the public agencies in 

borrowing countries charged with implementing Bank-financed projects 

are managerially weak and lack skilled and experienced staff. A series of 

recent Bank studies show that borrowers often have difficulty 

complying with Bank procurement rules. Significant institutional 

capacity building will be necessary to ensure that borrowers can carry 

out their management control responsibilities effectively.

• Risk assessment. The Bank has focused more attention on better 

assessing the risks associated with corruption and weak managerial 

capacity of its borrowers. However, the risks identified are not always 

raised to the attention of senior decisionmakers and fully addressed in 

risk mitigation plans. Moreover, the Bank does not have a system for 

allocating its anticorruption assistance among borrower countries 

based on risk. 

• Policies and procedures for ensuring management directives are carried 

out. The Bank has strengthened controls by devoting more attention and 

resources to supervising its projects more closely. This has included, for 

example, hiring or training local Bank staff or contracting with 

consultants to review borrower procurement actions more closely. 

However, the Bank and some borrowers do not always comply with 

Bank procedures on project auditing and Bank supervision of 

borrowers’ procurement and financial management practices.

• Monitoring. The Bank has introduced some new tools for monitoring 

and evaluating the implementation of Bank projects. However, these 

tools do not provide enough information for Bank management to 

measure the extent to which some key management control problems 

are being resolved. For example, Bank studies on the quality of Bank 

supervision do not fully address key performance problems reported by 

external and internal auditors.

• Information and communication. The Bank has significantly improved 

its dissemination and communication of information on its 

anticorruption efforts, both within the Bank and in borrowing countries. 

However, some borrower governments and nongovernmental 

organizations are still not aware of the Bank’s hotline and other 

mechanisms for reporting fraud and corruption.

The Bank is aware of many of these challenges and continues to take 

actions to address them but does not publicly report progress in 
B-282152

Page 7 GAO/NSIAD-00-73 World Bank Management Controls

implementing these management control improvements. This report 

contains recommendations to improve the Bank’s internal oversight 

mechanisms and risk assessment process, and to assure that the Bank 

monitors and reports on progress in correcting weaknesses in project 

management. We also recommend that the Department of the Treasury 

annually report to the Congress on the results of efforts to strengthen the 

Bank’s management control system.

In commenting on this report, the Bank noted that it holds itself to a high 

control standard and that it had already identified many of the weaknesses 

we cited through its own self-evaluations and has remedial actions 

underway. Treasury and the Bank agreed with our findings and 

recommendations and said that a more aggressive approach is needed in 

strengthening the Bank’s management control systems over project lending 

and building borrowers’ institutional capacity to fight corruption.

Background Concerns about corruption have intensified in recent years as there is a 

growing realization among international financial donors, including the 

World Bank, that corruption may undermine development by deterring 

investment and growth and exacerbating poverty. Although no Bank-wide 

estimates of the magnitude of this problem have been developed, levels of 

corruption vary from country to country. World Bank staff estimated that in 

one large borrowing country, about 20 to 30 percent of all development 

funds, totaling several billion dollars each year, had been systematically 

diverted.

The Bank requires borrowers to establish and maintain effective 

management controls over project funds and to implement projects. For 

example, borrowing agencies are required to produce a variety of financial 

and progress reports and to arrange for regular, independent project audits. 

For its part, the Bank exercises oversight of project implementation 

through a variety of control activities, including review of financial 

statements and audit reports, prior review of many procurement actions, 

and review of the eligibility of many project expenditures. 

The Bank and borrowers use the following process to develop and 

implement projects. (App. V describes the Bank’s management control 

activities in more detail.)

• Project identification and preparation. Project development begins 

when Bank staff and borrowers identify a project idea. During the 
B-282152

Page 8 GAO/NSIAD-00-73 World Bank Management Controls

subsequent preparation phase, borrowers bear the primary 

responsibility for examining all aspects of the proposed project and for 

preparing a project plan for Bank consideration. 

• Project appraisal and negotiation. After preparation is complete, Bank 

staff appraise sponsor proposals (including the arrangements for 

procurement and financial management). Bank staff negotiate with 

project sponsors the terms and conditions under which the Bank will 

commit funds to the project and, finally, prepare a project appraisal 

document. This document is supposed to contain all of the information 

the Bank management and the Executive Board need to decide whether 

or not Bank financing should be provided.

• Board approval. The Bank’s Executive Board decides whether to 

approve each proposed project and, in doing so, exercises oversight 

over the implementation of Bank policies and procedures—including 

those that govern procurement and financial management.

• Project implementation. The responsibility for project implementation 

rests with the borrowers, who must conform to Bank policies and 

procedures and other conditions outlined in the loan agreement. The 

Bank monitors and supervises project implementation, including project 

procurement and financial management, on a continuing basis until 

project completion and disburses funds contingent upon the borrower 

providing required documentation. Projects are subject to an annual 

independent audit arranged by the borrowers. These audits are to 

include an assessment of the adequacy of the accounting and internal 

control systems. 

The 181 member countries of the World Bank govern it through an 

Executive Board—the Bank’s primary oversight and decision-making body. 

Twenty-four Executive Directors from Bank member countries comprise 

the Executive Board. This Board considers and decides on overall policy 

issues that guide the Bank’s general operations and approves specific 

project proposals presented by the President of the Bank. The United 

States is the largest contributing member to the World Bank and thus holds 

the greatest number of voting shares (16.5 percent) on the Bank’s 

Executive Board (voting shares are allocated on the basis of member 

contributions). Other members holding the largest number of voting shares 

are Japan (7.9 percent), Germany (4.5 percent), France, and the United 

Kingdom (4.3 percent each).7

 The Secretary of the Treasury, who 

7

These voting shares apply to projects financed through the Bank’s market-based lending. 
B-282152

Page 9 GAO/NSIAD-00-73 World Bank Management Controls

represents the United States as a governor of the World Bank, has the lead 

role within the executive branch regarding U.S. policy toward the Bank.

In line with the best practices of major financial institutions in the United 

States, the Bank in 1995 adopted the management control standards of the 

Committee of Sponsoring Organizations of the Treadway Commission 

(COSO). This control framework, known as the “Internal Control −

Integrated Framework,” establishes a common definition of management 

controls for all Bank units and provides a standard to assess improvements 

in these controls. We refer to the components of this framework as the 

“COSO standards” in this report. (See app. III for a more complete 

discussion of these standards).

The Treadway Commission identified the following five standards that 

constitute the criteria against which a management control system is to be 

evaluated. All five standards must be met for controls to be judged effective 

in any particular area of an organization’s operations, thus providing 

reasonable assurance that funds are spent as intended.8

1. Control environment − An organization should establish a positive 

control environment, that is, one with a structure, discipline, and 

climate conducive to sound management controls. Factors that 

significantly affect the control environment include the integrity and 

ethical values of management and staff, the competence of personnel, 

the way the agency is organized, the manner in which management 

assigns authority and responsibility, and the attention and direction 

provided by oversight groups.

2. Risk assessment − An organization should properly identify, analyze, 

and manage the possible risks involved in meeting organizational 

objectives.

3. Control activities − An organization should establish control activities 

consisting of policies, procedures, techniques, and mechanisms that 

ensure that management directives are being carried out to meet 

8

It is recognized that no matter how well designed and implemented, management controls 

cannot provide absolute assurance that program funds will be used as intended. For 

example, human mistakes, judgment errors, and acts of collusion to circumvent controls 

can limit their effectiveness.
B-282152

Page 10 GAO/NSIAD-00-73 World Bank Management Controls

organization objectives. They include approvals, authorizations, 

verifications, and reviews of operating performance.

4. Monitoring − An organization should continually monitor and evaluate 

all aspects of internal control to assess the quality of performance over 

time. Serious management control deficiencies should be reported to 

higher levels, including top management and the Board of Directors.

5. Information and communication − An organization should identify, 

capture, and communicate information in a form and time frame that 

enable people to carry out their responsibilities.

In 1999, Bank management used these standards in assessing the 

effectiveness of internal controls over financial reporting but has not used 

these standards to determine the adequacy of management controls over 

the Bank’s project lending operations. The Bank concluded that 

management controls over financial reporting at the International Bank for 

Reconstruction and Development and the International Development 

Association funds met COSO standards. The Bank’s external auditor 

concurred with this statement.9

Control Environment 

Has Improved at the 

Bank but Is Weak 

Among Borrowers

According to COSO standards, establishing an effective management 

control environment requires well-managed and properly structured 

organizations with qualified personnel in place to implement proper 

management controls and address corruption. We assessed the control 

environment in terms of the Bank’s internal oversight mechanisms, project 

management, and Bank efforts to improve public institutions in borrowing 

member countries. 

While the Bank has made significant progress in strengthening its control 

environment by creating new oversight structures and increasing staff with 

expertise in financial management and procurement, many borrowers still 

have weak structures and limited managerial capacity, according to Bank 

records and officials. Consequently, the Bank has increasingly targeted its 

anticorruption efforts on building borrowers’ institutional capacity to fight 

corruption. 

9

On July 21, 1999, the Bank reported that its external auditor, Deloitte Touche Tohmatsu, 

agreed with this conclusion. 
B-282152

Page 11 GAO/NSIAD-00-73 World Bank Management Controls

Bank Internal Oversight 

Mechanisms Have Been 

Strengthened but Need 

Further Improvements

Internal oversight is key for preventing, detecting, and addressing 

corruption. Although the Bank has long had an internal audit function and a 

system of management controls, the Bank recognized that its internal 

oversight mechanisms were weak, according to several officials we spoke 

to. These officials indicated that the Bank lacked a central focal point for 

reporting and reviewing allegations of wrongdoing and sufficient expertise 

to investigate allegations of wrongdoing. In addition, while the Bank 

expected its staff to exhibit strong ethical behavior, the Bank did not have a 

strong ethics awareness program. The Bank’s external auditor reported in 

1998 that the Bank’s internal audit department—a key management 

oversight unit—had a fairly restricted scope of audit coverage and played a 

limited role within the Bank. For example, about 78 percent of the 206 

internal audit reports conducted from fiscal years 1995 through 1997 were 

focused on administrative compliance issues, such as country mission 

office procedures, rather than on determining whether project funds were 

being used as intended. 

While the Bank has made progress in strengthening internal oversight 

units, it still faces challenges in ensuring that all fraud and corruption 

allegations are centrally reported and effectively addressed.

Progress In 1998, the Bank established a 24-hour worldwide fraud and corruption 

hotline, created a new Oversight Committee on Fraud and Corruption for 

reviewing and monitoring allegations, formed an Investigations Unit 

comprised of professional fraud investigators, hired new investigative staff, 

and established a high-level Sanctions Committee to review results of 

investigations and to make recommendations to the World Bank President 

on whether certain contractors or individuals should be declared ineligible 

for Bank-financed contracts. In addition, the Bank strengthened its ethics 

outreach program and increased staff expertise to investigate allegations of 

employee misconduct. As of March 2000, the hotline had received 156 calls 

since its inception in October 1998. Ninety allegations resulting from these 

calls were referred for investigation to the Oversight Committee on Fraud 

and Corruption.10 Of the 90 allegations, 47 were investigated and found to 

have been either unsubstantiated or did not involve Bank funds. Two other 

allegations have been fully investigated and closed while 41 are still being 

investigated. 

10Sixty-six calls did not result in an investigation.
B-282152

Page 12 GAO/NSIAD-00-73 World Bank Management Controls

In addition, the Bank’s internal auditor had increased the proportion of 

operational audits targeting management controls, procurement, and 

financial management issues (in relation to administrative compliance 

audits) in fiscal years 1998-99 to 28 percent versus 22 percent in fiscal 

years 1995-97. The internal audit department’s annual workplan calls for 

about the same level of coverage of operational audits in fiscal year 2000.

Challenges The Bank’s initiatives to detect, prevent, and investigate fraud and 

corruption are positive steps; however, the Bank recognizes that further 

steps are needed to build on the progress made to date. 

• First, not all fraud and corruption allegations have been centrally 

reported to the Oversight Committee on Fraud and Corruption. During 

our June 1999 visit to one country where the Bank identified corruption 

to be a serious issue, we found that over 30 allegations of wrongdoing 

that were reported locally to Bank officials had not been reported to the 

committee. However, according to Bank officials, the country mission 

was dealing with these allegations locally and forwarded them to the 

Oversight Committee on Fraud and Corruption after our visit and 

followed up appropriately. In November 1999, the Bank issued 

additional guidelines to help ensure that all field office allegations are 

reported centrally; however, more time will be needed to assess whether 

this new guidance is being fully implemented.

• Second, the new oversight units responsible for reviewing, monitoring, 

and investigating allegations—the Oversight Committee on Fraud and 

Corruption and the Investigations Unit—are not organizationally 

independent of the Bank’s line management (see app. IV). The Oversight 

Committee on Fraud and Corruption reports directly to one of the 

Bank’s managing directors. The Investigations Unit also reports to the 

Oversight Committee on Fraud and Corruption’s secretariat. The 

independence of the investigative function could be affected by the fact 

that a managing director controls the budget of the Oversight 

Committee on Fraud and Corruption and Investigations Unit and also 

makes the final decision on whether an investigation is pursued, 

including those that may involve employees that report to this director. 

A January 2000 study by a Bank consultant confirmed our observation 

noting that the Investigation Unit did not have the necessary stature or 

independence. This study recommended that this unit report directly to 

the Bank President and be given the authority to independently 

investigative all matters involving fraudulent and corrupt practices. 

• In addition, one member of the Oversight Committee on Fraud and 

Corruption also serves on the Sanctions Committee. Thus, a person who 
B-282152

Page 13 GAO/NSIAD-00-73 World Bank Management Controls

helps decide what investigations should be undertaken also decides 

what sanctions should be imposed if improprieties are found. Bank 

managers we interviewed said that this arrangement might create a 

perception that impairment to independence may exist, regardless of 

whether it actually affects how investigative duties are carried out. In 

October 1999, the Bank contracted with a consultant to examine these 

organizational issues in more detail and propose alternatives to the 

present organizational arrangement. 

• Third, we noted that the Bank’s investigation function is fragmented 

between two units—the Investigations Unit and the Office of 

Professional Ethics. Each unit currently has its own investigative 

guidelines; case management system; a hotline and helpline, 

respectively; and investigative staff. According to Bank officials, this 

fragmentation has resulted in some confusion over the appropriate 

duties and responsibilities of these structures and some gaps in 

investigative coverage, hampering Bank efforts to promptly identify and 

investigate all allegations of potential wrongdoing. To resolve these 

problems, the heads of these units plan to work together toward 

standardizing the procedures and building internal capacity to operate a 

joint hotline and conduct investigations. In December 1999, the Bank 

hired another consultant to examine the operations of the Investigations 

Unit. 

Bank Is Improving its 

Project Management 

Capabilities, but Some 

Borrowers Lack Experience 

and Skilled Staff 

A strong control environment within the Bank and borrowing country 

institutions is critical for effectively implementing the Bank’s system of 

project management controls. For many years, the Bank has had policies 

and procedures in place aimed at ensuring that project financial 

management and procurement are sound and that funds are used as 

intended. Responsibility for ensuring compliance with these policies and 

procedures is shared by the borrowers, which execute the projects, and the 

Bank, which supervises the borrower through a variety of approvals and 

reviews of borrowers’ actions.
B-282152

Page 14 GAO/NSIAD-00-73 World Bank Management Controls

In recent years, the Bank has recognized that the control environment for 

its projects had deficiencies. Bank reports and studies issued in 1997 and 

1998 indicated that in many cases, both the Bank and its borrowers had 

insufficient managerial capacity to ensure effective safeguards against the 

misuse of project funds.11 In particular, the Bank identified deficiencies in 

financial accounting, reporting, and auditing in many projects. 

Furthermore, the Bank did not devote adequate attention to reviewing the 

borrowers’ procurement actions. An underlying cause of this problem was 

that the Bank did not have an adequate number of skilled staff to ensure 

that borrowers were complying with financial management and 

procurement policies and procedures, which were designed to minimize 

opportunities for corruption. 

The Bank has made progress in strengthening its project management 

capabilities but still faces major challenges in building this capacity among 

borrower agencies responsible for implementing Bank-financed projects.

Progress The Bank has undertaken initiatives to enhance the control environment 

for Bank projects, both within the Bank and among borrowers. In fiscal 

year 1998, the Bank launched a major effort to hire and train more Bank 

staff qualified to deal with the financial management and procurement 

aspects of project management. As a result, the Bank increased the number 

of qualified financial management staff by about 159 percent (from 34 in 

fiscal year 1998 to 88 in fiscal year 1999) and the number of qualified 

procurement specialists by about 78 percent (from 46 in 1997 to 82 in 

1999).12 A financial management specialist and a procurement specialist are 

now to be assigned to every Bank project, both new and ongoing. 

Furthermore, the Bank has assigned many of these new staff members to 

its country missions,13 where they can be more closely involved in 

implementing projects and strengthening management controls. 

In addition, the Bank has undertaken initiatives to build the financial 

management and procurement capacity of those agencies in borrowing 

11For example, see The World Bank Procurement Function − Adjusting to Emerging Needs

(Washington D.C.: World Bank, Apr. 1998), and Loan Administration Change Initiative 

(LACI) − Implementation Strategy Paper (Washington D.C.: World Bank, June 29, 1998).

12Figures for financial management specialists and procurement specialists are as of August 

1999 and June 1999, respectively.

13The Bank had 87 country missions as of the end of fiscal year 1999.
B-282152

Page 15 GAO/NSIAD-00-73 World Bank Management Controls

countries that are responsible for implementing projects. One major 

initiative introduced in July 1998 is aimed at ensuring that all new projects 

meet minimum requirements for financial management, including having 

adequate staffing, internal controls, and auditing arrangements. 

Similarly, the Bank has focused on improving borrowers’ compliance with 

Bank procurement rules. These efforts involve assessing implementing 

agencies’ capacity to manage new projects and devising action plans to 

remedy any significant gaps either before the project begins or during the 

course of the project. 

Challenges Despite these initiatives, the Bank recognizes that it still faces a major 

challenge in ensuring strong financial management and procurement 

capacity among its borrowers as the institutional capacity-building 

required may be difficult and time consuming to achieve, according to 

senior Bank officials we interviewed. Also, the Bank’s new initiatives to 

build greater financial management and procurement capacity, which 

began for new projects appraised in July 1998 (financial management) and 

November 1998 (procurement) only apply to about 208, or 14 percent, of 

the Bank’s 1,500 projects. Bank studies indicate that management 

weaknesses persist in ongoing projects. For example, the results of a series 

of recently completed procurement audits show a lack of understanding of 

and noncompliance with Bank procurement rules among many (17 of 25) 

borrowers subject to these audits.

Our review of 12 randomly selected projects approved by the Bank since 

November 1998 identified 5 projects in which the borrowers’ implementing 

agencies had little or no experience managing development projects, 

according to Bank records and staff. Thus, their ability to effectively 

manage the financial and procurement aspects of project implementation 

and safeguard against corruption appeared limited. Six of the projects we 

reviewed did not meet the Bank’s minimal financial management 

requirements at the time that the Board approved the projects. 

Furthermore, for 3 of the 12 projects, the Bank determined that the 

borrowers’ implementing agencies had particularly weak capacity for 

carrying out procurement in accordance with Bank rules. For four projects, 

the implementing agencies were not yet functioning and did not have key 

staff or operating procedures in place. Bank officials told us that it is 

common practice for borrowers to delay fully establishing 

project-implementing organizations until after projects are approved by the 

Board. These officials indicated that most management deficiencies would 

be corrected, as a legal condition of the loan, before any Bank funds are 
B-282152

Page 16 GAO/NSIAD-00-73 World Bank Management Controls

actually disbursed. However, even with required corrective actions, the 

ability of these agencies to exercise proper financial management and 

procurement functions is unproven, given the agencies’ lack of experience. 

In addition, the Bank remains concerned that project auditors lack 

institutional independence. Project auditing is a critical element of the 

Bank’s management control system; the Bank uses audits, arranged for by 

the borrower, to help ensure that project funds are used as intended. The 

Bank is required to approve the selection of the auditors. However, Bank 

guidance on auditor selection acknowledges that it is often not possible to 

ensure the independence of auditors, particularly government auditors that 

are used for auditing Bank-financed projects in many countries. The Bank 

guidance states that government auditors are frequently not professionally 

qualified accountants—many are political appointees, and some are public 

service administrators. Furthermore, the Bank has been concerned that 

government auditing institutions sometimes are understaffed, 

underfinanced, and subject to political pressure. 

Until the Bank has assurance that its borrowers’ institutions are properly 

organized, staffed, and experienced in financial management and 

procurement, the overall control environment for its projects will continue 

to be weak. Although the Bank has strengthened its capacity to supervise 

projects, it recognizes that this cannot fully compensate for the 

weaknesses of its borrowers, given the shared responsibility in 

implementing management controls. Hence, Bank assurances that funds 

will be managed appropriately depend on the success of ongoing and future 

capacity-building efforts.

Bank Faces Long-term 

Challenges in Improving 

Public Institutions in 

Borrower Countries 

The Bank has recognized that the key to helping countries fight corruption 

is to help them create a sound control environment at the country level. 

Many borrowers lack well-functioning public management systems; 

accountable organizations; and a strong legal framework to prevent, detect, 

and redress corruption. The Bank has supported a wide variety of 

initiatives to strengthen public institutions in its borrowers but faces 

significant challenges in ensuring that these efforts will be successful over 

the long run. 

Progress The Bank has introduced new programs to help borrowers establish strong 

management controls on a countrywide basis. The Bank has helped launch 

over 350 anticorruption activities in 95 countries. For example, it has 

conducted detailed surveys to help diagnose the magnitude and nature of 
B-282152

Page 17 GAO/NSIAD-00-73 World Bank Management Controls

corruption in 13 countries, and a major governance pilot program is 

currently working with teams in 7 African countries to develop and 

implement targeted anticorruption action plans. The Bank has also 

provided numerous institutional development grants to borrowers to 

enhance their ability to deal with corruption. For example, in one country 

we visited, the Bank awarded a grant to a newly created National Office of 

Public Ethics. The Bank has also supported capacity-building in the 

accounting and auditing professions, which are viewed as a critical area of 

reform for many large borrower countries. A country we visited received 

two grants to provide procurement and financial management training for 

agencies that implement projects and for auditing institutions. 

Challenges The Bank faces a difficult and long-term challenge in trying to help 

borrower countries create effective and well-managed institutions. 

According to the Bank’s Annual Review of Development Effectiveness in 

1998, only 40 percent of Bank-supported projects have had substantial 

impact on institutional development. In addition, the Bank’s achievements 

in institutional building in the financial sector were deemed likely to be 

sustainable in just 50 percent of countries for a variety of reasons, 

including “fragile institutional environments,” and low capacity to absorb 

foreign aid.14 A 1998 evaluation of the World Bank Institute’s (the World 

Bank’s research and training institute) efforts to help curb corruption in 

two African countries questioned the sustainability of these efforts for 

several reasons, including the lack of needed reforms in public 

procurement and lack of support and involvement of civil society. Bank 

officials are optimistic about the prospects for greater impact in its more 

recent institution-building efforts, because they said these efforts are based 

on some new approaches. Nonetheless, given the challenging nature of this 

work, major improvements in borrowing country institutions should not be 

expected for some time.

141998 Annual Review of Development Effectiveness (Washington, D.C.: World Bank, 1999).
B-282152

Page 18 GAO/NSIAD-00-73 World Bank Management Controls

Bank’s Risk 

Assessment Process Is 

More Detailed, but 

Some Weaknesses 

Persist

According to COSO standards, an effective management control system 

requires risk assessments to properly identify, analyze, and manage the 

possible risks to meeting project objectives. Recently, the Bank has 

focused attention on better assessing the risks associated with corruption 

and the weak management capacity of its borrowers. However, our review 

revealed that weaknesses persist in the Bank’s risk assessment process at 

the project level and country level. As a result, the Bank has approved some 

projects with limited assurance that all risks and borrower weaknesses 

have been addressed and that the Bank’s supervision of the project will 

minimize the potential misuse of project funds.

Project Risks and Mitigation 

Plans Not Always Identified 

for Decisionmakers

The Bank assesses project risks primarily during the project appraisal and 

approval process. When evaluating a project, the Bank staff prepares a 

project appraisal document. According to Bank guidance, this document 

should include all the information that Bank management and the Board 

need to decide whether or not Bank financing should be provided, 

including an assessment of critical project risks. This guidance requires 

that the appraisal identify each critical risk, note the severity of the risk 

(ranging from negligible to high), and indicate any measures to be taken to 

minimize the risk. These risks may include economic, political, and social 

factors that could hinder the implementation of the project and prevent it 

from meeting its development objectives.

A series of Bank studies from 1994 to 1998 showed that Bank staff had 

often not adequately assessed all risks in projects reaching approval stages 

with Bank management and the Executive Board of Directors. In particular, 

Bank staff did not always explicitly state the risks posed by the inadequate 

management capacity of many borrowers’ institutions or incorporate 

appropriate strategies to mitigate these risks. Although the Bank has made 

progress in ensuring that project risks are better identified and assessed 

during project design, the Bank faces additional challenges in ensuring that 

the results of these risk assessments are clearly communicated to the 

Board of Directors—the key decisionmakers charged with approving Bank 

project loans. 

Progress The Bank has established new requirements in 1998 to ensure that staff 

more systematically address risks in the design of new projects. Bank 

project managers and procurement and financial management specialists 

are required to analyze the risks to successful project implementation, 

including administrative, institutional, and financial risks. New project 
B-282152

Page 19 GAO/NSIAD-00-73 World Bank Management Controls

appraisal documents must include an action plan for reducing the risks 

through capacity-building activities and for mitigating the risks through 

appropriate levels of Bank supervision. In assessing procurement risks for 

each project, a Bank procurement specialist is required to rate the level of 

risk (ranging from low to high) and devise an appropriate supervision plan. 

This supervision plan is to include the monetary amount (threshold value) 

above which Bank pre-approval would be required for procurements; it is 

also to indicate to what extent the Bank will audit procurements to ensure 

that the borrower has followed Bank rules. 

Challenges Despite improvements in project design requirements, a July 1999 Bank 

study of new projects approved in 1998 showed that project appraisal 

documents continued to be unduly optimistic—Bank staff often 

understated or did not disclose known project risks relating to borrowers’ 

implementation capacity to Bank management and the Board of 

Directors.15

Our review of 12 projects approved after November 1998 confirmed that 

the Bank’s senior decisionmakers still have not adequately assessed the 

risks posed by potential corruption and weak managerial capacity of 

borrowers. We found that Bank staff had generally conducted the required 

assessments of financial management and procurement capacity for the 

new projects we reviewed. However, in nine cases, Bank staff did not 

clearly present the results of these assessments in the project appraisal 

document when seeking project approval from Bank management and the 

Board of Directors, as required by Bank guidelines. The Bank staff did not 

indicate the level of procurement risk for seven projects and did not 

indicate whether the project met the Bank’s minimum financial 

management requirements for seven projects. Consequently, the Board 

may not have had sufficient information to assess the borrowers’ capacity 

when approving these projects. 

Furthermore, we believe that Bank staff did not adequately identify the 

risks that potential corruption poses to projects when seeking management 

and Board approval. Only 4 of the 12 projects we reviewed identified 

corruption or undue political interference as a critical project risk (even as 

a low or negligible one), even though Bank reports had indicated that 

15Quality at Entry in Calendar Year 1998: A Quality Assurance Group Assessment

(Washington D.C.: World Bank, July 1999).
B-282152

Page 20 GAO/NSIAD-00-73 World Bank Management Controls

corruption is a problem in all of the countries included in our project 

sample. 

In addition, in the new projects we reviewed, the Bank often did not 

identify what steps the Bank will take to manage identified risks and 

weaknesses. In six of eight projects in which Bank staff had flagged weak 

management capacity, corruption, or political interference as a critical risk, 

the project appraisal documents did not describe what specific supervisory 

actions the Bank planned to take to mitigate the risks. For most projects 

with these types of risks, the Bank proposed providing additional technical 

assistance for the borrower agencies (sometimes funded by the projects) 

or requiring additional borrower actions to address the risks. Given the 

recognized weaknesses in borrower institutions and the difficulty 

borrowers have had in building capacity, technical assistance and borrower 

actions alone may not be sufficient to ensure that project risks can be 

mitigated. 

Furthermore, the project appraisal documents provided to the Board and 

Bank management did not consistently and comprehensively address how 

the Bank staff proposed to supervise the projects in order to compensate 

for specific borrower management weaknesses. Senior Bank officials told 

us that they have recognized the need for better planning of supervision 

activities and are devising new requirements for this function. The Bank 

plans to introduce these new requirements by June 2000.

Country Assistance 

Strategies Do Not Always 

Address Corruption Risks

The Bank also assesses risks at the overall country level when making 

decisions about country assistance and lending levels. In 1992, the Bank 

introduced a country assistance strategy process as a key tool in 

examining, among other things, the performance of Bank projects and the 

policy reform record in countries that receive Bank assistance. The Board 

considers the results of this analysis, including the risks posed by 

corruption, poor governance, and an adverse public policy environment, 

when approving loans and establishing lending levels for each country. In 

addition, the Bank’s process for allocating the Bank’s concessional (below 

market interest rate) loans among borrowers includes consideration of 

country governance issues, which includes corruption issues.
B-282152

Page 21 GAO/NSIAD-00-73 World Bank Management Controls

The Bank acknowledges that historically, like other international financial 

institutions, it has not adequately addressed the risks associated with 

corruption and poor governance when making decisions on providing 

country assistance. According to several Bank officials we spoke to as well 

as the Bank’s anticorruption literature, the Bank had for years been 

reluctant to address corruption risks openly and directly with borrowers.16

The Bank has made progress in addressing the nature and extent of 

corruption and related risks in some but not all country lending strategies. 

Progress In 1998, the Bank introduced new rules requiring country assistance 

strategies to explicitly address the state of governance and corruption in 

the country and its impact on Bank programs so that these issues could be 

considered in the Board’s lending decisions. In the same year, the Bank also 

introduced new procedures for enhancing the usefulness of key inputs into 

these country assistance strategies. For example, Bank staff are now 

required to complete, with borrower assistance, comprehensive risk 

assessments of countries’ national financial management and procurement 

systems to better identify major risks and weaknesses in institutions, 

government policies, and legal frameworks. 

Challenges Only about one-fourth of the 31 fiscal year 1999 country assistance 

strategies that we reviewed included a discussion of corruption-related 

risks or the role that progress on corruption-related issues would likely 

have on the Bank’s lending decisions. However, Bank officials told us that 

the treatment of these issues in the country assistance strategies has 

improved over time. In December 1999, the Bank completed a review of the 

treatment of corruption and governance issues in Bank country assistance 

strategies. While the study noted an improvement in the discussion of these 

issues from fiscal year 1998 to 1999, less than 40 percent of the assistance 

strategies were rated as satisfactory or better in explicitly assessing 

corruption risks to Bank projects and proposing remedial measures, if 

pertinent. This study also found that few assistance strategies included 

performance benchmarks or lending triggers related to governance 

conditions or corruption risks. The Bank expects more improvement in the 

discussion of these issues over time as more country strategies are subject 

to the new requirements. 

16For example, see Helping Countries Combat Corruption: The Role of the World Bank 

(Washington, D.C.: World Bank, Sept. 1997).
B-282152

Page 22 GAO/NSIAD-00-73 World Bank Management Controls

Bank’s Process to Prioritize 

Anticorruption Programs

One of the first steps in establishing a major anticorruption program in a 

country is conducting an assessment of that country’s procurement and 

financial management systems. However, the Bank has not prioritized, 

based on corruption risk, which countries should undergo these 

assessments. In its action plan, the Bank indicated that it would target 

assessments at countries where corruption risks were greatest. Bank 

officials confirmed that they did not use a systematic approach or establish 

priorities for conducting these assessments. Instead, the assessments were 

generally scheduled based on the interest of the borrowers or the existing 

knowledge level of Bank staff. As of November 1999, of 143 borrowers, the 

Bank had completed financial management risk assessments for 

57 countries and country procurement risk assessments for 16 countries. 

Figure 1 shows that few assessments (two procurement assessments and 

seven financial management assessments) were completed for the Bank’s 

top 10 fiscal year 1999 borrowers. These borrowers collectively received

62 percent of Bank financing in that year.
B-282152

Page 23 GAO/NSIAD-00-73 World Bank Management Controls

Figure 1: Anticorruption Risk Assessments Among the World Bank’s 10 Largest Borrowers

Legend

FY = fiscal year
B-282152

Page 24 GAO/NSIAD-00-73 World Bank Management Controls

a

Total lending includes investment and adjustment loans.

b

Completed between 1997 and August 1999.

c

Progress report.

d

Review is either planned or underway but was not completed as of August 1999.

Source: World Bank data.

A senior Bank official told us that the Bank hopes to target future 

anticorruption efforts, including the Bank’s country financial management 

and procurement risk assessments, to higher risk borrowers and that the 

Bank is currently developing some comprehensive “good governance” 

indicators to better guide its efforts.17 A Bank official indicated that it may 

take several years to develop these new indicators.

In addition to not targeting risk assessments to higher risk borrowers, the 

Bank has not scheduled the completion of its country level assessments of 

procurement and financial management risks to coincide with the approval 

of the Bank’s country assistance strategies. Our review of fiscal year 1999 

country assistance strategies did not reveal any cases in which the Bank 

included a discussion of the risks to development posed by weak financial 

management and procurement practices in the borrowing countries. 

Since the types and level of Bank financing appear to have been set through 

the country lending process without a full consideration of these important 

risk management tools, the Bank may have missed an important 

opportunity to better target its anticorruption risk assessments and 

leverage its efforts to minimize opportunities for corruption in 

Bank-financed projects. A senior Bank official told us that the proper 

sequencing of these events is more likely to occur in the future as the Bank 

gains more experience.

17For example, the World Bank Institute has developed six clusters of governance indicators 

for over 150 countries. The six clusters are (1) voice and accountability, (2) political 

instability and violence, (3) government effectiveness, (4) regulatory burden, (5) rule of law, 

and (6) graft. 
B-282152

Page 25 GAO/NSIAD-00-73 World Bank Management Controls

Increased Emphasis 

Placed on Control 

Activities, but Project 

Auditing and 

Supervision Remain 

Weak 

According to COSO standards, effective control activities should be 

undertaken to ensure that management’s directives are carried out. The 

Bank has established various control activities to ensure that borrowers 

follow Bank rules when implementing Bank-financed projects. The 

borrowing nation monitors implementation of projects and reports 

progress and financial status periodically. Independent audits arranged by 

the borrower are a key component of the Bank’s control activities. For 

every project, the Bank requires the borrower to arrange for an 

independent auditing firm or institution to conduct an annual financial 

audit. Audits must include reviews of project financial reporting and testing 

of internal controls for the project. 

To supplement borrower monitoring and project audits, Bank staff conduct 

various types of procurement and financial management supervision of 

projects to ensure borrowers’ compliance with Bank rules. These activities 

include, among other things, reviewing project financial accounting, 

reporting, and auditing arrangements; reviewing bid awards and contracts; 

reviewing project expenditures; and visiting project sites. In some cases, 

Bank approvals of certain borrower actions are specifically required under 

the loan agreements. For example, for major procurements, representing 

about one-third of the value of total Bank-financed procurement contracts, 

Bank staff must pre-approve contract awards to ensure that they are fair 

and verify that contract expenditures are eligible under the loan agreement 

before Bank funds are disbursed. However, for the remaining 

procurements, Bank staff are only required to conduct spot-checks to 

ensure that Bank rules were followed.

In the past several years, the Bank’s internal auditor has identified 

significant weaknesses in some control activities. For example, recent 

Bank reports have revealed that many Bank-approved auditors produced 

audit reports that were late and of poor quality, with limited identification 

of problems. In addition, Bank studies for 1996 through 1998 noted that the 

Bank had not practiced appropriate financial management supervision and 

ensured that borrowers complied with the Bank’s basic financial 

accounting, reporting, and auditing requirements. For example, in a 

September 1998 report on the quality of Bank supervision, Bank reviewers 

found that financial management supervision, while improving, was less 

than satisfactory in over 30 percent of the projects reviewed. In addition, 

other Bank studies indicated that the Bank often failed to conduct required 

spot-checks of borrowers’ compliance with procurement and expenditure 
B-282152

Page 26 GAO/NSIAD-00-73 World Bank Management Controls

eligibility requirements . As a result, a large and growing percentage of the 

contracts financed by the Bank were awarded without any Bank review.

The Bank has made progress in strengthening project auditing and 

supervision, but it is not yet clear whether its efforts have been successful. 

Progress The Bank has devoted increased resources and attention to financial 

management and procurement supervision. In the financial management 

area, the Bank has increased awareness among staff about the importance 

of ensuring adequate financial management arrangements and reporting in 

its projects. It has also upgraded its financial management policies and 

procedures, established a framework for ensuring proper financial 

management, and provided additional staff and training for this purpose. 

In the procurement area, the Bank has taken a variety of steps to better 

supervise borrowers’ procurement activities and ensure that contracts 

were awarded in compliance with Bank guidelines. This has included hiring 

or training local Bank staff or contracting with local consultants to review 

borrowers’ procurement actions. In addition to improving routine 

procurement supervision, the Bank has undertaken a number of special 

procurement audits to help oversee the use of project funds. In fiscal 

years 1998 and 1999, the Bank conducted or contracted for intensive 

procurement reviews of 54 of its approximately 1,500 projects. Since 1996, 

the Bank identified cases in 26 projects in 16 countries in which the 

borrower did not comply with the Bank’s procurement rules. Thus, the 

Bank refused to finance contracts valued at at least $114 million. In 

addition, the Bank has debarred 44 firms and 9 individuals, prohibiting 

them from conducting future business with the Bank.18

18The information on Bank “misprocurements,” that is, expenditures that have not been 

procured in accordance with Bank procurement rules and related loan agreements, covers 

the period from January 1996 to November 1999. Data on bank misprocurements occurring 

before this date are not available, as they were not centrally tracked. Debarment data are 

through March 24, 2000. 
B-282152

Page 27 GAO/NSIAD-00-73 World Bank Management Controls

For some new projects, the Bank has also introduced innovative 

approaches to project design and implementation intended to provide more 

effective controls over the use of project funds. For example, in several 

new projects we reviewed, community-based monitoring programs are 

being devised that incorporated input from local citizen and user groups. 

The Bank believes that since these groups have a vested interest in the 

outcome of the projects, they will put pressure on responsible officials to 

ensure the proper use of project funds. In one country we visited, the Bank 

allocated project funds to hire local consultants to facilitate community 

involvement in project design and implementation, including monitoring of 

project expenditures. Project implementers posted detailed information in 

local villages on the schedule and cost of small infrastructure works 

financed by the project. Eight of the 12 new projects19 we reviewed 

specifically included some aspect of increased transparency or community 

involvement in the project design to help prevent the misuse of funds. 

Challenges Although there are signs of improvement in the quality of supervision, the 

Bank is still having difficulties in correcting some of the shortcomings that 

the Bank’s internal units and external auditors have highlighted. For 

example, according to a 1999 Bank study on procurement reform in two of 

the Bank’s six geographical regions, one of these regions had not 

conducted the required level of procurement supervision, even though both 

regions had engaged in significant hiring of new specialized staff and 

training of existing staff members to strengthen this function. Bank 

officials indicated that this region is taking corrective measures to ensure 

that the required level of procurement supervision is completed.

The Bank is also experiencing difficulty in meeting financial management 

supervision requirements. A 1999 Bank study found that the percentage of 

projects for which Bank staff meet basic financial management supervision 

requirements increased from about 70 percent in 1998 to about 80 percent 

in 1999.20 However, Bank officials who conducted this study noted that 

Bank performance in this area was still deficient, considering that the 

requirements “should have been easily attainable.” Bank officials are 

optimistic that performance of these basic requirements will improve 

further as the Bank continues to build its financial management capacity. 

19Approved since November 1, 1998.

20Supervision Quality in Fiscal Year 1999: A Quality Assurance Group Assessment

(Washington, D.C.: World Bank, Oct. 7, 1999).
B-282152

Page 28 GAO/NSIAD-00-73 World Bank Management Controls

However, the Bank is also establishing additional requirements that will 

make financial management supervision more challenging in the future.

We found little evidence that improved financial management supervision 

has resulted in any increase in the quality of project auditing. The 

previously cited 1999 Bank study of financial management supervision 

indicated that Bank staff were generally more diligent about reviewing 

project audit reports. However, according to Bank managers we spoke to, 

supervision of project auditors is not considered the responsibility of Bank 

staff, and Bank staff conduct little quality control of audit work. 

Bank Conducts 

Extensive Monitoring, 

but Progress in 

Addressing Control 

Weaknesses Not 

Measured

According to COSO standards, an effective management control system 

requires monitoring of the controls to assess their quality over time and to 

ensure that problems are promptly resolved. Although the Bank has 

established an extensive array of mechanisms to monitor project 

management, it does not clearly measure progress the Bank is making in 

correcting management control weaknesses. Without a monitoring system 

that focuses on key areas of weakness, the Bank’s management and Board 

of Directors cannot be certain that the initiatives in the Bank’s 

anticorruption action plan are appropriate or sufficient to safeguard loan 

funds.

The Bank has a variety of systems to monitor and evaluate the quality of its 

management processes and controls. At the individual project level, Bank 

staff regularly (at least semiannually) submit a project status report, which 

includes the staff’s assessment of the progress of project implementation 

and the status of procurement and financial management, among other 

issues. These reports are compiled and analyzed annually to provide Bank 

management and the Board with a detailed report on overall portfolio 

performance. In addition to this reporting, various Bank units conduct 

evaluations of Bank project management. The Bank’s internal auditor has 

conducted occasional audits of various aspects of Bank supervision of 

Bank projects. The Bank’s quality assurance unit has taken a systematic 

evaluation approach, conducting annual studies to evaluate the quality of 

new project designs and Bank supervision activities. Finally, the Bank’s 

external auditor assesses annually the adequacy of the Bank’s management 

controls over financial reporting.

The Bank has made progress in using new tools for monitoring and 

evaluating the implementation of Bank projects. However, it faces 
B-282152

Page 29 GAO/NSIAD-00-73 World Bank Management Controls

challenges in ensuring that it corrects acknowledged weaknesses in 

management control activities.

Progress The Bank has improved its monitoring mechanisms by assigning 

responsibility for tracking Bank-wide compliance with quality standards 

for project supervision to a central operations group. This unit draws upon 

various monitoring mechanisms in place and has established some new 

ones. To assess progress on procurement reforms, the unit has sponsored 

new studies of two regions in 1999, with similar studies to follow in the 

future. To assess progress in financial management reform, the unit focuses 

on the quality assurance group’s annual review of supervision quality. In 

addition, in 1999, the unit solicited status reports on project supervision 

from the regional procurement and financial management advisors in each 

of the Bank’s six regions and compiled annual status reports for Bank 

management. 

Challenges Bank monitoring efforts do not fully assess the impact of Bank efforts to 

improve the strength of its management controls over project lending. In 

particular, the Bank’s monitoring efforts do not focus on key deficiencies in 

management controls highlighted by Bank studies in the past few years. 

Consequently, we were unable to determine the extent to which the Bank 

has corrected these deficiencies. In particular, we were unable to 

determine whether the quality of project audits has improved or whether 

Bank staff have conducted required reviews of project procurement, 

financial reporting, and expenditure eligibility.

The Bank does not systematically monitor the quality of project audits. 

Although the Bank has a system for tracking compliance with auditing 

requirements, according to Bank officials this system generates unreliable 

data that cannot be used to reach firm conclusions because Bank staff have 

not consistently entered these data accurately or on time. The Bank’s 

planned implementation of a new management information system may 

improve the reliability of these data in the future. Based on our review of 

the Bank’s other periodic monitoring activities, none includes a systematic 

assessment of audit quality. For example, the Bank’s annual study of 

financial management supervision addresses whether Bank management 

received and reviewed the required audit reports but not the quality of the 

audit. Thus, the Bank has not determined the extent to which the reliability 

of project audits as a management control activity has improved.

In addition, the Bank conducts limited monitoring of the extent to which 

Bank staff carry out required supervision at the project level, the regional 
B-282152

Page 30 GAO/NSIAD-00-73 World Bank Management Controls

level, or the Bank-wide level. At the project level, Bank staff are not 

required to report on compliance with key procurement and financial 

management supervision requirements in their mandatory project status 

reports. For example, these reports do not indicate to what extent Bank 

staff conducted required spot-checks of completed procurement actions 

and project expenditures reports to ensure that the borrower complied 

with Bank rules. Regional-level monitoring and reporting on supervision 

performance have also been incomplete. The annual regional reports on 

procurement and financial management supervision do not provide an 

analysis of the extent to which each region conducted the required level of 

supervision. As a result, Bank management cannot use these reporting 

systems to compile Bank-wide data for assessing whether Bank staff are 

meeting supervision quality standards.

At the Bank-wide level, the Bank does some monitoring and evaluation of 

project supervision in the annual review of supervision quality, prepared by 

the Bank’s Quality Assurance Group. However, this review gives an 

incomplete picture of the quality of Bank supervision because it includes 

only certain supervisory activities and does not encompass some important 

Bank supervisory functions where performance has persistently been 

weak. For example, the review of procurement supervision does not 

address the Bank’s performance in conducting required spot-checks of 

contract awards made by borrowers.21 Similarly, the review of financial 

management supervision does not address the Bank’s performance in 

spot-checking the eligibility of project expenditures. As a result, the 

supervision quality scores generated by this study mask performance 

problems reported by external and internal auditors. 

The Bank also lacks meaningful performance indicators that could be used 

to monitor the impact of its institutional development efforts in 

strengthening management controls in borrowing countries. Only 2 of the 

31 country assistance strategies we reviewed established measurable 

indicators for improving the anticorruption environment. Also, an 

evaluation of the Bank’s anticorruption efforts in two African countries 

prepared by a World Bank consultant in 1998 indicated that the Bank’s 

performance indicators could not be used to measure the effectiveness of 

the Bank’s interventions and approaches. Bank officials told us that 

21According to Bank procurement staff, the assessment addresses the Bank’s performance in 

conducting prior review of proposed contract awards but not ex-post reviews of contracts 

awarded without the Bank’s prior approval. 
B-282152

Page 31 GAO/NSIAD-00-73 World Bank Management Controls

developing indicators to assess progress being made in this area is very 

difficult, but efforts are underway.

Information and 

Communication Have 

Increased, but 

Challenges Exist in 

Borrower Countries

COSO standards emphasize the need for information to be communicated 

in a form and time frame that enable people to carry out their 

responsibilities. Bank management recognized the need to increase the 

level and quality of its communications on anticorruption initiatives with 

its own staff and among borrowers and has launched a major effort to 

improve communications through a variety of outreach programs. This 

outreach effort has been conducted through the internet, special 

publications, Bank-sponsored conferences, workshops, training sessions, 

and other means.

Despite progress in improving information and communications, the Bank 

still faces challenges in raising awareness within borrowing countries.

Progress The Bank has strengthened communication with and coordination on 

anticorruption issues among international donors, nongovernmental 

organizations, former government officials, academicians, business 

leaders, and other organizations. The Bank has also worked in tandem with 

the Organization for Economic Cooperation and Development, an 

economic forum of major industrialized countries, to promote global 

initiatives, such as the International Anti-bribery Convention.

Challenges During our country visits, we found that some borrowing country staff and 

members of civil society charged with monitoring Bank projects were not 

fully aware of the Bank’s efforts to establish new mechanisms for 

countering fraud and corruption in Bank-financed projects. For example, 

we visited several locations during our field visits where civil organizations 

involved in monitoring Bank-financed projects were not aware of the 

hotline or other mechanisms for reporting allegations of fraud and 

corruption. As a result, allegations of fraud and corruption in Bank projects 

could potentially go unreported to the Bank’s Oversight Committee on 

Fraud and Corruption or be handled locally without the committee’s 

knowledge. Senior Bank officials confirmed that additional efforts need to 

be made to increase awareness of the anticorruption activities and 

resources within borrower countries, particularly project implementing 

agencies and beneficiaries.
B-282152

Page 32 GAO/NSIAD-00-73 World Bank Management Controls

Although the Bank’s external auditor does assess the adequacy of some 

management controls, the scope of the assessment is limited to controls 

relating to the Bank’s financial statement reporting. The scope of the 

external auditor’s annual assessment does not currently extend to controls 

over project lending. The Bank is planning to extend the scope of its future 

COSO reviews to include an examination of the efficiency and 

effectiveness of its operations, which will include its lending operations. 

Conclusions The Bank lends billions of dollars to developing countries each year in a 

difficult and challenging environment. Over the past several years, the 

Bank has made a vigorous attempt to strengthen its management controls 

and build borrower capacity to better manage Bank-financed projects to 

reduce opportunities for fraud and corruption on its projects. This effort 

has entailed making major improvements in the Bank’s internal oversight 

structure, project management, and institutional development strategies. 

However, these controls, although improving, are not yet strong enough to 

provide reasonable assurances that project funds are spent according to 

the Bank’s guidelines. Significant weaknesses still exist in each of the key 

components of the Bank’s management control system. Efforts are 

underway to address many of these weaknesses in (1) internal oversight 

mechanisms, (2) assessing risks in individual projects and in overall 

country assistance strategies, (3) allocating anticorruption assistance 

among borrowers based on risk, (4) monitoring and reporting progress in 

correcting management control deficiencies, and (5) disseminating 

information on anticorruption activities within borrowing countries. 

Additional steps would enable the Bank to further limit opportunities for 

fraud and corruption and safeguard project funds. Continual management 

attention would also help sustain the current improvement efforts and 

ensure these remaining weaknesses are fully addressed. Nevertheless, 

questions will remain about the adequacy of the steps taken to strengthen 

these controls unless the World Bank publishes periodic public progress 

reports. 

Recommendations To help ensure that the World Bank achieves its goal of obtaining 

reasonable assurance that project funds are spent as intended and that 

corruption risks are mitigated in Bank-financed projects, we recommend 

that the Secretary of the Treasury instruct the U.S. Executive Director of 

the World Bank to work with other Executive Board members to encourage 

the Bank to
B-282152

Page 33 GAO/NSIAD-00-73 World Bank Management Controls

(1) integrate investigative functions into a single unit and establish 

organizational independence of the unit to better address allegations of 

wrongdoing;

(2) include more complete information in project appraisal documents and 

country assistance strategies on the risks related to corruption and any 

procurement and financial management weaknesses of borrowers, as well 

as planned supervisory actions to mitigate the identified risks;

(3) target procurement and financial management assessments at countries 

where corruption risks are greatest; 

(4) monitor and report on progress in strengthening management controls 

and correcting past project management control weaknesses, including 

results of efforts to strengthen project auditing and supervision; and

(5) develop a plan to raise awareness of the Bank’s anticorruption program 

among project implementing agencies and beneficiaries.

Furthermore, to ensure that Bank’s anticorruption initiatives have the 

desired impact, we recommend that the Secretary of the Treasury monitor 

Bank progress in meeting each of the five components of an effective 

management control system and annually report to the Congress evidence 

of progress. 

Agency Comments and 

Our Response

We received written comments from the Department of the Treasury, the 

agency that represents the United States at the World Bank, as well as from 

the World Bank. These comments are reprinted in appendixes VII and VIII. 

In addition to their overall comments, the Treasury and the Bank provided 

technical comments, which we incorporated in the report as appropriate.

Treasury agreed with our findings and recommendations and characterized 

the report as a fair and constructive assessment of a difficult and 

challenging subject that provides helpful guidance to assess process and 

policy improvements at the Bank. Treasury said that the Bank should 

increase its up-front investment in project control systems, particularly 

those related to procurement, financial management, and audit. Moreover, 

Treasury also said that the Bank should be more aggressive in building 

borrowers’ capacity to fight corruption, in providing more project planning 

and reviews prior to contract award, and in performing more assignments 
B-282152

Page 34 GAO/NSIAD-00-73 World Bank Management Controls

of borrowers’ public sector management control mechanisms to provide 

greater assurance that project money is well spent.

The World Bank said our report provides valuable input into its ongoing 

anticorruption efforts. The Bank noted that it has made significant 

progress, given that it is about one year into implementation of its 

anticorruption action plan and that fighting corruption will require a longterm effort. The Bank also indicated that it is taking action on the issues 

and recommendations outlined in our report, including steps to (1) 

strengthen the independence of the Bank’s investigative functions, (2) 

report risks more explicitly in project documents, (3) allocate 

anticorruption assistance on the basis of risk, (4) improve monitoring tools, 

and (5) introduce greater public reporting on its anticorruption initiatives. 

The Bank agreed that there are still areas requiring improvement in its 

management control system but believes that, for the most part, it has 

reasonable assurance that project funds are spent as intended. As our 

report points out, it is generally recognized that all five of the Committee of 

Sponsoring Organizations of the Treadway Commission standards must be 

met for controls to be judged effective in any particular area of an 

organization’s operations, thus providing reasonable assurance that funds 

are spent as intended. We believe the Bank is not in a position at the time to 

gauge the extent to which this is the case due to the weaknesses in its 

current system of controls described in our report.

We are providing copies of this report to the Honorable Lawrence 

Summers, the Secretary of the Treasury; James Wolfensohn, the President 

of the World Bank; and interested congressional committees. Copies will be 

made available to other interested parties upon request.
B-282152

Page 35 GAO/NSIAD-00-73 World Bank Management Controls

This report was prepared under the direction of Benjamin Nelson, Director, 

International Relations and Trade Issues, who may reached on 

(202) 512-4128 if you have any questions about this report. Other contacts 

and key contributors are listed in appendix IX. 

Henry L. Hinton, Jr. 

Assistant Comptroller General 
Page 36 GAO/NSIAD-00-73 World Bank Management Controls

Appendix I

Chronology of Major World Bank Efforts to 

Strengthen Management Control System ApendxiI

Since 1995, the Bank has undertaken a series of steps to strengthen its 

management control system. Figure 2 outlines major milestones in this 

effort.

Figure 2: Milestones in the World Bank’s Efforts to Strengthen its Management 

Control System, 1995-2000

Source: World Bank.

•October: Bank President addresses the “cancer of corruption” at World

Bank/International Monetary Fund annual meetings

•February: “Strategic Compact” introduced, which includes mandate and

resources to hire additional financial management and procurement

specialists, strengthen Bank’s fiduciary functions, provide anticorruption

assistance to interested borrowers, launch an ethics outreach program, and

undertake selective procurement audits

•September: Anticorruption strategy adopted, entitled “Helping Countries

Combat Corruption - the Role of the World Bank”

•January: Anticorruption action plan announced to staff

•December: Revised code of ethics introduced

•June: Directive introduced requiring more rigorous assessments of

countries’ procurement systems

•July: Directives aimed at improving project financial management take

effect for new projects

•October: 24-hour worldwide anticorruption hotline introduced

•November: Directives aimed at improving project procurement take effect

for new projects

Year Milestones

World Bank adopts internationally accepted standards of effective

management control

•January: Task force formed to review risk management system

1998

1999

2000

1995

1996

1997
Page 37 GAO/NSIAD-00-73 World Bank Management Controls

Appendix II

Implementation Status of the World Bank’s 

Anticorruption Action Plan ApendxiI

In 1997, the World Bank adopted an anticorruption strategy as outlined in a 

report titled “Helping Countries Combat Corruption: The Role of the World 

Bank.” To implement its strategy, the Bank subsequently put together an 

Anticorruption Action Plan. This plan outlines a series of anticorruption 

activities for the Bank to undertake aimed at (1) strengthening internal 

oversight mechanisms within the Bank, (2) improving the Bank’s project 

management processes, (3) strengthening public institutions in borrower 

countries, and (4) supporting international efforts to reduce corruption. 

Table 1 shows the implementation status of the Bank’s anticorruption plan 

as of December 1999.

Table 1: The Status of the Action Plan, as of December 1999

World Bank Action 

Status of

implementation

1 Strategy setting and dissemination

• Update strategy. Develop messages for annual meetings, and briefing materials.

Completed

• Present to the Board a public sector strategy paper and governance update. Completed

2 Executive Directors’ briefing

• Brief the Board on the implementation of the Bank’s anticorruption action plan.

Completed

3 Anticorruption web sites

• Establish web sites to share country experiences.

Completed

• Expand internal and external web sites. Underway

4 Anticorruption workshop and conference

• Conduct workshop on lessons learned from the Bank’s experience with corruption.

Completed

• Conduct conference on analytical developments, i.e., lessons learned from a sector standpoint. Underway

5 Major reports on corruption

• Submit outline for possible World Development Report on institutions, including corruption.

Completed

• Prepare Europe and Central Asia Region anticorruption report. Underway

6 Rules for reporting and handling fraud and corruption allegations

• Present proposal to senior management to clarify rules for reporting and handling internal and external 

fraud and corruption allegations.

Completed

7

Workshop on procurement practices

• Conduct workshop with experts to generate ideas on useful modern procurement practices.

Completed

8 Staff survey

• Survey staff on Bank culture, ethics, and their willingness to report corruption.

Completed

9 Security plan

• Prepare action plan to increase security for staff.

Completed

10 Annual meetings

• Hold seminar on corruption at the October 1998 annual meetings.

Completed

Continued
Appendix II

Implementation Status of the World Bank’s 

Anticorruption Action Plan

Page 38 GAO/NSIAD-00-73 World Bank Management Controls

World Bank Action 

Status of

implementation

11 Hotline

Launch hotline for reporting internal fraud and corruption.

Completed

12 Staff training

• Hold orientation for all regional staff, including resident mission staff.

• Provide specialist training.

Substantially 

completed

13 Accountability within regional departments

• Designate within each of the regions clear accountability and resources for anticorruption efforts.

Substantially 

completed

14 Project design support

• Establish a focal point within the Operational Core Services Network for links between project design 

and corruption.

Completed

• Assist operational staff, through best practice dissemination and advice, in project design features that 

can help to reduce corruption in Bank projects.

Underway

15 Publication of series of anticorruption notes

• Publish notes to provide guidance on corruption diagnosis and public sector reform approaches.

Underway

16 Procurement capacity building and risk analysis

• Complete scheduled country procurement assessment reviews in high-risk countries.

• Procurement Board to help teams implement new procedures for project capacity/risk analysis and 

evaluate experience.

Underway

 17 Financial management

• Implement the Loan Administration Change Initiative to ensure that all World Bank projects appraised 

after June 1998 meet minimum requirements for financial management.

• Increase the use of country financial accountability assessments, focusing on higher risk and priority 

countries.

Underway

18 Implement financial management and procurement reforms

• Assess and report on the first year’s experience with the implementation of financial management and 

procurement reforms. (completed)

• Adapt implementation of the reforms in light of the findings.

Underway

19 Require the systematic use of country risk assessments

• Issue guidelines for best practices and sequencing of the country procurement assessment reviews and 

the country financial accountability assessments.

Underway

20 Country requests for assistance

• Undertake anticorruption programs in countries requesting assistance (e.g., corruption studies, surveys 

and workshops, policy and institutional reform).

Underway

• Implement institutional reforms in countries that have a clear commitment and request assistance. Underway

21 Institutional reviews

• Undertake 4-5 pilot institutional reviews, including diagnostic work on governance and public sector 

performance, which will provide input in formulating country strategies and designing projects.

Underway

22 Research, training, and dissemination of best practices

• Undertake surveys and workshops, conduct training programs, and publish research reports.

Underway

23 Special topics

• Investigate the boundaries of Bank involvement in the area of political finance and corruption.

Planned

24 Country assistance strategy

• Explicitly address governance and corruption in every country assistance strategy. 

Underway

Continued from Previous Page
Appendix II

Implementation Status of the World Bank’s 

Anticorruption Action Plan

Page 39 GAO/NSIAD-00-73 World Bank Management Controls

Legend

COSO = Committee of Sponsoring Organizations of the Treadway Commission

Note: This table provides the status of the World Bank’s implementation of its anticorruption action 

plan, which was presented to the Board in November 1998 and updated in July and December 1999.

Source: World Bank.

World Bank Action 

Status of

implementation

25 High-risk countries

• Focus on countries with high indicators of corruption.

Underway

26 Anticorruption and lending

• Finalize Bank policy note on anticorruption and lending, including adjustment lending, in high-risk 

countries.

Underway

27 Governance

• Refine, evaluate, and disseminate internally existing governance indicators.

• Prepare principles or code of good governance.

Underway

28 International Development Association funding

• Assist in defining governance criteria for the Twelfth Replenishment of the International Development 

Association (IDA-12).

Underway

29 Sector strategy papers

• Require that anticorruption concerns are systematically addressed in key sector strategy papers.

Underway

30 Multilateral development banks and bilateral donors

• Share information and coordinate efforts with multilateral development banks and bilateral donors.

Underway

31 Nongovernmental organizations

• Continue collaboration with nongovernmental organizations on anticorruption.

Underway

32 Organization for Economic Cooperation and Development 

• Continue participation in the Working Group on Bribery.

• Assist Organization for Economic Cooperation and Development efforts to promote the antibribery 

convention in non-Organization for Economic Cooperation and Development countries.

Underway

33 Professional bodies and associations

• Enhance working relationships with international professional organizations such as the International 

Organization of Supreme Audit Institutions.

Underway

34 Crime and money laundering

• Continue participation in international conferences and other efforts to address international crime.

Underway

35 Projects and program evaluation

• Assess how corruption risks have been addressed in selected Bank projects and programs.

Underway

35 Ethics program

• Develop modern ethics management program, including updating the Code of Professional Ethics, 

providing integrity awareness training for staff, and investigating and addressing allegations of staff 

misconduct. 

Underway

37 COSO and internal controls

• Review adequacy of internal controls.

• Audit major risk areas of the Bank.

• Continue control self-assessments in Bank units.

• Report status of internal controls to the Audit Committee.

• Managing directors and vice presidents to annually submit a letter of representation on the adequacy of 

internal controls in their respective areas.

Underway

Continued from Previous Page
Page 40 GAO/NSIAD-00-73 World Bank Management Controls

Appendix III

The Committee of Sponsoring Organizations 

of the Treadway Commission’s Management 

Control Framework ApendxiI

In 1995, the World Bank adopted the Committee of Sponsoring 

Organizations of the Treadway Commission (COSO) framework to 

establish a common definition of management controls for all Bank units 

and a standard against which unit managers and auditors can assess and 

measure progress in improving management controls. GAO and other 

professional bodies use this framework, referred to as the “Internal 

Controls−Integrated Framework,” as a standard in evaluating management 

controls. (See GAO’s Nov. 1999 standards that update and replace the 

previous standards first issued in 1983).1

The COSO framework emphasizes accountability and ownership of 

controls at all levels. Under this model, the effectiveness of a management 

control system is measured by its capacity to provide reasonable assurance 

to the Executive Board of Directors and management regarding the 

achievement of their objectives in the following three categories:

• effectiveness and efficiency of operations,

• reliability of financial reporting, and

• compliance with applicable laws and regulations.

Management Control 

Components

Under COSO, management control is defined as consisting of five 

interrelated components that form the criteria for effective control. The 

five components are used as the criteria to evaluate the strengths and 

weaknesses of the controls and to identify what actions can be taken to 

improve controls. All five components must be present and effective in 

order for management to have the reasonable assurance needed. These 

components include the following:

Control environment. An organization should establish a positive control 

environment, that is, one with a structure, discipline, and climate 

conducive to sound management controls. Factors that significantly affect 

the control environment include the integrity and ethical values of 

management and staff, the competence of personnel, the way the agency is 

organized, the manner in which management assigns authority and 

responsibility, and the attention and direction provided by oversight 

groups.

1

Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, 

Nov. 1999).
Appendix III

The Committee of Sponsoring Organizations 

of the Treadway Commission’s Management 

Control Framework

Page 41 GAO/NSIAD-00-73 World Bank Management Controls

Risk assessment. An organization should properly identify, analyze, and 

manage the possible risks involved in meeting organizational objectives.

Control activities. An organization should establish control activities 

consisting of policies, procedures, techniques, and mechanisms that ensure 

that management directives are being carried out to meet organization 

objectives. They include approvals, authorizations, verifications, and 

reviews of operating performance.

Monitoring. An organization should continually monitor and evaluate all 

aspects of management control to assess the quality of performance over 

time. Serious management control deficiencies should be reported to 

higher levels, including top management and the Board of Directors.

Information and communication. An organization should identify, capture, 

and communicate information in a form and time frame that enable people 

to carry out their responsibilities.

World Bank 

Implementation 

Schedule

In 1995, the Bank established a 5-year timeline to ensure that, by the end of 

fiscal year 2000, management will be able to express assurance that 

adequate controls are in place, not only for financial reporting purposes, 

but also for efficiency and effectiveness of operations. The Office of 

Controller made a commitment to 

• meet the COSO standards for control effectiveness across the Bank’s 

major operational areas by the end of fiscal year 1996;

• extend the COSO standards for prudential controls to nonfinance 

organizational units in the Bank in fiscal year 1997;

• assert that both the International Bank for Reconstruction and 

Development and the International Development Association have 

maintained effective controls over financial reporting as of June 30, 

1997, and obtain the external auditor’s agreement;

• expand the application of the COSO framework during fiscal years 1998 

and 1999, so that issues of organizational efficiency and effectiveness 

are brought to light; and

• become an institution in which Bank management and staff will have 

the ability and process in place to analyze the effectiveness of internal 

controls for their areas of responsibility.
Appendix III

The Committee of Sponsoring Organizations 

of the Treadway Commission’s Management 

Control Framework

Page 42 GAO/NSIAD-00-73 World Bank Management Controls

In order to meet these goals, the Office of Controller adopted the Control 

Self-Assessment methodology for assessing controls based on the COSO 

framework. This approach uses the staff from various Bank units to

• review the business unit’s objectives, key processes supporting the 

stated objectives, associated risks, and mitigating controls; under 

normal circumstances, testing of key controls and documentation of 

testing is required;

• hold workshops to (1) analyze obstacles and strengths that affect the 

organization’s ability to achieve key business objectives and (2) decide 

upon an approach to address issues arising from the process;

• identify reportable conditions requiring control enhancements together 

with the results of the control self-assessment workshop in the business 

unit’s action plan; and

• obtain representation letters from all the Bank’s senior managers 

acknowledging their responsibility for effective controls and confirming 

that they have maintained an effective system of management control.

The control self-assessment methodology was initiated during fiscal year 

1996. Bank management has issued a series of reports to the Audit 

Committee of the Executive Board on the Bank’s progress made in 

implementing the COSO management control framework. The Internal 

Audit Division also issued annual reports in 1998 and 1999 providing 

independent observations and findings on internal controls in the Bank 

based on prior audits and the control self-assessment workshops. In 1999, 

the Bank concluded that it met the COSO criteria for effective internal 

control over financial reporting for the International Bank for 

Reconstruction and Development and the International Development 

Association. The Bank’s external auditor examined management’s assertion 

and concluded that it was fairly stated, in all material respects. Bank 

management has not made an assertion regarding the adequacy of internal 

controls over operations. 
Page 43 GAO/NSIAD-00-73 World Bank Management Controls

Appendix IV

World Bank Management Control Structure ApendxiIV

Source: World Bank.

Oversight Committee on

Fraud and Corruption

Board of Executive Directors

Bank President

Operations 

Evaluation 

Department

Inspection Panel

Internal 

Auditing 

Department

World Bank 

Institute

Operational 

Core Services 

Network

Office of 

Professional 

Ethics

General Counsel

Legal

Managing Director

Vice President 

and Controller

Human 

Resources

Loan 

Administration

Managing Director

Quality 

Assurance 

Group

Managing Director

Poverty 

Reduction and 

Economic 

Management 

Network

Senior Vice President 

and Chief Economist

Regional 

Departments

(AFR, MENA, 

SAS)

Regional 

deparments 

(EAP, ECA, 

LAC)

Office of the 

Ombudsman

AFR = Africa

EAP = East Asia & Pacific

ECA = Europe & Central Asia

LAC = Latin America & Caribbean

MENA = Middle East & North Africa

SAS = South Asia

Investigative Hotline

Unit

External 

Auditor

Board Committee

on Development 

Effectiveness

Board Personnel 

Committee

Board Audit 

Committee

Senior Vice 

President and 

Chief Financial 

Officer

Legend
Page 44 GAO/NSIAD-00-73 World Bank Management Controls

Appendix V

Management Controls in the World Bank’s 

Project Lending ApendxiV

The Bank and borrowers share responsibility for establishing and 

maintaining effective management controls. The borrower is responsible 

for execution of project procurement and financial management in 

accordance with Bank policies and procedures, as agreed with the Bank. 

The Bank is responsible for monitoring and supervising procurement and 

financial management on a continuing basis until project completion. The 

major management controls that Bank projects are subject to are outlined 

as follows.

Procurement Project procurement capacity assessment: Prior to project approval, the 

Bank independently assesses the adequacy of the procurement 

arrangements and plans, focusing on the institutional capacity to carry out 

these arrangements and assess risks involved. Based on this assessment, 

the Bank and the borrower develop an action plan to address any 

deficiencies.

Contract award and management: During project implementation, the 

borrower is responsible for ensuring that contracts for goods and works 

are awarded and managed in accordance with the policies and procedures 

agreed to with the Bank. For each contract, the borrower is required to 

document the procurement process, including analyzing bids, and to make 

this documentation, as well as the contract and other relevant information, 

available to the Bank.

Prior procurement reviews: For procurement contracts above a specified 

monetary threshold, the Bank reviews the procurement documents before 

the contract award is made to ensure that the borrower follows Bank 

procurement guidelines. The prior review thresholds vary by project, 

depending on the implementing agency and type of contract awarded.

Ex-post procurement reviews: Contracts not subject to prior review are 

subject to ex-post review by the Bank on a sample basis to ensure that they 

were awarded in compliance with Bank procurement guidelines. Minimum 

sample size varies by project and generally ranges from 5 percent to 

20 percent of contracts, depending on the implementing agency.

Financial Management Project financial management assessment: Prior to project approval, the 

Bank independently assesses the adequacy of the financial management 

arrangements, including accounting, financial reporting, and auditing 
Appendix V

Management Controls in the World Bank’s 

Project Lending

Page 45 GAO/NSIAD-00-73 World Bank Management Controls

systems, to ensure that they can provide accurate and timely information 

on project resources and expenditures. The assessment focuses on the 

borrower’s institutional capacity to carry out these arrangements and 

analyze the risks involved. Based on this assessment, the Bank and the 

borrower develop an action plan to address any deficiencies.

Financial accounting, reporting, and auditing : During project 

implementation, the borrower is responsible for maintaining a financial 

management system, including records and accounts, and for preparing 

financial statements in a format acceptable to Bank adequate to reflect the 

operations, resources, and expenditures related to the project. The 

borrower must have the financial statements for each year audited by 

independent auditors acceptable to the Bank. 

Annual audited financial statements must be submitted to the Bank by an 

agreed date and include (a) an assessment of the adequacy of accounting 

and internal controls systems to monitor expenditures and other financial 

transactions and ensure safe custody of project- financed assets; (b) a 

determination as to whether the borrower and project implementing 

entities have maintained adequate documentation on all relevant 

transactions; and (c) verification that expenditures submitted to the Bank 

are eligible for financing, and identification of any ineligible expenditures. 

Prior approval of auditor: Bank staff are required to approve the auditor 

based on a review of the auditor’s independence, qualifications, 

experience, and terms of reference and inform the borrower whether the 

auditor is acceptable.

Review and follow-up of audit reports: Bank staff ensure that audits are 

submitted on time, that their scope and quality are acceptable, and that any 

deficiencies identified in the project’s accounting and internal controls, or 

in the reliability of financial statements, are corrected by the implementing 

agency. 

Prior review of project expenditures: For major contracts above a specified 

monetary threshold, the Bank reviews the borrowers’ withdrawal 

applications before disbursing loan funds to ensure expenditures are 

authorized, eligible, and adequately documented.

Ex-post review of project expenditures: Expenditures for contracts not 

subject to prior review by the Bank are subject to ex-post review by Bank 

staff to ensure that they were authorized, eligible, and adequately 
Appendix V

Management Controls in the World Bank’s 

Project Lending

Page 46 GAO/NSIAD-00-73 World Bank Management Controls

documented. The sample size for such reviews is not clearly specified in 

Bank guidelines.
Page 47 GAO/NSIAD-00-73 World Bank Management Controls

Appendix VI

Objectives, Scope, and Methodology ApendxiVI

To determine whether the Bank’s management control system provides 

reasonable assurances that project funds are spent as intended, we 

assessed each of the following components of that system: the control 

environment, risk assessment, control activities, monitoring, and 

information and communication. For each of the five components, we

(1) identified acknowledged management control weaknesses, (2) assessed 

the Bank’s progress in addressing those weaknesses or otherwise 

strengthening management controls, and (3) identified remaining 

challenges in assuring the improvement measures are consistent with 

COSO management control standards. 

To identify acknowledged management control weaknesses, we reviewed 

numerous internal Bank reports and special studies prepared by the 

Controller’s Office, the Internal Audit Department, the Operations 

Evaluation Department, the Quality Assurance Group, and other Bank units 

and consultants. We also interviewed a variety of senior Bank officials 

throughout the Bank for additional background, details, and clarification of 

these issues. 

To identify the progress made by the Bank in strengthening management 

controls, we reviewed the Bank’s 1997 anticorruption strategy and related 

initiatives aimed at strengthening internal oversight units, improving 

project management, and strengthening public institutions in borrower 

countries to reduce opportunities for corruption. We interviewed and 

obtained documentation about these initiatives from numerous World Bank 

officials in Washington and in four countries. We also met with 

representatives of the Board of Executive Directors Audit Committee, the 

U.S. Department of the Treasury, and other multilateral institutions, such as 

the International Monetary Fund, the Asian Development Bank, the United 

Nations Development Program, and nongovernmental organizations. 

To identify remaining challenges, we evaluated how key management 

control units were implementing the World Bank’s initiatives. With regard 

to internal oversight issues, we reviewed the operations of the Office of 

Professional Ethics, Oversight Committee on Fraud and Corruption, 

Investigative Unit, and the Internal Audit Department, and other Bank 

units. We reviewed their mandates, composition, reporting authority, 

policies and procedures, and a random sample of reports and cases relating 

to allegations of fraud and corruption in Bank projects. With regard to 

project management, we reviewed the operations of key units involved in 

project implementation, including the Operational Core Services Network, 

the Controller’s Office, and all six regional offices. We reviewed 
Appendix VI

Objectives, Scope, and Methodology

Page 48 GAO/NSIAD-00-73 World Bank Management Controls

12 randomly selected projects for 12 different countries approved between 

November 1, 1998, and July 1, 1999, and a judgmental sample of 6 ongoing 

projects approved prior to November 1998. As part of these file reviews, we 

reviewed project documents, interviewed some Bank and borrower project 

staff, and conducted several site visits. We also reviewed a variety of 

internal Bank reports and studies on project management and supervision 

conducted by the Internal Audit Department, the Operations Evaluation 

Department, and the Quality Assurance Group, and other Bank units and 

interviewed officials involved in preparing these reports and studies. With 

regard to strengthening public institutions in borrower countries, we 

examined a random sample of 30 country assistance strategies and related 

documents approved since June 1, 1998, to determine how corruption and 

good governance issues were addressed. 

We did our work from January 1999 through December 1999 in accordance 

with generally accepted government auditing standards.
Page 49 GAO/NSIAD-00-73 World Bank Management Controls

Appendix VII

Comments From the Department of the 

Treasury ApendxiVI
Appendix VII

Comments From the Department of the 

Treasury

Page 50 GAO/NSIAD-00-73 World Bank Management Controls
Appendix VII

Comments From the Department of the 

Treasury

Page 51 GAO/NSIAD-00-73 World Bank Management Controls
Page 52 GAO/NSIAD-00-73 World Bank Management Controls

Appendix VIII

Comments From the World Bank ApendxiVI

Note: GAO comments 

supplementing those in 

the report text appears at 

the end of this appendix.
Appendix VIII

Comments From the World Bank

Page 53 GAO/NSIAD-00-73 World Bank Management Controls

See comment 1.

See comment 2.

See comment 3.
Appendix VIII

Comments From the World Bank

Page 54 GAO/NSIAD-00-73 World Bank Management Controls
Appendix VIII

Comments From the World Bank

Page 55 GAO/NSIAD-00-73 World Bank Management Controls
Appendix VIII

Comments From the World Bank

Page 56 GAO/NSIAD-00-73 World Bank Management Controls

The following are GAO’s comments on the World Bank’s letter dated

March 16, 2000.

GAO Comments 1. We agree that an important dimension of the Bank’s anticorruption 

effort is provided through policy dialogue, lending for adjustment and 

public sector reform, and advisory services as many borrowers lack 

well-functioning public management systems, accountable 

organizations, and a strong legal framework to prevent, detect, and 

redress corruption. Our report noted that the Bank has helped launch 

over 350 anticorruption activities in 95 countries, including a variety of 

initiatives designed to help borrowers strengthen public institutions 

and establish strong management controls on a countrywide basis.

2. We agree that the Bank’s role as a development institution is to work in 

countries that may have weak controls and capacity. However, we 

disagree that there is a blurring in the report between the Bank’s 

internal controls and those of the borrowers. The report focuses on the 

Bank’s system of controls to ensure project funds are used as intended, 

including its systems for project supervision, monitoring, and auditing. 

The report also recognizes that the responsibility for ensuring 

compliance with the Bank’s policies and procedures is shared by the 

Bank’s borrowers, which execute the projects, and the Bank, which 

supervises the projects through a variety of approvals and reviews of 

borrower actions. (See app. V for a description of the major 

management control activities.)

3. Our legislative mandate was to evaluate the control processes and 

anticorruption programs at the World Bank; thus, we did not analyze 

the anticorruption programs of other international financial 

organizations to see whether these organizations have reasonable 

assurances that project funds are being used as intended. 

Letr
Page 57 GAO/NSIAD-00-73 World Bank Management Controls

Appendix IX

GAO Contacts and Staff Acknowledgments ApendxiIX

GAO Contacts Harold Johnson, (202) 512-4128

Stephen M. Lord, (202) 512-4379

Acknowledgments In addition to those named above, Mark B. Dowling, Barney L. Gomez, 

Luisa Joy G. Labez, Rona H. Mendelsohn, Zina D. Merritt, James B. Michels, 

Gertrude O. Moreland, and Lawrence L. Suda also made key contributions 

to this report.

 (711371) Letr
Ordering Information The first copy of each GAO report is free. Additional copies of 

reports are $2 each. A check or money order should be made out to 

the Superintendent of Documents. VISA and MasterCard credit 

cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are 

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

Orders by visiting:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders by phone:

(202) 512-6000

fax: (202) 512-6061

TDD (202) 512-2537

Each day, GAO issues a list of newly available reports and 

testimony. To receive facsimile copies of the daily list or any list 

from the past 30 days, please call (202) 512-6000 using a touchtone 

phone. A recorded menu will provide information on how to obtain 

these lists.

Orders by Internet:

For information on how to access GAO reports on the Internet, 

send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web home page at: 

http://www.gao.gov

To Report Fraud, 

Waste, or Abuse in 

Federal Programs

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• e-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)

United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. GI00