WORLD FOOD 

PROGRAM

Stronger Controls 

Needed in High-Risk 

Areas

Report to the Committee on Foreign 

Affairs, House of Representatives

September 2012

GAO-12-790

United States Government Accountability Office

GAO
 United States Government Accountability Office

Highlights of GAO-12-790, a report to the 

Committee on Foreign Affairs, House of 

Representatives 

September 2012

WORLD FOOD PROGRAM

Stronger Controls Needed in High-Risk Areas

Why GAO Did This Study

In 2011, WFP provided about $4 billion 

in food assistance—including U.S. 

contributions of about $1.2 billion—to 

about 99 million beneficiaries in 75 

countries. Many of these countries 

include high-risk areas where WFP 

staff have limited access. In 2009, a 

media report alleged that large 

amounts of WFP’s food assistance 

were being diverted in one of these 

countries, Somalia. Subsequent 

external and internal audits found 

deficiencies in WFP’s control of its 

Somalia operations. In response, WFP 

took steps to strengthen its controls, 

including adopting the COSO internal 

control framework. To assess WFP’s 

ability to help assure that food reaches 

intended beneficiaries in high-risk 

areas, GAO examined the extent to 

which (1) the design of WFP internal 

controls related to delivery and 

monitoring of food assistance reflects 

COSO principles and (2) WFP has 

implemented as designed certain 

controls in selected high-risk areas. 

GAO reviewed COSO and other 

international principles; reviewed WFP 

policies, documents, and data; and 

interviewed WFP and U.S. officials. 

GAO conducted case studies of

Ethiopia, Kenya, and Somalia. 

What GAO Recommends

GAO recommends that the Department 

of State work through WFP’s Executive 

Board to ensure that management and 

the board take several actions to 

strengthen WFP’s ability to manage 

risks inherent in some environments as 

well as utilize the Audit Committee 

more fully and report losses more 

accurately. WFP, State, and other 

relevant U.S. agencies agreed with 

GAO’s recommendations.

What GAO Found

The design of the United Nations (UN) World Food Program’s (WFP) internal 

controls related to delivery and monitoring of food assistance generally reflects 

principles for internal controls and enterprise risk management developed by the 

Committee of Sponsoring Organizations of the Treadway Commission (COSO). 

WFP has developed an internal control framework that has, like the COSO 

internal control framework, five components: internal environment, risk 

management, control activities, information and communication, and monitoring. 

However, the design of some of WFP’s controls has weaknesses that could 

expose WFP to risks such as waste, fraud, and abuse. For example, WFP’s 

Executive Board oversight is limited, and it does not fully utilize the WFP Audit 

Committee to assist in overseeing the effectiveness of WFP’s risk management 

and internal control processes. Also, WFP has designed risk management 

policies but has not developed detailed guidance to instruct staff in addressing 

risks, especially at the country level where WFP is most vulnerable. Additionally, 

as recommended by COSO, WFP has established control activities that address 

risks to its objectives—for example, policies and procedures designed to help 

ensure tracking of food assistance from delivery at the port-of-entry to distribution 

to beneficiaries. However, weaknesses in the design of its commodity tracking 

system, including lack of capacity to track food in implementing partners’ 

custody, limit WFP’s ability to account for all food in these partners’ custody. 

Further, WFP has developed detailed policies for monitoring distribution of food 

assistance to beneficiaries, in line with COSO principles, but has not provided 

guidance that instructs staff to consider risk when determining needed levels of 

monitoring, including in high-risk areas where WFP staff have limited access. 

In the areas of Ethiopia, Kenya, and Somalia that GAO selected for its review, 

WFP has implemented procedures as designed for tracking and monitoring food 

assistance in its custody from port-of-entry to beneficiaries. However, WFP’s 

ability to account for food in the custody of implementing partners is constrained 

by the lack of tracking through its commodity tracking system, lack of timely 

reporting by some partners, and a limited number of monitors. In addition, 

security restrictions have limited WFP monitors’ access to partners’ warehouses 

and distribution sites in some high-risk areas. For example, in six districts in the 

southeast area of Ethiopia, WFP has not monitored implementing partners’ 

distribution sites since May 2011. Some of these factors may also limit WFP’s 

ability to provide accurate reporting of food assistance losses. Because its 

system does not track food in implementing partners’ custody and because of 

WFP’s restricted access to some sites, its calculation of food losses relies in part 

on partners’ distribution reports. However, these reports are sometimes late and 

inaccurate. Although operating in Somalia is inherently challenging, WFP 

reported an average loss rate of 0.25 percent for Somalia from 2007 through 

2011, compared with 0.41 percent for WFP’s operations globally. Moreover, 

despite concerns expressed by some WFP donors and Executive Board 

members, no external evaluation of WFP’s food loss data has been conducted 

since a 2006 review by WFP’s External Auditor. In that report, the Auditor noted 

that inadequate reporting of losses not only presents risks to the effectiveness of 

WFP’s aid efforts and the achievement of its objectives but also presents 

reputational risks in terms of donor confidence. 

View GAO-12-790. For more information, 

contact Tom Melito at (202) 512-9601 or 

melitot@gao.gov. 
Page i GAO-12-790 World Food Program Internal Controls

Letter 1 

Background 6

Design of WFP Internal Controls Related to Delivering and 

Monitoring Food Assistance Generally Reflects COSO Principles 

but Could Be Strengthened to Better Manage Risks 12

Security Restrictions and Limited Internal Controls Weaken 

Assurance of Food Delivery and Accurate Loss Reporting for 

Selected High-Risk Areas 35

Conclusions 55

Recommendations for Executive Action 56

Agency Comments and Our Evaluation 57

Appendix I Objectives, Scope, and Methodology 59

Appendix II World Food Program Governance, Oversight, and Management 

Structure 70

Appendix III Information on Case Study Countries—Ethiopia, Kenya, and Somalia 74

Appendix IV Comments from the World Food Program 82

Appendix V Comments from the U.S. Department of State 84

Appendix VI GAO Contact and Staff Acknowledgments 87

Related GAO Products 88

Contents
Page ii GAO-12-790 World Food Program Internal Controls

Tables

Table 1: WFP Direct Expenses for Ethiopia, 2007-2011 75

Table 2: WFP Direct Expenses for Kenya, 2007-2011 76

Table 3: WFP Direct Expenses for Somalia, 2007-2011 78

Table 4: Monitoring Data Reported by WFP for Ethiopia, Kenya, 

and Somalia 80

Table 5: Monitoring Data Reported by WFP for Selected GAO 

Fieldwork Sites and High-Risk Areas in Ethiopia, Kenya, 

and Somalia 81

Figures

Figure 1: WFP’s Operational Presence as of August 2012 7

Figure 2: Donor Contributions to WFP in 2011 9

Figure 3: WFP Governance, Oversight, and Management Structure 10

Figure 4: Examples of WFP Control Activities from Port-of-Entry to 

Distribution of Food Assistance 27

Figure 5: WFP Warehouse in Ethiopia 37

Figure 6: Distribution of WFP Food Assistance in Kenya 39

Figure 7: WFP’s Reported Food Assistance Losses in Ethiopia, 

Kenya, and Somalia and Worldwide, 2007-2011 49

Figure 8: WFP Management Structure 73

Figure 9: Timeline of Security and Humanitarian Events and 

Investigations into WFP Control Weaknesses in Somalia 79
Page iii GAO-12-790 World Food Program Internal Controls

Abbreviations

COSO Committee of Sponsoring Organizations of the Treadway 

 Commission 

COMPAS Commodity Movement, Processing and Analysis System

FAO Food and Agriculture Organization of the United Nations

EMOP emergency operation

ISO International Organization for Standardization

JIU Joint Inspection Unit

NGO nongovernmental organization

PRRO protracted relief and recovery operation

SMCA Strengthening Managerial Control and Accountability

UN United Nations

UNHCR United Nations High Commissioner for Refugees

UNDSS United Nations Department of Safety and Security

WFP World Food Program 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-12-790 World Food Program Internal Controls

United States Government Accountability Office 

Washington, DC 20548

September 13, 2012

The Honorable Ileana Ros-Lehtinen

Chairman

The Honorable Howard L. Berman

Ranking Member

Committee on Foreign Affairs

U.S. House of Representatives

The United States is the single largest donor to the United Nations (UN) 

World Food Program (WFP), contributing about $1.2 billion in cash and 

food in 2011—more than 30 percent of WFP’s revenue of about $3.7 

billion for the year. As the world’s largest humanitarian agency fighting 

hunger worldwide, in 2011 WFP provided food assistance to 99.1 million 

people in 75 countries, including a number of countries with areas that 

WFP has designated as high risk.1

In 2009, a media report alleged that large amounts of WFP’s food 

assistance in Somalia were being diverted to contractors, Somali clans, 

and local UN staff. Following the media report, WFP’s Office of 

Inspections and Investigations, the UN Monitoring Group on Somalia, and 

WFP’s External Auditor issued reports that found weaknesses in WFP’s 

control of its operations in Somalia.

In these areas, WFP staff may have 

limited access to those in need of food assistance and be endangered by 

local conflict or crime. For example, in high-risk areas in Somalia and 

Ethiopia, several WFP staff members were killed in 2011 while performing 

their duties, and WFP has lost 7 staff members and 13 WFP partner staff 

members in attacks in Somalia since 2008. 

2

 

1

Unless otherwise indicated, “WFP” refers to WFP management, including management 

at WFP headquarters, regional bureaus, and country offices.

Acknowledging that operating in 

Somalia is difficult and dangerous, WFP suspended activities in many 

parts of southern Somalia in January 2010 after an Islamist terrorist group 

controlling those areas, known as al-Shabaab, imposed unacceptable 

2

World Food Program, Office of Inspections and Investigations, Investigations of 

Allegations of Food Diversions in Somalia, OSDlI51/09-I 29/09 (2009); UN Security 

Council, Report of the Monitoring Group on Somalia pursuant to Security Council 

Resolution 1853 (2008), S/2010/91 (Geneva, Switzerland: 2010); Comptroller and Auditor 

General of India, External Audit Report: World Food Program’s Somalia Operations, 

WFP/EB.1/2011/5-B/1 (2011).

 
 

Page 2 GAO-12-790 World Food Program Internal Controls

operating conditions. In July 2011, WFP resumed food assistance in 

some areas that were no longer under al-Shabaab’s control, after the UN 

reported that the situation in southern Somalia had reached famine 

proportions. In its March 2010 report, the UN Monitoring Group on 

Somalia noted that the aid community had come to accept a certain level 

of risk, loss, theft, and diversion as “the cost of doing business” in 

Somalia.3 In addition, in its July 2012 report, the UN Monitoring Group 

stated that large-scale diversion of humanitarian assistance occurs in 

parts of Somalia but that WFP is taking all possible measures to 

investigate and address allegations of theft.4

In recent years, WFP has reported having designed and implemented a 

number of initiatives to strengthen its internal controls in Somalia and 

worldwide, including adopting principles from the Committee of 

Sponsoring Organizations of the Treadway Commission’s (COSO) 

“Internal Control—Integrated Framework” (COSO internal control 

framework).

International 

nongovernmental organizations (NGOs) and the media also continue to 

report diversion of food assistance in Somalia.

5

 

3

UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security 

Council Resolution 1853 (2008), S/2010/91 (2010).

Internal control generally serves as a first line of defense in 

safeguarding assets and is broadly defined as a process designed to 

provide reasonable assurance regarding (1) effectiveness and efficiency 

of operations; (2) reliability of financial reporting; and (3) compliance with 

4

UN Security Council, Report of the Monitoring Group on Somalia and Eritrea Pursuant to 

Security Council Resolution 2002 (2011), S/2012/544 (2012).

5

Committee of Sponsoring Organizations of the Treadway Commission, Internal Control—

Integrated Framework (1992). COSO was formed in 1985 to sponsor the National 

Commission on Fraudulent Financial Reporting, an independent, private-sector initiative 

that studied the causal factors that can lead to fraudulent financial reporting and 

developed recommendations for public companies and their independent auditors; the 

U.S. Securities and Exchange Commission and other regulators; and educational 

institutions. In 1992, COSO issued “Internal Control—Integrated Framework” to help 

businesses and other entities assess and enhance their internal control. Since that time, 

COSO’s internal control framework has been recognized by regulatory standards setters 

and others as a comprehensive framework for evaluating internal control, including 

internal control over financial reporting. 
 

Page 3 GAO-12-790 World Food Program Internal Controls

laws and regulations.6 In 2012, WFP’s former Executive Director 

described the organization’s system of internal control as designed to 

identify, evaluate, and reduce and manage—rather than eliminate—the 

principal risks of failure to achieve WFP’s objectives.7

As part of our current work on international food assistance,8 we sought 

to determine whether WFP systems are designed and implemented to 

help ensure that its food assistance reaches intended beneficiaries.9

1) the design of WFP internal controls related to the delivery and 

monitoring of food assistance reflects COSO principles and

This 

report examines the extent to which

2) WFP has implemented as designed certain controls related to the 

delivery and monitoring of food assistance in selected high-risk areas.

To address these objectives, we reviewed COSO’s internal control 

framework as well as COSO’s “Enterprise Risk Management—Integrated 

Framework”10

 

6

Committee of Sponsoring Organizations of the Treadway Commission, Internal Control—

Integrated Framework. According to COSO, an internal control system, no matter how well 

conceived and operated, can provide only reasonable—not absolute—assurance 

regarding achievement of an entity’s objectives. The likelihood of achievement is affected 

by limitations inherent in all internal control systems, such as faulty decision-making and 

resource constraints.

and related international principles and guidelines, 

including those in the International Organization for Standardization’s 

7

World Food Program, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012). 

The former WFP Executive Director served from April 2007 to April 2012, when Ertharin 

Cousin began her tenure. 

8

Our current work on international food assistance includes a review, forthcoming in 

September 2012, of USAID’s targeting of international food assistance. 

9

Throughout this report, “beneficiaries” refers to recipients of WFP food assistance. 

10Committee of Sponsoring Organizations of the Treadway Commission, “Enterprise Risk 

Management—Integrated Framework (2004). According to COSO, a key objective of this 

framework is to help managements of businesses and other entities better deal with risk in 

achieving an entity’s objectives. 
 

Page 4 GAO-12-790 World Food Program Internal Controls

(ISO) “ISO 31000 Risk Management—Principles and Guidelines.”11 We 

focused our review on WFP’s internal controls related to the delivery and 

monitoring of food assistance, primarily from port-of-entry to distribution to 

intended beneficiaries, because of WFP’s vulnerability to risks such as 

the alleged food diversion in Somalia during these stages of food 

assistance management. We did not review other processes, such as 

procurement, finance, and budget processes. We analyzed relevant WFP 

policies and procedures, relevant documents, and data related to internal 

controls at WFP’s corporate level and at the country level for three case 

study countries—Ethiopia, Kenya, and Somalia. We selected these 

countries based on a range of criteria, including U.S. contributions, 

amount of food assistance received, high-risk and non-high-risk 

environments in each country, and logistics and budget constraints. 

Because WFP operates in many countries and implements many different 

activities in each country, our case studies are not generalizable to all 

WFP countries and operations. We focused our review on emergency 

and protracted relief and recovery operations, which represent about 80 

percent of WFP’s operations, and on general food distribution activities 

within these programs. In addition to reviewing WFP’s internal controls 

and risk management process, we analyzed WFP’s methods for 

estimating losses of food commodities after arrival at the port-of-entry.12

 

11International Organization for Standardization, ISO 31000 Risk Management—Principles 

and Guidelines (2009). ISO is intended to be a family of standards relating to 

We reviewed WFP and external oversight reports and also reviewed

relevant U.S. government documents, including monitoring reports on 

WFP operations. We conducted fieldwork in Ethiopia and Kenya; 

however, we did not conduct fieldwork in Somalia because of logistical 

constraints and security concerns. We met with WFP Headquarters 

officials in Rome, Italy, officials from WFP’s East and Central Africa 

Regional Bureau in Nairobi, Kenya, and with WFP country officials for 

Ethiopia, Kenya, and Somalia. We also met with officials from the U.S. 

Agency for International Development (USAID), the U.S. Mission to the 

UN Agencies in Rome, the Food and Agriculture Organization of the 

risk 

management codified by the International Organization for Standardization. The purpose 

of “ISO 31000 Risk Management—Principles and Guidelines” is to provide principles and 

generic guidelines on risk management. ISO 31000 seeks to provide a universally 

recognized paradigm for practitioners and companies employing risk management 

processes to replace the myriad of existing standards, methodologies and paradigms that 

differed between industries, subject matters and regions.

12WFP refers to losses of food commodities after arrival at the port-of-entry as postdelivery losses. Throughout this report, we refer to such losses as food assistance losses. 
 

Page 5 GAO-12-790 World Food Program Internal Controls

United Nations (FAO), the UN High Commissioner for Refugees, and the 

UN Office for the Coordination of Humanitarian Affairs in Rome, Ethiopia, 

and Kenya. In Rome, we also met with some WFP recipient and donor 

representatives who are members of WFP’s Executive Board, with 

members of WFP’s Audit Committee, and with WFP’s External Auditor. 

See appendix I for a detailed discussion of our objectives, scope, and 

methodology.

We conducted our work from July 2011 to September 2012 in accordance 

with generally accepted government auditing standards. Those standards 

require that we plan and perform our work to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions 

based on our objectives. We believe that the evidence obtained provides 

a reasonable basis for our findings and conclusions based on our 

objectives.
 

Page 6 GAO-12-790 World Food Program Internal Controls

Because of the nature of its work as a humanitarian organization, WFP is 

called to serve where needed. As a result, WFP often operates in 

environments with a high level of inherent risk to the security of its staff, 

its ability to deliver food to beneficiaries, and its ability to maintain high 

standards of internal control. In the countries where WFP operates, the 

United Nations Department of Safety and Security (UNDSS) assesses the 

general security environment in specific geographic areas using five 

categories of threats: armed conflict, terrorism, crime, civil unrest, and 

hazards. UNDSS rates each area at one of six security levels, with level 6 

indicating the most dangerous environment. The UN Security 

Management System uses these ratings to assess security risks to UN 

agencies, funds, and programs; on the basis of these assessments, WFP 

determines appropriate risk mitigation measures to protect its staff and 

operations. WFP’s current security philosophy emphasizes seeking 

approaches to deliver food assistance where it is needed despite the 

risks.13

As of August 2012, WFP had an operational presence in 78 countries and 

had designated as high risk 23 countries where it operates, including 10 

countries in Sub-Saharan Africa (see fig. 1).14

 

13WFP’s security philosophy acknowledges that risk is an inevitable part of operations and 

aims to (1) enhance the security of personnel and (2) manage, rather than avoid, security 

risks as one of the challenges that WFP faces in implementing its programs.

14WFP’s designations of high-risk countries are not directly related to the UNDSS security 

ratings for geographic areas in the countries. WFP uses the following criteria to determine 

whether a country should be classified as high risk: volatile/insecure operating 

environment; implementation of humanitarian operations; level/volume of the operations 

(the higher the volume, the greater the need to assess/mitigate risks); and absence of a 

risk register (i.e., a document recording identified risks, their severity, actions to be taken 

to mitigate the risks, and individuals responsible for the mitigating actions).

Background
 

Page 7 GAO-12-790 World Food Program Internal Controls

Figure 1: WFP’s Operational Presence as of August 2012
 

Page 8 GAO-12-790 World Food Program Internal Controls

WFP provides most of its assistance through emergency operations 

(EMOP) and protracted relief and recovery operations (PRRO).15 To 

deliver food to intended beneficiaries, WFP works with private land 

transporters16 and with implementing partners,17 including NGOs, UN 

organizations, and recipient governments. WFP field monitors observe 

food distributions and, a few days or weeks after the distribution, conduct 

post-distribution monitoring, interviewing beneficiaries about the quantity 

of food received, their use of the food, and the food’s acceptability and 

quality. WFP uses its Commodity Movement, Processing and Analysis 

System (COMPAS), a global database, to track commodities throughout 

the supply chain, from the initial request for commodities by WFP field 

offices to the distribution of the commodities to beneficiaries. WFP’s 

logistics unit tracks and calculates losses of food assistance after delivery 

at the port-of-entry and reports annually on these losses to WFP’s 

Executive Board.

WFP receives voluntary contributions from a variety of donors—

governments, the public, and the private sector. In 2011, WFP received 

about $3.7 billion in contributions,18

 

15EMOPs are implemented in urgent situations and typically include food distribution or 

projects such as food aid in exchange for reconstruction work. PRROs are intended to 

help sustain disaster-hit communities as they reestablish livelihoods and stabilize food 

security. 

almost 62 percent of which came 

from the United States, Canada, Japan, the European Commission, and 

Germany (see fig. 2). The United States, the single largest donor, 

provided about $1.2 billion—more than 30 percent of WFP’s 2011 

funding—in cash and in-kind food aid. In addition to these contributions, 

U.S. agencies and officials based in the United States, in Rome, and in 

the field provide administrative, programmatic, technical, and operational 

16Private land transporters are usually truckers who may be contracted by WFP or by its 

implementing partners.

17WFP refers to third parties who help distribute its food to WFP beneficiaries as 

implementing or cooperating partners. Throughout this report, we refer to these third 

parties as implementing partners.

18In its 2011 annual performance report, WFP reported that it spent almost $3.8 billion on 

food assistance. Of this amount, about $2.4 billion, or 65 percent, supported EMOP and 

PRRO projects in the 23 high-risk countries, including about $1.5 billion in the 10 high-risk 

countries in Sub-Saharan Africa. See World Food Program, Annual Performance Report 

for 2011, WFP/EB.A/2012/4 (2012).

Contributions to WFP
 

Page 9 GAO-12-790 World Food Program Internal Controls

guidance to WFP and also conduct monitoring of U.S.-funded WFP 

programs where the U.S. government has not restricted its staffs’ 

access.19

Figure 2: Donor Contributions to WFP in 2011

WFP also submits reports on its operations and performance to 

the U.S. government, as it does to all WFP Executive Board members.

 

19U.S. officials conduct field monitoring visits of U.S.-funded WFP operations to observe 

and assess WFP programs, including the programs’ activities and challenges. These 

monitoring visits are generally summarized in a monitoring report or cable that is shared 

with the relevant program office or embassy and other U.S. officials who work on WFP 

programs. In addition, if in the interest of U.S. government foreign assistance objectives, 

U.S. officials might visit non-U.S. funded WFP operations.
 

Page 10 GAO-12-790 World Food Program Internal Controls

Several external and internal governance and oversight bodies are 

responsible for providing oversight of WFP and helping manage WFP 

risks. Figure 3 shows WFP’s governance, oversight, and management

structure.

Figure 3: WFP Governance, Oversight, and Management Structure

WFP Governance, 

Oversight, and 

Management Structure
 

Page 11 GAO-12-790 World Food Program Internal Controls

• UN governing bodies. Several UN entities, comprising 

representatives of the UN’s 193 member states, provide governance 

to WFP. These entities include the UN General Assembly, the FAO 

Conference, the UN Economic and Social Council, the FAO Council, 

the UN Advisory Committee on Administrative and Budgetary 

Questions, and the FAO Finance Committee.

• WFP Executive Board. WFP’s Executive Board includes 

representatives of 36 UN member states who are responsible for 

providing intergovernmental support and specific policy direction and 

supervision of WFP activities. The Executive Board exercises 

oversight over senior management. The Advisory Committee on 

Administrative and Budgetary Questions and the FAO Finance 

Committee are advisory bodies to the board.

• Independent external oversight. WFP’s independent external 

oversight is intended to assist the Executive Board in fulfilling its 

responsibility. The WFP External Auditor is appointed by, and reports 

to, the Executive Board and performs audits of WFP to satisfy him- or 

herself that the internal controls, including the internal audit, are 

adequate. The WFP Audit Committee serves in an expert advisory 

capacity to assist the Executive Board and the Executive Director in 

exercising their governance responsibilities for the financial reporting, 

internal control arrangements, risk management processes and other 

audit-related matters. The UN Joint Inspection Unit is mandated to 

conduct system-wide evaluations, inspections, and investigations 

throughout the UN. 

• Management structure. As head of WFP management, the 

Executive Director is responsible and accountable to the Executive 

Board for the administration of WFP and the implementation of WFP 

programs, projects, and other activities and for establishing effective 

internal controls and an effective independent internal oversight. WFP 

has a three-tier organizational structure, with its headquarters in 

Rome, Italy; seven regional bureaus (see app. II, fig. 8); and 77 

country offices. Headquarters is responsible for governance, strategic 

planning, policy making and macro-level monitoring. The regional 

bureaus provide technical assistance to the country offices and 

oversee their adherence to corporate guidelines, practices, and 

procedures. (See app. II for additional information on WFP’s 

governance, oversight, and management structure.)

• Independent internal oversight. WFP’s Office of Evaluation and the 

Inspector General and Oversight Office are independent of WFP’s 
 

Page 12 GAO-12-790 World Food Program Internal Controls

management and conduct audits, investigations, and inspections of 

WFP’s systems, processes, operations, and activities.

The design of WFP internal controls related to delivering and monitoring 

food assistance generally reflects COSO principles. However, several 

controls could be strengthened to better manage risks, including risks 

affecting WFP’s ability to deliver food assistance to intended 

beneficiaries. WFP’s internal control framework has five components.20

• Internal environment. WFP has designed policies and procedures to 

set the organization’s tone and emphasize internal controls, reflecting 

COSO principles, but oversight by WFP’s Executive Board and Audit 

Committee is limited.21

• Risk management. WFP has developed risk management policies 

and guidance, as recommended by COSO. However, WFP has not 

fully developed guidelines for implementing risk management, 

including guidelines for defining risk tolerance.22

• Control activities. WFP has designed numerous control activities, in 

line with COSO principles,23 to help ensure tracking of food 

assistance from port-of-entry to beneficiaries. However, the design of 

its commodity tracking system has weaknesses that limit its ability to 

account for food in the custody of implementing partners.

 

20The five components of WFP’s internal control framework are similar to those of the 

COSO internal control framework: control environment, risk assessment, control activities, 

information and communication, and monitoring. 

21WFP bases “internal environment,” the first component of its internal control framework, 

on elements of the “control environment” component of COSO’s internal control 

framework as well as on elements of COSO’s enterprise risk management framework.

22WFP bases the second component of its internal control framework on COSO’s internal 

control component “risk assessment,” COSO’s enterprise risk management framework, 

and principles and guidelines of other international organizations. WFP defines “risk 

tolerance” as representing an acceptable level of variation relative to the achievement of a 

particular objective. Risk tolerance seeks to provide measurable indicators of the level of 

risk tolerated in achieving a specific objective.

23According to COSO, control activities include a range of activities as diverse as 

approvals, authorizations, verifications, reconciliations, and reviews of operating 

performance and security of assets. 

Design of WFP 

Internal Controls 

Related to Delivering 

and Monitoring Food 

Assistance Generally 

Reflects COSO 

Principles but Could 

Be Strengthened to 

Better Manage Risks
 

Page 13 GAO-12-790 World Food Program Internal Controls

• Information and communication. WFP has several mechanisms for 

identifying, capturing, and communicating information to and from 

WFP management, in accordance with COSO principles.

• Monitoring. WFP has developed detailed policies on monitoring 

delivery of food assistance to beneficiaries, reflecting COSO 

principles, but this guidance does not call for monitoring to be risk 

based as recommended by WFP’s External Auditor.

In establishing its internal environment, WFP has designed policies and 

procedures, including developing a new internal control framework, to set 

the tone of the organization and influence staff consciousness of the 

importance of internal control. In addition, WFP plans to provide 

additional training and guidance to strengthen managerial control. 

However, some Executive Board members told us that their oversight is 

limited because of competing obligations and limited resources. 

Moreover, statements in WFP Audit Committee’s reports, as well as 

remarks by the committee’s current chairman and some Executive Board 

members, indicate that the board does not fully utilize the committee to 

provide the necessary independent oversight on internal controls.24

Internal Environment

According to COSO, the internal environment sets the tone of an organization, 

influencing the control consciousness of its people, and is the foundation for all 

other components of internal control, providing discipline and structure. Internal 

environment factors include the integrity, ethical values, and competence of 

staff; management’s philosophy and operating style; the way management 

assigns authority and responsibility and organizes and develops its people; and 

the attention and direction provided by the board of directors.

Source: COSO, “Internal Control—Integrated Framework” (1992).

WFP has developed several policies and procedures to set the 

organization’s tone and influence staff consciousness of the importance 

of internal control, reflecting COSO principles. For example, to address 

the integrity and ethical value of the organization, WFP established an 

ethics office in 2008 and has developed ethics-related policies, such as 

financial disclosure, antifraud and anticorruption, and whistleblower 

protection. In addition, since 2009, WFP’s management has reported on 

 

24The current chairman of the WFP Audit Committee was elected in December 2011, and 

his appointment was renewed in July 2012 for a 3-year term. 

Internal Environment:

WFP Has Designed 

Policies and Procedures to 

Set Tone of Organization, 

but Governance Oversight 

Is Limited

WFP Has Developed Policies 

and Procedures to Set Tone of 

Organization 
 

Page 14 GAO-12-790 World Food Program Internal Controls

several efforts aimed at strengthening elements of its internal 

environment, taken under WFP’s Strengthening Managerial Control and 

Accountability (SMCA). According to WFP, the SMCA initiative identified 

key actions to further improve internal controls. In September 2011, WFP 

issued a new internal control framework based on COSO that, according 

to the Executive Director, took into account the views of the external and 

internal auditors and the Audit Committee. WFP also developed guidance 

to help staff apply the new internal control framework, including a new 

manager’s guide to internal control, an accountability guide for managers, 

and a new internal control self-assessment checklist. In addition, WFP 

introduced a process that required all senior managers to provide the 

Executive Director with assurances related to the operation of internal 

control within their offices. Based on this new process, the former 

Executive Director included, for the first time, a statement on internal

control in WFP’s 2011 audited annual accounts.25 According to the former 

Executive Director, this statement provides specific assurance on the 

effectiveness of all internal controls in WFP.26

WFP’s former Executive Director reported that, to strengthen managerial 

control, WFP plans to increase support and training of managers and staff 

in key aspects of internal control, including ethics. According to WFP, 

ethics training is not mandatory. WFP stated that after it has identified the 

needed funding, it will establish a directive to include mandatory training 

in ethics and integrity to all staff. Currently, the ethics office provides 

ethics training to all new staff, procurement staff, and 100 workplace 

advisers in all country offices and regional bureaus. According to COSO, 

a strong ethical climate is vital to the well-being of the organization, all of 

its constituencies, and the public at large. In addition, the former 

Executive Director said that WFP’s management will provide further 

refinement of the internal control guidance and tools and improvements in 

the assurance questionnaire that managers are required to complete.

 

25 WFP, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012).

26The External Auditor did not perform an audit of WFP’s management’s assessment of 

the effectiveness of internal controls over financial reporting for 2011 as part of its annual 

audit, contrary to current best practices of multilateral organizations such as the World 

Bank and the Inter-American Development Bank. WFP management informed us that an 

audit of management’s assessments of the effectiveness of internal control, like 

management’s statements on internal control, is considered voluntary. 

WFP Plans to Provide 

Additional Training and 

Guidance to Strengthen 

Managerial Control
 

Page 15 GAO-12-790 World Food Program Internal Controls

Some of the members of WFP’s Executive Board told us that their 

oversight of WFP’s operation is constrained by competing obligations and 

limited staff resources.27 According to COSO principles, the control 

environment and “tone at the top” are influenced significantly by the 

entity’s board of directors.28

During our meeting with some of WFP’s Executive Board members, they 

informed us that because of their extensive responsibilities on the boards 

of FAO, the International Fund for Agriculture Development, and WFP, 

they do not have sufficient time or staff resources to ensure that WFP is 

being managed effectively. Similarly, our 2007 review of governance and 

oversight at six UN entities,

COSO adds that factors determining the 

board’s influence include the extent of its involvement and scrutiny of 

activities and the degree to which it raises, and pursues with 

management, difficult questions regarding plans or performance. Given 

the highly decentralized and complex nature of WFP’s operation, the 

significance of an active board has been reinforced by the more frequent 

and extensive crises in many high-risk environments as well as by the 

allegations of diversion of WFP’s food assistance in Somalia.

29

Statements in recent WFP Audit Committee reports, as well as remarks 

by the committee’s current chairman and some Executive Board 

members, indicate that the board does not fully utilize the committee for 

assistance in providing the independent oversight that is needed to 

including WFP, found that board members 

described oversight as difficult because they lacked sufficient resources 

and expertise. WFP board members also informed us that they were 

surprised to have learned about the 2009 allegations of food diversion 

and other lapses in internal controls in Somalia from the news media 

rather than from WFP’s management before the allegations were made 

public.

 

27WFP’s Executive Board consists of 36 members of the UN member state 

representatives. In September 2011, we met with 9 of the board members. See 

appendixes I and II for more information on the Executive Board. 

28In technical comments on a draft of this report, WFP noted that there is a fundamental 

difference between a company’s board of directors, which would typically include 

executive directors, and WFP’s Executive Board, which comprises representatives of 

sovereign states.

29GAO, United Nations Organizations: Oversight and Accountability Could Be 

Strengthened by Further Instituting International Best Practices, GAO-07-597

(Washington, D.C. June 18, 2007). 

Some WFP Executive Board 

Members Say Oversight Is 

Constrained by Competing 

Obligations and Limited Staff 

Resources 

Executive Board Does Not 

Fully Utilize Audit Committee 

for Oversight Assistance
 

Page 16 GAO-12-790 World Food Program Internal Controls

strengthen accountability and governance in WFP. COSO states that an 

entity’s audit committee is in a unique position to question top 

management regarding how it is carrying out its financial reporting 

responsibilities; the committee also has the authority to ensure that 

corrective action is taken and is in the best position to identify and act in 

instances where top management overrides internal controls.30

In 2007, we recommended that WFP establish an audit committee that is 

independent of management and report directly to the Executive Board.31

We also stated at that time that an external audit committee, accountable 

to the governing body, could assist the Executive Board with its 

responsibility to monitor the organization oversight function. In 2009, WFP 

established an external audit committee to provide independent, expert 

advice to the Executive Board and the Executive Director in fulfilling their 

governance responsibilities.32 The committee’s terms of reference also 

outline responsibilities for, among other things, ensuring the effectiveness 

of WFP’s internal control systems, risk management, audit and oversight 

functions, and governance processes. In 2010, WFP’s External Auditor 

noted benefits from the Audit Committee’s activities and recommended 

that the board place increasing reliance on the committee regarding audit 

matters, including significant control issues such as those in Somalia.33

However, in September 2011, the current Chairman of the Audit 

Committee informed us that the committee believed its terms of reference 

 

30In its technical comments on a draft of this report, WFP noted that in industry, where an 

audit committee is usually a committee of the board of directors, the committee’s 

communication and interaction with the board is fundamentally different than in WFP, 

where the Audit Committee members are technical oversight experts and the Executive 

Board comprises representatives of sovereign states.

31In 2007, WFP’s Audit Committee comprised both internal and external members and 

was accountable only to the Executive Director. See GAO-07-597. The current Audit 

Committee comprises five members who are appointed for a 3-year term, renewable for a 

second and final 3-year term. 

32According to the current Audit Committee’s terms of reference, the Executive Director is 

involved in the recruitment and selection process of Audit Committee members. The 

Executive Board considers candidates recommended by the Executive Director, and an 

appointment to the Audit Committee may only be revoked by the Executive Board after 

consulting the Executive Director. However, according to international best practices, the 

Audit Committee should report, and be accountable, to the governing body.

33 World Food Program, WFP Audited Annual Accounts, 2009, WFP/EB.A/2010/6-A/1 

(2010).
 

Page 17 GAO-12-790 World Food Program Internal Controls

were too limited. Although the Audit Committee’s terms of reference do 

not specifically prevent committee members from attending board 

meetings, the current Chairman told us that the committee’s Chair, alone 

among its members, is permitted to attend only one Executive Board 

meeting per year. In contrast, according to the Chairman, the committee 

believed that all members should be allowed to attend each of the 

Executive Board’s three annual meetings. In addition, the current 

Chairman stated that although the committee meets quarterly with several 

members of the Executive Board,34

In addition, statements in the Audit Committee’s recent annual reports to 

the Executive Board, as well as remarks by the committee’s current 

Chairman, indicate that the committee believes that it is not being fully 

utilized. In both its 2011 and 2012 annual reports, the Audit Committee 

stated that it “can be only as effective as the degree of ‘buy-in’ by the 

board and management of the need for an independent Audit Committee 

and of their acceptance of the Audit Committee’s role.”

no process exists to ensure that the 

board consults with the Audit Committee regarding high-risk issues or 

situations that could expose WFP to fraud allegations in the future. 

Moreover, the Audit Committee reported in 2011 that, like the Executive 

Board, it was not informed in advance of the allegations related to food 

diversion in Somalia in 2009. In November 2011, the External Auditor 

reported that the Executive Board had revised the Audit Committee’s 

terms of reference to clarify, among other things, that the committee’s 

Chair can inform the president of the board of any serious governance 

issue at any time.

35

 

34The Audit Committee meets quarterly with the Executive Board Bureau, which consists 

of five board members who are responsible for strategic planning of the board’s work, the 

preparation and organization of board meetings, and promotion of dialogue. See World 

Food Program, Annual Report of the Audit Committee, WFP/EB.A/2012/6-D/1 (2012).

In its 2012 

report, the Audit Committee also stated that because external audit 

committees are new entities within the UN system, there is “an 

understandable lack of clarity of how best to use an audit committee 

consisting of outside experts.” In addition, the 2012 report states that 

audit committees can leverage the work of the board and can provide 

independent advice to senior management. Further, in both its May 2011 

35World Food Program, Annual Report of the Audit Committee, WFP/EB.A/2011/6-C/1 

(2011); Annual Report of the Audit Committee (2012). As of April 2012, the Audit 

Committee submits its annual report to the Executive Board; previously, the committee 

submitted its annual report to the Executive Director for the board’s consideration. 
 

Page 18 GAO-12-790 World Food Program Internal Controls

and 2012 reports, the Audit Committee stated that it could not secure 

permission for site visits, possibly because of financial reasons. The 

committee emphasized the importance of conducting site visits, which it 

considers to be the norm for an audit committee in order to observe 

operations for which it has an oversight fiduciary responsibility. In 

September 2011, the committee’s current Chairman informed us that the 

committee had proposed that its role encompass more than a review. The 

Chairman also stated that site visits would allow the committee to check, 

on a test basis, selected offices, such as Haiti and Kenya, to determine 

whether its recommendations were implemented. In its May 2012 report, 

the FAO Finance Committee stated that the “added value of these visits 

would have to be clearly established to avoid duplication of efforts by the 

external and internal auditors and unnecessary burdening of field office 

staff with extra tasks.”36

Finally, some WFP Executive Board members informed us that it is 

difficult for the Audit Committee to be useful, owing to its lack of 

resources and on-the-ground experience of WFP’s operations and the UN 

overall. The revised Audit Committee terms of reference emphasize that 

members possess high qualifications and experience.

The FAO committee requested a proposal for 

field visits, including an analysis of the costs and benefits of such visits.

 

36The FAO Finance Committee exercises control over the financial administration of WFP. 

See appendix II for additional information regarding its role. 
 

Page 19 GAO-12-790 World Food Program Internal Controls

WFP has taken a number of actions to embed risk management 

throughout the organization, such as developing an enterprise risk 

management policy and a risk management framework.37 In addition, 

WFP told us that it has recently developed or refined various tools, such 

as risk-level scales, its corporate risk profile,38 and risk registers. 

However, WFP has not provided updated and adequately detailed 

guidelines to aid staff in identifying, assessing, and responding to risks. 

Further, the board has not set risk tolerance levels for WFP’s operations 

or communicated these in policies and guidelines, as its enterprise risk 

management policy stipulates.39

Risk Management

COSO defines risk management as a process designed to identify events that may affect 

the entity and to manage risk to be within its risk appetite, to provide reasonable 

assurance regarding the achievement of entity objectives. This process is effected by an 

entity’s board of directors, management, and other personnel and applied in strategy 

setting and across the enterprise.

Source: COSO, “Enterprise Risk Management —Integrated Framework,” 2004.

WFP has taken a number of actions aimed at embedding risk 

management throughout the organization, as suggested by COSO. 

According to COSO, enterprise risk management is most effective when 

risk management mechanisms are built into the entity’s infrastructure and 

are part of the essence of the organization; by building in enterprise risk 

management, an entity can directly affect its ability to implement its 

strategy and achieve its mission.

In 2005, WFP’s Executive Board approved an enterprise risk 

management policy, which provides the board’s overall intention and 

direction regarding the management of risks. The policy states that the 

board’s goal is to embed throughout WFP a systematic, effective, and

sustainable approach to managing risks and opportunities that adds value 

 

37WFP bases the “risk management” component of its internal control framework on 

principles included in the “risk assessment” component of COSO’s internal control 

framework as well as on principles included in COSO’s enterprise risk management 

framework. 

38A risk profile describes the characteristics of a risk, mapping the change in the likelihood 

and impact of the risk to which an organization is exposed. 

39COSO defines risk tolerance as the acceptable levels of variation relative to the 

achievement of an objective.

Risk Management: WFP 

Has Developed Policies for 

Managing Risks but Has 

Not Yet Provided Guidance 

Needed to Implement Risk 

Management throughout 

Organization

WFP Has Taken Actions to 

Embed Risk Management 

throughout Organization
 

Page 20 GAO-12-790 World Food Program Internal Controls

to decision making and is linked to objectives and results. The policy also 

states that it envisages a risk management framework based on the 

COSO enterprise risk management framework. In addition, the policy 

discusses the role of WFP’s Executive Board and management and 

summarizes WFP’s risk management philosophy.

In 2009, as part of its SMCA initiative, WFP continued the process of 

developing a risk management system.40

• creating an executive management council to review the effectiveness 

of risk and performance management arrangements and to review 

risks that have been escalated for its consideration;

According to WFP, a major gap 

in its risk architecture has been the lack of a system that enables 

managers to link risks directly to their objectives and that allows for the 

appropriate escalation of risk within the organization. In addition, 

according to WFP, budgetary constraints limited the support available to 

field offices to implement risk management effectively during 2009 and 

2010. As of May 2012, WFP had taken a number of actions to help 

embed risk management throughout the organization, including

• establishing a network of performance and risk management 

champions across all country and regional offices to guide best 

practice;

• beginning to develop a new organization-wide information technology 

system, intended to bridge the gap between risk management in 

country offices and at the corporate levels, which it expects to roll out 

to all business units and offices by 2013; and

• developing training programs on integrated risk and performance 

management, which it has provided to key country offices and will 

continue to provide in 2012 to offices that have not yet received it.

 

40According to principles and benchmarks established by ISO and the UN Joint Inspection 

Unit, a formal risk management system includes a formal risk management policy, 

framework, and risk management process. See International Organization for 

Standardization, ISO 31000 Risk Management—Principles and Guidelines; and UN Joint 

Inspection Unit, Review of Enterprise Risk Management in the United Nations System: 

Benchmarking Framework, (Geneva, Switzerland: 2010). 
 

Page 21 GAO-12-790 World Food Program Internal Controls

Also in May 2012, WFP reported that it had recently developed or refined 

various tools, such as impact, likelihood, and risk-level scales and 

categories; a corporate risk profile; corporate-, country-, and entity-level 

risk registers; and a risk management escalation process. Moreover, the 

Audit Committee stated in its April 2012 report to the Executive Board that 

it welcomed the use of the corporate risk register and that in 2011, an 

increasing number of offices put in place formal systems to identify, 

evaluate, and record risks. In May 2012, the Executive Director reported 

that, as of December 2011, 67 percent of office entities (i.e., country 

offices, regional bureaus, and headquarters divisions) had formal risk 

registers. According to WFP’s former Executive Director, all WFP offices 

were expected to have formal risk registers by the end of 2012. Further, 

in March 2012, the former Executive Director, after identifying a need for 

further training and guidance on managing risk, stated that this need will 

be addressed in 2012.

In addition, since 2011, WFP has identified risks based on three risk 

categories—contextual, programmatic, and institutional—that reflects the 

humanitarian context in which it operates.41

Finally, in May 2012, WFP developed a risk management framework, 

which is embedded in its Financial Resource Management Manual. In a 

WFP defines these 

categories as follows: (1) Contextual risks include those over which WFP 

has very little control, such as armed conflict, drought, and other 

humanitarian crises. (2) Programmatic risks include not meeting WFP’s 

objectives and causing harm to others, such as reduced program 

oversight with possible misuse of assistance, drawing beneficiaries into a 

conflict zone, and lack of donor funding. (3) Institutional risks are those 

with significant implications to WFP, such as misappropriation of 

assistance, corruption by partners, and reputational damage.

 

41See Victoria Metcalfe, Ellen Martin, and Sara Pantuliano, “Risk in Humanitarian Action: 

Towards a Common Approach?” a report commissioned by the Humanitarian Policy 

Group (London, UK: Overseas Development Institute, 2011). In this report, the Overseas 

Development Institute’s Humanitarian Policy Group—a team of independent researchers 

and information professionals working on humanitarian issues—states that its research 

indicates that while there is growing awareness of the nature of risk in the humanitarian 

sector, there is very little structured or agreed understanding of the range of risks 

prevalent in the sector, possibly with the exception of security risks. The report adds that 

the humanitarian community has much to learn from other sectors in assessing, for 

example, risk appetite and risk tolerance and in managing the many risks it faces. Neither 

WFP’s internal control framework nor its risk management framework mentions these risk 

categories. 
 

Page 22 GAO-12-790 World Food Program Internal Controls

draft document, WFP states that this framework is based on past lessons 

and best practices from the public and private sectors and from other UN 

agencies.42

WFP’s internal control framework identifies event identification, risk 

assessment, risk response, and risk tolerance as key principles of its risk 

management process. However, WFP has not yet provided guidance 

operationalizing these principles to help ensure consistent and integrated 

implementation of risk management throughout the organization. 

According to COSO, while an organization may have a sound strategy, 

competent employees, sound business processes, and reliable 

technology, every organization is vulnerable to risk and needs an 

effectively functioning risk management process. In addition, according to 

the UN Joint Inspection Unit, the risk management process must be 

formalized and operationalized through a framework, guidelines, and 

other administrative instructions, easily accessible to all staff, for 

consistent and correct implementation across organizational units.

In 2006, WFP management developed a risk management guide that 

briefly describes a risk management process; however, the 2006 guide is 

not clearly related to WFP’s current internal control or enterprise risk 

management frameworks, and it does not clearly describe methodologies 

and tools to assess risks.43 In January 2012, WFP management produced 

a draft facilitator’s guide for training staff in preparing country risk 

registers.44

 

42World Food Program, “Facilitator’s Guide: Preparing a Country Office Risk Register” 

(draft). 

According to WFP, as of June 2012, it had finalized training 

material for preparing the risk registers that was piloted in the South 

Africa region. WFP stated that it plans to roll out the training to the rest of 

the regions in 2013. However, WFP management has not yet provided 

overall guidance on the risk management process for staff in identifying, 

43WFP’s 2006 guidance describes a five-step process: (1) clarify expected results and 

critical stakeholders, (2) identify risks that can impact expected results, (3) prioritize risks’ 

importance (impact and likelihood), (4) act on risks and decide how to proceed with 

activities, and (5) review and communicate risks. World Food Program, “Risk 

Management Guide” (2006).

44World Food Program, “Facilitator’s Guide: Preparing a Country Office Risk Register” 

(draft). 

WFP Has Not Yet Provided 

Guidance Needed to Ensure 

Effective Organization-wide 

Implementation of Risk 

Management 
 

Page 23 GAO-12-790 World Food Program Internal Controls

assessing, and responding to risks, among other activities.45

Further, WFP’s Executive Board and management have not set or 

communicated organization-wide risk tolerance levels for WFP’s 

operations or provided guidelines on setting risk tolerance levels on a 

case-by-case basis. WFP’s enterprise risk management policy stipulates 

that the Executive Board or the Executive Director will set risk tolerance 

levels where appropriate and will communicate risk tolerance levels 

through corporate policies and guidelines. The policy also states that 

managers will set prudent tolerance levels within their areas of 

responsibility and authority. According to COSO, based on best practices, 

boards of directors are responsible for setting organization-wide risk 

tolerance. COSO states that some boards have established a risk 

committee to focus directly on enterprise risk management, with the 

committee’s responsibilities including developing and refining the 

organization-wide risk appetite and risk tolerance.

Without a 

comprehensive guidance on the risk management process, WFP staff 

may lack appropriate methodologies and tools to assess risks, especially 

at the country level, where WFP is most exposed to risks.

46

WFP management informed us that it is currently engaged in discussion 

of how risk tolerance should be set on a case-by-case basis but 

expressed reluctance to articulate an organization-wide risk tolerance 

level, stating that “it is not possible to balance financial or stewardship 

COSO also states 

that it is not uncommon for oversight responsibility for enterprise risk 

management to be assigned to the Audit Committee. COSO states that 

“in many cases it is believed that with its focus on internal control over 

financial reporting, and possibly a broader focus on internal control, the 

audit committee already is well positioned to expand its responsibility to 

overseeing enterprise risk management.” In its 2011 annual report, the 

WFP Audit Committee recommended that enterprise risk management 

should be a standard agenda item at each Executive Board meeting and 

that this would help the board refine the risk tolerance parameters within 

which it wants WFP to operate. 

 

45According to ISO principles and guidelines, the risk management process is the 

systematic application of management policies, procedures and practices to activities 

such as identifying, analyzing, evaluating, responding, monitoring, and reviewing risk. 

46Risk appetite is the amount of risk, on a broad level, that an organization is willing to 

accept in pursuit of its objectives. 
 

Page 24 GAO-12-790 World Food Program Internal Controls

risks in monetary terms against the potential loss of life that would result 

from WFP’s withdrawal,” for example, from a country or a program. 

However, our review of WFP policy and guidance showed that the 

Executive Board has not yet provided any written guidance to 

management on developing risk tolerance levels on a case-by-case 

basis, such as by considering the levels of food losses it is willing to 

tolerate to achieve its objective of providing food assistance under its 

emergency program in a country such as Somalia. Moreover, the current 

emergency program document for Somalia makes no reference to risk 

tolerance.

WFP has policies and procedures designed to help ensure tracking of

food in its custody from port-of-entry to beneficiaries. In addition, WFP 

has policies and procedures designed to help prevent loss of food in 

implementing partners’ custody, but its commodity tracking system has 

weaknesses, particularly tracking food in implementing partners’ custody. 

Control Activities

COSO defines control activities as the policies and procedures that help ensure that 

necessary actions are taken to address risks to achievement of an entity's objectives. 

Control activities include a range of activities as diverse as approvals, authorizations, 

verifications, reconciliations, and reviews of operating performance and security of 

assets. 

Source: COSO, “Internal Control—Integrated Framework” (1992).

WFP has designed policies and procedures intended to protect against 

the loss of food in its custody during delivery at the port-of-entry, transport 

to WFP warehouses, and storage in warehouses. In addition, WFP has 

designed policies and procedures for WFP staff to follow in distributing 

food to beneficiaries. The following are examples of WFP’s control 

activities.

• Port-of-entry. The WFP country office is responsible for supervising 

and coordinating the delivery of food commodities at the port-of-entry

and for ensuring that all parties, such as recipient authorities and 

superintendents,47

 

47Superintendents are independent cargo surveyors, employed by WFP to inspect WFP 

shipments at the time of delivery and ascertain their quantity and condition on delivery. 

are aware of their roles in the operation, according 

to WFP’s Transport Manual. A staff member from the WFP country 

Control Activities: WFP 

Has Designed Policies and 

Procedures for Tracking 

Food Assistance from 

Port-of-Entry to 

Beneficiaries, but Tracking 

System Has Weaknesses

WFP Has Policies and 

Procedures Designed to Help 

Ensure Tracking of Food in Its 

Custody
 

Page 25 GAO-12-790 World Food Program Internal Controls

office should be present, where feasible, or should monitor the 

operation through superintendents or agents. In addition, the country 

office should ascertain how the commodities will be stored after 

delivery or moved from the port.

• Transport. Transporters bidding on contracts to transport WFP food 

assistance receive WFP’s terms of agreement detailing, among other 

things, the transporter’s liability for any losses or damage of food in its 

custody. According to the Transport Manual, a waybill must 

accompany food in the transporter’s custody, attesting to the type and 

quantity of commodities transported; the name of the transporter; the 

vehicle details; the loading location and destination; and the departure 

and expected and actual arrival dates. At the destination, the WFP 

warehouse manager or consignee completes, signs, and stamps the 

waybill, acknowledging receipt and noting any loss or damage. The 

manager then makes a parallel entry in COMPAS—WFP’s commodity 

tracking system—which automatically adjusts data, such as for stored 

or damaged goods, at the receiving site. After the food is delivered, 

the transporter submits the completed waybill to WFP’s finance office 

to request payment for the services rendered.

• Warehouse. Food commodities in WFP warehouses must be 

managed through the COMPAS inventory module, according to 

WFP’s Transport Manual. In warehouses not yet computerized, 

commodities are to be managed through warehouse ledgers that are 

checked against stack cards on a regular basis.48

 

48Stack cards provide information on shipping instructions, batch numbers, type of 

commodity, date of arrival, quantity originally stacked, quantity out, and the balance, all 

which is signed for on the card itself.

In addition, the 

warehouse manager is required to conduct physical inventory of stock 

in the warehouses at regular intervals, to prevent and detect losses. 

Further, WFP staff are instructed to reconcile information on incoming, 

outgoing, and on-hand stock, as well as information from manual 

systems—stack cards and ledgers—with information in COMPAS. 

WFP’s Warehouse Management Handbook documents procedures 

for the storekeeper, including procedures for maintaining warehouse 

premises—such as installing boundary fences and gates to secure the 

warehouse against unauthorized entry—and warehouse buildings; 

procedures for unloading and checking food commodities, such as 

inspecting each new container food unloaded and addressing any 

defects; and procedures for creating and maintaining records. Further, 
 

Page 26 GAO-12-790 World Food Program Internal Controls

WFP’s Program Guidance Manual outlines procedures for WFP staff 

to follow in taking food from WFP warehouses for distribution to 

beneficiaries.

• Distribution to beneficiaries. WFP’s Program Guidance Manual 

states that WFP staff must complete various tasks immediately before 

distributing food assistance, such as verifying that required food has 

arrived, that distribution documents are ready, and that local 

authorities are present at the distribution. In addition, WFP staff must 

follow detailed instructions during the distribution, including scooping 

and weighing food and requiring that beneficiaries record their receipt 

of food rations.

Figure 4 shows some of WFP’s control activities, from delivery of food 

commodities at the port-of-entry to distribution of food to beneficiaries.
 

Page 27 GAO-12-790 World Food Program Internal Controls

Figure 4: Examples of WFP Control Activities from Port-of-Entry to Distribution of Food Assistance
 

Page 28 GAO-12-790 World Food Program Internal Controls

WFP has policies and procedures designed to help prevent loss of food 

after delivery to its implementing partners. For example, on receipt of 

WFP commodities, implementing partners are required to complete, sign, 

and stamp the WFP waybill, acknowledging receipt and noting any loss or 

damage, and WFP staff are to subsequently record information from the 

waybill into COMPAS, according to WFP’s Transport Manual. In addition, 

WFP requires its implementing partners to submit monthly and quarterly 

distribution reports containing information that WFP staff also record in 

COMPAS, such as amounts of food in the warehouse before receipt of a 

new shipment, amounts of food received, and amounts of food 

distributed. These reports also show the movements of received and 

distributed food items as well as any losses that have occurred at the 

implementing partners’ warehouses or during transport arranged by the 

implementing partners. The WFP country office is responsible for 

ensuring that implementing partners’ reporting is regular, timely, and 

complete and for checking the quality of the data in the distribution 

reports. According to WFP’s Transport Manual, these data quality checks 

are to include the overall consistency of the commodity accounts, such as 

accounting for the difference between opening stock and closing balance; 

completeness of data; and reconciliation of data on losses where 

relevant. The WFP country office is required to record in COMPAS the 

information in the distribution reports, to enable a complete accounting for 

the commodity logistics chain. 

Weaknesses in the design of COMPAS limit WFP’s ability to account for 

all food commodities, particularly in implementing partners’ custody. 

According to WFP, although food commodities in WFP warehouses are 

managed and tracked through COMPAS, COMPAS does not track food 

after delivery to implementing partners and thus cannot fully account for 

food after it is handed over to implementing partners. 

In 2011, the External Auditor found that COMPAS does not allow the 

recording of accurate dates for distributions by an implementing partner at 

multiple sites in a given location, such as a city or province.49

 

49World Food Program, Report of the External Auditor on WFP Operations in Somalia, 

WFP/EB.1/2011/5-B/1 (2011).

The auditor 

noted that COMPAS permits the entry of only one distribution report per 

implementing partner for a location for a specified period. In cases where 

implementing partners distribute food at multiple sites in a given location, 

WFP Has Policies and 

Procedures to Help Prevent 

Loss of Food in Implementing 

Partners’ Custody

Commodity Tracking System 

Has Weaknesses, Particularly 

Tracking Food in Implementing 

Partners’ Custody
 

Page 29 GAO-12-790 World Food Program Internal Controls

WFP staff are able to enter in COMPAS the implementing partners’ 

reports for the extra sites only by entering different, and therefore 

inaccurate, reporting dates. The External Auditor recommended that, to 

facilitate reconciliation between WFP allocation plans and implementing 

partners’ distribution reports, distribution site data should be captured in 

COMPAS for all food delivered to implementing partners. WFP agreed 

with the External Auditor’s recommendation, stating that COMPAS now 

includes information on distribution sites, allowing offices to specify where 

distributions took place.50

In 2011, WFP’s External Auditor also identified other weaknesses in 

COMPAS that hamper effective reconciliations of data in COMPAS.51 For 

example, the External Auditor observed that COMPAS does not facilitate 

the generation of reports or the export of a full set of data and, as a result, 

staff use other software to retrieve needed information from the system, 

exporting the information to worksheets for reconciliation.52 According to 

the External Auditor, this practice impairs data integrity. The External 

Auditor recommended that until WFP develops a new system to address 

the weaknesses in COMPAS, standardized report-generating tools should 

be used to prevent unauthorized staff from accessing COMPAS data. 

WFP did not agree with this recommendation and stated that it already 

uses recognized software to generate reports accessing COMPAS data 

and that it controls staff’s access to the data by limiting access rights.53

 

50World Food Program, WFP Management Response to the Report of the External 

Auditor on WFP Operations in Somalia, WFP/EB.1/2011/5-B/1/Add.1 (2011).

In 

addition, WFP’s management said that it sees no current benefit in further 

investment in reporting tools because it has begun an initiative, under the 

WFP Information Network and Global System II, to build a new logistics 

application—the Logistics Executions Support System—that includes 

commodity-tracking capabilities. According to WFP, assuming the 

availability of needed funding, WFP expects implementation of the new 

system to begin by the end of 2012 and to be completed by 2015.

51World Food Program, Report of the External Auditor on WFP Operations in Somalia.

52The External Auditor stated that, according to WFP management, COMPAS was 

developed as a data entry tool and separate applications, based on Microsoft Access and 

Oracle Discoverer, were subsequently developed for generating reports.

53World Food Program, WFP Management Response to the Report of the External 

Auditor on WFP Operations in Somalia.
 

Page 30 GAO-12-790 World Food Program Internal Controls

WFP has several mechanisms to enable communications between WFP 

management and stakeholders.54

Information and Communication

Further, WFP management has 

recently improved its communication with the Executive Board.

According to COSO, pertinent information must be identified, captured and 

communicated in a form and timeframe that enables people to carry out their 

responsibilities.

Source: COSO, “Internal Control—Integrated Framework” (1992).

WFP has developed mechanisms to identify, capture, and communicate 

information pertinent to its assistance efforts, among other things, to WFP 

management and stakeholders. For example:

• According to WFP’s Finance and Budget Manual, WFP management 

provides information about approved emergency operations and 

submits proposals for protracted relief and recovery operations above 

a given threshold to the Executive Board.55 These documents contain, 

among other things, details such as the number of beneficiaries, 

project duration, amount of food needed, and the cost of the food. 

These documents also have sections that discuss, for example, 

related actions of the country’s government and other entities; WFP’s 

assistance objectives and strategy response; WFP’s implementing 

partners; WFP’s performance monitoring methodology, risk 

assessment, and contingency planning; and security considerations 

related to operating in the environment.

• WFP country offices prepare standard project reports to inform 

stakeholders about the use of resources for a given project and the 

results obtained during the reporting year.56

 

54 According to WFP, stakeholders may include implementing partners, host governments,

nongovernmental organizations, UN agencies, contractors, and suppliers. Other 

stakeholders may include the media, beneficiaries, and internal entities, such as a WFP 

regional bureau, a headquarters division, or a neighboring country office.

55 The Executive Director has the authority to approve protracted relief and recovery 

operations with food values of $20 million or less and must inform the Executive Board of 

the approval. The board must approve protracted relief and recovery operations with food 

values in excess of $20 million. 

56Standard project reports are prepared for emergency operations, protracted relief and 

recovery operations, development operations, and special operations but are not prepared 

for bilateral projects. WFP considers a contribution to be bilateral if the donor directs that it 

be used to support a project or operation that is not initiated by WFP. 

Information and 

Communication: WFP 

Has Taken Steps to 

Enhance Communication 

with Stakeholders

WFP Has Several Mechanisms 

to Enable Communications 

between WFP Management and 

Stakeholders 
 

Page 31 GAO-12-790 World Food Program Internal Controls

• WFP’s logistics unit provides annual reports to the Executive Board 

on losses of food assistance after delivery at the port-of-entry, based 

primarily on data entered in COMPAS and WINGS II by the country 

offices. The country offices are responsible for quantifying losses 

during internal transport arranged by the country offices or regional 

bureaus as well as losses during post-delivery storage that is 

arranged and paid for by WFP.

• WFP routinely distributes updates on its operations in the Horn of 

Africa,57 as well as separate monthly updates on its operations in 

Somalia, to its member states and partner organizations, including 

those within the UN system. These documents inform stakeholders 

about WFP activities in these areas and cover, among other things, 

the conditions of the areas, the beneficiaries WFP intends to assist, 

and information on resources or funding, as well as, in the case of 

Somalia updates, data on distribution sites monitored. According to a 

WFP official, WFP started distributing these updates in August 2011, 

following the declaration of famine in Somalia.

Some of WFP’s Executive Board members informed us that WFP 

management improved its communications with the board after lapses in 

communication during the time of the Somalia allegations. For example, 

in February 2011, WFP management initiated informal quarterly 

operational briefings with Executive Board members.58

 

57The Horn of Africa updates cover Djibouti, Ethiopia, Kenya, Somalia, and Uganda. 

According to staff 

at the U.S. Mission to the UN Agencies in Rome, WFP held four 

operational briefings in 2011, holding its first briefing after the WFP 

Executive Board’s initial session that year. In June 2012, the U.S. Mission 

to the UN Agencies in Rome staff told us that they had received two such 

briefings since January and that a third is planned for September. In 

addition, WFP stated that it had conducted three seminars in Nairobi with

key stakeholders, including board members, WFP field staff, and 

implementing partners, in June 2011 to examine the risks faced and 

potential solutions in Somalia. Further, in September 2011, according to 

staff at the U.S. Mission to the UN Agencies in Rome, WFP briefed the 

Executive Board on the outcome of the Nairobi workshops. One board 

member informed us that the discussions in Nairobi were much more 

58World Food Program, Update on the Implementation of the External Auditor 

Recommendations on WFP’s Operations in Somalia, WFP/EB.A/2011/6-I (Rome, Italy: 

2011).

WFP Management Has 

Recently Improved Its 

Communication with the 

Executive Board 
 

Page 32 GAO-12-790 World Food Program Internal Controls

productive than the usual board meeting discussions. Also, board 

members told us that WFP informed the board in advance about an 

investigation of an implementing partner in Mogadishu, Somalia.

WFP also developed a process for staff at the country level to follow in 

communicating information about risks to WFP management. This 

process is currently effected through normal management channels and 

includes the escalation of information about events from the country office 

level, to the regional bureau, to the chief operating officer, and finally to 

the executive management council. In addition, WFP developed 

procedures for its staff to follow in response to a suspected case of 

diversion or wrongdoing. However, neither the new process nor 

procedures include clear criteria as to when issues should be escalated to 

the board. According to WFP, the circumstances will dictate the criteria 

for escalation to the Executive Board.

WFP has developed detailed policies to help WFP monitors conduct field 

monitoring as laid out by country offices’ monitoring plans. However, 

although WFP’s External Auditor recommended risk profiling as a basis 

for focused monitoring, WFP’s organization-wide monitoring guidance 

does not provide clear instructions to monitor distribution sites based on 

risk, including risks to WFP’s ability to distribute food to intended 

beneficiaries. 

Monitoring

According to COSO, monitoring is the means of assessing the quality of an internal 

control system’s performance over time to ensure that internal controls continue to 

operate effectively. This is accomplished through ongoing monitoring activities, separate 

reviews, or a combination of the two.

Source: COSO, “Internal Control—Integrated Framework” (1992).

WFP has developed detailed guidelines and policies that provide 

guidance to WFP staff and monitors on their roles and responsibilities in 

designing and implementing field monitoring of WFP operations. Detailed 

organization-wide guidance for monitors is available in WFP’s Monitoring 

and Evaluation Guidelines and in WFP’s Program Guidance Manual, 

which includes guidance for conducting food distribution monitoring and 

post-distribution monitoring for emergency operations and relief activities. 

In line with COSO’s monitoring standards, WFP’s Monitoring and 

Evaluation Guidelines states that all WFP’s operations should be 

regularly and systematically monitored and evaluated and that emergency 

operations must immediately put in place a system for food distribution 

Monitoring: WFP Has 

Developed Guidance for 

Field Monitoring of Food 

Assistance but Does Not 

Call for Risk-Based 

Monitoring

WFP Has Developed Detailed 

Policies for Field Monitoring
 

Page 33 GAO-12-790 World Food Program Internal Controls

monitoring so that reliable information is available on who is being fed 

and how much food they are receiving.59

WFP’s monitoring and evaluation guidance provides instructions for 

collecting field data, including discussions of sampling options, methods 

for choosing beneficiaries to interview, and instructions on collecting and 

processing qualitative data. In addition, WFP has developed numerous 

forms for food aid monitors to conduct on-site food distribution monitoring 

and post-distribution monitoring. WFP’s job profile for its monitors states 

that they are responsible for conducting continuous monitoring and 

reporting of food assistance, identifying potential problems, and 

periodically monitoring risk management and report on any actions taken.

According to COSO, monitoring 

should include the existence of mechanisms for capturing and reporting 

identified internal control deficiencies. In line with COSO, WFP guidance 

instructs monitors to follow-up on any problems from prior distributions, 

crosscheck data, and notify their supervisor of any discrepancies noted 

during the collection of monitoring data.

According to COSO, monitoring includes communications from external 

parties to corroborate internally generated information or to indicate 

problems. COSO also states that effective monitoring includes following 

up on corrective action where necessary. WFP guidelines reflect the 

COSO guidance by stating that WFP should work together with 

implementing partners to crosscheck monitoring findings, ensure that 

corrective action is taken when required, and assess the reliability and 

accuracy of partners’ monitoring reports.

Our review of WFP’s monitoring guidelines indicates that WFP country 

offices develop their countries’ monitoring plans and goals, including 

determining the number of sites to monitor and the frequency of 

monitoring. WFP guidelines state that country offices are responsible for 

monitoring and reporting on the progress, performance, and 

achievements of operations and programs as well as the handling and 

use of WFP-supplied commodities. WFP guidance also states that the 

amount of monitoring required depends on the distribution system 

 

59WFP’s Monitoring and Evaluation Guidelines states that the main components of a 

monitoring and evaluation strategy are (1) a logical framework; (2) a monitoring and 

evaluation plan for data collection and analysis; (3) reporting flows and formats; (4) a 

feedback and review plan; (5) a capacity building design; (6) an implementation schedule; 

and (7) a budget.
 

Page 34 GAO-12-790 World Food Program Internal Controls

adopted, the quantity of food being distributed, and the level of access to 

the distribution site.

WFP officials in Rome, Ethiopia, Kenya, and Somalia told us that country 

offices often focus their monitoring efforts on areas with a history of 

implementation and security problems.60 However, WFP’s organizationwide monitoring guidance does not provide clear instructions or 

guidelines stating that monitoring of warehouses and distribution sites 

should be based on risk, including risks to WFP’s ability to distribute food 

to intended beneficiaries. In 2006, the External Auditor recommended that 

WFP use statistical sampling approaches based on risk profiling and 

informed by implementing partner records, beneficiary concerns, and 

prior history, as a basis for focusing its monitoring resources.61

WFP’s organization-wide field monitoring guidance instructs monitors to 

follow up on issues based on prior field monitoring findings and also notes 

that risks, along with resources, budget and other factors should be 

captured in monitoring and evaluation plans.

According 

to COSO, an effective approach to monitoring includes designing and 

executing monitoring procedures that are prioritized based on risks to 

achieving organizational objectives.

62

 

60WFP officials told us that they also consider including risk, context of operations, 

capacities of implementing partners, geographical spread, and resources when 

determining the level of monitoring.

However, the guidance 

does not clearly instruct WFP staff and field monitors to consider risk as a 

key factor when determining the level of monitoring needed at 

warehouses and distribution sites. In addition, the guidance does not 

include instructions for tailoring monitoring based on the types of risk 

identified, including contextual risks, such as armed conflict, and 

institutional risks that could affect WFP’s reputation. For example, WFP’s 

organization-wide monitoring guidance does not address alternative 

approaches to ensuring monitoring of food assistance distribution sites in 

high-risk areas where the UN Department of Safety and Security 

(UNDSS) has restricted WFP staff’s access. Without specific guidance 

61United Kingdom National Audit Office, World Food Programme: Review of the 

Arrangements for Reporting Post Delivery Food Losses to the Executive Board, 

WFP/EB.1/2006/6-B/1 (2006).

62WFP’s guidance for monitoring the performance of its programs also instructs staff and 

monitors to document the type of risks that could affect the achievement of a program’s 

goals and outcomes.

WFP’s Monitoring Guidance 

Does Not Call for Risk-Based 

Monitoring Recommended by 

External Auditor
 

Page 35 GAO-12-790 World Food Program Internal Controls

that monitoring should be risk-based, WFP staff lack appropriate 

instructions to develop monitoring plans for those areas that are most 

vulnerable to waste, fraud, and abuse.

In the areas of Ethiopia, Kenya, and Somalia that we selected for our 

review, WFP has implemented procedures for tracking food from port-ofentry to beneficiaries, but security restrictions and limited internal controls 

in these areas weaken WFP’s ability to track food delivered to 

implementing partners. Further, although WFP has taken steps to 

improve monitoring, security restrictions, a limited number of monitors, 

and logistical challenges constrain its monitoring in these countries, 

hampering WFP’s ability to identify problems with food distribution. WFP 

has reported low rates of food assistance losses, but we found potential 

weaknesses in its collection of loss data after food is handed over to 

WFP’s implementing partners for distribution to beneficiaries. Moreover, 

no external evaluation of WFP’s food assistance loss data has been 

conducted since 2006.

Our review of WFP operations in selected areas of Ethiopia, Kenya, and 

Somalia showed that WFP has implemented procedures designed to 

prevent loss of food in its custody.63 However, limited access and lack of 

timely reporting by some implementing partners in these areas weaken 

WFP’s ability to track food in implementing partners’ custody. 

 

63We reviewed various documents for Ethiopia, Kenya, and Somalia that reflect controls 

that WFP has implemented while tracking the food commodity from these countries’ ports 

of entry to the intended beneficiaries for the period of January to June 2011. In this report, 

we use the term “selected areas” to include the sites we visited in our case study 

countries, the areas covered in the documents we reviewed, the areas covered in 

interviews we conducted in our selected countries, and other reviews related to internal

controls in our case study countries that we determined were appropriate for our 

researchable objectives. The areas we selected for review, like the countries we visited, 

are not generalizable to all areas in the selected countries or to the broader universe of 

WFP programs and operations.

Security Restrictions 

and Limited Internal 

Controls Weaken 

Assurance of Food 

Delivery and Accurate 

Loss Reporting for 

Selected High-Risk 

Areas

WFP Has Implemented 

Tracking Procedures but 

Has Limited Ability to 

Track Food in Custody of 

Implementing Partners in 

Selected Areas
 

Page 36 GAO-12-790 World Food Program Internal Controls

Our review of available documents for selected areas of Ethiopia, Kenya, 

and Somalia, as well as our visits to sites in Ethiopia and Kenya, found

that WFP has implemented procedures for receiving food at the port-ofentry, procuring transporters, and storing food in WFP warehouses.64

• Port-of-entry. We reviewed signed superintendence reports for 

Ethiopia, Kenya and Somalia. Each report included description of food 

commodities received at the port, the quantity received, and the 

shipping instruction number.

For 

example:

65

• Transport. We reviewed signed requests for quotations from 

transporters in all three countries. We also reviewed samples of 

waybills for Ethiopia, Kenya, and Somalia that had been completed, 

signed by the dispatching and receiving warehouse storekeepers and 

the transporter, and stamped, per WFP policy.

• Warehouses. We visited three WFP warehouses—one in Ethiopia 

and two in Kenya. As required by WFP policy, the warehouses had 

fences surrounding the buildings and appeared solid and stable; the 

warehouses’ interiors appeared organized and were arranged to allow 

access to the stored commodities; and the commodities were stacked 

on raised platforms, with spacing between the top of the stacks and 

the roof. For all three countries, we viewed food release notes, 

reflecting requests for food that the countries’ WFP program unit had

made to the logistics unit prior to the food’s release from WFP 

warehouses.66

 

64Because of logistical issues and security concerns, we were not able to visit sites in 

Somalia. 

WFP staff in Ethiopia, Kenya, and Somalia informed us 

that they reconcile data from WFP physical inventories against data in 

COMPAS. In Ethiopia, we observed WFP staff had reconciled 

physical inventory counts at given dates against food amounts that 

had been recorded in COMPAS, with explanations for any noted 

65The shipping instruction number identifies a consignment and is one of the keys to 

tracking and pipeline management.

66Instead of using food release notes, WFP Ethiopia uses document request forms to 

submit food requests. According to WFP, food release notes and document requests 

serve the same purpose.

WFP Has Implemented 

Procedures to Prevent Loss of 

Food in Its Custody in Selected 

Areas of Ethiopia, Kenya, and 

Somalia
 

Page 37 GAO-12-790 World Food Program Internal Controls

variations.67 In Kenya, staff at WFP’s East and Central Africa 

Regional Bureau told us that WFP country office staff also complete 

monthly minimum closure reports, which the regional bureau staff use 

to verify that country offices have reconciled physical inventory counts 

against data in COMPAS. Further, staff at a WFP Ethiopia field office 

confirmed that they have segregated the duties of staff who have 

access to COMPAS. According to WFP, this practice is intended to 

maintain the integrity of the data recorded in COMPAS. For example, 

the head of logistics for the WFP Ethiopia office can access COMPAS 

to view and verify data recorded by field office staff but cannot edit or 

add to their inputs.

Figure 5: WFP Warehouse in Ethiopia

We visited a food distribution site at a refugee camp in Ethiopia and two 

distribution sites in villages in Kenya. We also observed an implementing 

partner’s implementation of controls during a food distribution at one of 

the sites in Kenya.68

 

67We observed the reconciliation of physical inventory counts against data in COMPAS 

only in Ethiopia.

68We did not visit sites where WFP distributed the food directly to the beneficiaries.

Implementing Partners in 

Selected Areas of Ethiopia and 

Kenya Have Implemented 

Controls to Track Food in Their 

Custody
 

Page 38 GAO-12-790 World Food Program Internal Controls

• Ethiopia. At the food distribution site in Ethiopia, WFP’s implementing 

partner, the Ethiopian government, told us that every refugee 

household must have a ration card to receive food.69 We were also 

told that before each distribution, members of a relief committee—four 

WFP beneficiaries—verify that the materials used to measure rations 

are accurate and that the distribution process is conducted properly. 

The implementing partner said that representatives of the 

implementing partner performed distribution and post-distribution 

monitoring. In addition, members of the relief committee told us that 

the implementing partner’s staff observes the food distribution 

process, and that the relief committee monitors the process and 

reports its findings to the implementing partner. Another third party, 

the UN High Commissioner for Refugees (UNHCR), also assists at 

the refugee camps.70 Despite these controls, WFP has noted 

weaknesses in the Ethiopian government’s capacity to accurately 

account for, store, distribute, and report on food commodities in its 

care.71

 

69According to a UNHCR representative, ration cards identify refugees and family 

members eligible to receive rations. Ration cards are marked at the time of food 

distribution, allowing implementing partners to verify that cardholders received their rations 

for the distribution cycle.

70According to a 2012 WFP report, in Ethiopia, UNHCR’s chief responsibilities include 

supporting the Ethiopian government with financial resources for the determination of 

refugee status and registration processes and providing refugees with non-food items, 

such as cooking utensils, blankets and soap, and complementary foods, to improve the 

usability of the main food commodities that WFP provides. World Food Program, 

Summary Report of the Joint UNHCR/WFP Impact Evaluation on the Contribution of Food 

Assistance to Durable Solutions in Protracted Refugee Situations—Ethiopia, 

WFP/EB.1/2012/6-E (2012).

71WFP has made efforts to strengthen the Ethiopian government’s capacity in food 

commodity management through training and the development of a separate commodity 

tracking database.
 

Page 39 GAO-12-790 World Food Program Internal Controls

Figure 6: Distribution of WFP Food Assistance in Kenya

• Kenya. At one of the distribution sites in Kenya, we observed a food 

distribution administered by a nongovernmental organization. We also 

observed a relief committee monitoring the distribution process. 

Further, we observed that the implementing partner’s staff at the 

Kenya site organized the beneficiaries by family size, checking off 

beneficiaries from the beneficiary list as they received the ration, and 

that the implementing partner’s monitors were present for the 

distribution. In addition, beneficiaries told us that WFP monitors are 

normally present at the implementing partner’s distributions. 

According to WFP, the distribution we observed was 2 weeks late 

owing to land transport problems. At other distribution sites in Kenya, 

a 2011 WFP Office of Evaluation report on Kenya noted that some 

food distributions had frequently been missed in part because of 

logistical challenges.72

 

72World Food Program Office of Evaluation, Summary Evaluation Report-Kenya Country 

Portfolio, WFP/EB.2/2011/6-D (2011).

The evaluation noted that one implementing 

partner reported that it had not delivered 10 of the past 15 
 

Page 40 GAO-12-790 World Food Program Internal Controls

distributions. The evaluation did not note whether the undistributed 

food was accounted for or held until the next distribution round.

WFP staff in Ethiopia told us that they inspect the implementing partners’ 

warehouses to mitigate the lack of tracking through COMPAS of food 

delivered to implementing partners. They also said that they perform 

reconciliations of data in implementing partners’ monthly and quarterly 

distribution reports against data in COMPAS, as required by WFP’s 

Transport Manual. However, these efforts are constrained by limited WFP 

access as well as by a lack of timely reporting by implementing partners.

• Limited WFP access. According to WFP staff, security restrictions 

imposed by UNDSS limit WFP’s access to some areas and thus, in 

some cases, limit WFP’s ability to inspect implementing partners’ 

warehouses and verify their reporting. For example, WFP Ethiopia 

told us that because of UNDSS security restrictions, WFP staff have 

not had access since May 2011 to six districts in the Somali region of 

Ethiopia, where about 7,500 metric tons of WFP food commodities 

were distributed in 2011.73 According to WFP Ethiopia, one WFP staff 

was killed, one was injured, and two were taken hostage during an 

attack on WFP staff in this region in 2011. In addition, WFP Somalia 

staff told us that because of delays in finalizing a monitoring contract 

with a third party, there was limited WFP monitoring of implementing 

partners’ warehouses or distribution sites in Mogadishu for several 

months in late 2011. According to WFP Somalia, in December 2011, 

two WFP staff were murdered in central Somalia after they discovered 

the use of inflated beneficiary distribution lists.

• Lack of timely reporting by implementing partners. Some 

implementing partners in Ethiopia, Kenya, and Somalia do not submit 

their monthly distribution reports on a timely basis, according to WFP. 

To address this problem, WFP Somalia has developed standard 

operating procedures that outline steps that WFP staff in Somalia 

should take if implementation partners do not provide their distribution 

reports on time. WFP staff in Somalia also told us that in 2010 they 

distributed a warning letter to implementing partners stating that WFP 

will withhold payments if reports are late for 3 months or more. 

Further, WFP’s External Auditor stated that receiving timely monthly 

 

73According to WFP, in January 2012 UNDSS classified a 7th district in the Somali region 

of Ethiopia as inaccessible to WFP and other UN staff.

Limited Access and Lack of 

Timely Reporting Weaken 

WFP’s Ability to Track Food in 

Implementing Partners’ 

Custody
 

Page 41 GAO-12-790 World Food Program Internal Controls

distribution reports from implementing partners has historically been a 

challenge for WFP. In 2012, the WFP’s External Auditor reported that 

of a sample of 68 implementing partners, 27 (40 percent) had not 

submitted their monthly distribution reports at all, and as a result WFP 

had to estimate the figures for undistributed food.74 The External 

Auditor recommended that WFP streamline the procedure for 

collecting timely distribution reports from implementing partners and 

enhance the quality of its reconciliation of data on food undistributed 

by the partners. WFP agreed with this recommendation and stated 

that it will seek to ensure that monthly distribution reports are 

submitted promptly and reconciled with WFP data.75

WFP has made efforts to increase field monitoring in Somalia and 

reported that field monitoring findings inform its programming in Ethiopia, 

Kenya, and Somalia. Despite these efforts, security restrictions and 

limited resources constrain field monitoring in some high-risk areas, 

limiting WFP’s ability to identify problems with food distribution. 

Furthermore, WFP and its External Auditor have identified weaknesses 

with WFP’s field monitoring.

In the past 2 years, WFP has made efforts to increase its monitoring of 

food distributions in Somalia. WFP monitoring and evaluation guidelines 

state that all WFP operations should be regularly and systematically 

monitored and evaluated. From 2009 to early 2011, the UN Monitoring 

Group on Somalia, WFP’s Inspector General, and WFP’s External Auditor 

all investigated the allegations of food diversion in Somalia and reported 

control weaknesses.76

 

74World Food Program, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012). 

According to WFP, security restrictions prevented 

WFP from conducting field monitoring of general food distribution in 

Mogadishu in 2010. As a result, all WFP monitoring activities in the city 

that year consisted of “alternative monitoring,” which generally involved 

contacting stakeholders, such as implementing partners and 

75World Food Program, Report on the Implementation of the External Auditor 

Recommendations, WFP/EB.A/2012/6-H/1 (2012).

76World Food Program’s Inspector General Office, Office of Inspections and 

Investigations, Investigations of Allegations of Food Diversions in Somalia; UN Monitoring 

Group on Somalia, Report of the Monitoring Group on Somalia Pursuant to Security 

Council Resolution 1853; Comptroller and Auditor General of India, External Audit Report: 

World Food Programme’s Somalia Operations. 

WFP Has Taken Steps to 

Strengthen Monitoring, but 

Limited Coverage in Some 

Areas Weakens Ability to 

Identify Problems with 

Food Distribution

WFP Has Made Efforts to 

Increase Monitoring in Somalia
 

Page 42 GAO-12-790 World Food Program Internal Controls

beneficiaries, via telephone to inquire whether distributions had occurred 

as planned.

In late 2010, WFP began contracting with third-party monitors77 in 

Somalia to increase its monitoring coverage in areas that are inaccessible 

to WFP staff and monitors because of UNDSS security restrictions.78 In 

August 2012, WFP told us that a total of 25 third-party monitors were 

working in three areas in Somalia—10 in Mogadishu, 10 in Central 

Somalia, and 5 in the southern border areas. WFP stated that in 

Mogadishu, third-party monitors conduct most of WFP’s monitoring 

because of the security risks in the city. WFP noted that 47 percent of its 

distribution sites in Mogadishu were monitored in January 2012, 

compared with no field monitoring of distribution sites in Mogadishu in 

2010. In areas that are inaccessible to WFP and third-party monitors 

because of remoteness or security risks, WFP staff in Somalia continue to 

telephone key stakeholders, including beneficiaries and implementing 

partners, to verify that distributions took place as planned, according to 

WFP. However, according to a 2011 report by WFP’s External Auditor, 

this form of alternative monitoring may not always be reliable.79

Since July 2010, WFP Somalia has also maintained a beneficiary 

telephone hotline, which allows beneficiaries of WFP food assistance to 

provide anonymous feedback on WFP’s operations, monitors, and 

For 

example, the External Auditor stated that the WFP’s Somalia country 

office certified through telephone monitoring that WFP food assistance 

had been delivered to a site in Somalia for 2 months in 2009, but food 

was not provided to beneficiaries at this site during that time period. (See 

fig. 9 in app. III for more information on investigations of the Somalia 

allegations and the challenges WFP faces in that country).

 

77Third-party monitors are generally local staff hired by private firms rather than by WFP, 

the recipient government, or implementing partners. According to WFP, its third-party 

monitors must have the same qualifications and receive the same training as WFP 

monitors. Because WFP began using third-party monitors relatively recently and provided 

limited documentation on its use of third party monitors, we were unable to assess the 

effectiveness and qualifications of these monitors or to verify the type of training they 

received.

78WFP has also used third-party monitors in Afghanistan since 2007 and in Pakistan since 

2009. 

79Comptroller and Auditor General of India, External Audit Report: World Food 

Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011).
 

Page 43 GAO-12-790 World Food Program Internal Controls

implementing partners.80

Field monitoring findings are used to inform WFP programming in 

Ethiopia, Kenya, and Somalia, according to WFP officials. WFP’s 

monitoring and evaluation guidelines describe monitoring as a continuing 

function that uses systematic data collection to inform management of 

food aid programs’ progress and results. WFP staff in Ethiopia, Kenya, 

and Somalia told us that field monitors’ findings are captured in a 

narrative monthly report that is sent to the WFP country office and that 

these findings are used to inform programming. For example, WFP staff 

in Ethiopia told us that they increased refugees’ wheat rations by 20 

percent in response to monitors’ findings that the additional amount was 

needed to cover milling costs and milling losses. In addition to ensuring 

that it received the monthly reports on field monitors’ findings, WFP also 

set up a countrywide system in Somalia to consolidate, track, and report 

on monitoring findings and the follow-up status for WFP operations 

through a Somalia-specific monitoring database and a monthly monitoring 

and evaluation report. As recommended by the External Auditor in 

2011,

According to WFP, as of August 2012, the 

hotline had received a total of only 48 calls, more than half of them 

requests to become beneficiaries or complaints that rations were smaller 

than expected. WFP officials in Somalia attributed the low number of calls 

to the fact that the hotline number is not posted at all distribution sites and 

is not Somalia based, causing beneficiaries concern about the cost of 

calling an international number. WFP officials in Somalia said that, 

because the hotline has not been as effective as they envisioned, they 

plan to introduce a Somalia-based number and initiate a more systematic 

approach to informing beneficiaries about the hotline.

81 this report includes analysis of any significant variations between 

distribution monitoring and post-distribution monitoring.82

 

80WFP has also established a beneficiary hotline for operations in Afghanistan and 

Pakistan.

According to 

WFP, the Somalia country office uses the monitoring findings and results 

captured in the Somalia-specific database and report to develop each 

81Comptroller and Auditor General of India, External Audit Report: World Food 

Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011).

82Because WFP provided us with a single Somalia monitoring and evaluation report, from 

March 2011, we were able to verify the content of only that report.

WFP Reports That Field 

Monitoring Findings Inform 

Programming in Ethiopia, 

Kenya, and Somalia 
 

Page 44 GAO-12-790 World Food Program Internal Controls

month’s monitoring plan and send field missions to further investigate 

program issues.83

Several factors—security restrictions limiting access to some high-risk 

areas, limited numbers of monitors to cover all distribution sites, and 

logistical challenges affecting field monitoring—constrain WFP's ability to 

identify problems with food distribution in selected areas of Ethiopia, 

Kenya, and Somalia.

Security Restrictions 

UNDSS security restrictions, which limit WFP’s access to some high-risk 

areas in Ethiopia, Kenya, and Somalia, constrain WFP’s monitoring of 

these areas, according to WFP. COSO states that monitoring procedures 

should be prioritized based on risks that could affect an organization’s 

ability to achieve its objectives. Because of its restricted access to some 

high-risk distribution sites, WFP is unable to prioritize monitoring for these 

sites despite the risks.

• Ethiopia. Since May 2011, WFP has reported being unable to 

conduct any field monitoring in six districts in the Somali region in 

eastern Ethiopia because of UNDSS security restrictions.84

 

83WFP Somalia has also created standard operating procedures to determine how the 

results of monitoring should be used, as recommended by WFP’s External Auditor in its 

2011 report on Somalia. 

In 

addition, according to WFP, it has not provided for third-party 

monitoring in these districts. WFP reported that it provided 193,565 

metric tons of food to almost 2.4 million beneficiaries at 869 

distribution sites and five refugee camps in Somali throughout 2011. 

The Ethiopian government, as WFP’s implementing partner, 

distributes all food assistance for WFP’s refugee and relief programs 

in Ethiopia. According to WFP’s monitoring plan for Ethiopia, WFP 

aims to monitor 100 percent of distribution sites in the Somali region; 

however, it is currently not possible for WFP staff to access some 

sites owing to UNDSS restrictions. USAID, WFP, and UNHCR have 

reported on a lack of WFP monitoring coverage in some parts of the 

Somali Region in Ethiopia. For example, a June 2011 USAID 

monitoring report on two Somali refugee camps found that WFP was 

84UNDSS classified an additional district in this region as inaccessible in January 2012. 

Several Challenges Constrain 

Field Monitoring in High-Risk 

Areas, Limiting WFP’s Ability to 

Identify Problems with Food 

Distribution
 

Page 45 GAO-12-790 World Food Program Internal Controls

not conducting proper post-distribution monitoring.85 Another 2011 

USAID document stated that food assistance may have been 

distributed or sold to people who were not intended beneficiaries. 

According to a 2010 joint WFP, UNHCR, and Ethiopian government 

report, some refugee beneficiaries claimed that they did not receive 

the full amount of their food rations when WFP was not present to 

observe food distributions carried out by the Ethiopian government in 

the Somali region.86

• Kenya. A USAID document from August 2011 notes that WFP does 

not conduct post-distribution monitoring in a limited number of districts 

in northeastern Turkana, Kenya, because of security issues. In 

February 2012, WFP officials in Kenya told us that they rely on their 

implementing partner to monitor WFP programs in Mandera, Kenya, 

owing to security risks in that area. Further, in May 2012, WFP 

reported that because of security risks at the Dadaab Refugee Camp 

in Kenya, WFP’s post-distribution monitoring at that site would be 

limited.87

• Somalia. According to WFP, security risks have limited its ability to 

monitor distribution sites. For example, WFP reported that it achieved 

monitoring coverage of 58 percent of about 100 distribution sites in 

Mogadishu in February 2012. However, according to WFP, only 3 

percent of these distribution sites were monitored in November and 

December 2011, owing to security risks and delays in securing a 

contract with a third-party monitoring firm.88

 

85USAID conducts monitoring visits of U.S.-funded WFP operations and summarizes 

these findings in a narrative document.

WFP reported that it 

provided, through implementing partners, more than 3,500 metric tons 

of food to more than 350,000 beneficiaries in November 2011 and 

provided more than 5,000 metric tons of food to more than 400,000 

beneficiaries in February 2012 at these distribution sites in 

86World Food Program, United Nations High Commissioner for Refugees, and Ethiopian 

Government Administration for Refugee and Returnee Affairs, Ethiopia 2010, Joint 

Assessment Mission: Major Findings and Recommendations (2010).

87World Food Program, Horn of Africa Crisis, No. 33. (2012).

88Although WFP did not provide monitoring data for Mogadishu for October 2011, WFP 

officials in Somalia told us that limited monitoring was conducted in Mogadishu during that 

month.
 

Page 46 GAO-12-790 World Food Program Internal Controls

Mogadishu.89 In addition, WFP reported that only 6 percent of the 

border areas in Somalia were monitored in February 2012, owing to 

security risks in the area.

Limited Number of Monitors to Cover All Sites

WFP reported having a limited number of monitors to cover all distribution 

sites in Ethiopia, Kenya, and Somalia. According to WFP, it does not 

have the resources to monitor all distribution sites every month and 

therefore must determine how best to allocate these resources. WFP 

reports that on a monthly basis, 81 WFP monitors cover more than 3,000 

distribution sites in Ethiopia; 49 WFP monitors cover more than 2,500 

distribution sites in Kenya;90 and 64 WFP and third-party monitors cover 

more than 1,200 distribution sites in Somalia. In 2012, the UN Monitoring 

Group on Somalia reported that when monitors were not present during 

some food distributions in Mogadishu, local officials or other individuals 

controlling access to food assistance often required beneficiaries to sell 

the food back to them for a fraction of its value.91 According to a USAID 

document, WFP staff in Ethiopia and one of WFP’s implementing partners 

in Kenya, some distributions can take 5 days or more in parts of Ethiopia 

and Kenya, which, according to WFP, does not allow WFP monitors to be 

present from start to finish at these distributions. During our fieldwork in 

Ethiopia and Kenya, WFP beneficiaries and implementing partners told us 

that WFP often is not present to conduct monitoring.92

 

89The data on monitoring coverage, beneficiaries and metric tons are provided in the 

Somalia monthly updates that WFP sends to stakeholders. The most recent data on 

beneficiaries and metric tons provided, from the reports that we saw for Mogadishu, are 

for February 2012. The reports did not provide these data for December 2011 or January 

2012. 

At the Shimelba 

refugee camp in Ethiopia, WFP’s implementing partner and beneficiaries 

90Only general food distributions and food-for-assets distributions take place at these sites 

in Kenya.

91 UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security 

Council Resolution 2002 (2011), S/2012/544 (2012).

92According to WFP, WFP monitors’ access to some sites in Ethiopia and Kenya is limited 

by UNDSS security restrictions. Using its 6-point scale, UNDSS has rated the area where 

the Shimelba Refugee Camp is located at security level 3; Turkana, Kenya, at security 

level 4; and Mwingi, Kenya, at security level 2. In Turkana, we witnessed a general food 

distribution that occurred 2 weeks later than scheduled owing to land transport issues, 

according to WFP. Because of U.S. government security restrictions, we were unable to 

conduct any fieldwork in Somalia.
 

Page 47 GAO-12-790 World Food Program Internal Controls

told us that more WFP monitors were needed. Moreover, NGOs operating 

in Somalia told us that WFP does not have a large enough presence in 

the country. (See tables 4 and 5 in app. III for data on monitoring in 

Ethiopia, Kenya, and Somalia).

Logistical Challenges

Logistical challenges make it difficult for monitors to cover many 

distribution sites. For example, one WFP monitor we met with at the 

Shimelba refugee camp in Ethiopia told us that every month he must 

conduct distribution and post-distribution monitoring at 19 distribution 

sites and one refugee camp in the Tigray region in Ethiopia, a remote 

area of more than 20,632 square miles—larger than the combined areas 

of Vermont and New Hampshire—with rough terrain. In the last 3 months 

of 2011, WFP reported conducting monitoring at the Shimelba refugee 

camp only in December. In Turkana and Shimelba, WFP staff told us that 

WFP’s monitoring coverage is often constrained by weather conditions 

and poor roads, which make traveling to some distribution sites difficult 

and time consuming for monitors who must cover many sites.

In recent years, WFP’s Office of Evaluation and the External Auditor have 

identified weaknesses in WFP’s field monitoring of its programs. Seven of 

18 evaluations of WFP’s country and operation programs, including 

evaluations covering two of our case study countries,93 published by 

WFP’s Office of Evaluation from 2010 to 2012 raised concerns about 

WFP’s field monitoring. Some of these concerns included limited 

competency of monitors, insufficient monitoring to verify under-scooping 

of food rations, and inadequate monitoring of food storage to ensure 

adequate programming. In addition, in 2006, WFP’s External Auditor 

reported monitoring weaknesses, including an instance when monitors 

had not reported some losses because they believed that WFP required 

monitors to report only food losses representing more than 2 percent of a 

total delivery.94

 

93Three of the 18 evaluations covered Ethiopia and Kenya. 

94United Kingdom National Audit Office, World Food Programme: Review of the 

Arrangements for Reporting Post Delivery Food Losses to the Executive Board, 

WFP/EB.1/2006/6-B/1 (Rome, Italy: 2006).

WFP and External Auditor 

Have Found Field Monitoring 

Weaknesses 
 

Page 48 GAO-12-790 World Food Program Internal Controls

WFP reported low rates of food assistance losses for Ethiopia, Kenya, 

and Somalia in 2007 through 2011. However, reports by the UN 

Monitoring Group and WFP’s External Auditor raise questions regarding 

WFP’s reporting of losses for Somalia in 2009. More broadly, several 

factors—lack of timely reporting by implementing partners, limited access 

to implementing partners’ warehouses and distribution sites in some highrisk areas, and limited beneficiary reporting—weaken WFP’s ability to 

assure accurate reporting of data on losses of food in implementing 

partners’ custody. Despite donor and Executive Board concerns, no 

external evaluation of WFP food loss data has been conducted since a 

2006 review by WFP’s External Auditor. In that report, the auditor noted 

that inadequate reporting of losses presents not only risks to the 

effectiveness of WFP’s aid efforts and the achievement of its objectives 

but also reputational risks in terms of donor confidence.

For 2007 through 2011, WFP reported lower average loss rates for its 

operations in Ethiopia, Kenya, and Somalia than for its operations 

worldwide. WFP reported average loss rates of 0.30 percent for Ethiopia, 

0.21 percent for Kenya, and 0.25 percent for Somalia, compared with an 

average loss rate of 0.41 percent for $2.5 billion of total food handled 

annually worldwide.95

Figure 7 compares WFP’s annual reported food assistance loss rates for 

Ethiopia, Kenya, and Somalia with its global average loss rates for 2007 

through 2011.

According to WFP, short-delivery—that is, delivery 

of a smaller quantity of commodities than expected—and theft were the 

top reasons reported for global losses, with short-delivery accounting for 

27 percent and theft accounting for 20 percent of all losses.

 

95We compiled data on WFP’s food assistance losses from its 2007-2011 annual reports 

on food assistance losses and used these data to calculate summary statistics.

WFP Has Reported Low 

Rates of Food Assistance 

Losses for Ethiopia, Kenya, 

and Somalia, but Its 

Collection of Loss Data 

Has Potential Weaknesses

WFP Has Reported Low Loss 

Rates for Ethiopia, Kenya, and 

Somalia
 

Page 49 GAO-12-790 World Food Program Internal Controls

Figure 7: WFP’s Reported Food Assistance Losses in Ethiopia, Kenya, and Somalia and Worldwide, 2007-2011

Reports by the UN Monitoring Group and WFP’s External Auditor raise 

questions regarding WFP’s reported food assistance losses in Somalia in 

2009. As figure 7 shows, WFP reported a loss rate of 0.16 percent of the 

value of WFP food assistance handled in Somalia in 2009—the lowest 

rate that WFP reported for the country from 2007 through 2011. This rate 

reflects losses of 490.1 metric tons, valued at $239,291, from 355,760 

metric tons of total food assistance, valued at $152,237,880. Further, 

WFP’s 2009 annual report on food assistance losses shows lower loss 

rates for Somalia in 2009 than for 45 of the 74 countries where WFP 

operated that year.96 In addition, in response to allegations in the media,97

 

96World Food Program, Report on Post-Delivery Losses for the Period 1 January–31 

December 2009, WFP/EB.A/2010/13-A/Rev.2 (2010).

External Oversight Reports 

Raise Questions about WFP’s 

Reported Food Assistance 

Losses for Somalia in 2009
 

Page 50 GAO-12-790 World Food Program Internal Controls

a December 2009 report by the WFP Office of Inspections and 

Investigations did not find evidence of large-scale diversion. Instead, that 

report estimated that up to 10 percent of food distributed each month was 

sold in local markets by beneficiaries and thus was not diverted.98

However, a report by the UN Monitoring Group on Somalia in 2010 found 

that large-scale diversion of WFP food assistance had occurred in 

Somalia in 2009.99 For example, the report stated that in one instance, as 

much as approximately $4.4 million in food (significantly more than WFP’s 

reported losses of $239,291) may have been diverted directly to a local 

market without first being distributed to beneficiaries.100 Moreover, the 

WFP External Auditor’s 2011 report on WFP operations in Somalia raised 

doubts regarding the Office of Inspections and Investigations report’s 

methodology. The External Auditor concluded that food sold at local 

markets “may be higher than the 10 percent worked out by the Office of 

Inspections and Investigations” and that its own findings “do not support 

the [Office of Inspections and Investigations’] emphatic conclusion that 

food sold by the beneficiaries was the only source of food aid found in the 

markets.”101

In addition, the reports by WFP’s Office of Inspections and Investigations 

and External Auditor suggest that WFP’s limited monitoring of some food 

distribution sites makes it difficult for the organization to ensure accurate 

reporting of food assistance losses. Despite its conclusion that no largescale diversion of food assistance occurred in Somalia in 2009, the report 

by WFP’s Office of Inspections and Investigations states that in some 

areas of Somalia, WFP is not in a position to directly confirm the number 

of beneficiaries in the various camps or to verify that food sent for the 

 

97See Jonathan Rugman, “U.N. Probe after Aid Stolen from Somalia Refugees.” Channel 

4 News (UK), June 15, 2009, accessed July 24, 2012, http://www.channel4.com/news. 

98World Food Program, Office of Inspections and Investigations, Investigation of 

Allegations of Food Diversions in Somalia, OSDI/51/09 – I 29/09 (2009). 

99UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security 

Council Resolution 1853 (2008), S/2010/91 (2010).

100The UN Monitoring Group on Somalia’s 2012 report found that large-scale diversions of 

food assistance have continued in Somalia. According to the report, WFP has taken 

measures to investigate and address allegations of diversion, including through the use of 

third-party monitoring and independent audit firms. UN Security Council, Report of the 

Monitoring Group on Somalia Pursuant to Security Council Resolution 2002 (2011), 

S/2012/544 (2012).

101Comptroller and Auditor General of India, External Audit Report: World Food 

Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011).
 

Page 51 GAO-12-790 World Food Program Internal Controls

beneficiaries has reached them. Further, the WFP External Auditor’s 

report states that WFP has increasingly relied on alternative approaches 

to monitoring in Somalia, which the report characterizes as “subject to 

inherent bias.”

Although WFP takes steps to collect accurate loss data, several factors—

limited access to implementing partners’ warehouses and distribution 

sites in some high-risk areas, lack of timely reporting by implementing 

partners, and limited beneficiary reporting—weaken WFP’s ability to verify 

implementing partners’ reporting on food in their custody. According to 

WFP’s internal control framework, WFP management and personnel must 

have access to relevant, reliable, and accurate information that promotes 

effective decision-making in line with their responsibilities. WFP’s controls 

over food in its custody are designed to help ensure accurate loss data; 

for example, WFP transporters and receiving warehouse managers must 

both verify and sign for food received at WFP warehouses. WFP also 

includes analysis of losses above predetermined thresholds in its annual 

report on food assistance losses.102

• Limited WFP access. WFP’s lack of access to implementing 

partners’ warehouses and distribution sites in some high-risk areas, 

such as in Somalia, limits its ability to verify implementing partners’ 

reporting. For example, WFP reported that only 3 percent of 

distribution sites in Mogadishu, Somalia, were monitored in the last 2 

months of 2011, owing in part to security restrictions and delays in 

recruiting a third-party monitoring firm. WFP also reported that it could 

not conduct any on-site field monitoring in Mogadishu in 2010 

because of security risks. Further, although WFP encourages 

Because COMPAS does not track 

food in implementing partners’ custody, WFP relies in part on data in 

implementing partners’ monthly and quarterly distribution reports to 

calculate losses of food in their custody.

 

102WFP’s annual report on food assistance losses includes analysis of losses in a country 

if (a) the country registered food assistance losses of a single food type that represent at 

least two percent of the tonnage handled of that food and that have an absolute value of 

at least $20,000 and (b) the country registered losses of a single food type that have an 

absolute value greater than $100,000. In addition, the report describes measures to 

minimize losses, reviews factors contributing to losses in specific context and the 

preventive actions taken, and provides updates on issues outstanding from previous 

reports. For example, see World Food Program, Report on Post-Delivery Losses for the 

Period 1 January–31 December 2011. 

Several Factors Weaken WFP’s 

Ability to Assure Accurate 

Reporting on Losses of Food in 

Implementing Partners’ 

Custody
 

Page 52 GAO-12-790 World Food Program Internal Controls

unannounced monitoring visits, this approach is not always feasible in 

Somalia, according to WFP.103

• Lack of timely reporting by implementing partners. The failure of 

some implementing partners to submit the required monthly food 

distribution reports limits WFP’s ability to accurately report losses of 

food in the partners’ custody. In 2006, WFP’s External Auditor, 

commenting on problems with the timeliness of implementing 

partners’ food distribution reports, recommended that WFP include in 

its annual food assistance loss report the value and amount of 

commodities in the custody of the implementing partner whose reports 

WFP had not yet received.104 WFP complied with this 

recommendation in its 2006 report on losses during 2005105 but has 

not done so in subsequent reports. The External Auditor also 

recommended that WFP review, with a view to adopting a single 

global system, the country office systems being used to monitor 

implementing partner reporting. WFP stated in 2006 that it will explore 

the most appropriate means of monitoring implementing partner 

reporting and adopt a single global system by 2007; however, in 

January 2012, WFP reported that it was continuing to review country 

office systems and was still in the process of adopting a single global 

system. In addition, in its 2012 annual report, the External Auditor 

noted that getting timely distribution reports from implementing 

partners has historically been, and remains, a challenge.106

 

103The Associated Press conducted an analysis of the results of WFP’s announced and 

unannounced monitoring visits, as part of a broader examination of WFP’s activities in 

Somalia. See Katharine Houreld, “AP Exclusive: How Somalia Famine Aid Went Astray,” 

Associated Press, March 17, 2012. 

The 

External Auditor recommended that WFP streamline the procedure for 

collecting timely distribution reports from the implementing partners 

104United Kingdom National Audit Office, World Food Programme: Review of the 

Arrangements for Reporting Post Delivery Food Losses to the Executive Board, 

WFP/EB.1/2006/6-B/1 (Rome, Italy: 2006).

105In 2006, WFP reported having distributed a total of 4,245,359 metric tons in 2005. WFP 

estimated that implementing partners had not submitted reports for 37,537 metric tons—

0.9 percent, with an estimated value of $10.7 million—of this amount. COMPAS includes 

an option for marking a distribution quantity as an estimate for the last 3 months of the 

year if the implementing partners’ reports have not yet been received.

106Comptroller General and Auditor General of India, Report of the External Auditor on the 

Financial Statements: World Food Programme for the Year Ended December 2011, 

WFP/EB.A/2012/6-A/1 (2012).
 

Page 53 GAO-12-790 World Food Program Internal Controls

and enhance the quality of its reconciliation of data on undistributed 

food in the partners’ custody.

• Limited beneficiary reporting. WFP’s beneficiary hotline is intended 

to allow beneficiaries of WFP food assistance to report losses or short 

rations anonymously; however, among our case study countries, this 

hotline is available only in Somalia. Additionally, the hotline may not 

be easily accessible to all beneficiaries, because, according to WFP 

officials, the hotline number is not posted at all distribution sites and is 

not Somalia-based. WFP Somalia also told us that because the 

hotline has not been as effective as they envisioned, they plan to 

introduce a Somalia-based number and initiate a more systematic 

approach to informing beneficiaries about the hotline.

WFP has piloted a method using statistical sampling to collect data on 

losses incurred during distribution to beneficiaries, but WFP has not 

systematically applied this method to other country offices. According to 

the 2008 WFP document describing the pilot, “existing WFP loss 

monitoring systems are insufficient to capture losses during the final 

distribution phase to beneficiaries.”107

 

107World Food Program, Information Note on the Development and Qualification of 

Sampling Methodology and Statistical Analysis for Measuring Post-Delivery Losses, 

WFP/EB.A/2008/INF/6 (2008). 

The document indicates that 

although WFP tracks and quantifies food losses prior to distribution, it can 

only estimate, based on beneficiary receipts, losses during distribution. 

According to the WFP document, between 2007 and 2008 WFP piloted a 

random sampling methodology for food assistance losses in Zambia and 

Malawi. This methodology involved selecting distribution sites randomly, 

with larger sites more likely to be chosen; weighing and counting 

individual rations distributed at these sites; checking beneficiaries against 

a list; and checking food commodities at distribution sites against WFP 

records. This methodology identified differences between reported and 

actual numbers of beneficiaries; ration sizes; and amounts of food 

departing from, and returned to, the food stock. According to the 2008 

WFP document describing the pilot, this approach estimated the correct 

magnitude of losses and can considerably increase the losses reported 

by WFP. However, according to WFP, it has not systematically applied 

WFP Reported Piloting 

Systematic Method for 

Collecting Data on Losses 

Incurred during Distribution to 

Beneficiaries 
 

Page 54 GAO-12-790 World Food Program Internal Controls

this methodology to other country offices that met criteria outlined in the 

2008 document.108

In its annual reports on food assistance losses, WFP does not update 

prior years’ reported losses with the most recent information. WFP’s 

annual food assistance loss reports list losses that are being verified and 

state that these losses will be followed up in future reports. However, after 

confirming the losses under verification, WFP does not update its loss 

totals in subsequent reports. For example, in its 2007 report on food 

assistance losses, WFP stated that it was verifying 11,000 metric tons of 

food assistance losses, and its 2008 report confirmed some of those 

losses. However, WFP’s food assistance loss reports for 2010 and 2011 

did not update the loss total for 2007.

Despite concerns expressed by WFP donors, Executive Board members, 

and the External Auditors, WFP has not engaged an external party to 

conduct an evaluation of WFP’s loss reporting since the External Auditor 

conducted its evaluation in 2006. According to WFP’s internal control 

framework, independent oversight bodies may undertake periodic reviews 

of the effectiveness of its internal control procedures. In addition, COSO’s 

guidance on monitoring internal control systems states that ongoing and 

separate evaluations enable management to determine whether certain 

components (including information and communication) of internal control 

systems continue to function over time. During our fieldwork in Rome, 

some donors expressed doubts regarding WFP’s reported food 

assistance losses. Additionally, in 2005, WFP Executive Board members 

noted a possible contradiction between the low level of losses reported 

and the realities inherent in any food management system. According to 

the board members, even for the most organized and efficient commercial 

operations in developed countries, actual food losses exceed the levels 

reported by WFP.

 

108According to the 2008 WFP document, the methodology should be applied to country 

offices where there is a need to reduce distribution losses and where staffing levels are 

adequate. The document states that good accountability along the logistics chain, up to 

the final delivery warehouses, is a precondition for introducing the methodology in a 

country office. The document further notes that stable food supplies to each project site 

and a steady project environment are also necessary to obtaining statistically relevant 

data. See World Food Program, Information Note on the Development and Qualification of 

Sampling Methodology and Statistical Analysis for Measuring Post-Delivery Losses.

WFP Annual Reports on Food 

Assistance Losses Do Not 

Update Prior Year Losses with 

More Recent Information

WFP Has Not Engaged an 

External Party to Evaluate 

Food Loss Data in Recent Years
 

Page 55 GAO-12-790 World Food Program Internal Controls

The 2006 External Auditor’s report states that for effective management 

and minimization of losses, WFP should properly identify, investigate, and 

bring losses to the board’s attention and that inadequate reporting of 

losses presents not only risks to the effectiveness of WFP’s aid efforts 

and the achievement of its objectives, but also reputational risks in terms 

of donor confidence.109 However, according to WFP, since the External 

Auditor published its 2006 report, no external entity has evaluated WFP’s 

food assistance losses. As an example of a detailed evaluation of food 

assistance losses, in 2004, the International Food Policy Research 

Institute estimated that the highest food assistance loss rates by 

humanitarian organizations in Bangladesh occurred during the distribution 

to the beneficiaries and represented up to 8 percent of the total handled 

for the last quarter of 2002, with most of these losses resulting from short 

rationing during distribution to beneficiaries.110 In contrast, WFP reported 

food assistance losses of 0.02 percent—$9,700 in losses of $39.3 million 

handled—in Bangladesh for all of 2002.

WFP’s commitment to operate in some of the most challenging and 

dangerous areas of the world presents inherent risks to its ability to 

assure the delivery of food assistance to intended beneficiaries. Given 

this context, a strong system of internal control is needed to identify the 

principal risks to the achievement of WFP’s objectives, to evaluate the 

nature and extent of those risks, and to manage them effectively. The 

design of WFP’s internal controls related to delivering and monitoring 

food assistance generally reflects COSO principles for internal control, 

but weaknesses in some of these controls affect WFP’s ability to manage 

the risks inherent to WFP operations. For example, to the extent that it 

has not fully utilized the WFP Audit Committee, the Executive Board lacks 

the committee’s assistance in overseeing internal controls and risk 

management throughout the organization. In addition, staff lack 

 

109United Kingdom National Audit Office, World Food Programme: Review of the 

Arrangements for Reporting Post Delivery Food Losses to the Executive Board. 

110The report, which the International Food Policy Research Institute produced under 

contract with WFP, also included a detailed description of the food distribution system in 

Bangladesh, identified problems throughout the system, and made recommendations on 

how to solve these problems and minimize food assistance losses. See Akhter U. Ahmed, 

Shahidur Rashid, Manohar Sharma, and Sajjad Zohir, Food Aid Distribution in 

Bangladesh: Leakage and Operational Performance, FCND Discussion Paper No. 173 

(Washington, D.C.: International Food Policy Research Institute, 2004).

Conclusions
 

Page 56 GAO-12-790 World Food Program Internal Controls

instructions on operationalizing elements of risk management in areas 

most vulnerable to fraud, waste, and abuse. Further, without a written 

policy stating that monitoring should be based on risk, as recommended 

by WFP’s External Auditor, WFP country offices may not focus their 

limited staff resources to ensure regular monitoring of all high-risk 

distribution sites, increasing the possibility of the diversion of food from 

intended beneficiaries.

In the areas of Ethiopia, Kenya, and Somalia that we selected for our 

review, WFP has implemented procedures for tracking food delivery and 

has made efforts to improve monitoring of food distribution in Somalia. 

However, weaknesses in its tracking of food assistance in implementing 

partners’ custody, as well as UN security restrictions on WFP monitoring 

staff’s access to high-risk areas such as Mogadishu, Somalia, limit its 

ability to verify that implementing partners distribute food assistance to 

intended beneficiaries and to accurately report any food assistance 

losses. Without reliable data on food assistance distributions and losses, 

WFP has limited ability to provide accurate reporting on its operations and 

to avoid reputational risks that could affect its credibility with its 

stakeholders and donors and compromise its humanitarian mission of 

providing food assistance to those who depend on it. 

To strengthen WFP’s ability to manage the risks inherent to operating in 

high-risk areas such as Somalia, we are making the following five 

recommendations.

We recommend that the Secretary of State work with WFP’s Executive 

Board to 

• develop a plan for more fully utilizing the WFP Audit Committee to 

assist the board in monitoring the effectiveness of WFP’s risk 

management and internal control processes.

We also recommend that the Secretary of State work through WFP’s 

Executive Board to ensure that WFP management

• provides comprehensive risk management guidance addressing 

key elements of the risk management process, such as 

identifying, assessing, and responding to risks;

• revises WFP’s monitoring guidance to specify that field monitoring 

activities should be risk based;

Recommendations for 

Executive Action
 

Page 57 GAO-12-790 World Food Program Internal Controls

• provides organization-wide guidance for addressing monitoring 

deficiencies in areas inaccessible to WFP monitors because of 

security restrictions; and

• requires periodic external evaluations to assess and improve the 

reliability of data on food assistance losses.

We requested and received comments on a draft of this report from WFP 

and the Secretary of State. Both WFP and State—responding for itself, 

USAID, and the Department of Agriculture—provided written comments, 

which are reproduced in appendixes IV and V, respectively. In addition, 

State, WFP, USAID, and the U.S. Mission to the UN Agencies in Rome 

provided technical comments, which we incorporated in the report as 

appropriate.

In their written comments, both WFP and State agreed with our 

recommendations. WFP noted that strengthening its overall internal 

control framework and enterprise risk management will remain a priority. 

WFP also noted that it is currently addressing a number of the points 

raised in our report, as part of the overall organization-strengthening effort 

it launched in April. According to WFP, this effort includes a set of 

improvements to organization-wide monitoring and reporting, with an 

emphasis on putting in place a system that is succinct, resourced, and 

implementable at field level. WFP further noted that it will continue to 

consult with its member states, through its Executive Board, as it pursues 

further actions to ensure that its food assistance reaches intended 

beneficiaries in both high-risk and non-high-risk environments. In its 

written comments, State said that it will endeavor, through appropriate 

mechanisms—including the WFP Executive Board, bilaterally with WFP, 

and with partners—to implement all of our recommendations. State noted 

that USAID and USDA also agree with all of our recommendations and 

are prepared to support State as needed.

We are sending copies of this report to appropriate congressional offices, 

the Secretary of State and the Administrator of USAID, and relevant 

agency heads. The report is also available at no charge on the GAO 

website at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact 

me at (202) 512-9601 or melitot@gao.gov. Contact points for our Office of 

Agency Comments 

and Our Evaluation
 

Page 58 GAO-12-790 World Food Program Internal Controls

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff who made major contributions to this report are 

listed in appendix VI. 

Thomas Melito

Director, International Affairs and Trade
Appendix I: Objectives, Scope, and 

Methodology

Page 59 GAO-12-790 World Food Program Internal Controls

Our objectives were to examine the extent to which (1) the design of the 

World Food Program’s (WFP) internal controls related to the delivery and 

monitoring of food assistance reflects the Committee of Sponsoring 

Organization of the Treadway Commission’s (COSO) principles and (2) 

WFP has implemented as designed certain controls related to the delivery 

and monitoring of food assistance in selected high-risk areas. We focused 

our review primarily on WFP’s food assistance management from delivery 

at port-of-entry to distribution to intended recipients, because of WFP’s 

vulnerability to risks such as the alleged food diversion in Somalia during 

these stages of food assistance management. We did not review other 

processes, such as procurement, finance, and budget.

To address our first objective, we reviewed COSO’s Internal Control—

Integrated Framework; Enterprise Risk Management—Integrated 

Framework; Internal Control—Integrated Framework: Evaluation Tools; 

Enterprise Risk Management—Integrated Framework: Application 

Techniques; and Guidance on Monitoring Internal Control Systems.

1 We 

also reviewed other related international principles and guidelines, 

including the International Organization for Standardization’s (ISO) ISO 

31000—Risk Management Principles and Guidelines2 and the UN Joint 

Inspection Unit’s (JIU) “Review of Enterprise Risk Management in the UN 

System—Benchmarking Framework.”3

In choosing COSO criteria, or “points of focus,” for our analysis, we 

followed guidance in COSO’s Internal Control—Integrated Framework: 

Evaluation Tools, which suggests that evaluators tailor points of focus for 

each component of the framework to fit the entity’s facts and 

In addition, we reviewed WFP’s 

internal control framework, relevant WFP policies and procedures, 

relevant documents, and data related to internal controls.

 

1

Committee of Sponsoring Organizations of the Treadway Commission, Internal Control—

Integrated Framework (1992); Enterprise Risk Management—Integrated Framework

(2004); Internal Control—Integrated Framework: Evaluation Tools (1992); Enterprise Risk 

Management—Integrated Framework: Application Techniques (2004); Guidance on 

Monitoring Internal Control Systems (2009).

2

International Organization for Standardization, ISO 31000 Risk Management—Principles 

and Guidelines (2009).

3

Cihan Terzi and Istvan Posta, Review of Enterprise Risk Management in the United 

Nations System: Benchmarking Framework, JIU/REP/2010/4 (Geneva, Switzerland: 

United Nations Joint Inspection Unit, 2010). 

Appendix I: Objectives, Scope, and 

Methodology 

Objective 1: Examine the 

Extent to Which the 

Design of WFP’s Internal 

Controls Related to 

Delivery and Monitoring of 

Food Assistance Reflects 

COSO Principles
Appendix I: Objectives, Scope, and 

Methodology

Page 60 GAO-12-790 World Food Program Internal Controls

circumstances.4

For each of WFP’s internal control components, we examined information 

in the following documents, comparing it with criteria or points of focus in 

COSO’s Internal Control—Integrated Framework and Internal Control—

Integrated Framework: Evaluation Tools to determine whether the design 

of WFP internal controls related to the delivery and monitoring of food 

assistance reflects COSO principles.

We selected points of focus that are relevant to our 

scope. Further, we took into consideration any points of focus in WFP’s 

internal control framework that are not included in COSO’s framework. 

Where possible or appropriate, we identified documents, such as policy 

manuals, guidance, and circulars, that WFP has developed to address 

particular points of focus. Our analysis was not intended to conclude 

whether WFP’s internal control system overall is effective.

• Control environment. We reviewed a number of WFP documents 

including, but not limited to, sections of WFP’s Financial Resource 

Management Manual;5 internal control framework;6 strategic plan for 

2008 through 2013;7 annual reports for 2010 and 2011;8 General 

Regulations, General Rules, Financial Regulations, Rules of 

Procedures of the Executive Board;

9

 

4

The five components of WFP’s internal control framework are similar to the five 

components of COSO’s internal control framework. According to COSO’s Internal 

Control—Integrated Framework: Evaluation Tools, each element has substantive “points 

of focus” that represent some of the more important issues relevant to the component; not 

all points of focus are relevant to every entity, and additional issues will be relevant to 

some entities. 

Accountability Guide for 

5

We reviewed the following sections of WFP’s March 2012 Financial Resource 

Management Manual: section 2, “Governance”; section 3, “Internal Control”; section 4, 

“WFP Oversight; and section 5, “Responsibilities and Authorities.”

6

World Food Program, “Executive Director’s Circular EDD2011—Internal Control 

Framework” (2011).

7

World Food Program, Division of Communications and Public Policy Strategy, WFP 

Strategic Plan, 2008-2013. 

8

World Food Program, Annual Report 2010 (2011); The Year in Review, 2011 (2012). 

9

World Food Program, General Regulations, General Rules, Financial Regulations, Rules 

of Procedures of the Executive Board (2012). 
Appendix I: Objectives, Scope, and 

Methodology

Page 61 GAO-12-790 World Food Program Internal Controls

Managers;

10 Manager’s Guide to Internal Control;11 Internal Control 

Self-Assessment Checklists;

12 and Oversight Framework and Reports 

Disclosure Policy.

13 To identify any findings related to the WFP control 

environment, we also reviewed WFP’s annual audited accounts for 

2008 through 2011,14 the WFP Audit Committee’s annual reports for 

2011 and 2012,15 the WFP Office of the Inspector General’s annual 

reports for 2011 and 2012,16 and the Food and Agriculture 

Organization of the United Nations (FAO) Finance Committee’s 2012 

report.17 To identify points of integrity and ethical values, we reviewed 

the Code of Ethics for United Nations (UN) Personnel, WFP’s AntiFraud and Anti-Corruption Policy,18 and the UN Joint Inspection Unit’s 

(JIU) Ethics in the United Nations System.

19

 

10World Food Program, Resource Management and Accountability Department, 

Accountability Guide for Managers: A Quick Reference Guide for Managers on the 

Responsibilities and Accountabilities within Key WFP Processes, v. 1.0 (2011).

To review for best 

practices in examining the WFP Statement of Internal Control, we 

11World Food Program, Resource Management and Accountability Department, 

Manager’s Guide to Internal Control: WFP’s Guide to Internal Control for Managers

(2011). 

12World Food Program, Resource Management and Accountability Department, Internal 

Control Self-Assessment Checklists: A tool to help managers control their business better, 

v. 1.0 (2011).

13World Food Program, Oversight Framework and Reports Disclosure Policy, 

WFP/EB.A/2011/5-C/1 (2011).

14 World Food Program, Audited Annual Accounts, 2008, WFP/EB.A/2009/6”A/1 (2009); 

Audited Annual Accounts, 2009, WFP/EB.A/2010/6‐A/1 (2010); Audited Annual Accounts, 

2010, WFP/EB.A/2011/6‐A/1 (2011); Audited Annual Accounts, 2011, (WFP/EB.A/2012/6-

A/1 (2012). 

15World Food Program, Annual Report of the Audit Committee, WFP/EB.A/2011/6-C/1 

(2011); Annual Report of the Audit Committee, WFP/EB.A/2012/6-D/1 (2012).

16 World Food Program, Finance Committee, WFP Report of the Inspector General, FC 

139/10 (2011); Annual Report of the Inspector General, WFP/EB.A/2012/6-E/1 (2012).

17United Nations Food and Agriculture Organization, Report of the 144th Session of the 

Finance Committee, Rome, 11-15 June 2012 (2012).

18World Food Program, WFP Anti-Fraud and Anti-Corruption Policy, 

WFP/EB.2/2010/4‐C/1 (2010).

19United Nations Joint Inspection Unit, Ethics in the United Nations System (Geneva, 

Switzerland: 2010).
Appendix I: Objectives, Scope, and 

Methodology

Page 62 GAO-12-790 World Food Program Internal Controls

reviewed the World Bank’s annual report for 201120 and the InterAmerican Development Bank’s annual report for 2011.21 We also 

reviewed our 2007 report on UN oversight and accountability for 

historical information regarding the WFP Executive Board and Audit 

Committee.22 In September 2011, we interviewed nine members of 

WFP’s 36-member Executive Board—representatives of Cameroon, 

Canada, Guatemala, France, Germany, Netherlands, Sweden, United 

Kingdom, and the United States to the UN Food Agencies in Rome. 

We did not select the Executive Board members with whom we 

spoke; we requested a meeting with all available board members and 

met with those members who agreed to meet with us. In addition, we 

interviewed a director of the Comptroller and Auditor General of 

India—WFP’s External Auditor—as well as the current Chairman of 

the WFP Audit Committee.

• Risk management. We reviewed a number of WFP documents, 

including, but not limited to, WFP’s Enterprise Risk Management 

Policy; Financial Resource Management Manual, which includes 

WFP’s risk management framework; Risk Management Guide;23

internal control framework;24 WFP Strategic Plan, 2008-2013; annual 

performance reports for 2010 and 2011; Accountability Guide for 

Managers;

25 Manager’s Guide to Internal Control;26

 

20World Bank, The World Bank Annual Report 2011: Year in Review (2011).

and Executive 

Board approval documents for protracted relief and recovery 

operations and emergency operations. We also reviewed WFP’s 

annual audited accounts for 2008 through 2011, the WFP Audit 

Committee’s annual reports for 2011 and 2012, and the Office of the 

21 Inter-American Development Bank, Annual Report 2011: The Year in Review (2012).

22GAO, United Nations Organizations: Oversight and Accountability Could Be 

Strengthened by Further Instituting International Best Practices, GAO-07-597

(Washington, D.C.: June 18, 2007).

23World Food Program, “Risk Management Guide” (2006). 

24World Food Program, “Executive Director’s Circular EDD2011—Internal Control 

Framework” (2011).

25World Food Program, Resource Management and Accountability Department, 

Accountability Guide for Managers. 

26World Food Program, Resource Management and Accountability Department, 

Manager’s Guide to Internal Control. 
Appendix I: Objectives, Scope, and 

Methodology

Page 63 GAO-12-790 World Food Program Internal Controls

Inspector General’s annual report for 2011 and 2012 to identify any 

findings related to the WFP risk management. In addition, we 

reviewed ISO’s ISO 31000—Risk Management Principles and 

Guidelines; JIU’s Review of Enterprise Risk Management in the 

United Nations System—Benchmarking Framework; and a 

Humanitarian Policy Group-commissioned paper, “Risk in 

Humanitarian Action: Towards a Common Approach?”27 In addition, 

we interviewed WFP personnel regarding the risk management 

process. Further, we reviewed emergency and protracted relief and 

recovery operations documents for Ethiopia, Kenya, and Somalia to 

determine how risk management was covered.

• Control activities. We reviewed WFP’s Transport Manual, 

Warehouse Management Handbook, and Program Guidance Manual 

for guidance that WFP has designed related to controls over handling 

of food assistance at the port-of-entry, during transportation, in WFP 

warehouses, during WFP distributions to beneficiaries, and in the 

custody of implementing partners. We also reviewed the WFP’ 

External Auditor’s report related to controls observed for WFP’s 

COMPAS system.

• Information and communication. We reviewed WFP documents 

related to emergency operations and protracted relief and recovery 

operations for 2008 through 2015 for our case study countries—

Ethiopia, Kenya, and Somalia. We also reviewed the corresponding 

standard project reports that inform stakeholders about the use of 

resources for a given project and the results that WFP obtained during 

the reporting year. In addition, we reviewed WFP updates on the Horn 

of Africa and separate monthly updates on WFP operations in 

Somalia, which it distributes to its member states and partner 

organizations, including those within the UN system. Further, we 

reviewed WFP documents showing WFP’s risk management 

escalation process and procedures for managing potential diversion 

or wrong-doing of cooperating partners or transporters, which guides 

staff on what steps to take and whom to inform about a suspected 

case of diversion or wrongdoing. Last, we reviewed WFP’s Transport 

Manual for guidance on developing food assistance loss reports, 

which quantify WFP losses during internal transport arranged by 

 

27Victoria Metcalfe, Ellen Martin, and Sara Pantuliano, Risk in Humanitarian Action: 

Towards a Common Approach?, a report commissioned by the Overseas Development 

Institute’s Humanitarian Policy Group, 2011.
Appendix I: Objectives, Scope, and 

Methodology

Page 64 GAO-12-790 World Food Program Internal Controls

country offices or regional bureaus and during storage, arranged and 

paid for by WFP. We also interviewed some members of WFP’s 

Executive Board.

• Monitoring. We reviewed and analyzed WFP manuals and guidance 

related to field monitoring of WFP food assistance, including WFP’s 

Monitoring and Evaluation Guidelines and Program Guidance Manual. 

We focused on guidance related to distribution monitoring and postdistribution monitoring, not on performance monitoring or evaluations. 

We compared WFP’s guidance and manuals with monitoring criteria 

in COSO’s Internal Control—Integrated Framework; Internal Control—

Integrated Framework: Evaluation Tools; and Guidance on Monitoring 

Internal Control Systems. We also interviewed WFP staff in Rome, 

Ethiopia, Kenya, and Somalia to discuss how they develop their 

monitoring plans and goals. We reviewed internal and external 

oversight reports as well as WFP documents and reports related to 

the design of field monitoring.

To address our second objective, we reviewed WFP procedures to verify 

the implementation of WFP policies and guidelines at the organizational 

level and at the country level for our three case study countries—Ethiopia, 

Kenya, and Somalia. We selected these countries on the basis of a range 

of criteria, including the amount of U.S. contributions, the total amount of 

food assistance received, high-risk and non-high-risk environments, and 

logistics and budget constraints. Because WFP operates in more than 70 

countries and implements many different activities in each country, our 

case studies are not intended for generalization to all WFP countries and 

operations. We focused our review on emergency operations and 

protracted relief and recovery operations, which represent about 80 

percent of WFP’s operations, and on general food distribution activities 

within these programs. We focused primarily on general food distribution 

activities because it is generally the largest program under our case study 

countries’ operations.

For each country, we reviewed numerous documents that reflect some of 

the controls that WFP has implemented in selected areas. We also 

reviewed numerous documents for the three countries that show, for each 

country, the movement of a selected food commodity shipment from portof-entry to distribution sites during the period January to June 2011. We 

selected these shipments after discussion with WFP. 

We conducted fieldwork in Ethiopia and Kenya, selecting sites in each 

country after discussion with WFP; based on the shipment data we 

Objective 2: Examine the 

Extent to Which WFP Has 

Implemented as Designed 

Certain Controls Related 

to Delivery and Monitoring 

of Food Assistance in 

Selected High-Risk Areas
Appendix I: Objectives, Scope, and 

Methodology

Page 65 GAO-12-790 World Food Program Internal Controls

reviewed; and according to available time, logistical constraints, and 

security concerns. We also selected the sites to reflect a range of UN 

Department of Safety and Security (UNDSS) security levels, in order to 

examine any similarities or differences in WFP’s operations at the various 

security levels. We did not conduct fieldwork in Somalia, owing to 

logistical constraints and security concerns.

For the purposes of this report, we use the term “selected areas” to 

include the sites we visited in our case study countries, the areas covered 

in the documents we reviewed, the areas covered in interviews we 

conducted in our selected countries, and other reviews related to internal 

controls in our case study countries that we determined were appropriate 

for our researchable objectives. The areas we selected for review, like the 

countries we visited, are not generalizable to all areas in the selected 

countries or to the broader universe of WFP programs and operations.

• Control activities. To assess WFP’s implementation of its policies 

and guidelines related to control activities, we reviewed supporting 

documents showing the movement of the selected shipments in each 

case-study country: 13,970 metric tons of wheat for Ethiopia; 2,880 

metric tons of vegetable oil for Kenya; and 45 metric tons of split peas 

for Somalia. According to the supporting documents, all of the noted 

shipments were delivered to the respective countries between 

January and June 2011. In the field, we interviewed WFP East and 

Central Africa Regional Bureau staff, country staff, implementing 

partners, and transporters in Ethiopia and Kenya.28

 

28We visited the WFP Somalia country office located in Nairobi, Kenya. 

In addition, we 

visited WFP warehouses and an implementing partner warehouse in 

each country, and we visited one food distribution site in Ethiopia and 

two in Kenya, where we interviewed the beneficiaries. We also 

observed an implementing partner’s use of controls during a food 

distribution at one of the sites in Kenya. We interviewed staff from the 

U.S. Agency for International Development (USAID) and Department 

of State (State) in Ethiopia and Kenya, as well as staff from the UN 

High Commissioner for Refugees (UNHCR) and the UN Office for the 

Coordination of Humanitarian Affairs in Ethiopia, to obtain their 

insights on WFP operations in the country. We also reviewed the 

following WFP documents: Protracted Relief and Recovery 
Appendix I: Objectives, Scope, and 

Methodology

Page 66 GAO-12-790 World Food Program Internal Controls

Operation—Ethiopia 200365,

29 Summary Report of the Joint 

UNHCR/WFP Impact Evaluation on the Contribution of Food 

Assistance to Durable Solutions in Protracted Refugee Situations—

Ethiopia;

30 a February 2012 biweekly report on Ethiopia;31 WFP 

Management Response to the Report of the External Auditor on WFP 

Operations in Somalia;

32 standard operating procedures for Somalia, 

dated April 2010; Summary Evaluation Report—Kenya Country 

Portfolio;

33 Audited Annual Accounts, 2011;34 and Report on the 

Implementation of the External Auditor Recommendations.

35

• Monitoring. To assess WFP’s implementation of, and challenges 

related to, distribution and post-distribution monitoring in Ethiopia, 

Kenya, and Somalia and the extent to which monitoring helps assure 

the delivery of food assistance to intended beneficiaries in selected 

high-risk environments, we reviewed numerous WFP program and 

monitoring documents related to WFP operations in Ethiopia, Kenya, 

and Somalia. Some of these documents included WFP’s country 

monitoring plans, monitoring reports, and written responses to our 

questions. We also reviewed internal and external oversight and 

program reports for information on implementing field monitoring and 

related challenges. We also reviewed WFP’s evaluations published 

from 2010 through 2012 for findings related to field monitoring. 

Further, we conducted interviews in Ethiopia and Kenya with WFP 

staff and monitors, implementing partners, USAID, UNHCR, the UN 

Office for the Coordination of Humanitarian Affairs, and WFP 

beneficiaries. We were not able to assess the data on monitoring that 

 

29World Food Program, Protracted Relief and Recovery Operation: Ethiopia 200365, 

WFP/EB.1/2012/8/3 (2012). 

30World Food Program, Summary Report of the Joint UNHCR/WFP Impact Evaluation on 

the Contribution of Food Assistance to Durable Solutions in Protracted Refugee 

Situations—Ethiopia, WFP/EB.1/2012/6-E (2012). 

31World Food Program, Ethiopia Biweekly Report No. 3 (10 February 2012). 

32World Food Program, WFP Management Response to the Report of the External 

Auditor on WFP Operations in Somalia, WFP/EB.1/2011/5-B/1/Add.1 (2011). 

33World Food Program, Summary Evaluation Report—Kenya Country Portfolio, 

WFP/EB.2/2011/6-D. 

34World Food Program, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012). 

35World Food Program, Report on the Implementation of the External Auditor 

Recommendations, WFP/EB.A/2012/6-H/1 (2012).
Appendix I: Objectives, Scope, and 

Methodology

Page 67 GAO-12-790 World Food Program Internal Controls

WFP staff provided to us, because we did not have full access to 

information about the data’s sources. Therefore, we present a few 

examples of WFP-reported monitoring data in our report that we 

attribute to WFP and, for additional context, two tables of WFP’s 

reported data in appendix III.

• Food assistance losses. To assess the reliability of WFP’s data on 

losses of food assistance after arrival at ports-of-entry, we reviewed 

WFP’s policies and procedures and other documents on food 

assistance losses; a 2004 International Food Policy Research Institute 

report on food assistance losses;36 The WFP External Auditor’s 2006 

report on food assistance losses;37 WFP’s Office of Investigations and 

Inspections’ December 2009 report on Somalia;38 the UN Monitoring 

Group on Somalia’s March 2010 and July 2012 reports;39 and the 

WFP External Auditor’s January 2011 report on Somalia and 2012 

annual report.40

 

36Akhter U. Ahmed, Shahidur Rashid, Manohar Sharma, and Sajjad Zohir, Food Aid 

Distribution in Bangladesh: Leakage and Operational Performance, FCND Discussion 

Paper No. 173 (Washington, D.C.: International Food Policy Research Institute: 2004). 

We compared our case study countries’ loss rates 

with the global loss rate and compared Somalia’s loss rate in 2009 

with other accounts of losses in Somalia for 2009. To calculate WFP’s 

global food assistance loss rates, the food assistance loss rates for 

Kenya, Ethiopia, and Somalia, and the top reasons reported for losses 

for 2007 through 2011, we analyzed data compiled from WFP’s 

37United Kingdom National Audit Office, World Food Programme: Review of the 

Arrangements for Reporting Post Delivery Food Losses to the Executive Board, 

WFP/EB.1/2006/6-B/1 (Rome, Italy: 2006). 

38World Food Program, Office of Inspections and Investigations, Investigation of 

Allegations of Food Diversions in Somalia, OSDI/51/09-I 29/09 (2009). 

39UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security 

Council Resolution 1853 (2008) S/2010/91 (2010); Report of the Monitoring Group on 

Somalia and Eritrea Pursuant to Security Council Resolution 2002, S/2012/544 (2012). 

40Comptroller and Auditor General of India, External Audit Reports: World Food 

Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011); Report of the External 

Auditor on the Financial Statements: World Food Programme for the Year Ended 

December 2011, WFP/EB.A/2012/6-A/1 (2012).
Appendix I: Objectives, Scope, and 

Methodology

Page 68 GAO-12-790 World Food Program Internal Controls

annual reports on food assistance losses for 2007 through 2011.41 We 

also assessed these food assistance loss reports for consistency 

across years. We examined WFP’s data collection process via WFP’s 

policies and procedures, such as WFP’s Transport Manual42 and 

COMPAS user guide,43 and other WFP documents, such as WFP’s 

2008 information note on the development and qualification of 

sampling methodology and statistical analysis for measuring food 

assistance losses.44 We interviewed cognizant WFP officials in 

Washington, D.C.; Rome, Italy; Kenya; Ethiopia; and Somalia 

regarding COMPAS data. We also interviewed representatives of the 

International Food Policy Research Institute regarding its report on 

food assistance losses.45 As a result of our assessment, we 

determined, for reasons that we discuss in our report, that WFP’s data 

on food assistance losses were not sufficiently reliable for the purpose 

of accurately reporting losses for all countries.

For both objectives, we met with WFP officials in Rome, Italy, and in 

Washington, D.C. In addition, we conducted site visits in Ethiopia and 

Kenya and met with WFP country officials for Ethiopia, Kenya, and 

Somalia and officials from WFP’s East and Central Africa Regional 

Bureau in Nairobi. During our site visits, we also met with representatives 

of UNHCR and the UN Office for the Coordination of Humanitarian 

Affairs, WFP’s partners in some food assistance activities. In addition, in 

Rome, we met with the U.S. Mission to the UN Agencies in Rome; FAO; 

 

41World Food Program, Report on Post-Delivery Losses for the Period 1 January–31 

December 2007, WFP/EB.A/2008/13-A (2008); World Food Program, Report on PostDelivery Losses for the Period 1 January–31 December 2008, WFP/EB.A/2009/13-A 

(2009); World Food Program, Report on Post-Delivery Losses for the Period 1 January–31 

December 2009, WFP/EB.A/2009/13-A/Rev.2 (2010); World Food Program, Report on 

Post-Delivery Losses for the Period 1 January–31 December 2010, WFP/EB.A/2010/13-A 

(2011); World Food Program, Report on Post-Delivery Losses for the Period 1 January–31 

December 2011, WFP/EB.A/2012/13-A (2012).

42World Food Program, Transport Manual (2011). 

43World Food Program, Commodity Movement Processing and Analysis System: User 

Guide (2004). 

44World Food Program, Information Note on the Development and Qualification of 

Sampling Methodology and Statistical Analysis for Measuring Post-Delivery Losses, 

WFP/EB.A/2008/INF/6 (2008).

45 Ahmed, Rashid, Sharma, and Zohir, Food Aid Distribution in Bangladesh: Leakage and 

Operational Performance. 
Appendix I: Objectives, Scope, and 

Methodology

Page 69 GAO-12-790 World Food Program Internal Controls

some of WFP’s donor and recipient country representatives who are 

members of WFP’s Executive Board; a member of WFP’s Audit 

Committee; and a senior official of the Comptroller and Auditor General of 

India, which is WFP’s External Auditor. We also met with officials from 

State, USAID, and the U.S. Department of Agriculture in Washington, 

D.C., and during site visits.

We conducted our work from July 2011 to September 2012 in accordance 

with generally accepted government auditing standards. Those standards 

require that we plan and perform our work to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions 

based on our objectives. We believe that the evidence obtained provides 

a reasonable basis for our findings and conclusions based on our 

objectives.
Appendix II: World Food Program Governance, 

Oversight, and Management Structure

Page 70 GAO-12-790 World Food Program Internal Controls

WFP’s General Regulations establish the governance and oversight 

structure for WFP with clear distinctions among (1) governing bodies that 

involve member states,1 including WFP’s Executive Board; (2) 

independent external oversight bodies; and (3) independent internal 

oversight bodies. WFP’s management is headed by an Executive Director 

and includes functional offices, regional bureaus, and country offices.

Several external and internal WFP governance and oversight bodies are 

responsible for providing oversight and helping to manage WFP risks.

• UN governing bodies. Several UN entities, comprising 

representatives of the UN’s 193 member states, provide governance 

to WFP. These entities include the UN General Assembly, the FAO 

Conference, the UN Economic and Social Council, the FAO Council, 

the UN Advisory Committee on Administrative and Budgetary 

Questions, and the FAO Finance Committee.

• WFP’s Executive Board is a governing body that includes 36 of the 

UN’s 193 member states. According to WFP regulations, the board is 

responsible for providing intergovernmental support and specific 

policy direction to, and supervision of, WFP’s activities in accordance 

with the overall policy guidance of the General Assembly of the UN, 

the FAO Conference, the Economic and Social Council, and the 

Council of FAO. The board is also responsible for intergovernmental 

supervision and direction of WFP’s management. In addition, the 

Executive Board exercises an oversight function over WFP’s Office of 

Evaluation by providing strategic guidance, reviewing and approving 

the work plan and budget, and reviewing the independence of the 

evaluation function. 

• WFP’s Office of Evaluation and Oversight Office provide 

independent internal oversight. Both offices are independent from 

WFP’s management, and they conduct audits, investigations, and 

inspections on the systems, processes, operations, and activities 

WFP undertakes. The Director of the Office of Evaluation is 

responsible for implementing the evaluation policy, in particular for 

making institutional arrangements for independent evaluations and 

 

1

Member states are involved in WFP’s governance and oversight through various bodies 

and at different levels. 

Appendix II: World Food Program 

Governance, Oversight, and Management 

Structure 

WFP Governance and 

Oversight Bodies
Appendix II: World Food Program Governance, 

Oversight, and Management Structure

Page 71 GAO-12-790 World Food Program Internal Controls

ensuring adherence to the evaluators’ code of conduct. The Director 

of the Office of Evaluation is also accountable for ensuring the quality, 

credibility, and utility of evaluations. The Director of the Oversight 

Office, with the combined roles of inspector general and chief audit 

executive, has the responsibility for ensuring the integrity, efficiency, 

and effectiveness of WFP’s management, administration, and 

operations. The Director of the Office of Oversight is also responsible 

for preparing an annual report on the office’s activities, including a 

summary of significant oversight findings and the implementation 

status of recommendations, and for submitting this report to the 

Executive Director and the Executive Board.

• Independent external oversight bodies include the WFP External 

Auditor, the WFP Audit Committee, and JIU.

• The WFP External Auditor is appointed by, and reports to, the 

Executive Board. According to WFP regulations, the External 

Auditor is responsible for auditing WFP’s accounts, including all 

trust funds and special accounts, as deemed necessary to ensure 

that internal controls, including the internal audit, are adequate in 

light of the extent to which they are relied upon. The board may 

request the External Auditor to perform specific examinations and 

issue separate reports thereon.

• The WFP Audit Committee serves in an expert advisory capacity 

to assist the Executive Board and the Executive Director in 

exercising their governance responsibilities for the financial 

reporting, internal control arrangements, risk management 

processes, and other audit-related matters. The board approves 

the Audit Committee’s terms of reference. The committee’s 

mandate includes reviewing and advising on policies significantly 

affecting accounting and financial reporting issues and the 

effectiveness of WFP’s internal controls, internal audit function, 

and operational procedures; providing a forum to discuss internal 

control and risk management issues, operational procedures, and 

matters raised by internal and external audits; and providing 

comments on the work plans of the internal and external audit 

functions.

• JIU is an independent external oversight body of the UN system, 

mandated to conduct evaluations, inspections, and investigations 

system-wide. Its reports are submitted to the UN General 

Assembly and the governing bodies of participating specialized 

agencies, funds, and programs of the UN. The WFP Executive 
Appendix II: World Food Program Governance, 

Oversight, and Management Structure

Page 72 GAO-12-790 World Food Program Internal Controls

Board reviews JIU’s recommendations on a regular basis and also 

reviews reports by the WFP secretariat on the implementation of 

these recommendations.

• The FAO Finance Committee assists the FAO Council in 

exercising control over the financial administration of WFP. The 

committee’s functions include reviewing reports submitted by the 

WFP Secretariat and providing advice to the Executive Board.

WFP’s management is headed by an Executive Director who is 

responsible and accountable to the board for the administration of WFP 

and the implementation of WFP programs, projects, and other activities. 

The Executive Director is also responsible for establishing effective 

internal controls in management and an effective system of independent 

internal oversight through the Office of Evaluation and the Oversight 

Office.

WFP has a three-tier organizational structure, including headquarters in 

Rome, Italy; seven regional bureaus; and 77 country offices. WFP’s 

headquarters is in charge of governance, strategic planning, policy 

making, and macro-level monitoring. The regional bureaus provide 

technical assistance to the country offices and perform oversight over the 

country offices on adherence to corporate guidelines, practices, and 

procedures. Figure 8 reflects WFP’s management structure.

WFP Management 

Structure
Appendix II: World Food Program Governance, 

Oversight, and Management Structure

Page 73 GAO-12-790 World Food Program Internal Controls

Figure 8: WFP Management Structure
Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia 

Page 74 GAO-12-790 World Food Program Internal Controls

In examining whether the World Food Program (WFP) has implemented 

as designed certain controls related to delivering and monitoring food 

assistance in selected high-risk environments—our second objective—we 

focused our review on three countries: Ethiopia, Kenya, and Somalia. 

(App. I provides a description of our methodology for choosing these 

three as our case study countries.) The following provides background 

information on each country, including the UN Development Program’s 

(UNDP) Human Development index ranking, UNDSS security levels, 

statistics on food insecurity and malnutrition, percentage of the population 

requiring emergency food assistance, and WFP’s direct expenses.1 In 

addition, we present a timeline of security and humanitarian events in 

Somalia as well as investigations into allegations of control weaknesses 

in WFP operations in Somalia, including food diversion. Further, we 

include beneficiary and monitoring data for the three countries, including 

the areas where we conducted site visits, including number of monitors, 

number of distribution sites, and security levels.

State estimates that Ethiopia has a total population of about 84 million. 

Ethiopia is one of the world’s poorest countries, ranking 174 out of 187 

countries on the 2011 UNDP Human Development Index, with 23 million 

people living below the national poverty line. UNDSS has assessed 

security threats in the regions of Ethiopia at levels ranging from 1 

(minimal) to 4 (substantial).

WFP reports that malnutrition and food insecurity are significant problems 

in Ethiopia and that undernutrition contributes to 57 percent of deaths of 

children younger than 5 years. WFP also reported that from the end of 

2010 to the end of 2011, the food security situation deteriorated in 

Ethiopia, with 4.5 million people requiring emergency food assistance. In 

addition, UNHCR reports that, as of January 2012, Ethiopia was hosting 

more than 288,000 refugees from neighboring countries, such as Eritrea 

and Somalia.

In 2011, WFP’s direct expenses in Ethiopia totaled about $392 million, 

most of which was used to support the implementation of protracted relief 

and recovery operations (PRROs), as shown in table 1. One of the 

 

1

We are providing the data on WFP expenses for background purposes only and 

therefore did not assess their reliability. 

Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia

Ethiopia
Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia 

Page 75 GAO-12-790 World Food Program Internal Controls

PRROs addresses acute food insecurity through relief, safety nets, 

supplementary feeding, and HIV programs, while the other provides food 

assistance to refugees in Ethiopia. WFP Ethiopia’s guiding principle is to 

support government programs in addressing hunger by using food 

assistance where it adds value. WFP further assists the Ethiopian 

government through capacity building projects, such as Purchase for 

Progress (P4P), a food management improvement project, and 

vulnerability and assessment mapping. WFP is also a major contributor to 

supporting disaster risk management capacity in Ethiopia.

Table 1: WFP Direct Expenses for Ethiopia, 2007-2011

2007 2008 2009 2010 2011

Reliefa $148,862,000 $261,831,000 $354,215,000 $416,298,000 $339,050,000 

Development 17,836,000 b 19,658,000 26,414,000 26,247,000 27,029,000 

Special operations 164,000 c 2,578,000 4,041,000 3,125,000 3,837,000 

Bilateral trust funds and others 2,040,000 d 3,337,000 15,178,000 32,859,000 21,981,000 

Total $168,902,000 $287,404,000 $399,847,000 $478,529,000 $391,897,000 

Source: WFP’s 2011 Annual Performance Report, May 14, 2012.

Note: Expenses do not include program support and administrative costs. 

a

Includes activities under protracted relief and recovery programs, such as relief activities for both 

Ethiopians and refugees residing in Ethiopia, according to WFP. 

b

Development activities are intended to temporarily free the poor from the need to provide food for 

their families and to develop assets such as better houses and new agricultural skills, according to 

WFP.

c

Special operations typically involve short-term logistics and infrastructure work, according to WFP. 

d

Includes all expenses for WFP’s bilateral trust funds, General Fund, and Special Accounts. 

State estimates that Kenya had a population of approximately 39 million 

people in 2010. In the UNDP Human Development 2011 Index, Kenya 

ranked 143 out of 187 countries. UNDSS has assessed security threats in 

the regions of Kenya at levels ranging from 2 (low) to 4 (substantial).

In 2011, a complex crisis unfolded as severe drought affected the Horn of 

Africa and deepened into famine in parts of Somalia. WFP reported that 

in mid-2011, tens of thousands of Somalis arrived in Kenya’s Dadaab 

refugee camps each month, fleeing famine conditions and insecurity in 

southern Somalia. In addition, according to UNHCR, in September 2011 

the Kakuma refugee camp was home to more than 80,000 refugees and 

asylum-seekers, over half of them from Somalia, and the Dadaab and 

Kakuma camps had a combined population of more than half a million, 

Kenya
Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia 

Page 76 GAO-12-790 World Food Program Internal Controls

predominantly Somalis. Further, WFP reports that the drought made 

about 4 million Kenyans acutely food insecure.

In 2011, WFP’s direct expenses in Kenya totaled about $252 million, with 

most of this money used to support relief programs, including PRROs, as 

shown in table 2. WFP reported that, through one of the PRROs, it 

provided food assistance to refugees living in Dadaab and Kakuma 

camps and their host communities. The second PRRO supported families 

most affected by drought and rising food prices in the arid or semi-arid 

land, according to WFP. Both PRROs implemented general food 

distributions, nutrition support programs, and projects that paid in food for 

beneficiaries to build productive assets, such as those focused on 

harvesting and managing rainwater and conserving soil. In addition, 

where market conditions allowed, WFP delivered assistance through 

conditional and unconditional cash transfers.

Table 2: WFP Direct Expenses for Kenya, 2007-2011

2007 2008 2009 2010 2011

Relief $153,561,000 a $136,528,000 $222,834,000 $191,706,000 $228,590,000 

Development 28,532,000 b 25,022,000 23,722,000 21,655,000 21,702,000 

Special operations 8,205,000 c 681,000 0 0 0 

Bilateral trust funds and others 0 d 61,000 449,000 1,264,000 1,373,000 

Total $190,298,000 $162,293,000 $247,005,000 $214,625,000 $251,665,000 

Source: WFP’s 2011 Annual Performance Report, May 14, 2012.

Note: Expenses do not include program support and administrative costs. 

a

Includes activities under protracted relief and recovery programs, such as general food distribution 

for both Kenyans and refugees residing in Kenya, according to WFP. 

b

Development activities are intended to temporarily free the poor from the need to provide food for 

their families and to develop assets such as better houses and new agricultural skills, according to 

WFP.

c

Special operations typically involve short-term logistics and infrastructure work, according to WFP. 

d

Includes all expenses for WFP’s bilateral trust funds, General Fund, and Special Accounts. 

State estimates that Somalia had a population of approximately 9.9 

million people in 2011. Due to a lack of data on Somalia, the UNDP’s 

Human Development Index does not include Somalia in its ranking. WFP 

reports that Somalia has been affected by conflict and without a 

functioning government for more than two decades. UNDSS has 

assessed security threats in the regions of Somalia at levels ranging from 

3 (moderate) to over 5 (high).

Somalia
Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia 

Page 77 GAO-12-790 World Food Program Internal Controls

According to WFP, Somalia is classified as among the poorest and most 

food-insecure countries in the world. Six regions of southern Somalia 

were declared as famine zones by the Food Security and Nutrition 

Analysis Unit in 2011. Three of these regions were still classified as 

famine zones at the end of 2011. In many regions of Somalia, the global 

acute malnutrition rate remains near or above famine levels, and death 

rates remain high, especially for children, mainly because of continued 

outbreaks of measles, cholera, and malaria. WFP reports that current 

levels of malnutrition and mortality remain two to four times higher than 

typical levels in Somalia for this time of the year and six times the typical 

level for Sub-Saharan Africa.

In 2011, WFP’s direct expenses in Somalia totaled about $137 million, 

with most of this money used to support relief programs, including 

emergency operations, as reflected in table 3. WFP supported vulnerable 

Somalis through an emergency operation and three special operations.2

The main pillars of WFP’s emergency operations are general food 

distribution and nutrition programs to provide support to families living in 

emergencies and ensuring their adequate food consumption. An 

emergency school meals program provides a daily meal while increasing 

access to education of vulnerable children. Early recovery activities, 

including institutional feeding, and Food for Assets projects, including 

training, support the reestablishment of basic livelihoods of targeted 

households.

 

2

To support the provision of emergency humanitarian food assistance, WFP implemented 

three special operations in Somalia: (1) emergency rehabilitation of logistics and 

infrastructure, (2) humanitarian air service, and (3) logistics and emergency 

telecommunications. 
Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia 

Page 78 GAO-12-790 World Food Program Internal Controls

Table 3: WFP Direct Expenses for Somalia, 2007-2011

2007 2008 2009 2010 2011

Relief $64,508,000 a $168,086,000 $247,236,000 $104,916,000 $116,098,000 

Development 0 b 0 0 0 0 

Special operations 3,169,000 c 10,696,000 20,057,000 13,362,000 20,657,000 

Bilateral trust funds and others 0 d 0 596,000 1,611,000 728,000 

Total $67,678,000 $178,781 $267,889 $119,889,000 $137,483,000 

Source: WFP’s 2011 Annual Performance Report, May 14, 2012.

Note: Expenses do not include program support and administrative costs. 

a

Includes activities under emergency operations, such as general food distribution for Somalis, 

according to WFP. 

b

Development activities are intended to temporarily free the poor from the need to provide food for 

their families and to develop assets such as better houses and new agricultural skills, according to 

WFP.

c

Special operations typically involve short-term logistics and infrastructure work, according to WFP. 

d

Includes all expenses for WFP’s bilateral trust funds, General Fund, and Special Accounts. 

In June 2009, the United Kingdom-based Channel 4 News reported on 

allegations that WFP food assistance in Somalia had been diverted from 

intended beneficiaries. Since that time, the UN Monitoring Group on 

Somalia, WFP’s Office of Inspections and Investigations, and WFP’s 

External Auditor have conducted audits and investigations of these 

allegations and related control weaknesses. The allegations of food 

diversion and ensuing investigations added to the challenges WFP faced 

in Somalia due to drought, famine, and increased security risks and 

conflict related to the al-Shabaab terrorist group. Increased security risks 

in Somalia led many nongovernmental organizations, including WFP, to 

suspend their operations in some parts of Somalia in 2010. In 2011, WFP 

began providing assistance to some of the areas in Somalia it had exited 

in early 2010. Figure 9 shows a timeline of security and humanitarian 

events in Somalia as well as internal and external investigations into 

allegations of control weaknesses in WFP’s operations there, including 

food diversion.
Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia 

Page 79 GAO-12-790 World Food Program Internal Controls

Figure 9: Timeline of Security and Humanitarian Events and Investigations into WFP Control Weaknesses in Somalia
Appendix III: Information on Case Study 

Countries—Ethiopia, Kenya, and Somalia 

Page 80 GAO-12-790 World Food Program Internal Controls

WFP country offices in Ethiopia, Kenya, and Somalia set their own 

monitoring goals and monitoring plans. Tables 4 and 5 provide monitoring 

data reported by WFP, such as planned numbers of beneficiaries, 

UNDSS security levels, numbers of distribution sites, and numbers of 

monitors, for Ethiopia, Kenya, and Somalia as well as for selected 

fieldwork sites in Ethiopia and Kenya and high-risk areas in all three 

countries.

Table 4: Monitoring Data Reported by WFP for Ethiopia, Kenya, and Somalia

Number of 

planned 

beneficiaries 

UNDSS

security level

Number of 

distribution sites

Number of 

monitors for 

all program

Monthly 

distribution 

monitoring 

coverage goal

Monthly postdistribution 

monitoring 

coverage goal

Ethiopia 3,033,000 1 (minimal) to 

4 (substantial)

3,053 sites and 

16 refugee camps 

for all relief and 

recovery programs 

81 100 percent of all 

refugee camps

100 percent of all 

refugee camps a

Kenya

a

2,780,000 2 (low) to 

4 (substantial)

2,668 sites for 

General Food 

Distribution and 

Food for Assets 

activities within 

relief and recovery 

programs 

49 For nonrefugee 

general food 

distribution 

activities within 

relief and recovery 

programs - 

10 percent of all 

sites

120 households for 

each distribution site 

for non-refugee 

general food 

distribution activities 

within relief and 

recovery programs a

Somalia

a

1,900,000 3 (moderate) to 

over 5 (high)

1,241 sites for all 

programs

64 

(39 WFP and 

25 third-party) 

40 percent;

30 percent for 

areas covered by 

third-party 

monitoring

40 percent;

30 percent for

areas covered by 

third-party 

monitoring b

Source: WFP.

Note: Data shown under “Number of planned beneficiaries” are as of May 2012. All other data shown 

are as of August 2012. 

a

The WFP country offices in Ethiopia and Kenya have established different monitoring goals for the 

various programs operating in their respective countries (e.g., relief and recovery, refugees, school 

feeding, HIV/AIDS). We show the monitoring goals for the programs that we focused on and the sites 

that we visited during our fieldwork. 

b

According to WFP, WFP area offices in Somalia were also required to monitor each distribution site 

once every 3 months in 2011. 

Monitoring Data Reported 

by WFP
Appendix III: Information on Case Study

Countries—Ethiopia, Kenya, and Somalia 

Page 81 GAO-12-790 World Food Program Internal Controls

Table 5: Monitoring Data Reported by WFP for Selected GAO Fieldwork Sites and High-Risk Areas in Ethiopia, Kenya, and 

Somalia

UNDSS

security level

Number of

distribution sites 

Number of 

beneficiaries Number of monitors

Tigray, Ethiopia 1 (minimal) to 

3 (moderate)

332 distributions sites and 

3 refugee camps

386,529 4 

Somali, Ethiopia 3 (moderate) to 

4 (substantial)

869 distribution sites and

5 refugee camps

2,374,374 40 

Garissa, Kenya 

(includes Mwingi)

2 (low) to 

4 (substantial)

764 694,832 a 6 

Turkana, Kenya 4 (substantial) 273 427,400 5 

Mogadishu, Somalia 5 (high) 93 433,664 13 

(4 WFP monitors and 

9 third-party monitors)

Puntland, Somalia 4 (substantial) 312 337,346 11 

(all WFP monitors)

Source: WFP.

Note: Data shown are as of August 2012. 

a

According to WFP, although the WFP Garissa field office oversees 764 distribution sites, only 148 of 

these sites are monitored by WFP Garissa staff. 
Appendix IV: Comments from the World Food 

Program

Page 82 GAO-12-790 World Food Program Internal Controls

Appendix IV: Comments from the World Food 

Program 
Appendix IV: Comments from the World Food 

Program

Page 83 GAO-12-790 World Food Program Internal Controls
Appendix V: Comments from the U.S. 

Department of State

Page 84 GAO-12-790 World Food Program Internal Controls

Appendix V: Comments from the U.S. 

Department of State
Appendix V: Comments from the U.S. 

Department of State

Page 85 GAO-12-790 World Food Program Internal Controls
Appendix V: Comments from the U.S. 

Department of State

Page 86 GAO-12-790 World Food Program Internal Controls
Appendix VI: GAO Contact and Staff 

Acknowledgments

Page 87 GAO-12-790 World Food Program Internal Controls

Thomas Melito, (202) 512-9601 or melitot@gao.gov. 

In addition to the individual named above, Phillip Thomas (Assistant 

Director), Barbara Shields (Analyst-in-Charge), Martin De Alteriis, Mark 

Dowling, Etana Finkler, Fang He, Teresa Heger, Sabur Ibrahim, Jeffrey 

Isaacs, Reid Lowe, and Kimberly McGatlin made key contributions to this 

report. Other contributors include Ming Chen, Joy Labez, Armetha Liles, 

and Jeremy Sebest.

Appendix VI: GAO Contact and Staff 

Acknowledgments 

GAO Contact

Staff 

Acknowledgments
Related GAO Products

Page 88 GAO-12-790 World Food Program Internal Controls

Farm Bill: Issues to Consider for Reauthorization. GAO-12-338SP. 

Washington, D.C.: April 24, 2012.

International Food Assistance: Funding Development Projects through 

the Purchase, Shipment, and Sale of U.S. Commodities Is Inefficient and 

Can Cause Adverse Market Impacts. GAO-11-636. Washington, D.C: 

June 23, 2011.

International School Feeding: USDA’s Oversight of the McGovern-Dole 

Food for Education Program Needs Improvement. GAO-11-544. 

Washington, D.C: May 19, 2011.

International Food Assistance: Better Nutrition and Quality Control Can 

Further Improve U.S. Food Aid. GAO-11-491. Washington, D.C: May 12, 

2011.

Global Food Security: U.S. Agencies Progressing on Governmentwide 

Strategy, but Approach Faces Several Vulnerabilities. GAO-10-352. 

Washington, D.C.: March 11, 2010.

International Food Assistance: USAID Is Taking Actions to Improve 

Monitoring and Evaluation of Nonemergency Food Aid, but Weaknesses 

in Planning Could Impede Efforts. GAO-09-980. Washington, D.C.: 

September 28, 2009.

Somalia: Several Challenges Limit U.S. International Stabilization, 

Humanitarian, and Development Efforts. GAO-08-351. Washington, D.C.: 

February 19, 2008.

United Nations Organizations: Oversight and Accountability Could Be 

Strengthened by Further Instituting International Best Practices. 

GAO-07-597. Washington, D.C.: June 18, 2007.

Foreign Assistance: Various Challenges Impede the Efficiency and 

Effectiveness of U.S. Food Aid. GAO-07-560. Washington, D.C.: April 13, 

2007.

Darfur Crisis: Progress in Aid and Peace Monitoring Threatened by 

Ongoing Violence and Operational Challenges. GAO-07-9. Washington, 

D.C.: November 9, 2006.

Related GAO Products
Related GAO Products

Page 89 GAO-12-790 World Food Program Internal Controls

United Nations: Lessons Learned from Oil for Food Program Indicate the 

Need to Strengthen UN Internal Controls and Oversight Activities. 

GAO-06-330. Washington, D.C.: April 25, 2006.

Foreign Assistance: U.S. Food Aid Program to Russia Had Weak Internal 

Controls. GAO/NSIAD/AIMD-00-175. Washington, D.C.: September 29, 

2000.

Foreign Assistance: U.S. Bilateral Food Assistance to North Korea Had 

Mixed Results. NSIAD-00-175. Washington, D.C: June 15, 2000.

World Bank: Management Controls Stronger, but Challenges in Fighting 

Corruption Remain. GAO-00-73. Washington, D.C.: April 6, 2000.

Foreign Assistance: North Korea Restricts Food Aid Monitoring. 

NSIAD-00-35. Washington, D.C: October 8, 1999.

(320845)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.