Regional Multilateral Development Banks: External Audit Reporting Could Be Expanded
Published: 2001-12-14T00:00:00

Fast Facts:

Highlights:
section_title: What GAO Found
paragraphs: Multilateral Development Banks (MDBs) provide financial support to promote social and economic progress in developing countries and the countries of central and eastern Europe and the former Soviet Union. Under the Foreign Operations, Export Financing, and Related Programs Appropriations Act of 2001, the United States is providing $1.3 billion to support the MDBs, with $460 million going to the regional development banks and $840 million going to the World Bank Group. All of the MDBs GAO reviewed have received unqualified or "clean" opinions on their external audits. However, none of the MDBs GAO reviewed are required to report on their internal controls over financial reporting, lending operations, or compliance with their governing charters or policies. In addition, the regional MDBs' external financial statement audits are not intended to, and do not, provide assurances about internal controls over the MDBs' lending operations and whether funds are spent as intended. Most of the regional MDBs that GAO reviewed have developed anti-corruption strategies that recognize the importance of strong internal control systems. Each of the regional MDBs GAO studied has established internal audit functions as part of their controls.

section_title: Letter
paragraphs: Multilateral Development Banks (MDBs) were established to provide financial support for projects and programs designed to promote social and economic progress in developing countries and the countries of central and eastern Europe and the former Soviet Union. Under the Fiscal Year 2001 Foreign Operations, Export Financing, and Related Programs Appropriations Act (Public Law 106-429), the United States is providing approximately $1.3 billion to support the missions of the MDBs, with about $460 million going to the regional development banks and about $840 million going to the World Bank Group. Section 803(a) of the act provides that we report annually on the sufficiency of audits of the financial operations of each MDB conducted by the persons or entities outside the bank.
We will be issuing a series of reports in response to the reporting requirements in Public Law 106-429. The first in this series was Multilateral Development Banks: Profiles of Selected Multilateral Development Banks. As agreed with your offices, this second report provides our assessment of the external financial statement audit reporting process for the following four regional MDB groups:   African Development Bank Group,   Asian Development Bank,   European Bank for Reconstruction and Development, and  Inter-American Development Bank.
Financial statement audits and the related assurance provided by external auditors are important for MDBs because MDBs   operate in countries where transparency and accountability are ranked among the lowest in the world,   are multilateral entities not subject to oversight by any single national government, and   have missions that emphasize distributing funds for development, which need to be balanced with accountability for the use of those funds.
As agreed, this report addresses the following two specific areas related to the external financial statement audit process: 1.  the extent to which these MDB groups are obtaining assurance from the external auditors on internal control over financial reporting, lending operations, and compliance with key provisions of their charters and policies in conjunction with their financial statement audits and 2.  whether these MDB groups have audit committees in place to provide oversight of external financial statement audits and the MDBs’ internal control.
We have begun similar work at the World Bank Group and will report on that work at a later date.
subsections: section_title: Scope and Methodology
paragraphs: Public Law 106-429, Appendix A, Title VIII, identifies 10 MDBs to be included in the scope of our work. As agreed with your offices, this report focuses on external audits of four regional MDB groups and related entities:  African Development Bank (AfDB)
African Development Fund (AfDF)
Asian Development Bank (AsDB)
Ordinary Capital Resources (OCR)   Asian Development Fund (AsDF)
European Bank for Reconstruction and Development (EBRD)
Inter-American Development Bank (IDB)   Ordinary Capital (OC)   Fund for Special Operations (FSO)  Inter-American Investment Corporation (IIC)
The 4 MDB groups included in our scope include 6 of the 10 MDBs listed in Public Law 106-429: AfDB, AfDF, AsDB, EBRD, IDB, and IIC. As agreed, we focused our work on the regional MDBs because of congressional interest in these regional banks. In subsequent work we will address the four remaining MDBs listed in the law: the International Bank for Reconstruction and Development, International Development Association, International Finance Corporation, and the Multilateral Investment Guaranty Agency—which are all part of the World Bank Group.
Our objectives were to determine (1) the extent to which these MDB groups are obtaining assurance from the external auditors on internal control over financial reporting, lending operations, and compliance with key provisions of their charters and policies in conjunction with their financial statement audits and (2) whether these MDB groups have audit committees in place to provide oversight of external financial statement audits and the MDBs’ internal control. To meet our objectives, we held meetings and interviews with Department of the Treasury officials, including the U.S. Executive Director for the Inter-American Development Bank. We also reviewed the regional MDBs’ 1997 through 2000 audited financial statements and auditors’ opinions on the financial statements and identified the accounting and auditing standards used by each MDB,   analyzed and compiled information from the regional MDBs’ annual reports and their audited financial statements,   analyzed the external audit reports to determine the extent of the external auditors’ reporting on internal control and compliance in conjunction with the financial statement audits, reviewed the banks’ terms of reference (charters) to identify the scope of their audit committees’ oversight and compared them to relevant guidance on widely accepted internal control frameworks and principles on banking supervision,   obtained information from the U.S. Executive Directors of each MDB group on the MDBs’ audit committees, external audits, and the extent of external auditor reporting on internal control and compliance, reviewed widely accepted internal control frameworks, such as the Guidelines for Internal Control Standards developed by the International Organization of Supreme Audit Institutions, and   discussed various options for external auditor reporting with representatives from three international accounting firms that were responsible for some of the MDB audits.
MDBs are multilateral, international entities, and the United States, as an individual member country, generally does not have audit authority over their operations. As such, it was not part of our scope to evaluate whether the regional MDBs have implemented internal control, nor did we evaluate the quality of the external auditors’ work on the financial statement audits. It was not part of our scope to determine whether the audit committee members were independent of the regional MDBs they served, nor did we evaluate other components of the regional MDBs’ internal governance structure.
We conducted our work in Washington, D.C., from April through October 2001 in accordance with generally accepted government auditing standards. On November 30, 2001, we received comments from the Department of the Treasury, which are reproduced in their entirety in appendix IV. In addition, the department also provided a number of suggested technical changes to our report, which we incorporated as appropriate.
section_title: Background
paragraphs: MDBs are multilateral, international entities that finance economic and social development projects and programs in developing countries and countries of central and eastern Europe and the former Soviet Union. National governments are the shareholders—referred to as members—of the MDBs. MDB members include developing countries that borrow from the MDB as well as industrialized member countries. All members, including borrowing members, contribute to the capital of the MDBs and participate in oversight and in the setting of operating policies through their participation on the boards of governors and executive boards. The MDBs provide development assistance in the form of loans, equity investments, loan and equity guarantees, and technical assistance. The primary vehicle of development assistance is direct lending. In 2000, the regional MDBs included in this report approved about $16.3 billion of development assistance consisting of loans, loan guarantees, and equity investments for economic and social development.
The regional MDBs’ lending activities can be grouped primarily into the following two types: market-based lending and concessional lending. Operations of regional MDBs that provide loans with market-based rates are financed primarily through borrowings from world capital markets, members’ paid-in capital, and retained earnings. Members also provide support through subscriptions of callable capital. Because of the significant proportion of callable capital that is subscribed by members with strong credit ratings, including the United States, MDBs are able to use callable capital as backing to obtain more favorable financing terms when borrowing from world capital markets than would otherwise be available without the callable capital. To date there has never been a call on this capital for any of the MDBs included in this report.
The lending arms of the regional MDBs that provide concessional loans to the poorest of the developing countries—those meeting certain eligibility requirements—are financed through contributions from member countries and borrower repayments of outstanding loans. These loans are called “concessional” because they are provided with below-market interest rates and extended repayment terms. Due to the nature of concessional lending and the credit risks of borrower countries, the concessional lending arms do not have callable capital subscriptions and do not borrow from world capital markets to finance their operations. Unlike the market-based lending arms of the MDBs, which borrow from world capital markets to fund lending, concessional lending arms rely on capital replenishments or periodic contributions by members in addition to repayments from loans in order to continue lending operations.
An MDB’s activities are overseen through a board of governors, with a governor from each member country. In general, a board of governors is responsible for admitting new members, authorizing agreements for cooperation with other international organizations, making decisions about the board of executive directors, approving the MDB’s financial statements, determining the reserves and the distribution of profits, and making decisions about the scope of MDB operations. Each MDB also has a board of executive directors, which is responsible for, among other things, overseeing the bank’s daily operations, ensuring the implementation of the decisions of the board of governors, and approving the budget of the bank. The MDB’s own management and staff of international civil servants carry out the MDB’s daily operations.
The four regional MDB groups included in this report are referred to as regional MDBs because they focus their activities on a particular region. The regional MDBs’ memberships consist of developing or borrowing countries within a particular region of the world plus industrialized and other member countries located throughout the world. All members participate in oversight and the setting of operating policies of the MDBs through their participation on the executive boards and boards of governors. See table 1 for a discussion of the regional MDBs and their functions.
The United States is a member of all the regional MDBs discussed in this report, contributing significant amounts to support the missions of the MDBs and subscribing to a significant amount of the MDBs’ callable capital. The Congress appropriates funds for the United States’ contributions and capital subscriptions to the MDBs. In fiscal year 2001, the Congress appropriated about $239 million for the regional MDBs included in this report. During fiscal year 2001, the Congress also approved $221 million of new subscriptions to callable capital for those regional MDBs. The Department of the Treasury oversees the United States’ interests in the regional MDBs. See table 2 for a summary of U.S. resources provided to the regional MDBs through December 31, 2000.
In 2000, the regional MDBs we reviewed approved about $16.3 billion of development assistance consisting of loans, loan guarantees, and equity investments for economic and social development. Asia and the Pacific region received the largest portion of this development assistance, about $5.8 billion, while the Latin American and Caribbean region received approximately $5.4 billion, Africa received about $2.6 billion, and Europe and Central Asia received about $2.5 billion. Loans with market-based interest rates, equity investments, and loan guarantees accounted for about $12.9 billion of the total financial support provided by these MDBs during 2000, while concessional lending amounted to about $3.4 billion.
All of the regional MDBs we reviewed have annual financial statement audits. The regional MDBs’ external auditors are international certified public accounting firms that were contracted by the MDBs to audit the MDBs’ financial statements. All of the regional MDBs included in our report received unqualified or “clean” audit opinions on their financial statements for the 4 most recent years.
MDBs prepare their financial statements to comply with different bases of accounting. The MDBs present their financial statements using U.S. generally accepted accounting principles (U.S. GAAP) or international accounting standards (IAS), as shown in table 3. Due to the special nature and organization of the concessional lending arms of the MDBs, some of these entities prepare special-purpose financial statements that are meant to show the sources and uses of resources and to comply with accounting standards specific to the affiliate’s operations. The African Development Fund and the Inter-American Development Bank’s Fund for Special Operations, both concessional lending arms, prepared special-purpose financial statements in 2000.
section_title: MDB External Audits Could Be Enhanced by Reporting on Internal Control and Compliance
paragraphs: Agreements establishing the MDBs we reviewed call for external auditors to examine the banks’ financial operations. The external auditors for the MDBs included in our review conduct audits and prepare financial statement audit reports based on the international standards on auditing (ISA) or U.S. generally accepted auditing standards (U.S. GAAS). These standards require independent auditors to obtain a sufficient understanding of internal control to plan the audit and determine the nature, timing, and extent of tests to be performed. As part of an audit, the auditors are to communicate to the audit committee any internal control material weaknesses and reportable conditions that come to their attention during the course of their work. A frequent practice is for the auditors to issue a written document known as a management letter to communicate these weaknesses. The management letter, however, only addresses issues detected as part of the financial statement audit work, and it is not meant to be a comprehensive attestation on the sufficiency of an entity’s internal control. In order to obtain such assurance, the regional MDBs could engage their auditors to add this work to their annual audit or to perform a separate attestation engagement.
To date, none of the regional MDBs are required to engage, nor have they engaged, their external auditors to report on the MDBs’ internal control and compliance with key provisions of bank charters and policies. All of the charter agreements establishing the regional MDBs require them to take the necessary measures to ensure that the proceeds of any loan made, guaranteed, or participated in by them are used only for the purposes for which the loan was granted and with due attention to considerations of economy and efficiency. However, the charters do not contain requirements for an external auditor’s report on the regional MDBs’ internal control over these key objectives and requirements. In addition, the supporting documents provided to us by the regional MDB U.S. Executive Directors regarding the scope of audit services did not contain any requirements for the external auditor to provide a comprehensive report on internal control or compliance matters. Because the regional MDBs operate in a difficult and risky control environment, the member countries that provide financial backing and contributions to the MDBs could benefit from additional external audit assurance over the MDBs’ internal control over lending operations and internal control over compliance with key provisions of their charters.
subsections: section_title: Financial Statement Audit Coverage of MDBs
paragraphs: The MDBs’ external financial statement audits provide assurance over the MDBs’ reported financial position at a point in time and the financial results of its operations and cash flows for a given fiscal year. After the MDBs make loans to member countries, it is at the project and program levels where the money is ultimately spent by the borrowers for development purposes. The MDBs’ external financial statement audits do not specifically cover the use of funding at the project and program levels, once the MDB has lent funds to borrowers for development purposes. The MDBs’ external financial statement audits also do not provide and are not intended to provide specific assurance about the internal control over the MDBs’ lending operations and whether the funds are spent for their intended purposes.
A key control over the lending process at one of the regional MDBs is that as a condition of the loan, the MDB requires each project or program to receive audits from either the member government or an accounting firm.
The MDBs’ financial statement audits are currently not designed to report on the results of the project and program level audits, or their effectiveness as a control in the lending process. However, the external auditor could be engaged to provide a report on the MDBs’ internal control over lending operations and internal control over compliance with key provisions of the charters—if requested by the regional MDB. Figure 1 shows the relationship of the MDBs’ flow of government funding with their external audit and reporting.
Standards and guidance for financial statement audits do not require the auditor to provide an opinion on the effectiveness of internal control when performing a financial statement audit. Financial statement audits are not intended to provide a basis for the evaluation of the overall quality of the entity’s system of internal control. Therefore, in a typical financial statement audit, many controls designed to ensure the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with key provisions of bank charters may not be tested.
section_title: Standards for Financial Statement Audits
paragraphs: For financial statement audits, the International Federation of Accountants and the U.S.’ Auditing Standards Board (ASB) generally have similar audit requirements for internal control. It is important to note, however, that the standards for financial statement audits described below do not require the auditor to comprehensively review and report on internal control when performing external audits of financial statements.
International Standard on Auditing (ISA) 400, Risk Assessments and Internal Control, calls for the auditor to obtain an understanding of the accounting and internal control systems sufficient to plan the financial statement audit and develop an effective audit approach. In the audit of financial statements, the auditor is concerned with those policies and procedures within the accounting and internal control systems that are relevant to the financial statements. As such, a financial statement audit is not intended to provide explicit assurance that the entity’s funds were used for their intended purposes, or that management controls are in place to ensure the effective and efficient use of the funds. The auditor should make management aware, however, as soon as practical and at an appropriate level of responsibility, of any material weaknesses in the design or operation of the accounting and internal control systems that have come to the auditor’s attention during the course of the financial statement audit. In addition, ISA 260, Communication of Audit Matters with Those Charged with Governance, states that the auditor should promptly communicate audit matters of governance interest arising from the audit of financial statements with those charged with governance of an entity.
The ASB’s Statement on Auditing Standard (SAS) No. 55, as amended by SAS No. 78, Consideration of Internal Control in a Financial Statement Audit, also requires the auditor, in all financial statement audits, to obtain a sufficient understanding of a company’s internal control to assist in planning and performing the audit. The ASB has also issued guidance for auditors to use in identifying and reporting certain internal control deficiencies noted during an audit of financial statements. These matters, termed “reportable conditions,” are matters noted during the course of the financial statement audit that the auditor feels should be reported to the audit committee or its equivalent because they represent significant deficiencies that could adversely affect the organization’s ability to produce reliable financial statements.
Although current financial statement auditing standards established in the private sector do not require the auditor to report on internal control and compliance when performing a financial statement audit, the auditor can be engaged to provide a level of assurance on control and compliance in what is referred to as an attestation engagement. Attestation standards apply whenever an independent auditor has been engaged to provide assurance or report on a subject matter that is the responsibility of another party. For example, the regional MDB management would evaluate the effectiveness of its internal control and make an assertion about its effectiveness. In turn, the external auditor attests, or provides assurance on, the MDBs’ internal control or MDB management’s assertion about internal control. Attestation services can cover internal control over financial reporting, operations, and compliance with laws, regulations, or key policies. Internal control reporting by external auditors is quickly becoming not only a best practice but also a commonly implemented practice around the world.
section_title: Member Countries Could Benefit From Additional Assurance Provided by an External Auditor’s Attestation Over Internal Control
paragraphs: The regional MDBs operate in a difficult and challenging environment in countries where transparency and accountability are often lacking, and corruption sometimes flourishes. In fact, concerns about corruption have intensified in recent years as international financial donors have become increasingly aware that corruption may undermine development by deterring investment and growth and exacerbating poverty. Levels of perceived corruption vary from country to country, as shown in appendix I. Within this challenging environment, the regional MDBs must satisfy their dual mandate of providing development assistance and exercising their fiduciary responsibility. At the same time, MDBs must ensure that corruption is minimized in the projects they finance.
As shown in figure 2, the MDBs’ operations are funded through member countries’ paid-in capital and borrowing from capital markets, backed by members’ pledges of callable capital. Regional MDBs provide loans with market-based interest rates and loans on concessional terms. For example, the Asian Development Bank group uses its Ordinary Capital Resources for market-based lending and its Asian Development Fund for concessional lending. Figure 2 shows graphically how each arm serves as a financial intermediary, obtaining funds from world capital markets and member governments and providing loans to borrowers.
Operations of MDBs that provide loans with market-based rates are financed primarily through borrowings from world capital markets, members’ paid-in capital, and retained earnings. Their borrowings from world capital markets are at favorable terms because they have high credit ratings, based on their record of obtaining repayment on the loans they make to borrowers and on the backing provided by member countries’ subscriptions to callable capital. To date, there has never been a need for the MDBs that are the subject of this report to make a call on their callable capital.
The concessional lending arms, which do not borrow from world capital markets, rely on capital replenishments by members in order to continue lending operations. Unlike the market-based lending arms of the MDBs, the concessional lending arms need such replenishments because they have very long repayment terms and are lending to the less developed countries with high credit risk.
As of December 31, 2000, regional MDBs had outstanding loans of $116 billion. Concessional loans comprised 26 percent, $30 billion dollars, of that total. The total of concessional loans for the MDBs we reviewed is considerable. At the same time, concessional loans are exposed to the following three types of risk:   First, due to conditions in concessional lending countries, which are among the poorest countries in the world, MDBs are exposed to considerable country and credit risks.
Second, concessional loans are designed to aid the needs of developing countries, some of which are perceived to have the worst corruption problems in the world. See appendix I.
Third, because concessional lenders rely on contributions from members, they are not subject to the same market discipline and monitoring that come into play when borrowing from world capital markets to fund lending activities.
Moreover, even for the market-based lending MDBs, the discipline and monitoring that derive from their borrowing in the capital markets is not sufficient assurance to member countries that the MDBs have adequate controls over their lending operations or that controls are adequate to ensure that funds are used for the purpose for which the loan was granted. Capital-market investors are primarily interested in the financial soundness of the debt issuer. The assurance they receive from high credit ratings and the MDBs’ satisfactory record of obtaining loan repayments satisfies their needs.
Given this control environment, MDBs and member countries could benefit from the assurance and transparency provided by additional reporting on the part of external auditors on the MDBs’ assertions on internal control, especially in the area of internal control over lending operations and internal control over compliance with key provisions of bank charters and policies. A structured, disciplined process for establishing, monitoring, and reporting on internal control is critical to providing reasonable assurance over the reliability of an entity’s financial reporting, the effectiveness and efficiency of its operations, and its compliance with laws, regulations, charters, or policies.
Increased assurance through external auditor attestation and reporting to member countries on internal control would provide additional assurance and transparency to member country governments regarding the internal control over MDBs’ financial reporting, lending operations, and the use of their funds. The external auditor’s assessment could also consider the role and activities of the internal audit function in the MDBs’ internal control. Such reporting could be based on a structured and widely accepted framework and include the auditor’s examination and conclusions regarding management’s evaluation and assertion over the effectiveness of control in the following areas: 1.  Reliability of financial reporting: financial reporting controls are the policies and procedures that pertain to an entity’s ability to record, process, summarize, and report financial data consistent with the assertions in the financial statements. 2.  Effectiveness and efficiency of operations: Operations controls relate to managing the entity’s business and include policies and procedures to carry out organizational objectives, such as economy, efficiency, and effectiveness of operations. 3.  Compliance with applicable provisions of the MDBs’ charters and policies: Compliance controls are the policies and procedures management uses to comply with specified provisions of the MDBs’ charters and policies.
In order for the MDBs’ external auditors to report on controls over financial reporting, lending operations, and compliance, it will be necessary to adopt a phased-in approach. According to our work, reporting on internal control over financial reporting should be a relatively straightforward step for the MDBs to take because their external auditors are already performing financial statement audits; thus, the inclusion of internal control over financial reporting would be a natural addition. For example, the Federal Reserve Board in the United States has recently undergone this process and was able to report externally on internal control over financial operations by its third year.
While reporting externally on internal control over lending operations and use of funds is vital to MDB accountability, it is a more complex process that could take longer to implement. Before the external auditor can conduct its review, we believe that significant issues need to be addressed to lay the foundation for the internal control review. For example, while internal control frameworks, such as those recognized by the International Organization of Supreme Audit Institutions (INTOSAI), are available, internal control criteria for the MDBs will need to be specified and adopted by the MDBs. The MDBs could work together in developing specified criteria that can be used as a benchmark for implementing internal control and subsequently defining, measuring, and assessing the reasonableness of internal control over lending operations and compliance. The MDBs’ management and audit committees, along with their external auditors, would play an important role in defining the specific criteria in terms of applicability, significance, and materiality.
Another important issue we believe needs to be addressed by the key players would be to identify the key charter provisions to be included in a review of compliance controls and to define what would constitute “substantial” compliance with those key provisions of bank charters. After these significant issues are addressed, MDB management would be able to comprehensively document and assess the specific controls identified as material and applicable and subsequently provide its assertions on the effectiveness of those controls. Finally, the external auditor would then report on the reasonableness of management’s assertions related to the relevant lending operations and compliance controls.
We recognize that resolving these significant issues and developing this additional audit function could take several more years, which is why it is imperative that the MDBs begin phasing in a strategy as soon as possible. We also recognize that the costs of undertaking this effort may be considerable for the regional MDBs. However, the amount of funds at risk is also considerable.
section_title: Importance of Internal Control Standards and Reporting Worldwide
paragraphs: Effective internal control is critical in providing reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with laws and regulations. Furthermore, expanded reporting on internal control is becoming a widely accepted standard of reporting. As discussed in the following sections, a broad range of standard-setting organizations from around the world has issued guidance supporting the establishment, assessment, and reporting on internal control.
Bank regulators from a range of countries have endorsed the importance of internal control, sound management, and independent audits. In 1997, bank regulators from 19 industrial and developing countries, with input from an additional 9 countries, developed Core Principles for Effective Banking Supervision. These principles, published by the Basel Committee, identified 25 basic principles that need to be put in place for a supervisory system to be effective. A number of the principles address the importance of internal control and the audit function. For example, the principles call for   policies and procedures not only for the granting of loans but also for the ongoing management of loans; internal controls, including independent internal audit activities; and   external audit and compliance functions, to test adherence to these controls as well as applicable laws and regulations.
INTOSAI also recognizes the importance of effective internal control. In June 1992, INTOSAI issued its Guidelines for Internal Control Standards and defined an internal control structure as the plans of an organization, including management’s attitude, methods, procedures, and other measures that provide reasonable assurance that an organization is achieving the following general objectives:   promoting orderly, economical, efficient, and effective operations and quality products and services consistent with the organization’s mission;   safeguarding resources against loss due to waste, abuse, mismanagement, errors, fraud, and other irregularities;   adhering to laws, regulations, and management directives; and   developing and maintaining reliable financial and management data and fairly disclosing the data in timely reports.
In this guidance, INTOSAI prescribes the internal control standards that form a framework for an internal control structure that meets the above objectives. Upon issuance of its guidance, INTOSAI’s Internal Control Standards Committee called for supreme audit institutions to encourage and support the establishment of internal controls. This would encompass (a) management understanding its responsibilities for implementing and monitoring the control structures and (b) auditing those structures to assure that controls are adequate to achieve the desired result. INTOSAI member countries have reported to the INTOSAI Internal Control Standards Committee that they have achieved a wide range of positive results.
In 1992, the United Kingdom Committee on Financial Aspects of Corporate Governance published its study on corporate governance. A principal underlying motivation for the study was the perceived low level of confidence in financial reporting and the inability of external auditors to provide safeguards needed by the private and public sector financial statement users. Under the United Kingdom’s Principles of Good Governance and Code of Best Practices (the Combined Code), a narrative statement from management on how it applied the principles of good governance and whether it has complied throughout the accounting period with the Combined Code’s provisions is required. The external auditor then is required to report on whether the entity complied with the specified provisions of the Combined Code. In the United States, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) was formed to support the implementation of the recommendations by the National Commission on Fraudulent Financial Reporting, commonly referred to as the Treadway Commission. The Treadway Commission issued its report in 1987 recommending that the sponsoring organizations cooperate in developing additional, integrated guidance on internal control to provide a common reference point that entities can use to assess the quality of their internal control systems. In 1992, COSO issued its report on internal control, Internal Control—Integrated Framework. This framework is designed to assist management in assessing its internal control system against an established standard to help identify basic weaknesses in operation, financial reporting, and legal/regulatory compliance controls and take action to strengthen them. In 1994, COSO also issued an addendum, Reporting to External Parties, that addresses reporting guidelines where reports of internal control are issued in annual reports to shareholders. In a previous report, we reported that the World Bank had adopted a COSO framework. An excerpt of this report is provided in appendix II.
The U.S. Congress recognized the link between weak internal control and past failures of financial institutions when it enacted the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA). FDICIA requires the management of an insured depository institution to state its responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting. FDICIA also requires management to report on the effectiveness of this internal control system and an independent external auditor to attest to management’s assertions on internal control in a separate report. As implemented, management’s report on internal control and the auditor’s related attestation includes control over safeguarding of assets. Further, FDICIA requires large institutions to have independent audit committees and establishes a reporting link between the audit committee and the external auditor.
The General Accounting Office issues standards for internal control in the federal government as required by 31 U.S.C. 3512 (c), commonly referred to as the Federal Managers’ Financial Integrity Act of 1982. The Standards for Internal Control in the Federal Government provide the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. According to these standards, internal control should provide reasonable assurance that the objectives of the agency are being achieved in the following categories:  reliability of financial reporting,   effectiveness and efficiency of operations, including the use of the entities’ resources, and   compliance with applicable laws and regulations.
See appendix III for a sample report on internal control over financial reporting.
subsections: section_title: MDBs Emphasize the Importance of Internal Control
paragraphs: The MDBs have stated that internal control plays an integral role in providing assurance in the use of MDB funds. In addition to providing reasonable assurance over the use of public funds, MDBs have stated that effective internal control assists management and helps to ensure corporate accountability over the reliability of financial reporting, the effectiveness and efficiency of operations, and compliance with laws and regulations for any entity.
Based on our review of the regional MDBs’ Web sites, most of the regional MDBs that we reviewed have developed anti-corruption strategies that state that they recognize the importance of strong internal control systems. The regional MDBs have made public their anti-corruption concerns and strategies in their annual reports and Web sites. They acknowledge that a strong control environment within the regional MDBs and borrowing country institutions is critical for effectively implementing the regional MDBs’ systems of project management control.
In its 2000 annual report, AfDB stated that the main objective of financial control is to ensure a strong internal control framework within the AfDB’s overall processes involving financial risk, including payment processes and related computer systems. According to the AfDB, financial control also seeks to ensure that all disbursements of loans approved by the Bank comply with its rules, regulations, and processes. Similarly, according to its stated policy, AsDB has developed an anti-corruption policy that is designed to ensure that the fundamental building blocks for transparent, predictable, and accountable administration are in place. According to the AsDB, these building blocks include “…transparent procurement practices; effective internal control systems; and a well-functioning independent audit office.” In another example, EBRD has stated in its 2000 annual report that its financial management aims to “…ensure transparency and accountability at all levels and support effective corporate governance.” Finally, IDB has reported that a “simultaneous systemic effort will be undertaken to…minimize the risk of corruption in the allocation, commitment and disbursement of the Bank’s resources in its lending program and ensure that Bank operations are designed so as to be executed with transparency and within the framework of a proper control environment….”
We also found that each regional MDB has established an internal audit staff that is part of their organizational structure’s control environment. Generally, the internal auditors are responsible for providing analyses, evaluations, assurances, and recommendations on MDB operations to audit committees, boards of directors, and others with equivalent authority and responsibility. Standards established by the Institute of Internal Auditors specify that internal auditing is an independent,objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
While internal auditors do provide a level of assurance over operations and financial reporting to management, the responsibility to provide an audit opinion on the financial statements rests solely with the external auditor. The external auditor follows relevant auditing standards in rendering an audit opinion. The external auditor brings to management and the boards of directors a unique independent and objective view and contributes to an entity’s achievement of its financial reporting objectives, as well as other objectives. While the external auditor has sole responsibility for the audit report and for determining the nature, timing, and extent of audit procedures, much of the work of the internal audit department can be useful to support the external auditor in the audit of the financial statements. This same relationship holds true for reporting on internal control; the internal auditor provides internal assurance to management, while the external auditor provides an opinion, or attestation, following relevant standards. The external auditor’s assessment could consider the role and activities of the internal audit function in an MDB’s internal control.
section_title: Audit Committees Are Key to Strengthening MDB Accountability
paragraphs: Audit committees are established components of the control environment that strengthen the internal governance structure of an organization. An effective audit committee facilitates the successful performance of the board of directors’ oversight responsibilities for financial operations. An effective audit committee also normally oversees the internal and external auditors and communicates with them on the results of their audit work to facilitate fraud prevention and reliable financial reporting. As shown in figure 3, an audit committee—made up of a subcommittee of the board of directors—can establish an MDB’s accountability relationship with its external auditor, board of directors, and internal parties, which could result in information openly flowing to member countries and the general public.
In a recent report, the Blue Ribbon Committee panel listed a diligent and knowledgeable audit committee membership as one of the best practices aimed at making audit committees more effective. For the four regional MDBs in our review, information provided to us on the audit committee members’ education and job experiences indicated that generally the audit committee members have accounting or related financial management expertise. Qualifications in accounting or financial management are an important factor in audit committees’ effectiveness in fulfilling their governance responsibilities.
Another Blue Ribbon Committee best practice is the audit committee’s key role in monitoring the component parts of the audit process. Information provided to us indicated that the MDB audit committees were involved with the external auditors throughout the audit process. For the MDBs included in this report, the audit committee oversight activity generally included integral steps such as selecting the external auditor, monitoring the progress and the results of the audit, and communicating with the auditors. Documentation provided to us indicated that communication with the external auditor was regular and included discussions on issues such as internal control deficiencies noted during the course of the audit and the appropriateness of accounting principles and financial reporting.
The United Kingdom’s Combined Code addresses the role of corporate audit committees in a manner consistent with the Blue Ribbon Committee report. Among other things, the Combined Code requires all listed companies to establish an audit committee with a formal written terms of reference. This is a list of functions that audit committees are to perform to satisfy themselves that banks’ financial reporting and internal control are adequate and efficient. The Combined Code also recommends that a majority of the audit committee members be independent of management and free from any business or other relationship that could materially interfere with the exercise of their independent judgment.
According to the terms of reference, a key function of the regional MDB audit committees is to understand the adequacy of the banks’ internal control. Although the information provided to us indicated that the regional MDB audit committees were actively involved with the external auditors, the committees have not engaged the external auditors to report on internal control or compliance in conjunction with their financial statement audits. A main function of the audit committee is to contract for the audits and determine the scope of the auditors’ work and the reports to be submitted by the auditors. In that respect, the audit committees have the authority to expand and strengthen the MDBs’ financial statement audit reporting processes by requiring the external auditors to report on internal control and compliance, since none of the MDBs’ external auditors are currently engaged to report on these matters.
section_title: Conclusions
paragraphs: While the traditional role of the external audit function is to express an independent opinion on an entity’s financial statements, this role has increasingly been expanded to include reviews of internal control. Worldwide, countries and institutions are recognizing the importance of providing independent, external assessments on not only financial reporting, but also on internal control over an entity’s operations and internal control over compliance with laws and regulations or key policies.
Because MDBs are funded with public resources and are semigovernmental in nature, member countries that provide the MDBs’ financial support and backing would benefit from assurance provided by an external auditor over the MDBs’ controls and whether funds are being used as intended. This reporting could enhance the accountability and transparency of the MDBs by providing an additional level of assurance over what was spent, how it was spent, and what resources remain to be utilized. Such reporting would also provide information about the effectiveness of the MDBs’ control over lending operations and use of funds.
External audits of MDBs’ financial statements, along with external examinations of internal control over financial reporting, lending operations, and compliance with key bank charters and policies, and the reporting of the results of those audits to member countries, could help to provide this accountability and transparency. This type of transparency and accountability is especially important given the operating risks inherent in how funds are used in the MDBs’ activities and the fact that the MDBs rely on member countries’ financial contributions and backing to obtain funding for their operations. Because each of the MDBs included in this report has established internal audit functions, an external auditor’s assessment of internal control could also consider the activities of the MDBs’ internal auditors.
Regional MDBs’ audit committees are in a prime position to expand the external reporting for their MDBs and thus strengthen MDB accountability and enhance member country assurance that funds are spent as intended. Such assurance would be provided while relying on the MDBs’ own governance systems and respecting the multilateral nature of the MDBs.
Reaching the above level of assurance will take time. While the MDBs we looked at should generally be able to obtain an external auditor’s report on internal control over financial reporting within a short time frame—say 2 to 3 years—their ability to have an external auditor report on internal control over lending operations and internal control over compliance with key charter requirements will require a longer-term effort. It will take time for the MDBs to develop the resources and expertise needed to provide the accountability and assurance called for in our recommendations.
section_title: Recommendations for Executive Action
paragraphs: To (1) provide additional accountability, transparency, and assurance over the regional MDB groups’ lending operations and (2) ensure that project funds are spent as intended, we recommend that the Secretary of the Treasury instruct the U.S. Executive Directors of the four regional MDB groups included in this report to take the lead in working with the other Executive Directors to develop a policy requiring these MDBs and their audit committees to adopt a phased approach to enhance the current external audits of their financial operations, as follows.
Engage the external auditors to report on the MDBs’ internal control over financial reporting in conjunction with their financial statement audits or in a separate engagement.
Develop a plan, and report annually on the progress, to engage the external auditors to report on the MDBs’ internal control over lending operations and internal control over compliance with key provisions of bank charters and policies.
Provide the results of the external auditors’ reports and management’s progress reports to the MDBs and their member countries annually.
Our recommendations are intended to be implemented in phases. Reporting on the internal control over financial reliability should be possible in the near term for the regional banks, because they already issue annual audited financial statements. We recognize, however, that more effort and time will be required to identify, implement, and evaluate the applicable internal control criteria for lending operations and compliance with key charter provisions prior to engaging the external auditor to report on management’s assertions in those areas.
section_title: Agency Comments and Our Evaluation
paragraphs: In its comments on a draft of this report the Department of the Treasury acknowledged that establishing and maintaining an effective control environment is essential for the regional MDBs, especially given the unique nature of these multilateral institutions. Even though Treasury stated that it strongly supports oversight mechanisms to help assure increasingly productive development assistance of the regional MDBs, it questioned the cost-effectiveness of expanding the existing scope of the external auditors’ engagements to provide the requisite assurances that regional MDB internal controls are operating effectively. Treasury officials also stated their belief that internal entities within the MDB corporate governance structure are in a better position than an external auditor to assess the effectiveness of MDB controls.
Treasury also stated that, in its opinion, our draft report documents the sufficiency of the MDBs’ current external audits. However, the major focus of our report was to emphasize that given the control environment in borrowing countries, MDBs and member countries would benefit from the assurance and transparency provided by independent examination and reporting by external auditors in the area of internal control over lending operations and internal control over compliance with key provisions of bank charters and policies. Our report provides information about the results of the external financial statement audits at the MDBs and makes clear that by design the objective of a financial statement audit is not to provide assurance to member countries that project funds are used as intended. Our report notes that, although the regional MDBs have received clean opinions on their financial statements, the current financial statement audits cover only the MDBs’ financial position at a point in time and the financial results of operations and cash flows for a given fiscal year. The financial statement audits are not intended to and do not provide specific assurance about the effectiveness of the MDBs’ internal control over lending operations and compliance with bank charters and key policies. MDB project and program funds are used in countries where the level of perceived corruption is often high.
Treasury also described, for illustrative purposes, the processes used by IDB for lending oversight and the role of the IDB’s Auditor General and the board of directors in providing oversight. Treasury also stated its belief that the internal entities within the MDBs’ own internal governance structure are better placed than the external auditors to assess internal control of the institutions and to ensure that programs of the banks are effective and efficient as called for in their charters. We acknowledge the importance of the MDB’s own internal processes as a critical aspect of internal control, and MDB management’s responsibility for establishing and implementing an effective system of internal control. However, until the effectiveness of the regional MDBs’ internal control is subject to review by an independent third party, member countries will not have a comprehensive independent assessment of the effectiveness of the controls. The MDBs’ accountability, transparency, and assurance over internal control could be enhanced through expanded external audit processes whereby (1) management provides assertions to the external auditors that the controls are operating effectively, and (2) the external auditor provides an attestation to the effectiveness of the controls through its independent testing procedures.
Treasury questioned the cost-effectiveness of expanding the external auditors’ engagements to include reporting on internal control over lending operations. We recognize that expanding the scope of the auditors’ work will involve time and effort and, therefore, we recommended a phased approach. However, the amount of MDB funds at risk is considerable. The enhanced reporting is designed to provide additional accountability and transparency over the regional MDB groups’ lending operations and provide reasonable assurance that project funds are spent as intended. External auditor attestation and reporting to member countries on internal control would provide additional assurance and transparency to member country governments regarding the control over MDBs’ financial reporting, lending operations, and the use of their funds. The external audit function brings to management and the boards of director a unique, independent, and comprehensive view that provides assurances to offset the risks and perceived corruption in the countries receiving regional MDB funds. The department’s comments are reprinted in their entirety in appendix IV.
We are sending copies of this report to the Secretary of the Treasury, the presidents of the regional MDBs, and other interested parties. Copies will be made available to others upon request.
Please contact Jeanette Franzel, Acting Director, at (202) 512-9406 or by email at franzelj@gao.gov if you or your staffs have any questions concerning this report. Key contributors to this report were Darryl Chang, Bronwyn Hughes, Meg Mills, Charles Norfleet, Julie Phillips, and John Treanor.
section_title: Appendix I: Transparency International’s 2001 Corruption Perception Index
paragraphs: Transparency International is an organization dedicated to curbing both international and national corruption. Transparency International launched its Corruption Perception Index (CPI) in 1995. The CPI is a collection of polls, drawing on 14 surveys from 7 independent institutions for its 2001 results. The surveys reflect the perceptions of business people, academics, and country analysts. No country has been included in the CPI without results from a minimum of 3 surveys undertaken over the past 3 years. For this reason, not all countries with high levels of corruption may have been included.
The CPIs show that the regional MDBs function in environments that are perceived to have high levels of corruption, underscoring the importance of internal control over lending operations and compliance within the MDBs that are providing loans to those countries. According to Transparency International, the world’s poorest countries are the greatest victims of corruption. Their survey results also register very high levels of perceived corruption in the countries in transition, in particular the countries of central and eastern Europe and the former Soviet Union.
Figure 4 includes all the countries covered by Transparency International. We have also added countries that were among the MDBs’ five largest borrowers of all lending arms as of December 31, 2000, that were not included in the Transparency International CPI and indicate that CPIs for these countries are not available.
section_title: Appendix II: Summary of World Bank’s Implementation of the COSO Internal Control Framework as of April 2000
paragraphs: In 1995, the World Bank adopted the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework to establish a common definition of management controls for all Bank units and a standard against which unit managers and auditors can assess and measure progress in improving management controls. Audit organizations around the world use this framework, referred to as Internal Control— Integrated Framework, as a standard in evaluating management controls.
The COSO framework emphasizes accountability and ownership of controls at all levels. Under this model, the effectiveness of a management control system is measured by its capacity to provide reasonable assurance to the Executive Board of Directors and management regarding the achievement of their objectives in the following three categories:   effectiveness and efficiency of operations,  reliability of financial reporting, and   compliance with applicable laws and regulations.
subsections: section_title: Management Controls Components
paragraphs: Under COSO, management control is defined as consisting of five interrelated components that form the criteria for effective control. The five components are used as the criteria to evaluate the strengths and weaknesses of the controls and to identify what actions can be taken to improve controls. All five components must be present and effective in order for management to have the reasonable assurance needed. These components include the following: Control Environment. An organization should establish a positive control environment, that is, one with a structure, discipline, and climate conducive to sound management controls. Factors that significantly affect the control environment include the integrity and ethical values of management and staff, the competence of personnel, the way the agency is organized, the manner in which management assigns authority and responsibility, and the attention and direction provided by oversight groups.
Risk Assessment. An organization should properly identify, analyze and manage the possible risks involved in meeting organizational objectives.
Control activities. An organization should establish control activities consisting of policies, procedures, techniques, and mechanisms that ensure that management directives are being carried out to meet organization objectives. They include approvals, authorizations, verifications, and reviews of operating performance.
Monitoring. An organization should continually monitor and evaluate all aspects of management control to assess the quality of performance over time. Serious management control deficiencies should be reported to higher levels, including top management and the Board of Directors.
Information and communication. An organization should identify, capture, and communicate information in a form and time frame that enable people to carry out their responsibilities.
section_title: World Bank Implementation Schedule
paragraphs: In 1995, the Bank established a 5-year timeline to ensure that, by the end of fiscal year 2000, management will be able to express assurance that adequate controls are in place, not only for financial reporting purposes, but also for efficiency and effectiveness of operations. The Office of Controller made a commitment to   meet the COSO standards for control effectiveness across the Bank’s   extend the COSO standards for prudential controls to nonfinance organizational units in the Bank  in fiscal year 1997;   assert that both the International Bank for Reconstruction and Development and the International Development Association have maintained effective controls over financial reporting as of June  30, 1997, and obtain the external auditor’s agreement;   expand the application of the COSO framework so that issues of organizational efficiency and effectiveness are brought to light; and   become an institution in which Bank management and staff will have the ability and process in place to analyze the effectiveness of internal controls for their areas of responsibility.
In order to meet these goals, the Office of Controller adopted the Control Self-Assessment methodology for assessing controls based on the COSO framework. This approach uses the staff from various Bank units to review the business unit’s objectives, key processes supporting the stated objectives, associated  risks, and mitigating controls; under normal circumstances, testing of key controls and documentation of testing is required;   hold workshops to (1) analyze obstacles and strengths that affect the organization’s ability to achieve key business objectives and (2) decide upon an approach to address issues arising from the process; identify reportable conditions requiring control enhancements together with the results of the control self-assessment workshop in the business unit’s action plan; and   obtain representation letters from all the Bank’s senior managers acknowledging their responsibility for effective controls and confirming that they have maintained an effective system of management control.
World Bank initiated the control self-assessment methodology during fiscal year 1996. Bank management has issued a series of reports to the Audit Committee of the Executive Board on the Bank’s progress made in implementing the COSO management control framework. The Internal Audit Division also issued annual reports starting in 1998 providing independent observations and findings on internal controls in the Bank based on prior audits and the control self-assessment workshops. In 1999, the Bank concluded that it met the COSO criteria for effective internal control over financial reporting for the International Bank for Reconstruction and Development and the International Development Association. The Bank’s external auditor examined management’s assertions and concluded that it was fairly stated, in all material respects. Bank management has not made an assertion regarding the adequacy of internal controls over operations.
section_title: Appendix III: Sample External Auditor’s Report on Internal Control Over Financial Reporting
subsections: section_title: Independent Auditor’s Report
paragraphs: We have examined management’s assertion included in the accompanying Management’s report that (entity) maintained an effective internal control over financial reporting as of (date). (Entity’s) management is responsible for maintaining effective internal control over financial reporting. Our responsibility is to express an opinion on the effectiveness of internal control based on our examination.
Our examination was made in accordance with standards established by the (name of standard setter) and, accordingly, included obtaining an understanding of the internal control over financial reporting, testing and evaluating the design and operating effectiveness of internal control, and such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion.
Because of inherent limitations in any internal control, misstatements due to errors or irregularities may occur and not be detected. Also, projections of any evaluation of the internal control over financial reporting to future periods are subject to the risk that the internal control may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
In our opinion, management’s assertion that (entity) maintained an effective internal control over financial reporting as of (date) is fairly stated, in all material respects, based upon criteria established in the (widely accepted internal control framework selected by the entity as criteria for its own internal control assessment program).
section_title: Appendix IV: Comments From the Department of the Treasury