World Bank Group: Important Steps Taken on Internal Control but Additional Assessments Should Be Made
Published: 2003-06-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Congress passed Public Law 106-429 because it was concerned about the sufficiency of external audits of the financial operations of the World Bank Group, a set of multilateral development banks. This law provides that GAO report on the sufficiency of such audits of each Bank Group entity. GAO addressed (1) the extent that the external auditor was providing assurance on internal control over financial reporting, operations, and compliance with key provisions of bank charters and policies in conjunction with financial statement audits and (2) the role the Bank Group's audit committee plays in providing oversight of external financial statement audits and internal control.
section_title: What GAO Found
paragraphs: The Bank Group has taken important steps in strengthening its assessment and reporting on internal control, including (1) implementing a structured internal control framework, (2) conducting the internal control assessments necessary to provide its external auditor with an assertion about the effectiveness of the Bank Group's internal control over external financial reporting, and (3) contracting with its external auditor to provide an opinion, in conjunction with the financial statement audit, on whether management's assertion on internal control over external financial reporting is fairly stated. However, Bank Group management does not include an assertion on internal control over operations and compliance matters, and it has not asked the external auditor to give an opinion on those internal controls. During our review, we were told that the Bank Group does not yet have plans to conduct a comprehensive assessment of those controls. The Bank Group's external financial statement audits do not, and are not intended to, provide specific assurance about the internal control over the Bank Group's operations and whether the funds are spent for their intended purposes. Given the inherent risks in the banks' activities, additional assurance on these other categories of internal control--operations and compliance--would provide an added level of assurance to the Bank Group and its member countries that funds were used for their intended purposes. The Bank Group has established an audit committee that provides oversight of external financial statement audits and internal control. A major function of the committee is to nominate an external auditor and determine the scope of the auditor's work and the reports to be submitted by the auditor. The audit committee also has the external auditor give an opinion, in conjunction with the financial statement audit, on management's assertion on the Bank Group's internal control over external financial reporting. The audit committee has the authority to expand the external audits to include the auditor giving opinions on internal control over operations and compliance matters. Alternatively, the audit committee is also well-positioned to assign to an internal party or provide an external party the task of providing a thorough assessment of such controls.

section_title: Letter
paragraphs: Multilateral Development Banks (MDBs) were established to provide  financial support for projects and programs designed to promote social and  economic progress in developing countries throughout the world. In fiscal  year 2002, the United States provided approximately $1.3 billion to support  the missions of the MDBs, with about $820 million going to the World Bank  Group (Bank Group) and about $460 million going to regional MDBs. As a  group, the MDBs are the largest source of development aid for middle- and  low-income countries.
Section 803(a) of the Foreign Operations, Export Financing, and Related  Programs Appropriations Act, 2001 (Public Law 106-429) provides that  GAO report annually on the sufficiency of audits of the financial operations  of each MDB conducted by the persons or entities outside the bank. This is  the third in a series of reports in response to Public Law 106-429’s reporting  requirement. As agreed with your offices, this report covers the following  MDBs, which are all part of the World Bank Group: International Bank for Reconstruction and Development,  International Finance Corporation, and  Multilateral Investment Guarantee Agency.
The International Bank for Reconstruction and Development and the  International Development Association, which accounted for 80 percent of  the development assistance the Bank Group provided to developing  countries in 2002, are referred to as the “World Bank.” Financial statement  audits and the related assurance on internal control provided by the  external auditor are important for the Bank Group entities because they   have missions that emphasize distributing funds for development and  accountability for the use of those funds;  operate in countries where transparency and accountability are ranked  among the lowest in the world; and  are multilateral entities not subject to oversight by any single national  government.
Because borrowing countries often lack the transparency and  accountability needed to prevent and detect corruption, the Bank Group  entities that provide loans risk having the funds used for purposes other  than those intended. The United States and other donors have indicated  that they are concerned about these risks. Donors want to be assured that  the funds they provide are used only for the intended purpose, and the  Bank Group’s lending entities need to assure donors that the standard of  care over those funds meets donor expectations. Representatives from the  United States and the European Union have recently stated that they plan  to increase contributions to the world’s poorest countries if they have  assurance that the funds they are providing are used as intended in  developing countries and have measurable results.
As agreed with your offices, this report addresses the following two  specific areas related to the World Bank Group’s external financial  statement audit process:  1. the extent to which the Bank Group entities are obtaining assurance  from their external auditor on internal control over financial reporting,  operations, and compliance with key provisions of their charters and  policies in conjunction with their financial statement audits and  2. the role the Bank Group’s audit committee plays in providing oversight  of financial statement audits and internal control.
subsections: section_title: Scope and Methodology
paragraphs: Public Law 106-429, Appendix A, Title VIII, identifies 10 MDBs to be  included in the scope of our work. In prior work, we addressed 6 of the  MDBs listed in the law—the African Development Bank, African  Development Fund, Asian Development Bank, European Bank for  Reconstruction and Development, Inter-American Development Bank, and  the Inter-American Investment Corporation. As agreed with your offices,  this report focuses on the external financial statement audit and internal  control reporting process of the remaining four MDBs—which are all part  of the Bank Group—listed in the law:  International Bank for Reconstruction and Development (IBRD),  International Development Association (IDA),  International Finance Corporation (IFC), and   Multilateral Investment Guarantee Agency (MIGA).
To meet our objectives, we met with Department of the Treasury officials  and a representative of the office of the U.S. Executive Director for the  Bank Group. We also   reviewed the Bank Group entities’ 2002 and 2001 audited financial  statements and the external auditors’ opinions on the financial  statements and identified the accounting principles and auditing  standards used,   inquired of World Bank management and obtained information on the  audit committee, external audits, and the extent of the external auditor  giving opinions on internal control over financial reporting, operations,  and compliance matters,  analyzed and compiled relevant financial information from the Bank  Group entities’ annual reports and their audited financial statements,  reviewed the banks’ terms of reference to identify the scope of the audit  committee’s oversight and compared them to relevant guidance on  widely accepted internal control frameworks,  reviewed widely accepted internal control frameworks, such as Internal  Control—Integrated Framework issued by the Committee of  Sponsoring Organizations of the Treadway Commission and Guidelines  for Internal Control Standards developed by the International  Organization of Supreme Audit Institutions, and   discussed various options for reporting on internal control with  representatives from the international accounting firm responsible for  the financial statement audits of the Bank Group entities.
The Bank Group entities are multilateral, international entities that are  autonomous, and the United States, as an individual member country,  generally does not have audit authority over their operations. Thus, it was  not part of our scope to evaluate the components of the Bank Group  entities’ internal control governance structure, nor did we evaluate the  quality of the external auditor’s work on their financial statement audits  and internal control examinations over external financial reporting.  Moreover, it was not part of our scope to determine whether the audit  committee members were independent of the Bank Group entities they  served.
It was also not part of our scope to make any site visits to review any Bank  Group entities’ projects or programs. In accordance with GAO’s agreement  with the Bank Group and the Department of the Treasury on this  assignment, our interaction with officials from the Bank Group was limited  to the designated representative from the office of the U.S. Executive  Director for the Bank Group. The articles of agreement establishing the  Bank Group entities require the United States to deal with those  organizations only through the Department of the Treasury. Therefore, we  used Treasury officials as a conduit for obtaining information to conduct  our work.
We conducted our work in Washington, D.C., from May 2002 through March  2003 in accordance with U.S. generally accepted government auditing  standards. In May 2003, we received comments from the World Bank Group  and the Department of the Treasury, which are reproduced in their entirety  in appendixes III and IV. In addition, the Bank Group also provided a  number of suggested technical changes to our report, which we  incorporated as appropriate.
section_title: Background
paragraphs: The Bank Group entities included in this report—IBRD, IDA, IFC, and  MIGA—are multilateral, international entities with a mission to fight  poverty and improve the living standards of people in developing countries  throughout the world by providing development assistance in the form of  loans, equity investments, loan and equity guarantees, and technical  assistance. National governments are the shareholders—referred to as  members—of the Bank Group. These members include developing  countries that borrow from the Bank Group as well as industrialized  member countries. All members, including borrowing members, contribute  to the capital of the Bank Group and participate in oversight and in setting  operating policies through their participation on the boards of governors  and executive boards. See figure 1 for a summary of the components of the  Bank Group and their functions.
The lending activities of the Bank Group can be grouped primarily into the  following two types: market-based lending primarily done by IBRD and  concessional lending primarily done by IDA. IBRD provides loans with  market-based rates that are financed primarily through borrowings from  world capital markets, members’ paid-in capital, and retained earnings.  Members also provide support through subscriptions of callable capital.  Because of the significant proportion of callable capital that is subscribed  by members with strong credit ratings, including the United States, IBRD is  able to use callable capital as backing to obtain more favorable financing  terms when borrowing from world capital markets than would otherwise  be available. To date, IBRD has never made a call on this capital.
IDA provides concessional loans to the poorest of the developing  countries—those meeting certain eligibility requirements—and is financed  through contributions from member countries and borrower repayments of  outstanding loans. These loans are called “concessional” because they are  provided with below-market interest rates and extended repayment terms.
Due to the nature of concessional lending and the credit risks of borrower  countries, the concessional lending arms do not have callable capital  subscriptions and do not borrow from world capital markets to finance  their operations. Unlike IBRD, which borrows from world capital markets  to fund lending, IDA relies on capital replenishments or periodic  contributions by members in addition to repayments from loans and  transfers of net income from IBRD. As of June 30, 2002, the Bank Group  had outstanding loans of about $230 billion, and concessional loans  constituted 42 percent, or about $96 billion, of that total.
In 2002, the Bank Group entities approved about $24.4 billion of  development assistance consisting of loans, loan guarantees, and equity  investments for 466 new economic and social development operations and  projects. Loans with market-based interest rates, equity investments, and  loan guarantees accounted for about $16.3 billion of the total financial  support provided by the Bank Group during 2002, while concessional  lending amounted to about $8.1 billion. See table 1 for a summary of  development assistance in 2002 and number of new projects, by Bank  Group entity.
The Bank Group entities’ activities are overseen through a board of  governors, with a governor from each member country. In general, a board  of governors is responsible for admitting new members, authorizing  agreements for cooperation with other international organizations,  deciding about the board of executive directors, approving the Bank Group  entities’ financial statements, determining the reserves and the distribution  of profits, and deciding the scope of operations. Each Bank Group entity  also has a board of executive directors, which is responsible for, among  other things, overseeing the banks’ daily operations, ensuring the  implementation of the decisions of the board of governors, and approving  the budgets of the banks. The Bank Group entities’ own management and  staff of international civil servants carry out the daily operations.
The United States is a member in all the Bank Group entities discussed in  this report, contributing significant amounts to support their missions and  subscribing to a significant amount of their callable capital. The Congress  appropriates funds for U.S. contributions and capital subscriptions to the  Bank Group. In fiscal year 2002, the Congress appropriated about  $800 million in U.S. contributions and approved about $20 million of new  subscriptions to callable capital for the Bank Group. The Department of the  Treasury oversees U.S. interests in the Bank Group. See table 2 for a  summary of U.S. support of about $58.7 billion provided to the components  of the Bank Group entities from their inception through June 30, 2002.
The Bank Group entities prepare their financial statements to comply with  different bases of accounting. They present their financial statements using  U.S. generally accepted accounting principles (U.S. GAAP), international  accounting standards (IAS), and special purpose basis of accounting, as  shown in table 3. According to the Bank Group, due to the special nature  and organization of the IDA, the concessional lending arm of the Bank  Group, it prepares special purpose financial statements that are meant to  show the sources and uses of resources to comply with its articles of  agreement.
The Bank Group’s external auditor has audited the annual financial  statements of all the entities of the Bank Group. Each entity has received  an unqualified or “clean” audit opinion on its financial statements for the 3  most recent years. The Bank Group’s external financial statement audits,  performed by an international accounting firm, provide assurance over its  reported financial position at a particular time and the financial results of  its operations and cash flows for a given fiscal year. However, the Bank  Group’s external financial statement audits do not, and are not intended to,  provide specific assurance about the internal control over the Bank  Group’s operations and whether the funds are spent for their intended  purposes. Figure 2 shows the relationship between the Bank Group’s flow  of government funding and its external audit and reporting.
The Bank Group’s external auditor performs its audits based on U.S. GAAS  and ISA. These standards require the independent auditor to obtain a  sufficient understanding of internal control to plan the audit and determine  the nature, timing, and extent of tests to be performed. As part of the audits  of the Bank Group entities, the auditor communicates to the audit  committee any internal control material weaknesses and reportable  conditions that were noted during the course of the audit. As is common  practice, the auditor issues a written document known as a management  letter to communicate these weaknesses. The management letter addresses  issues detected as part of the financial statement audit work and it is not meant to be a comprehensive examination of the sufficiency of the  Bank Group’s internal control.
section_title: Bank Group Has Taken Important Steps on Internal Control but Reporting Could Be Expanded
paragraphs: Management of the Bank Group entities has acknowledged the importance  of internal control and has (1) implemented a structured internal control  framework, (2) conducted the internal control assessments necessary to  provide its external auditor with a formal assertion on the effectiveness of  the Bank Group’s internal control over external financial reporting, and  (3) contracted with its external auditor to provide an opinion, in  conjunction with the financial statement audits, on whether managements’  assertions on internal control over external financial reporting are fairly  stated.
For fiscal year 2002, the four Bank Group entities included in their annual  reports both management’s assertion that it met the Committee of  Sponsoring Organizations of the Treadway Commission (COSO) criteria  on internal control over external financial reporting as of June 30, 2002, and  the external auditor’s opinion that management’s assertion on internal  control over external financial reporting was fairly stated. However, Bank  Group management does not include in its assertion internal control over  operations and compliance with key provisions of bank charters and  policies, and it has not asked the external auditor to give opinions on those  internal controls.
Although the banks’ charters do not specifically call for a management  assertion or an external auditor opinion on internal control over operations  and compliance, they do state that the banks are to take the necessary  measures to ensure that the proceeds of any loan made, guaranteed, or  participated in by them are used only for the purposes for which the loan  was granted. Given the inherent risks in the banks’ activities, further  assurance on these additional categories of internal control—operations  and compliance—would provide an added level of assurance to the Bank  Group and its member countries that funds were used for their intended  purposes.
subsections: section_title: Bank Group Has Engaged an External Auditor to Provide Opinions on Internal Control over Financial Reporting
paragraphs: The Bank Group entities have acknowledged the importance of internal  control and have taken an important step in obtaining audit assurance over  internal control: They have engaged their external auditor to provide an  opinion on management’s assertions on internal control over external  financial reporting and have included those results in their 2002 annual  reports. This public reporting of the external auditor’s opinions on  management’s assertions provides a level of assurance on the Bank Group’s  ability to record, process, summarize and report financial data consistent  with the assertions in the financial statements as well as a level of  transparency to member countries and others outside the Bank Group.
The Bank Group—specifically through the controllers’ departments—has  also taken steps internally to strengthen internal control. The World Bank,  beginning in 1995, adopted the internal control standards of COSO. The  Bank Group adopted the COSO framework to establish a common  definition of internal control and provide a standard that managers and  auditors can use to assess and measure progress in improving internal  control. Entities and their internal control needs differ dramatically by line  of business and size, and by culture and management philosophy. COSO  provides a framework for implementing a system of internal control, but  the specific internal controls put in place and monitored by management  depend on the type of operations to be managed and the associated risks.  See appendix I for a description of the five components of internal control  under the COSO framework.
Under the COSO framework, the effectiveness of internal control is  measured by an organization’s capacity to provide reasonable assurance in  the following three categories.
Reliability of financial reporting: Financial reporting controls relate to  an entity’s ability to prepare reliable financial statements.
Effectiveness and efficiency of operations: Operations controls address  the entity’s basic business objectives, including performance goals and  the safeguarding of resources.
Compliance with applicable laws and regulations: Compliance controls  deal with the entity complying with those laws and regulations to which  the entity is subject.
As shown in figure 3, under COSO, an organization is responsible for the  effectiveness of three categories of internal control.
Internal controls often serve to accomplish more than one objective.  Frequently, internal controls established primarily for operations or  compliance objectives may also accomplish financial reporting objectives.  Internal controls directed at operations and compliance also may deal with  events, transactions, or other occurrences that must be reported in the  financial statements. Internal control is not one event, but a series of  actions and activities occurring throughout an entity’s operations and on an  ongoing basis. As entities strive to improve operational processes,  management should continually assess and evaluate its internal control.  Monitoring—a process that assesses the quality of an internal control  system’s performance over time—is an essential element of internal control  and is particularly relevant for carrying out the fiduciary responsibilities  that are integral to the Bank Group’s operations.
Although current financial statement auditing standards established in the  private sector do not require the auditor to report on internal control and  compliance when performing a financial statement audit, the auditor can  be engaged to provide a level of assurance—called an attestation—on  internal control over operations and compliance. The Bank Group also  has other options for providing assurance over internal control over  operations and compliance. For example, the Bank Group could request a  comprehensive evaluation of its internal controls over these functions,  which could be conducted by its internal auditor, its external auditor, an  outside consultant, or by another unit within the Bank Group.
section_title: World Bank Units’ Responsibilities for Internal Control and Oversight of Operations
paragraphs: In its anticorruption progress report and operations evaluation report,  the World Bank states that many units provide internal control and  oversight over the use of World Bank funds in lending operations, including  those shown in table 4.
The World Bank states that the above units have taken on new and  broadened functions for quality assurance and evaluation over the past  several years and have strengthened its ability to supervise the fiduciary  aspects of its loans and help borrowers—some perceived to have the worst  corruption problems in the world as shown in appendix II—strengthen  their own capacities. The above units are an important part of the World  Bank’s internal control over operations and compliance. Although it was  not part of our scope to evaluate the effectiveness of these units, or any  similar units in IFC and MIGA, they have the potential of providing the  basis for the Bank Group to offer further assurance and transparency on its  internal controls. For example, the Bank Group’s internal or external  auditor, or other group or entity, internal or external to the Bank Group,  could provide a comprehensive evaluation of the Bank Group’s control  over operations and compliance to determine whether they are working as  designed to ensure that funds are spent as intended. In 1995, the World  Bank established a 5-year timeline to ensure that, by the end of fiscal year  2000, management would be able to express assurance that adequate  controls were in place, not only for financial reporting purposes, but also  for efficiency and effectiveness of operations. The World Bank has not yet  met that goal. During our review, we were told that the Bank Group does  not yet have plans to have a comprehensive assessment of these controls.
section_title: Bank Group Could Benefit from Additional Assurance on Internal Control over Operations and Compliance
paragraphs: Because the Bank Group entities operate in a difficult and risky control  environment, the member countries could benefit from additional  assurance over the Bank Group entities’ internal control over operations  and compliance with key provisions of their charters. The Bank Group  operates in countries where transparency and accountability are often  lacking, and corruption—broadly defined as the abuse of public office for  private gain—sometimes flourishes. The Bank Group must satisfy its dual  mandate of providing development assistance in these environments and  exercising its fiduciary responsibility, including ensuring that corruption is  minimized in the projects it finances.
The World Bank acknowledged in an anticorruption progress report that  corruption undermines public support for development assistance by  creating an erroneous perception that all assistance is affected by  corruption. In this report, the World Bank stated that it would make every  effort to prevent corruption in the projects and programs it finances in  borrower countries. The report also showed the control and oversight units  the World Bank established to improve the operational effectiveness of its  procurement and financial management practices. However, the Bank  Group has not taken steps to provide additional assurance and  transparency that its funds are being used as intended by requiring a  comprehensive assessment of controls over operations and compliance.
In addition, the World Bank in its report Clean Government and Public  Financial Accountability acknowledged that borrower countries’  government and external auditors are unable to give the World Bank  sufficient assurance that World Bank funds were exclusively used for  intended purposes. Risks that Bank Group funds are used for purposes  other than those for which loans were granted—whether for concessional  or market-based loans—could be mitigated through effective  implementation and evaluation of internal controls over operations and  compliance.
The Bank Group’s system of internal control, adopted under the COSO  framework, could facilitate a comprehensive assessment of internal  controls over operations and compliance designed to uncover any material  internal control weaknesses in operations and compliance that need to be  corrected. A comprehensive evaluation of these controls could also  provide additional credibility to the Bank Group’s (1) internal evaluation  reporting system and (2) commitment to provide funds only to those who  use the funds for intended purposes. Such an assessment would provide  additional assurance to both the Bank Group and its member countries  over the use of funds and could be accomplished in one of several ways: (1)  through the Bank Group’s internal audit function, (2) by the external  auditor, in conjunction with its financial statement audit, giving an opinion  on whether management’s assertions on internal controls over operations  and compliance are fairly stated, (3) by another entity within the Bank  Group, or (4) by another external entity, such as a consultant.
Such an assessment would include identifying the specific elements of the  COSO criteria that are objective, measurable, and relevant to use in  assessing the reasonableness of internal control over operations and key  charter provisions to be included in a review of compliance controls and to  define what would constitute compliance with those key provisions of  bank charters. After these significant issues are addressed, Bank Group  management would be able to comprehensively document and assess the  key controls identified and subsequently provide its assertions on the  effectiveness of those controls.
section_title: Bank Group Has Established an Audit Committee That Provides Oversight of Financial Reporting and Internal Control
paragraphs: The Bank Group’s board of executive directors has appointed an audit  committee to provide, on its behalf, oversight on matters such as the  effectiveness of financial policies and reporting; various aspects of  financial, business, operating, and reputational risks; and internal control  in the Bank Group entities. The Bank Group’s audit committee has a  purpose, scope, and operating principles congruent with those customarily  established for audit committees. A major function of the Bank Group’s  audit committee is to nominate an external auditor to conduct audits of the  Bank Group’s financial statements and determine the scope of the auditors’  work and the reports to be submitted by the auditors.
The information provided by the Bank Group on the functions of its audit  committee indicated that the audit committee’s terms of reference included  responsibilities such as those listed in table 5.
Information provided to us by the Bank Group indicates that the Bank  Group entities’ audit committee was actively involved with the external  auditor during its financial statement audits. Audit committee activities  with the external auditor included communications about internal control  recommendations, discussions on management’s COSO assertion on  internal control over external financial reporting, the external auditor’s  opinion on management’s assertion, and considerations on the external  auditor’s conclusions on the appropriateness of accounting principles. The  information also showed that the audit committee kept current with the  work of the internal auditor.
The audit committee has a particularly important role to play in assuring  fair presentation and appropriate accountability in connection with  financial reporting, internal control, compliance and related matters. An  effective audit committee facilitates the successful performance of the  board of executive directors’ oversight responsibilities for financial  operations and is an independent safeguard on corporate management with  respect to its responsibilities for preparing financial statements and  implementing an internal control framework.
The Bank Group’s audit committee currently has the external auditor  provide an opinion on management’s assertion on the Bank Group’s  internal control over external financial reporting. The audit committee has  not asked the Bank Group entities’ external auditor to provide assurance  on internal control over operations or compliance. The audit committee  has the authority, as part of determining the scope of the auditor’s work, to  expand and strengthen the Bank Group entities’ internal control reporting  processes by requesting the external auditor to give an opinion on internal  control over operations and compliance matters once management decides  such reporting is appropriate. A key step in this process is for management  to first apply the scope of COSO to its controls over operations and  compliance and to develop the appropriate criteria to assert on internal  control over operations and compliance matters. The audit committee  could then have the external auditor to provide an opinion on  management’s assertions over those controls using the criteria specified by  management.
Alternatively, the audit committee could work with the internal and  external auditors, other entities within the Bank Group, or an external  party to conduct a comprehensive evaluation of internal controls over  operations and compliance to determine whether such controls are in place  and are functioning properly to prevent misuse of funds and to ensure  compliance with key provisions of bank charters and policies.
section_title: Conclusions
paragraphs: The Bank Group has taken important steps in strengthening its assessment  and reporting on internal control by performing the internal control  assessments necessary to provide an assertion on internal control over  external financial reporting and having its external auditor give an opinion  on that assertion. At the same time, Bank Group management does not  include in its assertion internal control over operations and compliance  with key charter provisions, and it has not asked the external auditor or  any other organization, internal or external, to provide a comprehensive  evaluation of its controls over these areas. The assurance that such an  assessment can provide through reporting on internal control over  operations and compliance is especially important given the operating risks  inherent in the Bank Group’s activities. The audit committee is well- positioned to assign an internal party or provide an external entity the task  of providing a thorough assessment of such controls. This additional  assurance would strengthen the Bank Group’s accountability and enhance  member country assurance that funds are spent as intended.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of the Treasury instruct the U.S.  Executive Director of the Bank Group to take the lead in working with the  other executive directors in developing a policy requiring the Bank Group  entities to enhance the audit function and reporting of their financial  operations. This would entail (1) conducting a comprehensive evaluation  of internal controls over operations and compliance to determine whether  such controls are in place and are functioning properly to prevent misuse  of funds and to ensure compliance with key provisions of bank charters  and policies and (2) reporting annually to the board of executive directors  through the audit committee on the progress made. This evaluation could  be carried out in any of several ways, including through the internal audit  function; by the external auditor, in conjunction with the financial  statement audit; by another entity within the Bank Group; or by an external  party, such as a consultant. These Bank Group entities should also provide  the results of the assessment to member countries annually.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments from the Office of the President of the  World Bank, which represented the official response of the World Bank  Group. We also received written comments from the Deputy Assistant  Secretary for Multilateral Development Banks and Specialized  Development Institutions at the Department of the Treasury, the agency  that represents the United States at the World Bank Group. These  comments are reprinted in their entirety in appendixes III and IV.
In its comments, the World Bank Group welcomed our recommendation  for a comprehensive assessment of internal controls over operations and  compliance with bank charters and policies but did not comment on our  recommendation that such evaluations be conducted annually. The Bank  Group stated that given the many reforms it has underway to strengthen its  control framework, an assessment of internal control over operations and  compliance would be most useful if undertaken once the range of changes  over those controls is substantially in place. We agree that effective timing  for implementing our recommendation would coincide with the Bank  Group’s implementation of reforms. It added that such changes are  expected to be complete in about 18 to 24 months.
While Treasury also agreed with our recommendation for a comprehensive  evaluation of internal controls over operations and compliance, it did not  agree that the Bank Group should follow this initial assessment with annual  evaluations. It acknowledged that periodic updates would be reasonable  but characterized annual evaluations as excessive and unnecessary based  on its view that the overall structure of internal controls changes  infrequently and usually only marginally.
Given the inherent risks in the Bank Group entities’ lending activities, we  remain convinced that the Bank Group should report annually on all three  categories of internal control—financial reporting, operations, and  compliance. Under the COSO framework, effective internal control is an  essential aspect of managing shifting environments and evolving demands  and priorities. Internal control is not one event, but a series of actions and  activities occurring throughout an entity’s operations and on an ongoing  basis. As entities strive to improve operational processes, management  should continually assess and evaluate its internal control. Monitoring—a  process that assesses the quality of an internal control system’s  performance over time—is an essential element of internal control and is  particularly relevant for carrying out the fiduciary responsibilities that are  integral to the Bank Group’s operations. Annual reporting on internal  control is now common practice both in the public and private sector and is  often performed in conjunction with annual financial statement audits.
Treasury pointed out that our draft report documents the sufficiency of the  Bank Group’s current external audits. Although our report provides  information about the results of the external financial statement audits at  the Bank Group, our report also makes it clear that, by design, the objective  of a financial statement audit is not to provide assurance on internal  control. The current financial statement audits cover only the banks’  financial position at a point in time and the financial results of operations  and cash flows for a given fiscal year. Given that the Bank Group’s external  auditor’s opinion on internal control extends only to management’s  assertions on the effectiveness of internal control over external financial  reporting, many facets of internal control would not be covered. The scope  of the financial statement audits of the Bank Group entities and the  separate assessment of controls over external financial reporting are not  intended to and do not provide specific assurance about the effectiveness  of the internal control over operations and compliance with bank charters  and key policies.
Considering the Bank Group’s reforms to strengthen internal control over  operations and compliance, we emphasize the need for annual assessments  of those controls. As acknowledged in comments from the Bank Group,  internal control is a “dynamic process,” and reforms are under way in the  Bank Group to strengthen its control framework. As the Bank Group  develops and institutes these reforms, monitoring is needed to help ensure  that controls are functioning as intended in preventing misuse of funds and  ensuring compliance with key provisions of bank charters and policies.  Annual reporting to provide accountability and transparency over lending,  equity investment, and guarantee operations carries additional importance  for the Bank Group because the international organization’s mission  requires it, as stated in its comments, “to be active in countries where  controls are weak.” As acknowledged by the Bank Group, “monitoring  exposure against defined benchmarks” is one of several changes that will  provide the banks with “significantly improved controls over lending,  equity investment, and guarantee operations.” As stated in our  recommendations, the evaluation and reporting on internal control over  operations and compliance could be carried out in several ways, including  through the internal audit function; by the external auditor, in conjunction  with the financial statement audit; by another entity within the Bank  Group; or by an external party, such as a consultant.
We are sending copies of this report to the Secretary of the Treasury, the  president of the World Bank Group, and other interested parties. Copies  will be made available to others upon request. In addition, the report will be  available at no charge on the GAO Web site at http://www.gao.gov.
Please contact me at (202) 512-9406 or by email at franzelj@gao.gov if you  or your staffs have any questions concerning this report. Key contributors  to this report were Charles Norfleet, Meg Mills, and Maxine Hattery.
section_title: Components of Internal Control under COSO
paragraphs: The World Bank, beginning in 1995, adopted the Committee of Sponsoring  Organizations of the Treadway Commission (COSO) internal control  framework. Under the COSO framework, there are five interrelated  components of internal control that define the minimum level of quality  acceptable for internal control in an organization and provide the basis  against which internal control is to be evaluated. The five components are  used as the criteria to evaluate the strengths and weaknesses of the internal  controls and to identify actions that can be taken to improve controls. All  five components must be present and effective in order for management to  have reasonable assurance that risks are managed to ensure the  achievement of the organization’s objectives. At the Bank Group,  management is responsible for developing the detailed policies,  procedures, and practices to fit its organization’s operations and to ensure  that they are built into and are an integral part of its operations. The five  internal control components, which apply to all aspects of an organization’s  operations, including programmatic, financial, and compliance, include the  following: Control environment. The control environment reflects management’s  commitment and attitude to the implementation and maintenance of an  effective internal control structure. The control environment which  management promulgates through the organization will strongly influence  the design and operation of control policies and procedures. It will also  determine how effective they are in mitigating risks and achieving  objectives.
Risk assessment. All organizations, regardless of size or nature, encounter  some form of risk that can adversely impact the achievement of its  objectives. Assessing risk is a major component of an effective control  structure. It involves the identification, analysis, assessment, and  prioritization of risks that need to be treated by control activities.
Control activities. Control activities are the tailored policies and  procedures that ensure (1) the mitigation of risks, (2) irregularities are  prevented or detected and corrected, (3) assets are safeguarded from  unauthorized use or disposal, and (4) financial records and other relevant  databases are complete and accurately reflect the entire operational  activities of the organization, and assist in timely preparation of accurate  financial statements.
Information and communication. Information and communication are  critical for performance reporting, decision making, both within the  organization and externally, and the achievement of strategic objectives.
Monitoring. Monitoring is the final component of an effective internal  control structure and is closely linked to information and communication.  In addition to performance monitoring, the effectiveness of the control  structure itself also needs to be monitored and reviewed. Control  monitoring can be undertaken in two ways, by ongoing monitoring and by  separate reviews and evaluations.
section_title: Transparency International’s 2002 Corruption Perception Index
paragraphs: Transparency International is an organization dedicated to curbing both  international and national corruption. Transparency International launched  its Corruption Perception Index (CPI) in 1995. The CPI is a collection of  polls, drawing on 15 surveys from 9 independent sources for its 2002  results. The goal of the CPI is to provide data on extensive perceptions of  corruption within countries. The 2002 CPI shows that the Bank Group  entities function in environments that are perceived to have high levels of  corruption, underscoring the importance of internal control over  operations and compliance within the Bank Group entities that are  providing loans to those countries.
The CPI serves as an important indicator of the image a country conveys to  investors and potential business partners. Because the CPI is derived from  15 different surveys that garner the perceptions of both residents and  expatriates, both business people and risk analysts, the index provides a  snapshot of the views of the people who make key decisions on investment  and trade. The CPI builds public awareness of the corruption issue, and it  adds to pressure on governments to directly address the issue and the  damaged image of their nation that low rankings in the CPI reflect.
The CPI is a composite index that consists of credible sources using  diverse sampling frames and different methodologies, including one used  by the World Bank. The methodology is reviewed by a steering committee  consisting of leading international experts in the fields of corruption,  econometrics, and statistics. Members of the steering committee make  suggestions to improve the CPI, but the management of Transparency  International makes the final decisions on the methodology used. For the  2002 CPI, data was included from the following organizations’ surveys and  documents:  World Bank, World Business Environment Survey;  World Economic Forum, Africa Competitiveness and Global   Institute for Management Development, World Competitiveness   PricewaterhouseCoopers, Opacity Index;  Political & Economic Risk Consultancy, Asian Intelligence Issue;  Economist Intelligence Unit, Country Risk Service and Country   Freedom House, Nations in Transit;  Gallup International on behalf of Transparency International, Bribe   Columbia University, State Capacity Survey.
No country was included in the CPI without results from a minimum of  three surveys undertaken over the past 3 years. For this reason, not all  countries with high levels of corruption may have been added. Figure 4  includes the borrower countries by region.
section_title: Comments from the World Bank Group
section_title: Comments from the Department of the Treasury
subsections: section_title: GAO’s Mission
paragraphs: The General Accounting Office, the audit, evaluation and investigative arm of  Congress, exists to support Congress in meeting its constitutional responsibilities  and to help improve the performance and accountability of the federal government  for the American people. GAO examines the use of public funds; evaluates federal  programs and policies; and provides analyses, recommendations, and other  assistance to help Congress make informed oversight, policy, and funding  decisions. GAO’s commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost is  through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older  products. The Web site features a search engine to help you locate documents  using key words and phrases. You can print these documents in their entirety,  including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site  daily. The list contains links to the full-text document files. To have GAO e-mail this  list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO  Mailing Lists” under “Order GAO Products” heading.
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Public Affairs