    United Nations Organizations: Oversight and Accountability Could
    Be Strengthened by Further Instituting International Best
    Practices (18-JUN-07, GAO-07-597).

    Since 2005, the United Nations (UN) has been attempting to reform
    its management processes, in part to help ensure that resources
    are used effectively and efficiently. Some of these reforms focus
    on improving oversight and accountability at the United Nations.
    In this report, GAO examines the extent to which selected UN
    organizations' (1) internal audit offices have implemented
    professional standards for performing audits and investigations,
    (2) evaluation offices have implemented UN evaluation standards,
    and (3) governing bodies are provided with information about the
    results of UN oversight practices. GAO obtained and analyzed
    international standards and relevant documents from six of the
    largest UN organizations, and also met with U.S. and UN
    officials.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-07-597
        ACCNO:   A70888
      TITLE:     United Nations Organizations: Oversight and
    Accountability Could Be Strengthened by Further Instituting
    International Best Practices
         DATE:   06/18/2007
      SUBJECT:   Accountability
    	     Audit oversight
    	     Auditing standards
    	     Best practices
    	     Evaluation
    	     Internal audits
    	     Internal controls
    	     International organizations
    	     International relations
    	     Quality assurance
    	     Risk management
    	     Standards evaluation
    	     Waste, fraud, and abuse

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-07-597

         * [1]Report to Congressional Committees

              * [2]June 2007

         * [3]UNITED NATIONS ORGANIZATIONS

              * [4]Oversight and Accountability Could Be Strengthened by Further
                Instituting International Best Practices

         * [5]Contents

              * [6]Results in Brief
              * [7]Background
              * [8]UN Internal Audit Offices Have Not Fully Implemented Key
                Components of International Auditing Standards

                   * [9]All Audit Offices Are Developing Risk-Based Work Plans
                     but Lack Completed Organizationwide Risk- Management
                     Frameworks to Guide Their Work
                   * [10]Some Audit Offices Lack Sufficient Staff to Cover
                     High-Risk Areas
                   * [11]Some Audit Offices Have Not Fully Implemented Quality
                     Assurance Processes
                   * [12]All Audit Offices Have Implemented a Recommendations
                     Tracking System and Follow-up Process, and Some Have
                     Implemented Mechanisms to Strengthen Their Process
                   * [13]Some Internal Oversight Units Lack Sufficient
                     Investigative Staff and Rely on Other Parties to Investigate
                     Wrongdoing
                   * [14]UN Agencies Are in Various Stages of Adopting Ethics
                     Policies

              * [15]UN Evaluation Offices Have Not Fully Implemented UN
                Evaluation Standards

                   * [16]Most Evaluation Offices Lack Sufficient Resources and
                     Expertise
                   * [17]Most Evaluation Offices Have Not Fully Implemented
                     Quality Assurance Processes
                   * [18]All Evaluation Offices Are Working toward Fully
                     Establishing Mechanisms to Systematically Follow Up and
                     Report on the Status of Their Recommendations

              * [19]Governing Bodies Lack Full Access to Information That Could
                Provide Greater Insights into UN Organizations' Operations and
                Identify Critical Systemic Weaknesses

                   * [20]Governing Bodies Lack Full Access to Internal Audit
                     Reports
                   * [21]Most Governing Bodies Lack Direct Information from the
                     Internal Audit Offices on the Adequacy of the Audit Offices'
                     Resources and Capacity to Conduct Oversight
                   * [22]Most Audit Committees Are Not Aligned with Best
                     Practices

                        * [23]Most Audit Committees Are Not Accountable to Their
                          Governing Bodies
                        * [24]Some Audit Committees Are Composed of Senior
                          Management Officials
                        * [25]Some Organizations Are Considering the
                          Establishment of Audit Committees That Are Aligned with
                          Best Practices

              * [26]Conclusions
              * [27]Recommendations for Executive Action
              * [28]Agency Comments and Our Evaluation

         * [29]Scope and Methodology
         * [30]Comments from the Department of State
         * [31]Comments from the Food and Agriculture Organization
         * [32]Comments from the World Food Program

              * [33]GAO Comment

         * [34]Comments from the World Health Organization

              * [35]GAO Comments
              * [36]GAO Comments

         * [37]Comments from the International Labor Organization
         * [38]Comments from the United Nations Development Program
         * [39]Comments from the United Nations Children's Fund

              * [40]GAO Comments

         * [41]GAO Contact and Staff Acknowledgments
         * [42]Related GAO Products
         * [43]PDF6-Ordering Information.pdf

              * [44]Order by Mail or Phone

                     United States Government Accountability Office

    Report to Congressional Committees

    GAO

    June 2007

                              UNITED NATIONS ORGANIZATIONS

    Oversight and Accountability Could Be Strengthened by Further Instituting
                              International Best Practices

    UNITED NATIONS ORGANIZATIONS

    Oversight and Accountability Could Be Strengthened by Further Instituting
    International Best Practices

      What GAO Found

    Although the six UN internal audit offices that GAO reviewed have made
    progress in implementing international auditing standards, they have not
    fully implemented key components of the standards. The organizations lack
    completed organizationwide risk-management frameworks, which are essential
    in identifying the areas with the greatest vulnerability to fraud, waste,
    and abuse. In addition, three audit offices lack sufficient staff to cover
    high-risk areas of the organization. Furthermore, some of the audit
    offices have not fully implemented quality assurance processes, which
    include activities such as external peer reviews. Some of the
    organizations also do not have professional investigators to probe
    allegations of wrongdoing.

    While the six UN evaluation offices that GAO reviewed are working toward
    implementation of UN evaluation standards, they have not fully implemented
    them. Most of the evaluation offices lack sufficient resources and
    appropriate expertise to manage and conduct evaluations, especially at the
    country level. This has impacted their ability to conduct high-quality and
    strategically important evaluations. In addition, most of the evaluation
    offices have not fully implemented quality assurance processes relating to
    areas such as evaluation methodology, scope, evidence, and findings.
    Furthermore, all of the evaluation offices are working toward fully
    establishing mechanisms that systematically follow up and report on the
    status of their recommendations.

    The governing bodies responsible for oversight of the six UN organizations
    that GAO reviewed lack full access to internal audit reports and most lack
    direct information from the audit offices about the sufficiency of their
    resources and capacity to conduct their work, which could provide greater
    insights into the organizations' operations and identify critical systemic
    weaknesses. In addition, with one exception, the organizations' audit
    committees that GAO examined are generally not accountable to their
    governing bodies, and some are composed of senior management officials.

        Differences in UN Organizations' and IIA's Best Practices Accountability
                                       Structures

      Source: GAO analysis of UN data
      and Institute of Internal Auditors' guidance.

                     United States Government Accountability Office

    Contents

      [45]Letter 1

    [46]Results in Brief 4
    [47]Background 7
    [48]UN Internal Audit Offices Have Not Fully Implemented Key
    Components  of  International  Auditing  Standards  14
    [49]UN  Evaluation Offices Have Not Fully Implemented UN Evaluation
    Standards
    [50] 29 Governing  Bodies Lack  Full Access  to Information  That
    Could Provide Greater Insights into UN Organizations' Operations and
    Identify   Critical    Systemic   Weaknesses    39
    [51]Conclusions    50
    [52]Recommendations for Executive  Action 50
    [53]Agency  Comments and  Our Evaluation 51
    [54]Appendixes

    Appendix I:
    Appendix II:
    Appendix III:
    Appendix IV:
    Appendix V:
    Appendix VI:
    Appendix VII:
    Appendix VIII:
    Appendix IX:

    [55]Scope and Methodology 55
    [56]Comments from the Department of State  60
    [57]Comments from the  Food and Agriculture  Organization 64
    [58]Comments from the World Food  Program 67
    [59]GAO Comment  69
    [60]Comments from  the World Health Organization  70
    [61]GAO  Comments 72  [62]Comments from  the
    International Labor Organization 73
    [63]GAO Comments 76
    [64]Comments  from the United Nations  Development Program 78
    [65]Comments  from the  United Nations Children's Fund 79
    [66]GAO  Comments 81
    [67]GAO Contact and  Staff Acknowledgments 83
    [68]Related GAO Products

    Figures
    [69]Figure 1: Governance Structure of Selected UN Funds and
    [70]Programs and  Specialized  Agencies  10
    [71]Figure  2:  Internal  and External Oversight Structure of Selected UN
    Funds and Programs and Specialized Agencies 12
    Figure 3: Selected UN Funds' and Programs' and Specialized
    Agencies' Progress toward Implementing International
    [73]Auditing Standards                                        15
    Figure 4: Selected UN Funds' and Programs' and Specialized
    Agencies' Progress toward Ensuring Sufficient Resources
    [75]to Perform Investigations                                 25
    Figure 5: Selected UN Funds' and Programs' and Specialized
    Agencies' Progress toward Implementing Financial
    Disclosure and Whistleblower Protection Policies          28
    Figure 6: Selected UN Funds' and Programs' and Specialized
    Agencies' Progress toward Implementing UNEG Standards and Norms 30
    Figure 7: Audit Committee Purpose, Membership, and
    Responsibilities According to Best Practices              44
    Figure 8: Differences between Current Practice for Most of the UN
    Organizations and IIA's Best Practice Accountability
    Structure for Audit Committees                            46
    Figure 9: Audit Committees at the Six UN Organizations That We
    Examined                                                  48

                                     Abbreviations

    ALNAP           Active Learning Network for Accountability and
                    Performance in Humanitarian Action
    BOA             Board of Auditors
    FAO             Food and Agriculture Organization
    IIA             Institute of Internal Auditors
    ILO             International Labor Organization
    IT              information technology
    JIU             Joint Inspection Unit
    OECD/DAC        Organization for Economic Cooperation and Development/
                    Development Assistance Committee
    OIOS            Office of Internal Oversight Services
    PBAC            Program, Budget and Administration Committee
    UN              United Nations
    UNDP            United Nations Development Program
    UNEG            United Nations Evaluation Group
    UNICEF          United Nations Children's Fund
    WFP             World Food Program
    WHO             World Health Organization

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed in
    its entirety without further permission from GAO. However, because this
    work may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this material
    separately.

    United States Government Accountability Office
    Washington, D.C. 20548

    June 18, 2007

    The Honorable Norm Coleman
    Ranking Member
    Permanent Subcommittee on Investigations
    Committee on Homeland Security and Governmental Affairs
    United States Senate

    The Honorable Ileana Ros-Lehtinen
    Ranking Member
    Committee on Foreign Affairs
    House of Representatives

    Member states contribute billions of dollars annually to the United
    Nations (UN) system^1 for programs that meet emergency humanitarian needs,
    provide development assistance, and support economic and social
    development in over 190 countries. To direct these programs, member states
    have created governing bodies in each UN organization to develop
    governance practices for maintaining the strategic direction of the
    organization, overseeing the effective and efficient use of resources, and
    monitoring the actions of management and operations. The UN system
    generally has both internal and external accountability and oversight
    mechanisms. Internal oversight functions include reviewing the
    effectiveness and efficiency of the organizations' operations, evaluating
    the organizations' compliance with UN financial rules and regulations,
    conducting investigations on allegations of misconduct, and reporting to
    the executive heads of the organizations. External oversight functions
    generally report to the organizations' governing bodies on the
    organizations' finances and also may perform nonfinancial reviews of the
    efficiency and effectiveness of the organizations' operations.

    ^1The UN system is composed of the main Secretariat and separately
    administered funds and programs and specialized agencies. For example,
    funds and programs include the United Nations Children's Fund and the
    United Nations Development Program, which have executive boards and
    executive heads but are under the authority of the UN Secretary-General.
    In contrast, specialized agencies, such as the Food and Agriculture
    Organization, have their own governing bodies and executive heads and are
    not under the authority of the Secretary-General. The agencies, which are
    legally independent international organizations with their own rules,
    membership, organs, and financial resources, were brought into
    relationship with the United Nations through negotiated agreements.

    As the largest financial contributor to the United Nations, the United
    States has advocated comprehensive management reform of the UN system,
    including measures to strengthen governance and improve oversight. Also,
    over the past 2 years, member states and independent experts have proposed
    management reforms that call for sustained action to strengthen
    accountability and transparency in the UN system by improving UN oversight
    practices. As such, several management reforms and proposals have focused
    on improving the effectiveness and increasing the capacity and
    independence of the oversight function at the United Nations.

    In 2005, representatives of UN member states identified an urgent need to
    improve UN management processes and requested that the UN Secretariat's
    Secretary-General and General Assembly propose and approve reforms for
    strengthening the organization in several areas, including accountability
    and oversight. For example, at the 2005 World Summit, the General Assembly
    requested a comprehensive independent review of the Secretariat's Office
    of Internal Oversight Services (OIOS) with a view toward strengthening
    that office, as well as a systemwide review of UN governance and
    oversight.^2 While these reforms have focused primarily on the
    Secretariat, they serve as a model for UN systemwide reforms to help
    ensure that resources are used effectively and efficiently. However, in
    2006, we reported to Congress that progress toward implementation of
    reforms, including those relating to strengthening oversight, has been
    slow.^3

    In this report, we examine the extent to which (1) internal audit offices
    have implemented professional standards for performing audits and
    investigations, (2) evaluation offices have implemented UN evaluation
    standards, and (3) governing bodies are provided with information about
    the results of UN oversight practices. The scope of our work includes the
    internal audit and evaluation offices at the three largest UN funds and
    programs--the United Nations Development Program (UNDP), the United

    ^2We reported in 2006 that UN funding arrangements constrain OIOS's
    ability to operate independently and recommended that reliable funding
    arrangements that do not undermine the independence of the office be made.
    See GAO, United Nations: Funding Arrangements Impede Independence of
    Internal Auditors, [86]GAO-06-575 (Washington, D.C.: Apr. 25, 2006).

    ^3GAO, United Nations: Management Reforms Progressing Slowly with Many
    Awaiting General Assembly Review, [87]GAO-07-14 (Washington, D.C.: Oct. 5,
    2006).

    Nations Children's Fund (UNICEF), and the World Food Program (WFP);^4 and
    three of the largest UN specialized agencies--the Food and Agriculture
    Organization (FAO), the International Labor Organization (ILO), and the
    World Health Organization (WHO). In most of the organizations that we
    studied, the investigations function was part of the internal audit
    office.

    To complete this study, we analyzed UN documents and processes and
    practices relating to the audit, investigation, and evaluation functions
    of the six UN organizations we examined. We reviewed professional
    standards, guidelines, and best practices for performing audits,
    investigations, and evaluations, including the Institute of Internal
    Auditors' (IIA) International Standards for the Professional Practice of
    Internal Auditing,^5 the UN Uniform Guidelines for Investigations, and the
    UN Evaluation Group (UNEG) standards and norms.^6 The six UN organizations
    we examined have adopted these standards, norms, and guidelines. For the
    purposes of our study, we selected key audit standards to examine the
    extent to which these organizations have implemented IIA standards. To
    examine the extent to which the organizations have implemented UNEG
    standards and norms, we selected those standards and norms to match the
    key audit standards to the extent possible. We also compared current
    governance structures at the six organizations with IIA guidance on the
    use of audit committees. We interviewed UN officials and staff with
    governance and oversight responsibilities and members of the internal
    audit committees and the external auditors for each organization. Finally,
    we interviewed officials from the U.S. Departments of State (State),
    Labor, and Health and Human Services; the U.S. Agency for International
    Development; and 32 UN member state representatives. Appendix I contains
    more details on our scope and methodology. We conducted our work in
    Washington, D.C.; New York; Geneva; and Rome. We performed our work
    between June 2006 and March 2007 in accordance  with generally accepted
    government  auditing standards.

    ^4WFP is a subsidiary of both the United Nations and the Food and
    Agriculture Organization.

    ^5IIA is recognized as the internal audit profession's leader in
    certification, education, research, and technological guidance. IIA
    provides comprehensive guidance for internal auditing through its
    Professional Practice Framework, including the International Standards for
    the Professional Practice of Internal Auditing, which outlines the tenets
    of the internal audit profession and the Role of Auditing in Public Sector
    Governance that defines key elements needed to maximize public sector
    audit activity.

    ^6UNEG is a group of professional practioners. UNEG adopted standards and
    norms in 2005 to professionalize the evaluation function, provide guidance
    to evaluation offices in preparing their evaluation policies or other
    aspects of their operations, as well as to guide the establishment of the
    institutional framework, management of the evaluation function, and the
    conduct and use of evaluations.

                                    Results in Brief

    Although the six UN internal audit offices that we reviewed have made
    progress in implementing international auditing standards, they have not
    fully implemented key components of the standards, such as basing annual
    work plans on organizationwide risk-management frameworks and obtaining
    the necessary resources to conduct their work. All of the audit offices
    are at various stages of developing and implementing their own riskbased
    work plans, but the offices are doing so without the benefit of completed
    organizationwide risk-management frameworks, which are essential in
    identifying the areas with the greatest vulnerability to fraud, waste, and
    abuse. In addition, three of the six UN audit offices lack sufficient
    staff to cover high-risk areas of the organizations. Furthermore, three of
    the audit offices have not fully implemented quality assurance processes,
    which include activities such as internal and external peer reviews. For
    example, ILO has not had an external peer review, but it plans to have one
    this year for the first time. All audit offices have a tracking and
    follow-up system for recommendations to ensure that senior management is
    addressing deficiencies identified by internal and external auditors, and
    some offices have undertaken efforts to strengthen their follow-up
    processes. In addition, three of the organizations currently do not have
    professional investigators and rely heavily on auditors to probe
    allegations of wrongdoing, which is a practice that could impact the
    organizations' ability to provide adequate audit coverage and ensure that
    investigations are properly carried out. While most of the organizations
    are in various stages of considering and implementing ethics policies,
    none have adopted financial disclosure requirements for their oversight
    staff to monitor potential conflicts of interest.

    Although the six UN evaluation offices that we reviewed are working toward
    implementation of UN evaluation standards and norms, such as resource
    adequacy and quality assurance processes, they have not fully implemented
    them. Five of the evaluation offices reported that they lack sufficient
    resources and staff with expertise to manage and conduct
    evaluations--conditions that have impacted their ability to conduct
    highquality and strategically important evaluations. For example, UNICEF
    reported that about two-thirds of its country offices do not have
    sufficient staff with the requisite skills to consistently deliver
    high-quality evaluations. In addition, five of the evaluation offices have
    not fully implemented quality assurance processes relating to evaluation
    staff selection, design, and reporting. Specifically, they have identified
    weaknesses in areas such as evaluation methodology, scope, evidence, and
    findings. Furthermore, all of the evaluation offices are working toward
    fully establishing mechanisms that systematically follow up and report on
    the status of their recommendations, to provide assurance to senior
    management that steps are being taken to address identified weaknesses in
    their programs.

    The governing bodies responsible for oversight and accountability of the
    resources of the six UN organizations that we reviewed lack full access to
    internal audit reports and most lack direct information from the internal
    audit offices about the sufficiency of their resources and capacity to
    conduct their work, which could provide greater insights into the
    organizations' operations and identify critical systemic weaknesses. In
    addition, although most of the organizations have audit committees that
    review internal audit activities and report to the heads of the
    organizations, only WHO has an audit committee that is autonomous of
    senior management and is part of the governing body. To carry out some of
    their oversight responsibilities, UN governing bodies are provided with
    the external auditor's report on the organization's financial statements
    as well as the internal audit office's summary of internal audit
    activities. However, the governing bodies do not have full access to
    internal audit reports-- including those that identify systemic weaknesses
    in internal controls and cases of fraud, waste, and mismanagement--and the
    management response letter to audit reports, which includes senior
    management's plans for taking correction action. Also, most of the
    governing bodies lack direct information from the internal audit offices
    on the sufficiency of the audit offices' staffing and financial resources
    as well as the audit offices' capacity for conducting effective oversight.
    International best practices suggest that oversight could be strengthened
    by establishing an independent audit committee--composed of members
    external to the management of the organization and reporting to the
    governing body on the effectiveness of the audit office and on the
    adequacy of its resources--as part of the governance structure of each of
    the United Nations' governing bodies. However, the audit committees at
    four of the six UN organizations that we examined are not in line with
    these international best practices, and one entity does not have an audit
    committee. Four of the five audit committees are not accountable to their
    governing bodies, and three of these committees are composed of senior
    management officials. An audit committee that is composed of external
    members and accountable to its governing body also could assist it with
    its responsibility to monitor the organization's oversight function. In
    the absence of such an audit committee, many of the member state
    representatives to the governing bodies told us that they find such
    monitoring difficult because they lack sufficient resources and expertise.

    We make recommendations in this report to the Secretary of State to direct
    the U.S. Missions to work with member states to improve oversight and
    accountability in UN organizations by (1) making audit reports available
    to the governing bodies that will provide further insight into the
    operations of the United Nations' organizations and identify critical
    systemic weaknesses and (2) establishing independent audit committees that
    are accountable to their governing bodies, where this does not now occur.

    We requested and received comments on a draft of this report from the
    Secretary of State and cognizant officials representing the six
    UN-affiliated agencies that we reviewed--FAO, ILO, UNDP, UNICEF, WFP, and
    WHO. These comments are reprinted in appendixes II through VIII, along
    with our responses to specific points. State endorsed the main findings
    and conclusions of the draft report and stated that the United States has
    established partnerships with several other like-minded member states, and
    will continue to work with them to build a constituency for strengthening
    oversight and accountability in the UN system. FAO stated that our report
    observations are clear, comprehensive, and well-reasoned and that its
    governing body has begun taking steps that align with implementing our
    recommendations. UNDP stated that it is reviewing the issues related to
    the recommendations, and that a number of these issues will be part of the
    interaction with the Executive Board during June 2007. WFP noted that the
    substance of our recommendations is currently being debated in many forums
    throughout the UN system, and that its Executive Board and its bureau have
    been engaged in considering issues related to the composition and
    reporting lines of the audit committee. WHO commented that it is engaged
    with other organizations in the UN system in addressing the issue of
    access to internal audit reports and noted that its Program, Budget and
    Administration Committee already fulfills most of the requirements that we
    advocate, such as independence from senior management and accountability
    to the governing body. ILO commented that it has serious reservations
    about implementing our recommendation to make internal audit reports
    available to governing bodies. We maintain that providing the governing
    body access to all internal audit reports will provide the governing body
    greater insight into the organization's operations and highlight systemic
    weaknesses in internal controls. UNICEF noted that any proposal to reorder
    the governance mechanisms so as to align them with a particular
    understanding of the IIA standards would be a matter for UNICEF's
    Executive Board (among other institutions). We recognize that decisions
    regarding changes in UNICEF's lines of reporting to allow UNICEF's
    governing body access to all audit reports, as well as the creation of an
    independent audit committee to be in line with international best
    practices, will require the consideration and approval of UNICEF's
    Executive Board. We also maintain that the United States, as a member of
    UNICEF's governing body, should work with other member states to consider
    implementation of these recommendations.

      Background

    According to the United Nations, effective oversight services are a high
    priority and a crucial component in the Secretary-General's efforts to
    strengthen the organization in the 21st century. Effective oversight
    practices are integral to establishing good governance and help to provide
    assurance to governing bodies and senior management that resources
    contributed to the organization are not vulnerable to waste, fraud, and
    abuse.

    Generally, governance is the system by which organizations are directed,
    controlled, and held to account to provide reasonable assurance that
    objectives are met and that operations are carried out in an ethical and
    accountable manner. Good governance requires a clear division of
    responsibilities between the governing body and senior management. In
    addition, good governance includes clearly articulated ethical values,
    objectives, and strategies; proper tone at the top; and internal controls.
    An absence of good governance structures and a lack of adherence to basic
    governance principles increases the risk of public corruption. The
    governing bodies in each UN organization are responsible for developing
    governance practices for maintaining the strategic direction of the
    organization, and monitoring the actions of management and operations.

    Oversight is a key activity in governance that addresses whether
    organizations are carrying out their responsibilities and serves to detect
    and deter public corruption. Oversight functions include monitoring,
    evaluating, and reporting on the organization's performance and holding
    senior management accountable for results. These functions also encompass
    the auditing, internal and external, of the organization's financial
    results and the effectiveness of its internal controls. In addition,
    oversight also includes investigation of allegations of fraud. The UN
    system, including its affiliated funds and programs and specialized
    agencies, generally has both internal and external accountability and
    oversight mechanisms.

    The principal bodies responsible for conducting oversight in the UN funds
    and programs and specialized agencies in our study include member states
    in their capacity as members of the governing bodies; governing body
    committees; internal auditors; investigators; evaluation offices; and
    external auditors, including the UN Joint Inspection Unit (JIU). These
    bodies are defined in the following text and illustrated in figure 1.

         o Member states refers to those countries that are members of each of
           the UN organizations.
         o Governing body is composed of member state representatives who are
           responsible for steering and directing the organization. Its role is
           to set and maintain the organization's strategic direction, effective
           and efficient allocation of resources, and effective monitoring of
           management and operations. The governing body exercises oversight over
           senior management.
         o Governing body committee is composed of member state representatives
           who are responsible for certain governance functions, such as budget
           and finance committees; it makes recommendations to the governing body
           or acts on its behalf in the interests of efficiency and
           effectiveness.
         o Senior management refers to the chief administrative or executive
           officer of a UN organization and his or her senior management team.
           Senior management is responsible for the organization's day-to-day
           operations and the implementation of the policies, strategies, and
           budgets established by the governing body. It has the duty to assess
           risk and establish effective controls to achieve objectives and avert
           risk. Senior management exercises oversight over the organization's
           operational activities.
         o Internal auditors determine whether there is an adequate and effective
           system of internal controls for providing reasonable assurance with
           respect to the integrity of financial and operational information;
           compliance with regulations, rules, policies, and procedures, and
           safeguarding of assets; economic and efficient use of resources, and
           identifying opportunities for improvement; and effectiveness of
           program management for achieving objectives consistent with policies,
           plans, and budgets. Internal auditors are generally accountable to the
           organization's senior management.
         o The Office of Internal Oversight Services is the internal auditor of
           the UN Secretariat and other UN organizations, including several funds
           and programs, under the authority of the UN Secretary-General. Certain
           funds and programs, such as UNDP and UNICEF, fall within OIOS's
           jurisdiction but do not always use OIOS's services because they have
           their own oversight units. OIOS's authority does not extend to UN
           specialized agencies, such as FAO, ILO, and WHO.^7
         o Investigators examine allegations of wrongdoing, including fraud,
           corruption, misconduct, and other irregular activity, to propose
           corrective management and administrative measures, such as an eventual
           prosecution or disciplinary measures as appropriate. Investigators are
           accountable to the organization's senior management.
         o Evaluators determine the relevance, effectiveness, and impact of an
           ongoing or completed program, project, or policy in light of its
           objectives and accomplishments to incorporate lessons learned into
           decision-making processes. The governance structures of evaluation
           offices vary among organizations; either the governing bodies or the
           heads of the organizations are responsible for the governance of the
           evaluation offices.
         o The external auditor reports on the organization's accounts and may
           make observations on financial procedures, the accounting system,
           internal financial controls, and the administration and management of
           the organization in general. Several bodies within the UN system
           provide external oversight. The Board of Auditors (BOA) serves as the
           external auditor for the UN funds and programs. BOA is mandated to
           express an opinion on the financial statements and, in general, on the
           administration and management of the organization. Each of the
           specialized agencies has its own external auditor, which is generally
           the Auditor-General of a member state's supreme audit institution.^8

    7 [88]GAO-06-575.

    ^8BOA examines the UN Secretariat and other UN organizations within the
    Secretary-General's authority. BOA is presently composed of the heads of
    the national audit offices of France, the Philippines, and South Africa.
    Unlike the other funds and programs, WFP does not fall under BOA's
    jurisdiction. Instead, WFP's governing body appoints its external auditor
    in accordance with WFP's Financial Regulations. The National Audit Office
    of the United Kingdom currently serves as the external auditor of WFP and
    ILO, while the Comptroller and Auditor-General of India serves as the
    external auditor for WHO and FAO.

    o In addition, the Joint Inspection Unit, the only independent systemwide
    external oversight body, has the authority to perform inspections,
    evaluations, and investigations throughout the UN system, including the
    funds and programs and specialized agencies.^9

    Figure 1: Governance Structure of Selected UN Funds and Programs and Specialized
                                        Agencies

                      Audit authority
                      Operational/Reporting relationship
                      FAO   Food and Agriculture Organization
                      ILO   International Labor Organization
                      OIOS  Office of Internal Oversight Services
                      UNDP  United Nations Development Program
                      UNICEF United Nations Children's Fund
    						WFP World Food Program
    						WHO World Health Organization
    						OIOS has no oversight authority
    						OIOS has oversight authority
    						These organizations have their own internal oversight entities

    Source: GAO analysis of UN data.

    ^aThe Board of Auditors serves as the external auditors for both UNDP and
    UNICEF. Currently, the National Audit Office of the United Kingdom serves
    as the external auditor for WFP.

    ^bCurrently, the National Audit Office of the United Kingdom serves as the
    external auditor for ILO, while the Comptroller and Auditor General of
    India serves as the external auditor for WHO and FAO.

    ^cUN funds and programs operate under the authority of the UN Secretariat.

    ^dWFP is under the authority of the Director General of FAO and the UN
    Secretary-General.

    ^9JIU primarily examines thematic areas, such as the possibility of
    outsourcing certain services that cut across UN organizations. Although
    the JIU statute provides it with the mandate to conduct investigations, at
    the time of our study, it did not have the resources to carry out its
    mandate to investigate wrongdoing, according to JIU.

    The UN funds and programs and specialized agencies organize their internal
    oversight functions^10 in different ways. For example, in most of the UN
    organizations we examined, the oversight functions are separated into two
    distinct units--one unit for the audit and investigation functions, and
    another unit for the evaluation function--while in WHO, these three
    functions are combined into a single unit and operate under one office.
    Figure 2 provides an overview of the organizational structure of the
    oversight functions at the UN organizations we studied, as well as their
    total budgets for the biennium 2006-2007. On the basis of UN member
    states' assessed rates of contribution, the U.S. government provides 22
    percent of the budgets of FAO, ILO, and WHO. The amounts that the United
    States provides to UNDP, UNICEF, and WFP are on a voluntary basis. On the
    basis of the United States' budget for fiscal years 2006 and 2007, the
    United States provided total amounts of about $209 million to UNDP and
    $249 million to UNICEF. In calendar year 2006, the United States
    contributed $1.1 billion to WFP.^11

    ^10For the purposes of this report, oversight functions include audit,
    investigation, and evaluation functions.

    ^11Contributions to WFP are dependent on an ongoing needs assessment for
    emergency food aid. Therefore, State could not provide us with an estimate
    for U.S. contributions made in 2007.

      Figure 2: Internal and External Oversight Structure of Selected UN Funds and
                           Programs and Specialized Agencies

                                   Oversight function

                                          Budget
              20 dedicated  56 dedicated  and
              professional  professional  staff
              field         field         data do
              positions     positions     not
              funded by     funded by     include
              separate      separate      regional
              budget        budget        and
                                          country
                                          offices
    External  UN Board of   UN Board of   National  National
    auditors  Auditors      Auditors      Audit     Audit     Supreme      Supreme
                                          Office    Office    Audit        Audit
                                          of the    of the    Institution  Institution
                                          United    United    of India     of India
                                          Kingdom   Kingdom
                           Source: GAO analysis of UN data.
                           aILO's 2006-2007 biennium budget figure does
                           not include voluntary contributions.

    ^bILO's governing body is a tripartite structure, which is composed of 28
    member state representatives, 14 employer members, and 14 worker members.

    ^cWHO's OIOS is composed of the audit, investigation, and evaluation
    functions.

    ^dEvaluations can be conducted or managed or both by headquarters,
    regional, and field offices. Some evaluation offices (UNDP, ILO, WHO, and
    FAO) are centrally managed and oversee the activities of the regional and
    field offices. Other evaluation offices (UNICEF and WFP) activities are
    decentrally managed and overseen directly by the regional and field
    offices.

    The audit, investigation, and evaluation functions within UN organizations
    were established to advise senior management. The primary objective of
    internal oversight in these organizations is to assist senior management
    in fulfilling its responsibilities by providing advice on the adequacy of
    internal controls and management practices on the basis of a systematic
    and independent review of the organizations' operations. For example, the
    mission of WFP's internal audit office is to help the organization
    accomplish its objectives with a systematic approach to assess the
    organization's risk-management, control, and governance processes and
    suggest improvements to them. At the six organizations we studied, the
    chief audit executives were appointed by and accountable to the heads of
    their respective organizations, and in some organizations--such as ILO and
    WHO--the appointments are made following a consultation with its governing
    body.

    The span of oversight and accountability of the evaluation function varies
    among the six organizations we examined. Also, the types of evaluations
    vary and may include corporate,^12 thematic, and programmatic evaluations.
    Generally, at the six organizations that we examined, evaluation reports
    are made publicly available.^13 UNDP, ILO, WHO, and FAO evaluation
    functions are centralized, such that the headquarters evaluation offices
    manage the evaluation function of the organization. For example, based on
    the evaluation policy of UNDP, the evaluation office at headquarters is
    the custodian of the evaluation function.^14 As such, the evaluation
    office,
    among other things, submits its annual plan to the governing body, reports
    annually to the governing body on the function, findings and
    recommendations of evaluations, assures mandatory decentralized
    evaluations and support quality assurance of evaluations, as well as
    conduct strategic, thematic, program, and other evaluations as
    required.^15 In contrast, the management of UNICEF's and WFP's evaluation
    functions is decentralized. For example, WFP's evaluation function
    consists of its central evaluation office, which manages evaluations,
    complemented by evaluations that are managed by regional bureaus and
    country offices. In addition, WFP's evaluation office at headquarters
    provides limited informal support to the bureaus and country offices.
    UNICEF's evaluation office at headquarters commissions and conducts
    evaluations and provides guidance on evaluation standards, but it has no
    responsibility for overseeing the quality and independence of evaluations
    at the regional or country level. The regional office conducts evaluations
    related to regional strategies and provides oversight and support for
    evaluations undertaken by country offices, and the country offices are
    responsible for strategically selecting and conducting evaluations at the
    country level.

    ^12Corporate evaluations have a scope that is of interest to the whole
    organization and have systemic implications.

    ^13ILO said that its public page contains full text reports of major
    evaluations and abstracts of all other independent evaluations. According
    to UNICEF, as established by the Evaluation Committee Rules and Procedures
    in June 2004, the evaluation office will assume that all reports are
    suitable for public dissemination unless informed in writing by the
    commissioning office.

    ^14In June 2006, the governing body of UNDP approved its first evaluation
    policy, which is in line with the requirements of UNEG norms and
    standards.

      UN Internal Audit Offices Have Not Fully Implemented Key Components of
      International Auditing Standards

    Although the six UN internal audit offices that we examined have made
    progress in implementing key components of international auditing
    standards, they have not fully implemented key components of the
    standards. All of the audit offices are at various stages of developing
    and implementing their own risk-based work plans, but they lack a
    completed organizationwide risk-management framework, which is essential
    in identifying the areas with greatest exposure to fraud, waste, and
    abuse. In addition, three audit officials stated that their audit offices
    lack sufficient staff to cover high-risk areas. Three audit offices have
    not fully implemented quality assurance processes, such as internal and
    external peer reviews. All of the audit offices have a recommendations
    tracking and follow-up system to ensure that senior management is
    addressing deficiencies identified by internal and external auditors, and
    some offices have undertaken efforts to strengthen their follow-up
    process. In addition, some of the organizations do not have professional
    investigators and rely
    heavily on auditors to probe allegations of wrongdoing, a practice that
    could impact the organizations' ability to ensure that investigations are
    properly carried out. In addition, while most of the organizations are in
    various stages of considering and implementing ethics policies, none have
    adopted financial disclosure requirements for their oversight staff to
    monitor potential conflicts of interest. Figure 3 provides information on
    the six UN audit offices' progress toward implementing international
    auditing standards.

    ^15UNDP defines strategic evaluations as those evaluations that assess its
    performance in areas that are critical to ensuring sustained contribution
    to development results in the context of emerging development issues and
    changing priorities at the global and regional levels. Strategic
    evaluations may cover the organization's policies and programmatic
    approaches.

    Figure 3:  Selected  UN Funds'  and  Programs' and  Specialized  Agencies'
    Progress toward Implementing International Auditing Standards

    Source: GAO analysis of UN data.

    ^aWHO conducted  an  internal self-assessment  that  was validated  by  an
    external party. The scope and findings of this review were not provided to
    GAO.

        All Audit Offices Are Developing Risk-Based Work Plans but Lack Completed
        Organizationwide Risk-Management Frameworks to Guide Their Work

          IIA Standard: Planning

    The internal audit activity plan of engagementsshould be based on a risk
    assessment, undertaken at least annually. The input of senior management
    and the board should be considered in this process. (2010.A1)

    All audit offices are developing and implementing risk-based work plans,
    but the organizations' senior management has not completed
    organizationwide risk-management frameworks that would assist in guiding
    the audit offices' work plans, as shown in figure 3. A riskmanagement
    framework is (1) a systematic approach to identifying, assessing, and
    acting on the probability that an event or action may occur that could
    threaten or adversely affect an organization's activities, assets, and
    reputation and (2) the responsibility of the organization's management.
    Accordingly, the framework should reflect senior management's perspective
    of the organization's risk environment and enable the internal audit
    office to direct audit resources to those areas with the greatest exposure
    to fraud, waste, and mismanagement. While risk management is the
    responsibility of the organization's senior management, IIA standards
    state that the internal audit office should assist the organization by
    identifying and evaluating significant exposures to risk and by
    contributing to the improvement of risk management and control systems.

    While the internal audit offices of ILO, UNDP, UNICEF, WFP, and WHO have
    contributed to their respective organizations' development of a
    riskmanagement framework, none of the organizations have fully completed
    such a framework. For example, IIA reported that WFP's audit office played
    a key role in introducing an organizationwide risk-management framework by
    helping to draft the risk-management proposal that the executive board
    approved in late 2005 and by facilitating a series of organizationwide
    risk-management workshops for headquarters and field offices.^16 IIA also
    reported that the implementation of this organizationwide risk-management
    framework would take about 2 years to complete, and it recommended that
    WFP continue to implement the framework. In response to IIA, WFP indicated
    that it was in the process of identifying a corporate risk coordinator and
    a chief risk officer to work on the project's implementation. However,
    these are only initial steps to developing an organizationwide
    risk-management framework. WFP audit officials stated that until WFP has a
    risk-management model in place, the audit office will have to rely on its
    current process for assessing risks, which includes a range of factors,
    such as questionnaires to managers; consideration of prior audit results;
    emerging risks identified in consultation with management; and the results
    of data collection and analysis. In contrast, FAO's audit office has not
    been involved in assisting senior management in developing
    an organizationwide risk-management framework, according to FAO's senior
    audit officials.

    ^16This information is based  on IIA's review of  WFP's audit function  in
    2006.

    All audit offices are making progress toward establishing their own
    riskassessment processes to plan their work. These processes are unique to
    each audit office, and the methodology for conducting the risk-assessments
    ranges from an informal process to a more formal risk-assessment model.
    For example, ILO's audit office developed a risk-assessment model and
    undertook a risk assessment toward the end of 2006. The model is based on
    a quantitative approach that defines the audit universe, numerically ranks
    audit risks on the basis of a risk index, and uses a formula-based scoring
    system. Previously, ILO's external auditor had recommended that the audit
    office develop a more comprehensive risk-based work plan for each
    biennium, and that the plan be formally accepted or approved by the head
    of the organization to confirm his satisfaction on the level of internal
    audit assurance being delivered. ILO first used this risk model to
    prioritize its 2007 work plan. Another example is WHO's audit office,
    which uses an informal risk-assessment process to plan its audit work. WHO
    audit officials stated that the organization has engaged a consultant to
    assist in developing an organizationwide risk-management framework. Once
    this framework is established, audit officials said that they will be
    better informed and will use the framework to help refine their risk-based
    work plans.

    Finally, all audit offices submit their risk-based work plans for review
    and approval by senior management. However, only WHO submits its work
    plans to the governing body for review as called for by IIA standards. IIA
    standards state that the input of senior management and the governing body
    (board) should be considered in the work plan. Input from the governing
    body is essential to help ensure, among other things, that the work plans
    are consistent with the organizations' goals; that management understands
    its risk environment; and that the audit office has sufficient resources
    (which are determined by the management and the governing body) to execute
    the work plan. In addition, most audit offices (FAO, UNDP, UNICEF, WFP,
    and WHO) create annual work plans as called for by IIA standards.^17
    However, according to audit office officials, their work plans would
    benefit from an organizationwide risk assessment that reflects
    management's perspectives of the organizations' risk environment.

    ^17ILO prepares a comprehensive risk-based  work plan on a biennium  basis
    and updates the work plan annually.

        Some Audit Offices Lack Sufficient Staff to Cover High-Risk Areas

          IIA Standard: Resource Management

    The audit chief should ensure that internal audit resourcesare
    appropriate, sufficient, and effectively deployed to achieve the approved
    plan. (2030)

    Three of the six senior audit chiefs (FAO, UNICEF, and WFP) reported that
    they do not have sufficient resources to carry out their approved work
    plans, while three (ILO, UNDP, and WHO) reported that they have sufficient
    resources. IIA standards require that audit chiefs have resources that are
    appropriate, sufficient, and effectively deployed to achieve the approved
    work plan. While UN audit chiefs can request additional resources from the
    head of the organization through the budgeting process, it is the
    responsibility of the head of the organization to ensure that the audit
    office receives sufficient resources to audit high-risk areas or accept
    the risks for not taking action. Generally, UN governing bodies are
    unaware of the audit offices' budget requests, but governing bodies would
    be aware of external auditors' reports that identify the need for
    increased audit resources. Without sufficient financial resources for
    audit and investigative positions, audit offices would not be able to
    adequately address areas, such as financial management and information
    technology systems that are vulnerable to fraud and abuse. We did not
    review the sufficiency of the reported resources.

    Senior audit officials of FAO, UNICEF, and WFP stated that they do not
    have sufficient resources to execute their audit work plans. UNICEF's
    audit capacity does not provide adequate coverage of high or significant
    audit risk areas in headquarters and the field, according to UNICEF senior
    audit officials and UNICEF's external auditor, BOA. BOA reported in June
    2006 that the audit office's deployment of most of its staff resources to
    the field has limited its coverage of the 18 headquarters offices and
    divisions. Specifically, BOA reported that between 1999 and 2005, the
    audit office conducted between one and four headquarters audits per year,
    and that in a number of cases, the areas audited did not pertain to the
    core activity of the division. BOA also reported that except for one
    review--the financial logistics system security and authorization--carried
    out in 2001, the audit office had not audited information technology areas
    such as data centers, applications, networks, security, and data
    integrity. At the time of BOA's audit, the audit office lacked information
    technology (IT) expertise, but it subsequently hired one senior IT
    specialist in 2006. UNICEF audit officials agreed with BOA's findings and
    informed us that additional auditors are still needed to expand the
    coverage of headquarters, systems, and performance audits. According to
    BOA, a possible indicator of understaffing is the relationship between the
    number of audit staff and the growth in UNICEF's budget and country
    offices. For example, between 2000 and 2004, although UNICEF's budget
    increased by about 57 percent and its reserves and fund balances doubled,
    the audit office's staff level decreased by one during that period. UNICEF
    audit officials informed us that on the basis of BOA's audit, its
    executive board requested that the audit office conduct a needs assessment
    of its resource requirements, which it is currently performing as part of
    a UNICEF-wide review.

    FAO's audit chief also informed us that the audit office lacks sufficient
    resources to address high-risk areas. The audit chief said that there are
    many high-risk areas that the audit office cannot cover within a 2-year
    period, and that FAO would like to cover 100 percent of its high-risk
    areas every 2 years. According to the audit chief, FAO's audit work plan
    is driven by the financial resources provided to the internal audit unit,
    and the determination of which high-risk areas to cover depends on the
    amount of available financial resources.

    WFP's audit chief informed us that the audit office does not have
    sufficient resources to conduct its planned work for 2007. The audit chief
    stated that the audit office had experienced a budget shortfall based on
    its work plan for 2007, and that WFP absorbed this shortfall by decreasing
    audit coverage of lower-risk areas. However, WFP senior officials stated
    that further budget revisions and curtailment of planned recruitment in
    2007 has left WFP's internal audit service short of its requirements, and
    that budget uncertainties continue into 2008. Furthermore, according to
    the audit office, for 2007, resource constraints have resulted in deferred
    audit coverage of a number of field offices, and the planned audit of a
    complex special operation also was deferred to a future year.

    ILO's, UNDP's, and WHO's audit chiefs stated that their audit offices have
    sufficient resources to conduct most of their planned audit work,
    especially in high-risk areas. According to ILO's audit chief, the audit
    office has sufficient resources to achieve its 2007 audit work plan, and
    funds are available in the 2007 budget to outsource an IT audit.^18 ILO's
    external auditor had recommended in 2006 that the office consider
    increasing its level of IT audit specialists to support the audit of
    internal controls, particularly regarding its integrated resource
    information system. The audit chief also stated that the proposed
    2008-2009 program budget includes provisions for an additional
    professional staff, a part-time general service staff, as well as nonstaff
    resources, which could be used to provide IT audit services. The
    International Labor Conference will consider the proposed
    2008-2009 budget in June 2007. In addition, WHO's audit chief stated that
    he has obtained the number of positions that his office requires to
    complete its planned work and has not had to postpone work or travel due
    to lack of resources. WHO's audit chief also reported that the office
    successfully hired additional staff in 2006 for the 2007 plan of work.

    ^18However, according to ILO's audit chief, the 2007 work plan is based on
    current staffing levels, and the achievement of the work plan will be
    subject to demands placed on the audit office to undertake investigations.

    UNDP's senior audit officials stated that the organization currently has
    sufficient resources to address most of its audit work plan for 2007. In
    2005, the audit office reported to the agency head that the cases of fraud
    uncovered in some country offices and at headquarters had occurred over
    long periods, which indicated that internal controls and review processes,
    including internal audits, had been very weak. In 2006, the audit office
    requested a budget of about $13 million on the basis of its risk-based
    work plan.^19 However, UNDP's senior management initially provided the
    office with a budget allocation of about $7 million, according to UNDP
    audit officials. The audit office did not have enough funds to perform its
    planned work and requested additional resources, which was increased by
    three subsequent allotments totaling $1.4 million. Both the audit chief
    and UNDP's external auditor had emphasized to the head of the organization
    that the audit function needs to be strengthened. Furthermore, BOA
    reported in June 2006 that UNDP's internal audit coverage was insufficient
    and that in the past 4 years, the audit office had performed an average of
    less than four audits per year at headquarters, all of which were of a
    very limited scope. BOA reiterated its recommendations to increase the
    audit capacity to cover key areas, such as financial records, procedures,
    and controls at headquarters. In April 2007, UNDP officials informed us
    that for 2004 to 2006, all very-high-risk-rated countries and 72 percent
    of high-risk- rated countries had been audited. In addition, UNDP
    officials said they performed a risk assessment at the end of 2006, and
    senior management allocated $10 million to carry out its audit work plan
    in 2007. Furthermore, the officials said that senior management has
    committed to allocate additional resources as deemed necessary. According
    to UNDP officials, for the 3-year period of 2005 to 2007, they plan to
    audit all very-high-risk areas and 96 percent of high-risk countries.

    ^19The $13 million would  have allowed high-risk  countries to be  audited
    once every 2 years, medium-risk countries once every 3 years, and low-risk
    countries once every 4 years.

        Some Audit Offices Have Not Fully Implemented Quality Assurance Processes

    IIA Standards: Quality Assurance and Improvement Program

    Internal assessmentsshould include ongoing reviews of the performance of
    the internal audit activity. (1311)

    External assessments, such as quality assurance reviews, should be
    conducted at least once every 5 yearsby an independent reviewer or review
    team from outside the organization. (1312)

    Although all six audit offices have a number of quality assurance measures
    in place, FAO, ILO, and UNDP fall short of fully meeting the IIA quality
    assurance auditing standards. Quality assurance mechanisms are important
    tools that can provide a level of assurance to the management of the
    organization on the effectiveness and performance of the audit function.
    Quality assurance and improvement programs include continuous reviews that
    are conducted by internal and external reviewers. Internal reviews include
    supervisory reviews of audit documentation and reviews of completed audits
    by auditors who were not involved with the engagement to determine whether
    they were conducted in accordance with the organization's quality control
    policies and procedures. External reviews are generally conducted by
    independent firms that examine the audit function and audit documentation
    against established auditing quality standards, such as IIA standards.

    While all audit offices have some form of internal quality assurance
    processes in place, the processes vary widely across organizations and are
    not always standardized or documented. All audit officials stated that
    their internal quality assurance processes include reviews of audit
    documentation by senior audit officials, audit peers, or team coordinators
    to determine whether there is sufficient evidence to support audit
    findings. For example, WHO audit team coordinators review work conducted
    by auditors from the inception to the end of the audit and examine the
    quality of work and the audit evidence gathered. In addition, WHO's
    internal oversight director stated that he reviews all aspects of the
    auditing work, including planning memorandums, report drafts, and comments
    from the auditee, before a report is issued in its final format. While
    some audit offices, such as ILO, UNICEF, and WFP, have documented their
    internal quality assurance processes or have adopted software that
    documents their quality assurance processes, FAO and UNDP have not. UNDP
    has not documented its quality assurance process, and the audit office is
    currently taking steps to document the process to comply with IIA
    standards. FAO audit officials stated that they do not have standardized
    procedures to review audit documentation of field auditors but expect to
    standardize the process with the introduction of electronic work papers
    that auditors from headquarters can review. Standardized procedures,
    including documentation of the internal quality assurance process, would
    help to provide assurance that the internal audit activity is performed in
    accordance with the organization's standards and assist peer reviewers in
    evaluating the organization's compliance with the standards.

    Although periodic external peer reviews required by IIA can provide
    reasonable assurance of the quality of the audit offices' work, we found
    that two of the audit lacked a timely external review. UNDP, UNICEF, WFP,
    and WHO audit offices have met IIA standards by undergoing external
    reviews of their quality assurance processes at least once over the past 5
    years. On the basis of an external review of UNDP's 2004-2005 audit
    activities, in June 2006, UNDP's external auditor made several
    recommendations for improving UNDP's audit activities. For example, BOA
    recommended that UNDP enforce the timely receipt of audit reports that are
    prepared by contractors who audit UNDP program activities in the field to
    facilitate the audit office's review. BOA also reviewed UNICEF's audit
    activities and reported that UNICEF had implemented many quality assurance
    processes required by IIA standards. BOA recommended that the audit office
    institute internal peer file review and ensure that there is evidence of
    supervisory review on all audit documentation. UNICEF responded that it
    had implemented BOA's recommendations pertaining to quality assurance.
    Regarding WFP, IIA conducted an external review in March 2006 and found
    that WFP generally conforms to its standards. IIA made a number of
    recommendations, including that WFP expand and formalize its internal
    quality assessment activities, such as supervisory reviews of selected
    audits, and provide training to audit management and staff to ensure
    consistent application of audit documentation standards. WFP reported that
    it is in the process of implementing these recommendations. In August
    2006, WHO's OIOS performed an internal quality assurance self-assessment,
    which was validated by external reviewers. However, WHO did not provide us
    with information covering the scope and findings of this review. According
    to the director of WHO's OIOS, the quality assurance review included the
    office's three functions of audit, evaluation, and investigation and
    indicated general compliance with IIA standards.

    FAO and ILO have not had external peer reviews in the past 5 years,
    according to audit officials. For example, FAO audit officials stated that
    FAO's audit office was peer reviewed in 2001 against standards established
    by the UN Panel of External Auditors. The office was due to be reviewed in
    2006, but the review was postponed due to budget constraints. However, IIA
    began a review in February 2007, according to FAO audit officials. ILO has
    not had an external review, but according to the acting chief of audit,
    plans have been placed on hold for such a review due to difficulty in
    having audit staff available to support the review. According to ILO's
    acting chief of audit, funds have been included in the 2007 budget for an
    external
    review to be performed on the  basis of IIA's standards beginning in  fall
    2007.

        All Audit Offices Have Implemented a Recommendations Tracking System and
        Follow-up Process, and Some Have Implemented Mechanisms to Strengthen Their
        Process

          IIA Standards: Monitoring Progress

    The chief audit executive should establish and maintain asystem to monitor
    the disposition of results communicated to management. (2500)

    The chief audit executive should establish afollow-up process to monitor
    and ensure that management actions have been effectively implemented or
    that senior management hasaccepted the risk of not taking action.
    (2500.A1)

    All six audit offices we examined have a system in place to monitor and
    follow up on the recommendations that are made to agency management to
    help ensure that proper attention is being paid to any deficiencies that
    are identified by the internal audit office. Some audit offices have also
    undertaken efforts to strengthen their follow-up process to ensure that
    recommendations are acknowledged and addressed by their organizations'
    management. UNDP, UNICEF, and WFP track the status of their
    recommendations in electronic work paper software, such as CARDS, Team
    Mate, and AutoAudit.^20 UNICEF reports that establishing the database in
    AutoAudit has significantly improved tracking and reporting on the status
    of its recommendations. In contrast, FAO, ILO, and WHO track their
    recommendations in software such as Excel or Access. FAO audit officials
    said that they plan to use Team Mate in the future because Excel is not as
    flexible, and that Team Mate will allow for input from the departments
    they have audited.

    All audit offices have a process in place to follow up on the status of
    their recommendations and to determine whether any action has been taken
    to address them. However, the frequency of follow-up and the way in which
    it is conducted varies from agency to agency. For example, three of the
    audit offices follow up with auditees every 6 months (FAO, ILO, and UNDP);
    UNICEF follows up quarterly; WFP follows up monthly on the basis of the
    recommendation implementation due date; and WHO has no set time frame for
    follow up, which instead is determined by the types of outstanding
    recommendations. The audit offices rely on implementation reports from the
    offices that were audited to determine whether adequate actions have been
    taken to close the audit recommendations. However, all senior audit
    officials we interviewed stated that these written reports from the
    auditees are supplemented by subsequent reviews of the status of
    recommendations during the audit office's next field visit to verify
    whether the appropriate actions were taken to implement the
    recommendations.

    Three of the audit offices (FAO, ILO, and WFP) have established mechanisms
    to ensure that recommendations are acknowledged and
    addressed by organization management. For example, according to an FAO
    official, the audit committee has been playing an active role in
    monitoring the status of recommendations, and, as a result, there is more
    commitment from management to follow up on recommendations. At every audit
    committee meeting, the committee members review each recommendation to
    determine which ones have not been addressed. As a result of the audit
    committee's regular monitoring, FAO has cleared the backlog of
    recommendations and improved the timeliness of their implementation.
    According to FAO, of the 2,790 recommendations issued during 2000 to 2005,
    88.9 percent are closed, 4.9 percent are open, and 6.2 percent are
    ongoing. ILO's Accountability Committee is charged with examining cases of
    persistent failure on the part of officials to implement the
    recommendations of the internal and external auditors. Furthermore,
    according to WFP audit officials, WFP's audit committee is very active in
    consulting with management in instances of nonresponsiveness by management
    and where internal audit has concluded that management's implementation
    plans are not satisfactory.

    ^20AutoAudit is an  electronic audit  system that  is widely  used in  the
    audit industry.  The planning,  execution, and  follow-up actions  of  all
    audits are documented in AutoAudit.

        Some Internal Oversight Units Lack Sufficient Investigative Staff and Rely
        on Other Parties to Investigate Wrongdoing

    Investigation, which is an integral element of oversight, is a legally
    based and analytical process designed to gather information to determine
    whether wrongdoing has occurred. At the six organizations we examined,
    investigations are guided by the UN Uniform Guidelines for Investigations.
    Three internal oversight units lack a sufficient number of professional
    investigators and rely on other parties who may not be qualified to
    conduct investigations, such as auditors, to determine whether wrongdoing
    has occurred. In addition, some of the oversight units that do have
    professional investigators reported that they are limited in their
    capacity to conduct investigations with their existing staff. Limited
    investigative capacity impacts their ability to conduct planned audits and
    close cases, which may cause backlogs. According to the UN Uniform
    Guidelines for Investigations, organizations should reasonably ensure that
    resources available for investigations are proportionate to the number and
    magnitude of allegations and the potential benefits to the outcome of the
    case. Figure 4 provides information on selected UN funds' and programs'
    and specialized agencies' progress toward ensuring sufficient resources to
    perform investigations.

    Figure 4:  Selected  UN Funds'  and  Programs' and  Specialized  Agencies'
    Progress toward Ensuring Sufficient Resources to Perform Investigations

    Source: GAO analysis of UN data.

    Currently, ILO, UNICEF, and WHO do not have professional investigators.
    UNICEF and WHO each have one full-time position allocated for a
    professional investigator. UNICEF's position is currently vacant, while
    WHO's position is in the process of being filled. ILO does not have any
    investigator positions, although its internal oversight officials have
    made several requests to management for additional investigative
    resources. In March 2007, ILO's governing body approved ILO's 2008-2009
    budget, which requested an increase for oversight resources. According to
    ILO's chief internal auditor, the additional resources will be allocated
    to employ a qualified and experienced investigator. In addition, while
    UNDP has professional investigators, in late 2006, UNDP senior officials
    reported they needed additional investigative staff because of increases
    in the number of cases due to the adoption of a whistleblower protection
    policy and the establishment of a fraud hotline in 2005. Accordingly,
    UNDP's internal oversight unit stated in its annual report to its
    governing body that additional investigative resources are needed to
    address the increased caseload. Subsequently, in 2007, UNDP's
    investigative unit received a 43 percent increase in resources, for a
    total of $2 million, and UNDP officials told us that they are sufficiently
    staffed to meet their needs. Moreover, FAO's investigative capacity is
    limited because the head of investigations is the only staff member with a
    background in investigations. The rest of the staff consists of auditors
    who have some investigative training but lack investigative experience,
    according to FAO officials. Currently, WFP's investigative function is
    staffed with seven positions, including five professional staff. However,
    there are new organizationwide initiatives that may increase WFP's
    caseload, and WFP's senior officials told us they will
    monitor the impact of these initiatives to ensure that investigative
    resources continue to be sufficient.

    Because the UN internal oversight units we examined lack professional
    investigators, these units rely on auditors or consultants to conduct
    investigations. As a result of their limited capacity, many internal
    oversight units have backlogs of investigative cases and are unable to
    complete planned audits. The internal oversight units of ILO and WHO,
    which do not have professional investigators, rely on auditors to conduct
    investigations on an as-needed basis. Currently, all of ILO's auditors are
    engaged in conducting investigative work, according to ILO senior
    officials. Also, in a 2006 report of the internal oversight activities,
    WHO noted that it makes resources available for investigations as
    situations develop, and that regularly scheduled audit work is interrupted
    or deferred to provide resources for investigative purposes. FAO and ILO
    internal oversight officials reported that they have been unable to
    conduct their planned audits because auditor resources were diverted at
    times to conduct investigations that occurred throughout the year. In
    addition, some organizations hire consultants to conduct investigations as
    an interim measure. FAO, UNDP, WFP, and WHO officials reported hiring
    consultants to conduct investigative work. These shortfalls, in part, have
    led to a backlog of cases that have not been resolved at four of the six
    organizations we studied (FAO, UNDP, UNICEF, and WFP). For example, in
    2006, UNDP reported a backlog of 57 outstanding cases--55 unresolved cases
    were carried forward from 2005, and 2 unresolved cases were from 2004.
    With the additional resources for two investigator positions UNDP received
    in 2007, UNDP officials told us that their capacity to handle cases should
    improve.

        UN Agencies Are in Various Stages of Adopting Ethics Policies

    Most organizations are in various stages of adopting ethics policies, such
    as requiring conflict-of-interest and financial disclosure statements and
    adopting whistleblower policies to protect those who reveal wrongdoing.
    Ethics policies could strengthen oversight by helping to ensure more
    accountability and transparency within the organizations. All UN employees
    are subject to standards for ethical conduct that have been established by
    the International Civil Service Advisory Board.^21 Ethical standards
    developed by IIA and the UN Uniform Guidelines for Investigations apply
    specifically to auditors and investigators, respectively. UNEG is
    currently drafting its own set of ethical guidelines for UN evaluation
    staff.^22

    UN organizations have created various ethics policies across the six
    organizations to help to ensure that all staff, including internal
    oversight staff, are free from conflicts of interest. Some internal
    oversight units rely on their staff to comply with a general declaration
    that all UN employees sign when they are employed by the organization. For
    example, all FAO employees, including oversight staff, are required to
    sign a Declaration for Code of Conduct, which states that one must
    exercise loyalty and discretion as an international civil servant and
    maintain independence from any government or other external party.
    Similarly, in 2006, ILO began requiring all of its employees, including
    oversight staff, to complete a disclosure of interest statement on a
    periodic basis. WHO employees also complete a Declaration of Interest
    statement; however, the requirement applies to its senior managers and
    staff members who perform selected functions, such as procurement, and
    does not apply to its entire oversight staff. Other organizations, such as
    UNDP and WFP, rely on their oversight staff to self-report any conflict of
    interests, although WFP's investigative unit was developing a
    conflict-of-interest policy to cover investigations staff in fall 2006.

    None of the six organizations we examined require their internal oversight
    staff to disclose their financial interests, which could help to ensure
    that employees are free from conflicts of interest. In late 2006, UNICEF
    established a financial disclosure policy for senior management and
    officials who are responsible for selected functions, such as procurement,
    but did not apply the policy to auditors, investigators, and evaluators
    below the senior management level. Although FAO does not currently require
    its oversight staff to disclose their financial interests, it is currently
    seeking governing body approval to amend its staff regulations to require
    financial disclosure statements. Once FAO has amended its staff
    regulations, WFP will also be able to require its staff to disclose their
    financial interests. However, FAO and WFP have not determined whether this
    policy will apply to all of their internal oversight staff. Furthermore,
    all six of the organizations we studied have made efforts to increase
    accountability by implementing whistleblower protection policies in line
    with UN Uniform Guidelines for Investigations to protect those who reveal
    wrongdoing within their respective organizations. FAO, ILO, UNICEF, WFP,
    and WHO have established whistleblower protection policies, and UNDP is
    developing such a policy. Figure 5 provides information on selected UN
    funds' and programs' and specialized agencies' progress toward
    implementing financial disclosure and whistleblower protection policies.

    ^21The Standards of Conduct for the International Civil Service were
    prepared by the International Civil Service Advisory Board and were
    adopted by the United Nations General Assembly in resolution 56/244 in
    2001. Regarding ethics, the Standards of Conduct state that international
    civil servants may be required to disclose certain personal assets if this
    is necessary to enable their organizations to make sure there is no
    conflict.

    ^22Although the IIA standards do not call for organizations to establish
    an ethics office or to provide compulsory ethics training, some UN
    organizations have made efforts to implement such policies. Among the six
    organizations we studied, only ILO and UNDP have established an ethics
    office or officer, while WHO is discussing whether to create such an
    office or position. The other organizations--FAO, UNICEF, WFP, and
    WHO--had not taken steps to establish such an office or position. UNDP is
    the only organization that we examined that has instituted compulsory
    ethics training, a best practice, for its employees. UNICEF offers
    voluntary ethics training to its staff, while other organizations have not
    developed or implemented such training.

     Figure 5: Selected UN Funds' and Programs' and Specialized Agencies' Progress
     toward Implementing Financial Disclosure and Whistleblower Protection Policies

                            Source: GAO analysis of UN data.

      UN Evaluation Offices Have Not Fully Implemented UN Evaluation Standards

    Although the six UN evaluation offices that we examined are working toward
    implementing components of UN evaluation standards and norms, they have
    not fully implemented them.^23 These components include ensuring that
    adequate resources are allocated to enable the evaluation function to
    operate effectively, implementing quality assurance processes, and
    following up systematically on recommendations that were made to
    management. Most of the evaluation offices reported that they lack
    sufficient resources and staff with expertise to manage and conduct
    evaluations--conditions that have impacted their ability to conduct
    highquality and strategically important evaluations.^24 Most of the
    evaluation offices have not fully implemented quality assurance processes;
    as a result, there are reported weaknesses in areas such as evaluation
    staff selection, design, and reporting processes. In addition, all of the
    evaluation offices are working toward fully establishing mechanisms that
    systematically follow up and report on the status of their recommendations
    to provide assurance to senior management that steps are being taken to
    address identified weaknesses in their programs. Figure 6 provides
    information on the six UN evaluation offices' progress toward implementing
    UNEG's standards and norms.

    ^23"Evaluation office" as used in this report refers to evaluations
    conducted or managed, or both, by headquarters, regional, and country
    offices.

    ^24Strategic evaluations are those that assess performance in areas that
    are critical to ensuring sustained contribution to development results in
    the context of emerging development issues and changing priorities at the
    global and regional levels. These strategic evaluations may cover policies
    and programmatic approaches.

    Figure 6:  Selected  UN Funds'  and  Programs' and  Specialized  Agencies'
    Progress toward Implementing UNEG Standards and Norms

                            Source: GAO analysis of UN data.

        Most Evaluation Offices Lack Sufficient Resources and Expertise

          UNEG Standard/Norm

    Ensure adequate financial and human resources for evaluation in order to
    allow efficient and effective delivery of servicesby a competent
    evaluation function and enable evaluation capacity strengthening.
    (standard 1.1:2)

    Evaluators must have the basic skill set for conducting evaluation
    studiesand managing externally hired evaluators. (norm 9.3 and standards
    2.1:2 and 2.1:3)

    The evaluation offices of FAO, ILO, UNICEF, UNDP, and WFP reported that
    they do not have enough staff or staff with the appropriate expertise,
    especially in the field, to manage or conduct high-quality and
    strategically important evaluations as required by UNEG. WHO's officials
    stated that their evaluation office has sufficient staff and staff with
    appropriate expertise to conduct and manage evaluations. Due to the lack
    of evaluations staff and expertise at most organizations, member states
    may not be provided with accurate and comprehensive information regarding
    whether the program or project is achieving its intended objectives, to
    make informed decisions as to whether the program or project should be
    modified or eliminated. Specifically, UNEG standards call for governing
    bodies or heads of the organizations, or both, to ensure adequate
    financial and human resources to allow the efficient and effective
    delivery of evaluation services by competent staff. In addition, although
    all evaluation offices engage consultants to supplement the work conducted
    by their evaluators, according to a panel of evaluation experts, the
    availability of qualified evaluation consultants in many countries is
    limited. Some regional officers have developed rosters of prescreened
    consultants to support country offices in managing the evaluation process.
    However, UN officials reported that budget constraints and limited supply
    of wellqualified people hamper regional directors' and monitoring and
    evaluation officers' efforts to hire local consultants. We did not review
    the sufficiency of the reported evaluation staff.

    Officials in UNICEF's evaluation office and its peer review panel reported
    that they do not have sufficient numbers of staff or staff with
    appropriate expertise to conduct evaluations and to strengthen evaluation
    capacity.^25 Although the number of professional monitoring and evaluation
    staff has increased by 42 percent since 2002, UNICEF's evaluation
    officials reported that their staffing needs are still unmet at
    headquarters and in the field.^26 UNICEF also reported that funding for
    evaluations at the country level is not allocated separately from other
    functions so that the 156 professional staff in the field perform other
    duties as well as devote a portion of their time to conducting
    evaluations. In addition, the evaluation office reported
    that about two-thirds of UNICEF's offices do not have a monitoring and
    evaluation officer at the appropriate level of expertise and therefore are
    less able to consistently deliver high-quality evaluations.^27 In May
    2006, an external peer review panel recommended that the resources for the
    evaluation office be increased to sufficiently cover strategic evaluations
    based on the organization's priorities. The review panel also stated that
    critical gaps in quality and resources at the regional and country levels
    weaken the usefulness of the evaluation function as a management tool.
    According to evaluation officials, UNICEF's executive board requested that
    they assess the adequacy of the evaluation budget, which they are
    currently performing as part of a UNICEF-wide review.

    ^25UNICEF reported that evaluation resources are scarcer for the more
    expensive evaluations, including corporate-level and country-program
    evaluations. Donor-funded efforts usually do not face implementation
    constraints, but quality may be less than desired if the country office
    does not have a fully skilled evaluation staff.

    ^26UNICEF reported that it had 48 evaluation professionals in 2002, and 68
    in 2006.

    UNDP officials reported that they do not have sufficient staff or staff
    with the right skills to manage the evaluations that are performed by
    consultants at the country and regional levels.^28 According to UNDP
    officials, existing budget practices for evaluation vary among country
    offices. Evaluation resource requirements are often determined on an
    informal basis for field offices, and the amounts allocated are generally
    insufficient for quality evaluations. In addition, most of the country and
    regional offices are not staffed with evaluation specialists, but rather
    with focal points. With few exceptions, focal points are not evaluation
    specialists but managers with multiple responsibilities who may perform
    some evaluation-related work. Specifically, only 20 of the 142 country
    offices have full-time monitoring and evaluation professionals,
    specialists or advisors, while 22 country offices have only focal points.
    In addition, all 5 regional bureaus have focal points that support
    evaluation planning and liaise with country offices and with the
    evaluation office at headquarters. Only 1 regional center has a monitoring
    and evaluation specialist position.^29 A senior evaluation official
    informed us in April 2007 that a number of country offices are in the
    process of recruiting monitoring and evaluation professionals. In
    contrast, according to UNDP officials, the centrally managed evaluation
    function, which resides in the evaluation office at headquarters,
    independently produces evaluations of a strategic and policy nature and
    presents them
    directly to the Executive Board. These evaluations are funded adequately,
    and the expertise of the evaluation staff at headquarters and the
    consultants it recruits are considered highly professional.

    ^27UNICEF has 126 country offices and 7 regional offices.

    ^28The evaluations conducted by UNDP fall into two categories: (1)
    independent evaluations conducted by the evaluation office at headquarters
    and (2) decentralized evaluations managed by country offices, regional
    bureaus, and practice and policy bureaus that are conducted by
    consultants.

    ^29Annual Report of the Administrator on Evaluation in 2005 (May 2006).

    FAO's evaluation officials informed us that FAO does not have sufficient
    resources to manage and conduct evaluations to address a reasonable level
    of senior management's concerns. The evaluation office relies heavily on
    the use of outside consultants for its expertise; however, it is difficult
    to maintain quality evaluations while only using consultants, according to
    the officials. Resources are needed to hire staff to manage the
    consultants' work.^30 In addition, ILO officials said that all four of its
    evaluation professionals at headquarters are experienced, and that they
    provide guidance to their regional and technical offices.^31 However, all
    major evaluations are conducted by consultants in the field, and there is
    not enough staff at the field level with the expertise to manage the
    evaluation process and to ensure that the evaluations produced by the
    consultants are of good quality. ILO officials informed us in April 2007
    that the 2008-2009 budget will include funding for two additional staff.
    Furthermore, according to WFP officials, their current plan of work for
    evaluations has been designed to fit resources allocated for evaluations
    rather than to ensure adequate resources for the evaluation function. WFP
    officials said that they lack resources to conduct evaluations especially
    in the regional and country offices. According to the officials, only 50
    percent of WFP's planned decentralized evaluations managed by regional
    bureaus and country offices were actually conducted in 2006. Similar to
    other UN evaluation offices, such as UNDP and UNICEF, WFP officials said
    that there are few dedicated monitoring and evaluation staff in regional
    offices, and that most of them handle a large number of other duties with
    only limited experience in evaluation. According to the officials, this
    situation hampers the quality of decentralized evaluations.

    ^30The officials said  that resources are  inadequate for regular  program
    activities and significantly inadequate for extrabudgetary programs.

    ^31ILO's evaluation office at  headquarters has three professional  staff.
    The fourth evaluation professional staff  joined the evaluation office  in
    2007 on a temporary basis for 1 year.

        Most Evaluation Offices Have Not Fully Implemented Quality Assurance
        Processes

          UNEG Norm

    Each evaluation should employ design, planning, and implementation
    processes that are inherently quality oriented, covering appropriate
    methodologies for data collection, analysis, and interpretation. (norm
    8.1)

    Evaluation reports must present in acomplete and balanced way the
    evidence, findings, conclusions, and recommendations, etc. (norm 8.2)

    The evaluation offices of FAO, ILO, UNDP, UNICEF, and WFP have not fully
    implemented quality assurance processes to help ensure that evaluation
    reports adequately address criteria such as evaluation methodology, scope,
    evidence, and findings.^32 WHO's director of OIOS states that the office
    has in place a stringent internal and external quality assurance review
    system for the evaluation function and that an internal quality assurance
    selfassessment, which was validated by external reviewers, indicates that
    the evaluation office was in general compliance with IIA standards.^33 A
    number of the reported deficiencies point to weaknesses in the design
    process (purpose and objectives, scope, and methodology); in the reporting
    process (evidence-based findings, conclusions, and limitations); and the
    staff selection process (the quality of the evaluators and management of
    the process). However, while not required by UNEG's standards and norms,
    some of the entities have taken steps to implement quality-review
    mechanisms, such as external peer reviews of draft reports, external
    review of their quality assurance processes, and evaluation committees, to
    provide an added level of quality assurance. UNDP and UNICEF have had
    external peer reviews of their evaluation offices at headquarters, and
    FAO, ILO, and WFP have performed quality appraisal exercises or
    selfassessments that have identified several areas where their quality
    assurance processes could be improved.

    ILO's evaluation office reported in November 2006 that while it has
    addressed shortcomings in its evaluation practices, it needs to fully
    implement quality assurance processes to improve the quality of its
    evaluations. The evaluation office reported that some areas of the
    evaluations show strength, but the office does not consistently have
    welldeveloped monitoring and review plans, as well as indicators and
    targets, for which evaluators can conduct evaluations. To improve the
    quality of its
    evaluation reports, ILO performed a quality appraisal exercise and
    reviewed 16 of the 65 independent project evaluations that were finalized
    in 2005. In November 2006, ILO reported, among other things, the following
    results on the basis of its review:

    ^32In addition, in 2005, UNEG performed a baseline review of its UN
    evaluation members and, among other things, reported that management
    follow-up and quality assurance processes were found to be consistently
    weak, according to UNICEF. UNEG Task Force on `Quality Stamp' for
    Evaluation - Baseline Synopsis of UNEG Members (December 2005).

    ^33WHO's OIOS is composed of audit, evaluation, and investigation
    functions. According to the director, the office has chosen the IIA
    standards as the overarching professional guidance because they are more
    independent and authoritative than UNEG standards and are responsive to
    the evaluation function. However, OIOS also has adopted the UNEG standards
    for its evaluation function and applies them accordingly in the
    performance of evaluation projects. In addition, WHO conducted an internal
    self-assessment that was validated by an external party. The scope and
    findings of this review were not provided to GAO.

         o About one-half of the evaluation reports did not state the purpose,
           scope, or objectives of the evaluation.
         o Many reports did not include a methodology section or did not explain
           the methodology in a satisfactory manner.
         o Only 1 of 6 evaluation reports that used sampling or case studies
           explained the selection method.
         o All but 1 of the reports included recommendations and identified
           lessons learned, but it was difficult to extract the lessons learned
           from the evaluations.
         o The findings and conclusions were generally of adequate to good
           quality, but the quality of the analysis varied.

    On the basis of this appraisal, ILO officials stated that the two key
    factors for improving the quality of evaluations are the quality of
    evaluators and the effective management of the evaluation process. As a
    result, (1) the evaluation office has designed 1-day training courses on
    managing independent evaluations, guidelines to provide to all external
    evaluators on expected content and quality of their evaluation reports,
    and (2) steps are being taken to include oversight and control of the
    selection of evaluators, among other things.

    A UNDP senior official reported in May 2006 that the quality and utility
    of the evaluations commissioned by country offices are uneven. Some
    evaluations present rigorous and credible assessments of UNDP performance,
    while others are lacking in their assessment of the program's performance
    and evaluative evidence, according to the UNDP senior official.^34 The
    UNDP senior official also said that part of the problem comes from a lack
    of clarity in program objectives and poorly defined
    performance indicators. In contrast, UNDP officials said that the
    evaluation office at headquarters follows a strict regime of quality
    assurance, including quality validation by external advisory panels. In
    December 2005, an external advisory panel completed a peer assessment of
    UNDP's evaluation office at headquarters and reported that it produces
    evaluations that are credible, valid, and useful for learning and strategy
    formation in the organization.^35 UNDP reports that it is taking a number
    of actions to help ensure the quality of centrally managed and
    decentralized evaluations. In June 2006, the Executive Board approved an
    evaluation policy for UNDP, which is based on the requirements of UNEG
    standards and norms. Quality standards are being developed for each stage
    of the evaluation process, including the planning, conduct, and use of
    evaluations. UNDP officials said that these standards will provide
    objective, transparent benchmarks against which quality can be checked,
    scored, and ensured at each stage of the process.^36 According to UNDP
    officials, the implementation of the evaluation policy for field
    evaluations has just begun, and the evaluation office at headquarters
    intends to carry out an assessment of the policy's implementation in
    2008-2009. Furthermore, the evaluation office hopes to update its handbook
    on evaluation and monitoring in 2007.

    ^34According to UNDP, the evaluations produced by country offices, besides
    being used for programmatic improvement, are building blocks for
    strategic, global, regional, and country program evaluations.

    While UNICEF's evaluation office at headquarters reports that it has
    provided guidance and quality standards for conducting evaluations and
    reporting on them, it states that while there has been progress over the
    past 2 years, considerable improvement is required, particularly at its
    country offices, to ensure the quality of its evaluations.^37 In addition,
    UNICEF's peer review panel reported in May 2006 that at the country level,
    in particular, there were inconsistencies in applying guidance provided by
    the evaluation office at headquarters to ensure that all evaluations and
    evaluation reports meet the required quality standards. The panel reported
    that consideration should be given to strengthening guidance through
    training on evaluation reporting standards, such as evidence, conclusion,
    and recommendations, and that the accountability for quality assurance
    across UNICEF's
    evaluation function should be more clearly defined, particularly at the
    country and regional levels.

    ^35This peer assessment was designed under the auspices of the
    Organization for Economic Cooperation and Development/Development
    Assistance Committee Network on Development Evaluation.

    ^36Annual Report of the Administrator on Evaluation in 2005 (May 2006).

    ^37UNICEF Evaluation Office, The Quality of Evaluations Supported by
    UNICEF Country Offices 2000-2001 (September 2004). In this 2004 report,
    UNICEF stated that nearly onethird of its evaluations are poor, and that
    major improvements and value for money can be gained by enhancing quality.

    FAO evaluation officials said that they have a quality assurance process
    in place that differs on the basis of the types of evaluation reports it
    produces. According to the evaluation officials, internal quality
    assurance was strengthened with a set of quality standards introduced in
    the last 3 months and the addition of review conducted by external
    evaluation specialists to the reviews carried out by independent peer
    review panels and staff. FAO officials informed us that there was further
    room for improvement regarding whether the evaluation office was meeting
    UNEG's quality standards, including for corporate evaluations. WFP
    performed a selfassessment of its evaluation function in August 2005 as
    part of the UNEG checklist on evaluation quality and identified areas for
    improvement, such as ensuring that the quality of evaluation reports is
    systematically controlled by quality rules, which it is currently
    addressing.

    While not required to do so by UNEG's standards and norms, some of the
    organizations have taken steps to implement quality review mechanisms,
    such as external peer reviews of draft reports, peer reviews of the
    evaluation function, and evaluation committees, to provide an added level
    of quality assurance. For example, WFP's evaluation office said that it
    uses the Active Learning Network for Accountability and Performance in
    Humanitarian Action (ALNAP) for the review of its humanitarian
    evaluations.^38 In addition, three of the evaluation offices (UNDP,
    UNICEF, and WHO) have had external peer reviews that cover their quality
    assurance processes within the past year or 2, while two are currently
    undergoing reviews (FAO and WFP). Furthermore, four of the evaluation
    offices (FAO, ILO, UNICEF, and WFP) have established evaluation
    committees.

    ^38ALNAP reviews UN  organization evaluations  on humanitarian  assistance
    programs and comments on their quality.

        All Evaluation Offices Are Working toward Fully Establishing Mechanisms to
        Systematically Follow Up and Report on the Status of Their Recommendations

          UNEG Standard

    There should be asystematic follow-up on the implementation of the
    evaluation recommendations that have been accepted by management and/or
    the governing bodies. (norm 12.2 and standard 3.17:41)

    There should be a periodic report on the status of the implementation of
    the evaluation recommendations. This report should be presented to the
    governing bodiesand/or the head of the organization. (norm 12.3 and
    standard 3.17:42)

    All evaluation offices are working toward fully establishing mechanisms to
    systematically follow up and report on the implementation status of their
    recommendations. UNEG requires its evaluation offices to perform a
    systematic follow-up and prepare a periodic report on the status of the
    implementation of the evaluation recommendations that have been accepted
    by the head of the organization or the governing body, or both.

    FAO's, ILO's, UNDP's, and WHO's evaluation offices have systems in place
    to follow up on management's response to their evaluation recommendations.
    Officials of ILO's evaluation office said that its monitoring of
    management's implementation of recommendations is overseen by ILO's
    Evaluation Advisory Committee, which requires ILO management to formally
    respond every 6 months to the evaluation office's findings and
    recommendations. UNDP's evaluation office developed its recommendation
    monitoring system in 2006 and has a systematic follow-up process in place.
    FAO's program committee^39 requires that management respond to the
    evaluation office's recommendations by indicating which recommendations it
    will accept or reject, or both, and report on the progress made in
    implementing the recommendations. The program committee requires FAO's
    evaluation office to determine whether the report is produced and complies
    with the standards, according to the chief evaluation officer. WHO has a
    follow-up process in place, and the frequency of recommendation follow-up
    depends on the type of the evaluation.

    UNICEF's and WFP's evaluation offices have begun to develop evaluation
    recommendation tracking systems to allow better follow-up on the status of
    their recommendations. UNICEF's evaluation officials stated that they are
    in the process of developing such a system because the prior
    recommendation monitoring processes did not use a consistent structure or
    guidance. Specifically, the evaluation office had been addressing the
    status of recommendations through memorandums that are exchanged among
    divisions or offices involved in action plans.^40 Like UNICEF, WFP is in
    the process of developing a follow-up system, which will take into account
    international good practice, as discussed during UNEG's meetings, to
    further improve its system.

    ^39This program committee is a committee of the member countries
    (governing bodies).

    ^40In addition, UNICEF's peer review panel reported in May 2006 that
    management responses have not been systematically required until recently,
    and that there has been no system for tracking follow-up of
    recommendations.

    All of the evaluation offices provide periodic reporting on the status of
    their recommendations to agency heads or their governing bodies, or both.
    The reporting of the status of recommendations would indicate to
    management and the governing bodies the extent to which actions are being
    taken to address identified weaknesses in the evaluation programs or
    projects. ILO's and WFP's evaluation offices report to their governing
    bodies annually on the implementation status of their recommendations, and
    WHO reports twice a year to its senior management and governing body.
    FAO's evaluation office is required to provide a status report on its
    recommendations to its governing body after 1 to 2 years, depending on the
    type of evaluation performed. Every 4 months, the head of UNDP's
    evaluation office provides a report to senior management on the status of
    the implementation of its recommendations, which includes highlighting
    recommendations and systemic issues that are not being addressed. UNDP's
    evaluation office plans to provide a periodic report on the status of its
    recommendations to its governing body as part of its annual reporting,
    beginning in 2007. In addition, UNICEF's evaluation office provides a
    report on the status of its evaluation recommendations to its evaluation
    committee, which is chaired by its executive director. While UNICEF
    officials said that UNICEF does not provide periodic reporting covering
    the specific status of each recommendation to its governing body, it
    provides information to give the governing body a general understanding of
    whether the systemic issues the evaluation office raised are being
    addressed.

      Governing Bodies Lack Full Access to Information That Could Provide Greater
      Insights into UN Organizations' Operations and Identify Critical Systemic
      Weaknesses

    The governing bodies responsible for oversight and accountability of the
    resources of the six UN organizations that we reviewed lack full access to
    internal audit reports and most lack direct information from the internal
    audit offices about the sufficiency of their resources and capacity to
    conduct their work, which could provide greater insights into the
    organizations' operations and identify critical systemic weaknesses. In
    addition, although most of the organizations have audit committees that
    review internal audit activities and report to the heads of the
    organizations, only WHO has a committee that is autonomous of senior
    management and is part of its governing body. To carry out some of their
    oversight responsibilities, UN governing bodies are provided with the
    external auditor's report on the organization's financial statements as
    well as the internal audit office's summary of internal audit activities.
    However, where the governing bodies do not have full access to internal
    audit reports, they may lack full information on systemic weaknesses in
    internal controls; cases of fraud, waste, and mismanagement; senior
    management's response to audit recommendations; and senior management's
    plans for taking
    correction action. Also, most of the governing bodies lack direct
    information from the internal audit offices on the sufficiency of the
    audit offices' staffing and financial resources as well as the audit
    offices' capacity for conducting effective oversight. In addition,
    international best practices suggest that oversight could be strengthened
    by establishing an independent audit committee--composed of members
    external to the management of the organization and reporting to the
    governing body on the effectiveness of the audit office and on the
    adequacy of its resources--as part of the governance structure of each of
    the United Nations' governing bodies. However, the audit committees at
    four of the six UN organizations we examined are not in line with these
    international best practices, and one of the entities does not have an
    audit committee. Four of the five audit committees are not accountable to
    their governing bodies, and three of these committees are composed of
    senior management officials. An audit committee that is composed of
    external members and accountable to the governing body could also assist
    it with its responsibility to monitor the organization's oversight
    function. In the absence of such an audit committee, many of the member
    state representatives to the governing bodies told us they find such
    monitoring difficult because they lack sufficient resources and expertise.

        Governing Bodies Lack Full Access to Internal Audit Reports

    While the governing bodies of the six organizations we examined receive
    information from various sources about the effectiveness of the
    organizations' financial and programmatic operations, they do not have
    full access to internal audit reports, which could increase transparency
    and provide further insight into the organizations' operations. Currently,
    the governing bodies receive information on the organizations' operations
    from various sources, including the external auditor's report on the
    organization's financial statements, the internal audit office's report
    summarizing its main findings and activities, and the audit committee's
    report on the internal audit office's activities. For example, UNICEF's
    audit office provides an independent annual report to the governing body
    covering its summary of audit activities, findings, analysis of systemic
    weaknesses, and issues of internal controls. In September 2006, UNICEF's
    Executive Board requested that UNICEF's audit office further enhance the
    level of analysis in its annual report to include management responses to
    key and recurring issues identified by the audit office, as well as assess
    and report on the adequacy of resources for the internal audit function,
    which the audit office will provide in future reporting.

    While these existing information sources help the governing body exercise
    its oversight responsibilities, some member states want access to internal
    audit reports, which would increase transparency and their awareness of
    the adequacy and effectiveness of the organization's system of internal
    controls. For example, a representative stated on behalf of the European
    Community that the international organizations should work in the spirit
    of transparency regarding member states' access to internal audit reports.
    Similarly, in a governing body committee meeting to discuss member states'
    access to internal audit reports, a U.S. representative stated that
    although the internal audit office's annual report to the governing body
    contains useful information, it does not provide enough information to
    determine whether implemented recommendations significantly improve FAO's
    operations. Over the past year, another U.S. representative requested
    specific internal audit reports that would provide more information on the
    oversight of UNDP's operations in a specific country. The U.S.
    representatives stated that full access to UNDP audit reports would help
    them to exercise their oversight responsibilities as members of the
    governing body.

    The UN Secretariat's internal audit office provides member states with
    access to internal audit reports upon request, and some of the UN
    organizations we studied are considering making these reports available to
    member states. In December 2004, the UN General Assembly granted member
    states access to internal audit reports of the UN Secretariat's internal
    audit office to increase transparency and accountability at the
    Secretariat.^41 Previously, the internal audit offices' reports were
    issued only to the Secretary-General and the heads of the UN organizations
    under examination. According to a U.S. representative, the practice of
    providing member states with access to audit reports at the UN Secretariat
    has helped to provide insight into the operations of the United Nations
    and identify critical systemic weaknesses. Currently, although WHO's
    internal audit office does not provide member states with copies of its
    internal audit reports, the office's policy is to provide a detailed
    briefing, which may include reading the internal audit report, to member
    states upon request. Under ILO's financial regulations, the chief internal
    auditor has the authority to submit any internal audit report to the
    governing body, if the chief internal auditor deems it necessary to do so.
    In addition, some of the organizations we studied are considering making
    internal audit reports available to member states. For example, since May
    2006, FAO's governing
    body has been discussing the criteria by which member states may access
    FAO's internal audit reports. Although WFP's governing body has not
    formally considered requesting access to audit reports, WFP's chief
    internal auditor said he would not oppose such a measure if the governing
    body makes such a decision after considering all of the advantages and
    disadvantages, including issues of confidentiality and due process,
    because he believes that member states' access would enhance the
    organization's transparency. However, some internal audit officials
    indicated that it may be difficult and time-consuming to modify the
    current structure of audit reports to delete sensitive material, and that
    making the reports available to member states would raise issues
    concerning confidentiality, administrative workloads, and the potential
    for micromanagement by member states.

    ^41See G.A. Res.  59/272, U.N.  GAOR, 59^th Sess.,  U.N. Doc  A/RES/59/272
    (2005).

        Most Governing Bodies Lack Direct Information from the Internal Audit
        Offices on the Adequacy of the Audit Offices' Resources and Capacity to
        Conduct Oversight

    Most governing bodies of the six UN organizations we examined are not
    provided with information directly from the internal audit offices on the
    adequacy of the audit offices' staffing and financial resources; as a
    result, the governing bodies may be unaware of the audit offices' capacity
    to conduct effective oversight. WHO's governing body does receive this
    information through its Program, Budget and Administration Committee.
    According to international auditing standards, an internal audit office
    should have sufficient resources to effectively achieve its mandate.
    However, the internal audit officials must rely on senior management to
    ensure that they have sufficient resources to conduct their planned
    audits.

    Several UN audit officials stated that they had expressed the need for
    additional resources to senior management officials who can grant or deny
    their funding request, depending on the budgetary situation of the
    organization and senior management's commitment to oversight issues. For
    example, ILO audit officials stated that over the past several years, they
    had requested resources to hire an investigator, but until this year, no
    action had been taken. In March 2007, the governing body approved ILO's
    2008-2009 budget request, which sought additional funds for its internal
    audit office; according to ILO's chief internal auditor, ILO will use the
    additional oversight resources to employ a qualified and experienced
    investigator. While the governing bodies approve the organizations'
    overall budgets, in general they do not see the internal audit office's
    budget, staff size, and results of resource needs assessments. Therefore,
    the governing bodies may be unaware of the internal audit offices'
    requests for additional resources. For example, although UNICEF officials
    told us that the audit office lacks adequate resources to address
    high-risk areas and that
    UNICEF's audit chief submits an annual report directly to its governing
    body, the audit chief did not communicate this deficiency to its governing
    body when it had the opportunity to do so in its June 2006 annual report
    on its internal audit activities. As a result, the governing body may not
    be aware of the audit chief's concerns.

        Most Audit Committees Are Not Aligned with Best Practices

    Although five of the six UN organizations that we examined have
    established audit committees, the accountability structure and composition
    of four of these audit committees are not aligned with IIA's best
    practices.^42 According to IIA, an independent audit committee is
    considered critical to help ensure that the organization has strong and
    effective processes related to independence, internal control, risk
    management, compliance, ethics, and financial disclosure. Figure 7 depicts
    the purpose, membership, and responsibilities of an audit committee,
    according to best practices. Best practices also suggest that the
    governing body approve the functions and responsibilities of the audit
    committee. In addition, members of the audit committee should understand
    accounting principles, financial statements, and internal controls.
    According to IIA, an audit committee's responsibilities are to review the
    proposed budgets of the internal oversight offices, make recommendations
    to the governing body on the level of resources needed for internal
    oversight, and provide a level of independence from the organization's
    senior management. Moreover, an independent audit committee provides the
    governing body with an independent and objective assessment of audits of
    the organization's financial statements and the internal auditors'
    performance. Of the six UN organizations, only WHO's PBAC has an audit
    committee structure that includes many of IIA's best practices.

    ^42All  six  UN   organizations  that  we   studied  have  adopted   IIA's
    International  Standards  for  the   Professional  Practice  of   Internal
    Auditing.

    Figure 7: Audit Committee Purpose, Membership, and Responsibilities According to
                                     Best Practices

    Source: GAO analysis of IIA guidance.

    Although five of the six UN organizations that we examined have
    established audit committees, the accountability structure and composition
    of four of these audit committees are not aligned with the IIA best
    practices. Specifically, most audit committees, except for WHO's, are
    neither independent of senior management nor accountable to the governing
    body, and most include senior management officials rather than exclusively
    external financial experts. WHO's PBAC functions as an audit committee and
    is generally aligned with IIA's best practices.^43 The PBAC is composed of
    14 of WHO's governing body members and is accountable to WHO's entire
    governing body.^44 In addition, WHO's PBAC independently provides
    information on the effectiveness and capacity of WHO's internal audit
    office directly to the full governing body. In contrast, according to the
    audit committee charters of FAO's, UNDP's, UNICEF's, and WFP's, their
    audit committees are accountable to the heads of their respective
    organizations and not to their respective governing bodies. In addition,
    these committees do not independently report on the effectiveness and
    capacity of the organization's internal audit office directly to their
    respective governing bodies, as IIA suggests. Although all four audit
    committees provide reports summarizing their work to the governing bodies,
    FAO's, UNICEF's, and WFP's audit committees issue their reports to their
    respective organization heads who provide a copy to the governing body. In
    contrast, UNDP's audit committee charter allows the committee to
    independently submit its annual report to its governing body. Without an
    independent and knowledgeable audit committee, senior management's opinion
    could override that of the audit committee. As a result, a governing body
    would not have the benefit of an audit committee's assistance in ensuring
    that an organization has implemented effective oversight practices. Figure
    8 illustrates the differences between the current practice of the four UN
    organizations without independent audit committees and IIA's best practice
    accountability structure for the audit committee, governing body, senior
    management, external auditor, and internal audit office.

    ^43In May 2004, WHO's governing body merged the Administration, Budget and
    Finance Committee, the Audit Committee, and the Programme Development
    Committee into a single committee, composed of its members, called the
    Program, Budget and Administration Committee.

    ^44WHO's governing body is composed of 32 members.

    Figure8:  Differences  between  Current  Practice  for  Most  of  the   UN
    Organizations and IIA's Best  Practice Accountability Structure for  Audit
    Committees

    Source: GAO analysis of UN dataand IIA guidance.

    Most Audit Committees Are Not Accountable to Their Governing Bodies

    The audit committees at four of the five organizations that have audit
    committees are not accountable to their governing bodies, despite IIA's
    recommendation that the audit committee report regularly to the governing
    body. As previously stated, WHO's PBAC (audit committee) is composed of
    members of its governing body, and it is accountable to the governing
    body. According to their charters, UNDP's and WFP's audit committee
    chairpersons may present their annual reports to their respective
    governing bodies. However, UNDP's audit committee was newly reconstituted
    in 2006 and has not issued its first annual report, so UNDP's governing
    body has not had the opportunity to request that the audit committee
    chairperson present it. Although WFP's governing body received the audit
    committee's first annual report in 2005, the contents of the report were
    not discussed at WFP's governing body meetings. WFP's audit committee did
    not release its annual report in 2006, so the chairman has not had the
    opportunity to present it. Although WFP's audit committee charter
    specifies that the
    chairman shall present an audit committee report annually^45 to the
    governing body, the chairman believes there is insufficient interaction
    between the committee and the governing body. In 2006, WFP's external
    auditor recommended that the governing body formally acknowledge the role
    and mandate of the audit committee to reinforce the independence of such a
    committee and to ensure a closer alignment of WFP's arrangements with best
    practices in governance. A member of WFP's governing body stated that the
    governing body has begun discussing what role, if any, the audit committee
    should have in the organization and what type of relationship it should
    have with the governing body. The governing body members have not reached
    consensus on this matter. At FAO and UNICEF, the extent to which the audit
    committee interacts with the governing body is unclear. The relationship
    of FAO's audit committee to its governing body is not mentioned in its
    charter. One FAO governing body representative stated that he was unaware
    of the activities and composition of FAO's audit committee, and that there
    was no formal interaction between the audit committee and the governing
    body. UNICEF's audit committee charter specifies that its audit committee
    is expected to maintain free and open communication with BOA, the internal
    audit office, and UNICEF senior management, and that it may consult the
    head of the governing body only in exceptional circumstances.

    Some Audit Committees Are Composed of Senior Management Officials

    At three of the UN organizations that we examined, the organizations'
    senior management officials are members of the audit committees, and the
    audit committees are not always composed of financial experts. IIA
    recommends that the audit committee be composed of external members who
    have expertise in accounting and financial matters. Figure 9 provides
    information on the current composition and accountability structure of the
    UN audit committees that we studied. UNDP has an audit committee that is
    composed entirely of external members who have oversight or financial
    backgrounds, but it is not accountable to the governing body. WHO's audit
    committee is composed of 14 of its governing body members, 2 from each of
    its 6 geographical regions, plus a chairman and a vice-chairman who are ex
    officio members. UNICEF's, WFP's, and FAO's audit committee charters allow
    for the inclusion of senior management officials on the committee. Whereas
    UNDP's, UNICEF's, and WFP's audit committee charters specify that the
    chairperson shall be a member external to the organization, FAO's
    audit committee charter specifies that the audit chairperson shall be  the
    Deputy Director General.

    ^45WFP's audit committee charter does not specify whether the report  that
    the governing body receives  is the same report  submitted to the head  of
    the organization.

        Figure 9: Audit Committees at the Six UN Organizations That We Examined

                       UNDP            UNICEF            WFP            ILO               WHO                 FAO
    Audit        Composed of 5    Composed of 3    Composed of 3    Currently,   Created by member      Composed of 2
    committee    external         external and 3   external and 2   there is no  statesand composed of  external and 5
    composition  membersappointed internal         internal         audit        14 membersselected     internal
    and by whom  by the head of   membersappointed membersappointed committee.   from among the         membersappointed
    itsmembers   the              by the head of   by the head of   In March     governing body.a       by the head of
    are          organization.    the              the              2007, ILO                           the
    appointed                     organization.    organization.    submitted a                         organization.
                                                                    proposal to
                                                                    its
                                                                    governing
                                                                    body to
                                                                    consider
                                                                    establishing
                                                                    an
                                                                    independent
                                                                    oversight
                                                                    committee.
                 External member  External member  External member  Not          Chairman and           Deputy Director
    Committee    of               of               of               applicable.
    chairperson  committee        committee        committee,                    Vice-Chairman ex       General.
                 designated by    elected by       appointed by the              officio selected from
                 the head of the  committee        head of the                   among the
                 organization.    members.
                                                   organization.                 governing body
                                                                                 members.
    To whom the  Head of the      Head of the      Head of the      Not          Governing body.        Head of the
    audit                                                           applicable.
    committee is organization.    organization.    organization.                                        organization.
    accountable
    Reports      Committee        Committee        Committee        Not                                 Committee
    issued to    issuesannual     issuesannual     issuesannual     applicable.  Committee              issuesannual
    itsgoverning report to the    report to the    report to the                 issues/presentsreports report to the
    body         governing body.  head of the      head of the                   twice per              head of the
                 Upon request,    organization,    organization.                 year to the governing  organization,
                 chairman shall   who providesa    Committee also                body.                  who providesa
                                  copy to                                                               copy to
                 present the      the governing    preparesa report                                     the governing
                 report to        body.                                                                 body's
                 the governing                     that is                                              Finance
                 body.                             transmitted                                          Committee.
                                                   through the head
                                                   of
                                                   the organization
                                                   to
                                                   the governing
                                                   body.
    Source: GAO analysis of UN data.

    ^aIn 2004, WHO's Administration, Budget and Finance Committee, the Audit
    Committee, and the Programme Development Committee merged into a single
    committee.

    Some Organizations Are Considering the Establishment of Audit Committees
    That Are Aligned with Best Practices

    An independent audit committee could assist the governing body in
    monitoring the organization's oversight functions. In the absence of such
    an audit committee, many member state representatives said that they find
    such monitoring to be difficult because they lack sufficient resources and
    expertise. The majority of the member state representatives are
    responsible for programmatic and policy issues within several UN
    organizations, and many said that they consider oversight issues secondary
    to programmatic issues. In addition, some representatives told us that the
    highly technical aspects of auditing make it difficult for them to
    question or challenge audit practices. As a result, some member states are
    not actively engaged in monitoring UN oversight organizations due to
    impediments in the existing governance structure and the lack of resources
    and expertise. However, an independent audit committee could provide the
    governing body with an independent assessment of the organizations'
    financial statements and the internal auditors' performance.

    Some organizations have begun discussing whether to establish audit
    committees that are aligned with IIA best practices. According to WHO, its
    PBAC, which acts as its audit committee, fulfills most of the requirements
    of an audit committee. Its audit committee was created by the member
    states, and it is independent from senior management and is accountable to
    the governing body. In addition, among other things, PBAC reviews the work
    plan of the internal audit office and the external auditor; reviews the
    internal audit staffing and ensures that the function has adequate
    resources; reviews periodic reports of internal audit, including annual
    reports summarizing audit findings and progress on implementation of
    internal and external audit recommendations. However, WHO's chief internal
    auditor does not have a direct organizational reporting line to the PBAC,
    but rather reports directly to WHO's Director-General. IIA's guidance
    provides that the internal auditor should have the organizational
    independence to allow the audit activity to conduct work without
    interference by the entity under audit. By reporting organizationally to
    WHO's Director-General, rather than to the PBAC, the chief internal
    auditor does not have a level of organizational independence that is
    consistent with IIA's guidance. The member states of ILO's governing body
    and its external auditor recommended that ILO establish an audit
    committee. In response, ILO is currently making progress toward
    establishing an independent oversight advisory committee that could be in
    line with best practices and accountable to the governing body and
    entirely composed of external members, if implemented as proposed. For
    example, in March 2007, ILO submitted a proposal to its governing body to
    consider establishing an independent oversight committee, but the
    governing body has not yet reached consensus on this matter. In addition,
    FAO's senior management is taking steps to reconstitute its audit
    committee by 2008 so that the committee is composed entirely of external
    members; however, the audit committee will still be accountable to the
    head of the organization, rather than to the governing body, according to
    a senior FAO official. Moreover, WFP's senior management indicated that it
    would be open to adopting an external audit committee that conforms to
    IIA's best practices, and WFP's current audit committee chairman concurred
    with this view.

      Conclusions

    The governing bodies of the UN funds and programs and specialized agencies
    are responsible for providing effective oversight and accountability for
    the billions of dollars provided annually by member states, including the
    United States, to support a wide range of activities globally. Since UN
    organizations are funded with government resources, it is essential that
    member states have measures in place that provide timely, independent, and
    comprehensive information on the operational effectiveness and efficiency
    of their programs. Independent and adequately resourced oversight
    mechanisms that employ international accountability standards and best
    practices are an integral part of organizations and can provide the
    governing bodies with reasonable assurance that the UN organizations'
    funds are being used as intended. For various reasons, existing internal
    oversight mechanisms within the six UN organizations that we reviewed had
    not fully implemented some key components of internationally accepted
    standards and best practices. This condition hinders them from carrying
    out some of their oversight responsibilities as defined by the governing
    bodies of their respective organizations. In addition, because key
    internal oversight structures, such as audit committees, do not report
    directly to the governing bodies, the organizations' good governance
    practices are hampered. Without the insights provided by access to
    internal audit reports, an independent audit committee, and an internal
    audit activity with a high level of independence, the governing bodies
    could face challenges in fully executing their responsibilities of
    monitoring the effective and efficient use of resources, senior
    management's actions, and the organization's operations.

      Recommendations for

    To improve oversight in UN organizations, we are making
    recommendations to the Secretary of State to direct the U.S. Missions to
    work with member states by taking the following two actions:

         o Make internal audit reports available to the governing bodies to
           provide further insight into the operations of the United Nations'
           organizations and identify critical systemic weaknesses.
         o Establish independent audit committees that are accountable to their
           governing bodies, where this currently does not occur. Audit committee
           oversight responsibilities could include the following:

    o ensuring communication and reporting lines between the head of internal
    audit and the audit committee,
         o reviewing internal audit staffing and ensuring that the function has
           the necessary resources,
         o reviewing and assessing the annual internal audit plan,
         o reviewing management's responsiveness to internal audit findings, and
         o monitoring and assessing internal audit effectiveness.

      Agency Comments and Our Evaluation

    We requested and received comments on a draft of this report from the
    Secretary of State and cognizant officials representing the six
    UN-affiliated agencies that we reviewed--FAO, ILO, UNDP, UNICEF, WFP, and
    WHO. These comments are reprinted in appendixes II through VIII, along
    with our responses to specific points. State, FAO, UNDP, WFP, and WHO
    generally agreed with the findings, conclusions, and recommendations. ILO
    commented that it has serious reservations about implementing our
    recommendation to make internal audit reports available to governing
    bodies. UNICEF expressed concerns about our recommendation to establish
    independent audit committees that are accountable to their governing
    bodies. State and the six UN-affiliated agencies submitted technical
    comments that we have incorporated into this report, as appropriate.

    State endorsed the main findings and conclusions of our report.
    Specifically, State fully agreed that members of the governing bodies
    should have access to reports and that the establishment of independent
    audit committees that meet international best practices would strengthen
    governance. State also noted that our report accurately recognizes that
    this goal will require the United States to work with other member states
    to build support. According to State, the United States has established
    partnerships with several other like-minded member states, and will
    continue to work with them to build a constituency for strengthening
    oversight and accountability in the UN system.

    FAO stated that our report observations are clear, comprehensive, and
    well-reasoned. The organization also said that the report's thrust toward
    instituting further best practices is considered timely and consistent
    with the approach that FAO has been observing in recent years. In
    addition, regarding the recommendation on the sharing of internal audit
    reports, FAO said that this matter is currently under consideration by
    both the FAO governing bodies and by the Chief Executives' Board for
    Coordination of the UN system. Furthermore, regarding our recommendation
    on establishing an independent audit committee that is accountable to
    these entities' governing bodies, FAO stated that from 2008 onwards, the
    FAO audit committee will be composed solely of external members who will
    act in an advisory capacity to the FAO Director-General.

    UNDP stated that it has taken note of the recommendations put forth in the
    report. Also, UNDP stated that it is reviewing these recommendations, and
    that these will be part of the interaction with the Executive Board during
    June 2007.

    WFP stated that the report is a useful contribution to the ongoing debate
    on enhancing oversight and accountability in the UN system. Specifically,
    WFP noted that the substance of our recommendations is currently being
    debated in many forums throughout the UN system. In addition, WFP noted
    that its Executive Board and its bureau have been engaged in considering
    issues related to the composition and reporting lines of the audit
    committee.

    WHO commented that it is engaged with other organizations in the UN system
    in addressing the issue of access to internal audit reports. The
    organization noted that while it supports the concept of transparency,
    there is a need to balance the sharing of information against the need to
    protect privileged information and the rights of staff members. In
    addition, WHO noted that its PBAC already fulfills most of the
    requirements that we advocate, such as independence from senior management
    and accountability to the governing body. Upon receipt of WHO's technical
    comments, our report was updated to reflect that WHO has a PBAC that
    operates similarly to an audit committee. Furthermore, WHO stated that
    IIA's best practice accountability structure illustrated in our report
    would effectively create a second external auditor, which would not be a
    workable solution. We disagree that the IIA guidance would create an
    external auditor and leave the Director-General without an internal audit
    function. Specifically, IIA guidance on the key elements of an effective
    public sector audit activity, which would apply to the internal audit
    activity at WHO, provides that at a minimum, the audit activity needs to
    have organizational independence that allows audit work that is without
    interference by the entity under audit and is seen to be independent as
    well. The IIA guidance states that this organizational independence
    contributes to the accuracy of the auditors' work and the ability to rely
    on the audit results. By having the WHO internal audit activity report
    organizationally to the PBAC, which serves as the audit committee for
    WHO's governing body, the independence of internal audits of the
    Director-General's programs and responsibilities would be enhanced
    significantly. In addition, the Director-General would continue to have an
    internal audit function, but it would be reporting organizationally to the
    PBAC of the governing body.

    ILO noted that our report did not sufficiently reflect actions taken by
    ILO to address issues highlighted regarding inadequacy of audit staffing
    levels; lack of an organizationwide risk-management framework; and lack of
    access to internal audit reports and other information by the governing
    body, audit staff financial disclosure, and an audit committee. Our report
    was updated after receipt of ILO's technical comments to reflect
    information provided by the organization regarding several of these
    issues, including adequacy of resources, financial disclosure, and the
    proposal submitted by the Director-General to ILO's governing body calling
    for the creation of an independent audit committee. In addition, ILO
    stated that the report does not reflect the process that ILO has in place
    concerning the provision of access to information. We updated our report
    to reflect information provided in ILO's technical comments about this
    process. Furthermore, ILO commented that it has serious reservations about
    implementing the recommendation regarding making internal audit reports
    available to governing bodies. We maintain that providing the governing
    body with access to all internal audit reports will provide the governing
    body greater insight into the organization's operations and highlight
    systemic weaknesses in internal controls.

    UNICEF noted that many of the issues raised in our report are for
    consideration by the UNICEF Executive Board, and UNICEF recognizes the
    importance of ensuring that any discussion of such issues takes place
    within the jurisdiction of the UNICEF Executive Board. Regarding the
    recommendation of making internal audit reports available to the governing
    body and audit committee, UNICEF stated that its Executive Board has
    requested that UNICEF further enhance the level of analysis in the
    publicly available annual report of UNICEF's Office of Internal Audit;
    include management responses to the key and recurring issues identified by
    the Office of Internal Audit; and assess and report on the resources
    required for the internal audit function. In addition, UNICEF noted that
    any proposal to reorder the governance mechanisms so as to align them with
    a particular understanding of the IIA standards would be a matter for the
    UNICEF Executive Board (among other institutions). We recognize that
    decisions regarding changes in UNICEF's lines of reporting to allow
    UNICEF's governing body access to all audit reports, as well as the
    creation of an independent audit committee to be in line with
    international best practices, will require the consideration and approval
    of UNICEF's Executive Board. We also maintain that the United States, as a
    member of UNICEF's governing body, should work with other member states to
    consider and implement these recommendations.

    We are sending copies of this report to interested congressional
    committees, the Secretary of State, and the U.S. Permanent Representative
    to the United Nations. We will also make copies available to others upon
    request. In addition, the report will be available at no charge on the GAO
    Web site at http://www.gao.gov.

    If you or your staffs have any questions about this report, please contact
    me at (202) 512-9601 or melitot@gao.gov. Contact points for our
    Offices of Congressional Relations and Public Affairs can be found on the
    last page of this report. GAO staff who made major contributions to this
    report are listed in appendix IX.

    Thomas Melito
    Director, International Affairs and Trade

     Appendix I

    Scope and Methodology

    Our objectives were to examine the extent to which (1) internal audit
    offices have implemented professional standards for performing audits and
    investigation, (2) evaluation offices have implemented United Nations (UN)
    evaluation standards and norms, and (3) governing bodies are provided with
    information about the results of UN oversight practices. For our review,
    we selected 6 UN organizations from among the 10 funds and programs and 15
    specialized agencies that comprise the universe of all UN funds and
    programs and specialized agencies. On the basis of their budgets for
    biennium 2004-2005, we selected the 3 largest funds and programs and 3 of
    the largest specialized agencies.^1 Therefore, our results cannot be
    generalized to the full universe of all funds and programs and specialized
    agencies and may not represent the practices of the smaller UN
    organizations. The funds and programs we selected include the United
    Nations Development Program (UNDP), the United Nations Children's Fund
    (UNICEF), and the World Food Program (WFP). The specialized agencies we
    selected include the Food and Agriculture Organization (FAO), the
    International Labor Organization (ILO), and the World Health Organization
    (WHO).

    To examine the extent to which the six organizations' internal audit
    offices have implemented professional standards for performing audits, we
    reviewed relevant standards issued by the Institute for Internal Auditors
    (IIA), which is recognized as the internal audit profession's leader in
    certification, education, research, and technological guidance. IIA
    provides comprehensive guidance for the profession through its
    Professional Practice Framework, including the International Standards for
    the Professional Practice of Internal Auditing, which outlines the tenets
    of the internal audit profession and The Role of Auditing in Public Sector
    Governance, which provides guidance to all levels of government. The six
    UN organizations that we examined have adopted the IIA standards. To
    conduct our review, we selected key audit standards that were based on
    previous GAO work.^2 Specifically, we (1) selected standards relating to
    risk-management framework, risk-based audit work plans, resource
    management, quality assurance, recommendation monitoring, and ethics
    practices and (2) assessed the extent to which these six organizations'
    practices were consistent with these standards. We examined documents from
    the six organizations, including reports prepared by the organizations'
    external auditors, external peer reviewers, and audit committees, as well
    as reports prepared by the chief audit executives for senior management
    and governing bodies. In addition, we conducted interviews with various
    officials, including officials of the internal audit offices, finance
    division, audit committees, legal offices, and external auditors. We did
    not perform independent assessments of the organizations' audit functions.
    Our reviews were limited to reviews of documents and interviews with the
    various officials. For example, to assess whether the internal audit
    offices had sufficient resources to conduct their risk-based work plan, we
    based our findings on interviews with the organizations' audit officials
    and their external auditors' assessment of the adequacy of the
    organizations' audit coverage.

    ^1Total 2004-2005 biennium budgets (in billions of US dollars) for the
    following UN organizations include regular and extrabudgetary resources:
    UNDP, $7.13; WFP, $5.99; UNICEF, $4.87; WHO, $3.98; FAO, $1.34; and ILO,
    $0.90.

    ^2GAO, United Nations: Funding Arrangements Impede Independence of
    Internal Auditors, [91]GAO-06-575 (Washington, D.C.: Apr. 25, 2006).

    Regarding investigations, the six UN organizations we examined have
    adopted the UN Uniform Guidelines for Investigations, which are intended
    to be used as guidance in the conduct of investigations in conjunction
    with each organization's rules and regulations. In particular, we focused
    on the guideline that states that the planning and conduct of the
    investigation should reasonably ensure that resources devoted to
    investigations are proportionate to the allegation because having
    resources for investigations is fundamental to probe allegations of
    wrongdoing. To assess the extent to which investigative resources were
    sufficient, we examined documents from the six organizations, including
    reports prepared by the organizations' external auditors, annual reports
    of the oversight unit chiefs to the head of the organization, and the
    audit committees' reports, where applicable. In addition, we conducted
    interviews with various officials, including external auditors, internal
    auditors, and investigators, where applicable. We did not perform
    independent assessments of the organizations' investigative functions. To
    assess the organizations' efforts to adopt financial disclosure and
    whistleblower policies, we examined their policies and procedures and
    spoke with relevant officials, including officials from the organizations'
    human resources, legal, and oversight units. All UN employees are subject
    to standards for ethical conduct established by the International Civil
    Service Board. In addition, each oversight function--audit,
    investigations, and evaluations--is guided by its respective professional
    standards. IIA has developed standards to guide the ethical conduct of
    auditors. The UN Uniform Guidelines for Investigations applies
    specifically to investigators. The UN Evaluation Group is currently
    drafting its own set of ethical guidelines for UN evaluation staff. The
    International Civil Service Board, IIA, and the UN Uniform Guidelines for
    Investigations all address the need
    for staff to avoid conflicts of interest and disclose any such
    impairments. The UN Uniform Guidelines for Investigations recommends the
    practice of protecting the identities of those who make complaints to the
    investigative office.

    To examine the extent to which the six organizations' evaluation offices
    have implemented UN evaluation norms and standards, we reviewed the
    relevant standards and norms issued by the UN Evaluation Group (UNEG).
    UNEG adopted these norms and standards in 2005 in an attempt to
    professionalize the evaluation function and provide guidance to evaluation
    offices in preparing their evaluation policies or other aspects of their
    operations. Norms are the guiding principles for evaluating the results
    achieved by the UN system, the performance of the organizations, the
    governance of the evaluation function within each organization of the UN
    system, and the value-added use of the evaluation function. A set of
    standards complementing these norms has been drawn from the best practices
    of UNEG members, Organization of Economic Cooperation and Development
    (OECD)/Development Assistance Committee evaluation principles, national
    standards of OECD countries, evaluation policies of the international
    financial institutions, evaluation policies of the European Union,
    standards of evaluation associations, and evaluation guidance developed by
    the Active Learning Network for Accountability and Performance in
    Humanitarian Action. These standards are intended to guide the
    establishment of the institutional framework, management of the evaluation
    function, and conduct and use of evaluations. UNEG conducted a baseline
    assessment of its evaluation office members in 2005; however, we could not
    obtain access to this information. Only UNDP's and UNICEF's evaluation
    offices have had external assessments performed on the basis of these
    standards and norms.^3 To conduct our review, we selected standards and
    norms relating to ensuring the adequacy of financial and human resources,
    competency of staff, quality assurances processes, and recommendations
    follow-up. To the extent possible, we based our review on those standards
    and norms that matched key audit standards. Although we did not assess the
    quality of evaluations conducted, we did examine whether processes to help
    ensure quality were in place. Time and resource constraints limited our
    ability to evaluate organizations' implementation of the other UNEG
    standards and norms. We examined documents from the
    six organizations, including reports prepared by the organizations'
    evaluation offices and external peer reviewers, and annual reports of the
    evaluation offices. In addition, we conducted interviews with various
    officials of the evaluation offices. We did not perform independent
    assessments of the organizations' evaluation function.

    ^3For the UNDP peer review, the reviewers assessed the evaluation
    functions on the basis of the norms, and for UNICEF, the peer reviewers
    used primarily the norms. UNDP's peer review was completed in December
    2005, and UNICEF's was completed in May 2006.

    To assess the organizations' efforts to implement professional standards,
    guidelines, and norms for audit, ethics, and evaluations, and to assess
    the sufficiency of the organizations' investigative resources, we
    developed the following scale:

        1. Generally implemented: Evidence of a series of actions that indicate
           the standards, norms, or guidelines are generally or mostly
           implemented.
        2. Partially implemented: Evidence of some actions taken toward
           implementation.
        3. Not implemented: Evidence that no steps have been taken to implement
           the standards, norms, or guidelines.
        4. Not clear: Insufficient or conflicting information regarding status in
           implementing the standards, norms, or guidelines.

    Three GAO staff used this scale to assess the organizations' performance
    and sufficiency of their resources independently of each other. These
    staff then met to reconcile any differences in their initial assessments.

    To examine the extent to which governing bodies are provided information
    about the results of UN oversight practices, we reviewed documents from
    the six organizations, including reports prepared by the organizations'
    external auditors, the oversight unit chiefs, the governing bodies, and
    the audit committees, where applicable. We also examined the charters of
    the audit offices and the audit committees, where applicable. In addition,
    we reviewed relevant guidance regarding audit committees issued by IIA.
    Furthermore, we conducted interviews with various officials, including
    internal audit officials, external auditors, and members of the audit
    committees, where applicable. We also interviewed selected representatives
    from UN member states, including representatives from the U.S. UN missions
    in Geneva, Rome, and New York and U.S. representatives to the governing
    bodies of the UN organizations we
    examined. In Geneva, we spoke with members of the Geneva Group,^4
    including representatives from the United Kingdom, Canada, the
    Netherlands, Australia, and Germany. In Rome, we spoke with additional
    members of the Geneva Group, including representatives from the United
    Kingdom, Spain, Canada, Sweden, South Korea, Germany, Switzerland,
    Finland, Italy, France, Russia, New Zealand, Japan, and the Netherlands.
    In addition, we met with representatives of the Group of 77^5 from
    Zimbabwe, Madagascar, Iraq, Dominican Republic, Bangladesh, Brazil,
    Cameroon, China, Egypt, Kuwait, Nicaragua, Peru, the Philippines, Sri
    Lanka, and Thailand. In New York, we spoke with mission representatives to
    the UN from Belgium, Australia, the United Kingdom, Canada, Japan, and
    Pakistan.

    Furthermore, to address our objectives, we spoke with senior officials
    from the Departments of State (State) and Labor in Washington, D.C., and
    senior officials from State, Labor, Health and Human Services, and the
    U.S. Agency for International Development at the U.S. Missions to the
    United Nations in Geneva, Rome, and New York. At these locations, we met
    with management and staff responsible for governance and oversight at FAO,
    ILO, UNDP, UNICEF, WFP, and WHO. In addition, for information on the
    budget and staff resources of these six organizations, we used fiscal
    biennium 2006-2007 data provided by these organizations. We determined
    that these data were sufficiently reliable for the purposes of this
    report.

    We conducted our work from June 2006 through March 2007 in accordance with
    generally accepted government auditing standards.

    ^4The Geneva Group consists of the 14 largest donor countries on the basis
    of their contributions.

    ^5The Group of 77 is a coalition of developing countries that promotes its
    members' collective  interests. Currently,  131 developing  countries  are
    members of the G-77.

                                      Appendix II

                         Comments from the Department of State

                                       Appendix III

                   Comments from the Food and Agriculture Organization

                                      Appendix IV

                          Comments from the World Food Program

    Note: GAO comment supplementing those in the report text appear at the end
    of this appendix.

    See comment 1.

    The following is GAO's  comment on the World  Food Program's letter  dated
    May 7, 2007.

    1. WFP noted that a request was made for an appropriate change in staff

      GAO Comment

    rules and regulations to oblige key staff to undertake periodic conflict
    of interest and final disclosure. While we agree that this is a critical
    step toward fully implementing a sound ethics policy, we noted in this
    report that all staff conducting audits, investigations, and evaluations
    should be included as those defined as "key staff."

                               Appendix V

              Comments from the World Health Organization

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    Appendix V Comments from the World Health Organization

                                     See comment 1.

                                     See comment 2.

                                     See comment 3.

    The following are GAO's comments on the World Health Organization's letter
    dated May 8, 2007.

    1. WHO commented that our report lacks recognition of its key efforts to

      GAO Comments

    increase transparency during the past several years. We updated the text
    of our report to include additional information on what is and can be
    provided by the internal auditor to the Health Assembly and member states.

        1. WHO commented that its Program, Budget and Administration Committee
           (PBAC) operates similarly to an independent audit committee and
           already fulfills most of the requirements that we advocate, such as
           independence from senior management and accountability to the
           governing body. We updated the text of this report to include this
           information.
        2. WHO stated that the IIA's best practice accountability structure
           illustrated in our report would effectively create a second external
           auditor, which would not be a workable solution. We disagree that the
           IIA guidance would create an external auditor and leave the
           Director-General without an internal audit function. The guidance
           focuses on the reporting relationship needed to achieve organizational
           independence for the internal audit function. Specifically, IIA
           guidance on the key elements of an effective public sector audit
           activity, which would apply to the internal audit activity at WHO,
           provides that at a minimum, the audit activity needs to have
           organizational independence that allows audit work that is without
           interference by the entity under audit and is seen to be independent
           as well. The IIA guidance states that this organizational independence
           contributes to the accuracy of the auditors' work and the ability to
           rely on the audit results. By having the WHO internal audit activity
           report organizationally to the PBAC, which serves as the audit
           committee for WHO's governing body, the independence of internal
           audits of the Director-General's programs and responsibilities would
           be enhanced significantly. In addition, the Director-General would
           continue to have an internal audit function, but it would be reporting
           organizationally to the PBAC of the governing body.

                                     Appendix VI

                  Comments from the International Labor Organization

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    See comment 1.

    See comment 2.

                                     See comment 3.

                                     See comment 4.

                                     See comment 5.

                                     See comment 6.

    The following are GAO's comments on the International Labor Organization's
    letter dated May 11, 2007.

    GAO Comments 1. ILO commented that our report did not sufficiently reflect
                       actions
                       taken by ILO to address issues highlighted regarding
                       inadequacy of
                       audit staffing levels, lack of an organizationwide
                       risk-management
                       framework, lack of access to internal audit reports and
                       other
                       information by the governing body, audit staff financial
                       disclosure, and
                       an audit committee. Our report was updated after receipt
                       of ILO's
                       technical comments to reflect information provided by the
                       organization
                       regarding several of these issues, including adequacy of
                       resources,
                       financial disclosure, and its proposal submitted by the
                       Director-General
                       to ILO's governing body in March 2007 calling for the
                       creation of an
                       independent audit committee.
                       ILO commented that the report refers to an overall lack of
                    2. a
                       requirement for financial disclosure. According to ILO, in
                       February
                       2006, it introduced a declaration that required that all
                       procurement
                       officials submit an annual declaration. In addition, in
                       April 2007, ILO
                       introduced a register of financial interests for all
                       senior staff (graded at
                       D1 level and above) and other designated officials
                       (procurement)
                       requiring them to make an annual financial disclosure
                       identifying
                       potential conflicts of interest and any supplements or
                       gifts received. We
                       updated our report to reflect these actions, but maintain
                       that requiring
                       financial disclosures from all staff conducting audits,
                       investigations,
                       and evaluations is a sound practice that could help to
                       ensure that
                       employees are free from conflict of interest.
                       ILO disagreed with our use of the findings from the
                    3. quality assessment
                       exercise that was published in its Annual Evaluation
                       Report submitted
                       to ILO's Governing Body in November 2006. Consistent with
                       our
                       generally accepted government auditing standards, we cite
                       the findings
                       of external assessments, if publicly available and where
                       applicable, that
                       specifically relate to our reporting objectives. We do not
                       independently
                       endorse the findings of these assessments, but are
                       transparent about
                       the use of them in the scope and methodology sections of
                       our report.
                       ILO stated that it has serious reservations about
                    4. implementing the
                       recommendation regarding making internal audit reports
                       available to
                       governing bodies. We maintain that providing the governing
                       body with
                       access to all internal audit reports will provide the
                       governing body with greater insight into the organization's
    						 operations and highlight systemic weakness in internal controls.

        1. ILO stated that the report should note that the proposed Terms of
           Reference for an Independent Oversight Advisory Committe submitted by
           the Director-General to ILO's governing body in March 2007, is in line
           with the recommendation for establishing an independent audit
           committee. We updated our report after receipt of ILO's technical
           comments to reflect this action.
        2. ILO commented that the report makes no reference to the tripartite
           governance structure of ILO. We updated our report to include a
           sentence explaining ILO's tripartite structure.

                                      Appendix VII

                  Comments from the United Nations Development Program

                                      Appendix VIII

                    Comments from the United Nations Children's Fund

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    See comment 1.

    See comment 2.

    See comment 3.

    See comment 4.

    See comment 5.

    The following are  GAO's comments  on the United  Nations Children's  Fund
    letter dated May 18, 2007.

    1. UNICEF commented that our draft report did not reflect a full

      GAO Comments

    appreciation of the specific governance structures of the United Nations.
    We provide information in the introduction, background, and body of our
    report to help our readers understand the context of our three reporting
    objectives. Our review was not of the overall UN governance structures,
    but rather of the governance structures of the six UN affiliated
    organizations noted in our report. Figure 1 in our report shows the
    overall UN governance structure of the six UNaffiliated organizations
    reviewed.

        1. UNICEF noted that any proposal to reorder the governance mechanisms so
           as to align them with a particular understanding of the IIA standards
           would be a matter for the UNICEF Executive Board (among other
           institutions). We recognize that decisions regarding changes in
           UNICEF's lines of reporting to allow UNICEF's governing body access to
           all audit reports, as well as the creation of an independent audit
           committee to be in line with international best practices, will
           require consideration and approval by UNICEF's Executive Board. In
           addition, State and several of the other UN organizations reviewed
           noted that discussions relating to our recommendations are currently
           being considered in many forums throughout the UN system.
        2. UNICEF stated that the draft offered a view of "best practice" that is
           inconsistent with certain legislated oversight arrangements. Current
           best practice calls for the external auditor to report to an audit
           committee, which is part of the governing body, which in this case is
           the General Assembly. Therefore, the current reporting by UNICEF's
           external auditor is consistent with IIA's guidance, and we do not
           suggest that it be changed.
        3. UNICEF commented that in 2002, the President of IIA opined that "as
           long as your reporting relationship permits you to accomplish your
           responsibilities, as stated in [IIA] standard 1110, you are reporting
           to the correct level." UNICEF stated that administrative reporting to
           the executive head of an organization is in accordance with IIA
           standards. We do not imply that reporting to the executive head is not
           in accordance with IIA standards. IIA guidance does provide that, at a
    minimum, the organizational independence of the internal audit activity
    needs to allow audit work that is without interference by the entity under
    audit and is seen as independent as well. IIA guidance describes the audit
    committee's responsibility for overseeing internal audit as well as the
    reporting relationship between internal audit and senior management. By
    having the UNICEF internal audit activity report organizationally to an
    independent audit committee of the governing body, the independence and
    appearance of independence would be significantly improved.

    5. UNICEF noted that its internal audit service provides a detailed
    summary of audit activities, findings, and analysis of systemic weaknesses
    to the governing body. In addition, UNICEF stated that its Executive Board
    has requested that UNICEF further enhance the level of analysis in the
    annual report of UNICEF's Office of Internal Audit, include management
    responses to the key and recurring issues identified by the Office of
    Internal Audit, and assess and report on the resources required for the
    internal audit function. We updated our report to reflect these actions.

                                     Appendix IX

                         GAO Contact and Staff Acknowledgments

    GAO Contact

    Thomas Melito, (202) 512-9601 or melitot@gao.gov

    Staff Acknowledgments

    In addition to the person named above, Phyllis Anderson, Assistant
    Director; Zina Merritt, Assistant Director; Debbie Chung; Jane Kim; Andrea
    Miller; and Barbara Shields made key contributions to this report. In
    addition, Jeffrey Baldwin-Bott, Valerie Caracelli, Martin De Alteriis,
    Mark Dowling, Etana Finkler, Jackson Hufnagle, Charlotte Moore, and Jena
    Sinkfield provided technical support.

    Related GAO Products

    United Nations: Management Reforms Progressing Slowly with Many Awaiting
    General Assembly Review. [93]GAO-07-14 . Washington, D.C.: October 5,
    2006.

    United Nations: Weaknesses in Internal Oversight and Procurement Could
    Affect the Effective Implementation of the Planned Renovation.

    [94]GAO-06-877T. Washington, D.C.: June 20, 2006.

    United Nations: Oil for Food Program Provides Lessons for Future Sanctions
    and Ongoing Reform. [95]GAO-06-711T. Washington, D.C.: May 2, 2006.

    United Nations: Internal Oversight and Procurement Controls and Processes
    Need Strengthening. [96]GAO-06-710T. Washington, D.C.: April 27, 2006.

    United Nations: Funding Arrangements Impede Independence of Internal
    Auditors. [97]GAO-06-575 . Washington, D.C.: April 25, 2006.

    United Nations: Lessons from Oil for Food Program Indicate Need to
    Strengthen Internal Controls and Oversight. [98]GAO-06-330 . Washington,
    D.C.: April 25, 2006.

    United Nations: Procurement Internal Controls Are Weak. [99]GAO-06-577 .
    Washington, D.C.: April 25, 2006.

    Peacekeeping: Cost Comparison of Actual UN and Hypothetical U.S.
    Operations in Haiti. [100]GAO-06-331 . Washington, D.C.: February 21,
    2006.

    United Nations: Preliminary Observations on Internal Oversight and
    Procurement Practices. [101]GAO-06-226T. Washington, D.C.: October 31,
    2005.

    United Nations: Sustained Oversight Is Needed for Reforms to Achieve
    Lasting Results. [102]GAO-05-392T. Washington, D.C.: March 2, 2005.

    United Nations: Oil for Food Program Audits. [103]GAO-05-346T. Washington,
    D.C.: February 15, 2005.

    United Nations: Observations on the Oil for Food Program and Areas for
    Further Investigation. [104]GAO-04-953T. Washington, D.C.: July 8, 2004.

    Related GAO Products

    United Nations: Observations on the Oil for Food Program and Iraq's Food
    Security. [105]GAO-04-880T. Washington, D.C.: June 16, 2004.

    United Nations: Observations on the Management and Oversight of the Oil
    for Food Program. [106]GAO-04-730T. Washington, D.C.: April 28, 2004.

    United Nations: Observations on the Oil for Food Program.
    [107]GAO-04-651T. Washington, D.C.: April 7, 2004.

    Recovering Iraq's Assets: Preliminary Observations on U.S. Efforts and
    Challenges. [108]GAO-04-579T. Washington, D.C.: March 18, 2004.

    United Nations: Reforms Progressing, but Comprehensive Assessments Needed
    to Measure Impact. [109]GAO-04-339 . Washington, D.C.: February 13, 2004.

    Weapons of Mass Destruction: U.N. Confronts Significant Challenges in
    Implementing Sanctions against Iraq. [110]GAO-02-625 . Washington, D.C.:
    May 23, 2002.

    United Nations: Reform Initiatives Have Strengthened Operations, but
    Overall Objectives Have Not Yet Been Achieved. [111]GAO/NSIAD-00-150 .
    Washington, D.C.: May 10, 2000.

    United Nations: Progress of Procurement Reforms. [112]GAO/NSIAD-99-71 .
    Washington, D.C.: April 15, 1999.

    United Nations: Status of Internal Oversight Services. [113]GAO/NSIAD-98-9
    . Washington, D.C.: November 19, 1997.

    References

    Visible links
      86. http://www.gao.gov/cgi-bin/getrpt?GAO-06-575
      87. http://www.gao.gov/cgi-bin/getrpt?GAO-07-14
      88. http://www.gao.gov/cgi-bin/getrpt?GAO-06-575.
      91. http://www.gao.gov/cgi-bin/getrpt?GAO-06-575
      93. http://www.gao.gov/cgi-bin/getrpt?GAO-07-14
      94. http://www.gao.gov/cgi-bin/getrpt?GAO-06-877T
      95. http://www.gao.gov/cgi-bin/getrpt?GAO-06-711T
      96. http://www.gao.gov/cgi-bin/getrpt?GAO-06-710T
      97. http://www.gao.gov/cgi-bin/getrpt?GAO-06-575
      98. http://www.gao.gov/cgi-bin/getrpt?GAO-06-330
      99. http://www.gao.gov/cgi-bin/getrpt?GAO-06-577
     100. http://www.gao.gov/cgi-bin/getrpt?GAO-06-331
     101. http://www.gao.gov/cgi-bin/getrpt?GAO-06-226T
     102. http://www.gao.gov/cgi-bin/getrpt?GAO-05-392T
     103. http://www.gao.gov/cgi-bin/getrpt?GAO-05-346T
     104. http://www.gao.gov/cgi-bin/getrpt?GAO-04-953T
     105. http://www.gao.gov/cgi-bin/getrpt?GAO-04-880T
     106. http://www.gao.gov/cgi-bin/getrpt?GAO-04-730T
     107. http://www.gao.gov/cgi-bin/getrpt?GAO-04-651T
     108. http://www.gao.gov/cgi-bin/getrpt?GAO-04-579T
     109. http://www.gao.gov/cgi-bin/getrpt?GAO-04-339
     110. http://www.gao.gov/cgi-bin/getrpt?GAO-02-625
     111. http://www.gao.gov/cgi-bin/getrpt?GAO/NSIAD-00-150
     112. http://www.gao.gov/cgi-bin/getrpt?GAO/NSIAD-99-71
     113. http://www.gao.gov/cgi-bin/getrpt?GAO/NSIAD-98-9
    *** End of document. ***