oversight

World Food Program: Stronger Controls Needed in High-Risk Areas

Published by the Government Accountability Office on 2012-09-13.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States Government Accountability Office

GAO              Report to the Committee on Foreign
                 Affairs, House of Representatives



September 2012
                 WORLD FOOD
                 PROGRAM
                 Stronger Controls
                 Needed in High-Risk
                 Areas




GAO-12-790
                                            September 2012

                                            WORLD FOOD PROGRAM
                                            Stronger Controls Needed in High-Risk Areas

Highlights of GAO-12-790, a report to the
Committee on Foreign Affairs, House of
Representatives




Why GAO Did This Study                      What GAO Found
In 2011, WFP provided about $4 billion      The design of the United Nations (UN) World Food Program’s (WFP) internal
in food assistance—including U.S.           controls related to delivery and monitoring of food assistance generally reflects
contributions of about $1.2 billion—to      principles for internal controls and enterprise risk management developed by the
about 99 million beneficiaries in 75        Committee of Sponsoring Organizations of the Treadway Commission (COSO).
countries. Many of these countries          WFP has developed an internal control framework that has, like the COSO
include high-risk areas where WFP           internal control framework, five components: internal environment, risk
staff have limited access. In 2009, a       management, control activities, information and communication, and monitoring.
media report alleged that large             However, the design of some of WFP’s controls has weaknesses that could
amounts of WFP’s food assistance
                                            expose WFP to risks such as waste, fraud, and abuse. For example, WFP’s
were being diverted in one of these
                                            Executive Board oversight is limited, and it does not fully utilize the WFP Audit
countries, Somalia. Subsequent
external and internal audits found
                                            Committee to assist in overseeing the effectiveness of WFP’s risk management
deficiencies in WFP’s control of its        and internal control processes. Also, WFP has designed risk management
Somalia operations. In response, WFP        policies but has not developed detailed guidance to instruct staff in addressing
took steps to strengthen its controls,      risks, especially at the country level where WFP is most vulnerable. Additionally,
including adopting the COSO internal        as recommended by COSO, WFP has established control activities that address
control framework. To assess WFP’s          risks to its objectives—for example, policies and procedures designed to help
ability to help assure that food reaches    ensure tracking of food assistance from delivery at the port-of-entry to distribution
intended beneficiaries in high-risk         to beneficiaries. However, weaknesses in the design of its commodity tracking
areas, GAO examined the extent to           system, including lack of capacity to track food in implementing partners’
which (1) the design of WFP internal        custody, limit WFP’s ability to account for all food in these partners’ custody.
controls related to delivery and            Further, WFP has developed detailed policies for monitoring distribution of food
monitoring of food assistance reflects      assistance to beneficiaries, in line with COSO principles, but has not provided
COSO principles and (2) WFP has             guidance that instructs staff to consider risk when determining needed levels of
implemented as designed certain             monitoring, including in high-risk areas where WFP staff have limited access.
controls in selected high-risk areas.
GAO reviewed COSO and other                 In the areas of Ethiopia, Kenya, and Somalia that GAO selected for its review,
international principles; reviewed WFP      WFP has implemented procedures as designed for tracking and monitoring food
policies, documents, and data; and          assistance in its custody from port-of-entry to beneficiaries. However, WFP’s
interviewed WFP and U.S. officials.         ability to account for food in the custody of implementing partners is constrained
GAO conducted case studies of               by the lack of tracking through its commodity tracking system, lack of timely
Ethiopia, Kenya, and Somalia.               reporting by some partners, and a limited number of monitors. In addition,
                                            security restrictions have limited WFP monitors’ access to partners’ warehouses
What GAO Recommends                         and distribution sites in some high-risk areas. For example, in six districts in the
GAO recommends that the Department          southeast area of Ethiopia, WFP has not monitored implementing partners’
of State work through WFP’s Executive       distribution sites since May 2011. Some of these factors may also limit WFP’s
Board to ensure that management and         ability to provide accurate reporting of food assistance losses. Because its
the board take several actions to           system does not track food in implementing partners’ custody and because of
strengthen WFP’s ability to manage          WFP’s restricted access to some sites, its calculation of food losses relies in part
risks inherent in some environments as      on partners’ distribution reports. However, these reports are sometimes late and
well as utilize the Audit Committee         inaccurate. Although operating in Somalia is inherently challenging, WFP
more fully and report losses more           reported an average loss rate of 0.25 percent for Somalia from 2007 through
accurately. WFP, State, and other           2011, compared with 0.41 percent for WFP’s operations globally. Moreover,
relevant U.S. agencies agreed with          despite concerns expressed by some WFP donors and Executive Board
GAO’s recommendations.
                                            members, no external evaluation of WFP’s food loss data has been conducted
                                            since a 2006 review by WFP’s External Auditor. In that report, the Auditor noted
View GAO-12-790. For more information,      that inadequate reporting of losses not only presents risks to the effectiveness of
contact Tom Melito at (202) 512-9601 or     WFP’s aid efforts and the achievement of its objectives but also presents
melitot@gao.gov.
                                            reputational risks in terms of donor confidence.
                                                                                     United States Government Accountability Office
Contents


Letter                                                                                              1
                       Background                                                                   6
                       Design of WFP Internal Controls Related to Delivering and
                         Monitoring Food Assistance Generally Reflects COSO Principles
                         but Could Be Strengthened to Better Manage Risks                         12
                       Security Restrictions and Limited Internal Controls Weaken
                         Assurance of Food Delivery and Accurate Loss Reporting for
                         Selected High-Risk Areas                                                 35
                       Conclusions                                                                55
                       Recommendations for Executive Action                                       56
                       Agency Comments and Our Evaluation                                         57

Appendix I             Objectives, Scope, and Methodology                                         59



Appendix II            World Food Program Governance, Oversight, and Management
                       Structure                                                                  70



Appendix III           Information on Case Study Countries—Ethiopia, Kenya, and Somalia           74



Appendix IV            Comments from the World Food Program                                       82



Appendix V             Comments from the U.S. Department of State                                 84



Appendix VI            GAO Contact and Staff Acknowledgments                                      87



Related GAO Products                                                                              88




                       Page i                          GAO-12-790 World Food Program Internal Controls
Tables
          Table 1: WFP Direct Expenses for Ethiopia, 2007-2011                        75
          Table 2: WFP Direct Expenses for Kenya, 2007-2011                           76
          Table 3: WFP Direct Expenses for Somalia, 2007-2011                         78
          Table 4: Monitoring Data Reported by WFP for Ethiopia, Kenya,
                   and Somalia                                                        80
          Table 5: Monitoring Data Reported by WFP for Selected GAO
                   Fieldwork Sites and High-Risk Areas in Ethiopia, Kenya,
                   and Somalia                                                        81


Figures
          Figure 1: WFP’s Operational Presence as of August 2012                       7
          Figure 2: Donor Contributions to WFP in 2011                                 9
          Figure 3: WFP Governance, Oversight, and Management Structure               10
          Figure 4: Examples of WFP Control Activities from Port-of-Entry to
                   Distribution of Food Assistance                                    27
          Figure 5: WFP Warehouse in Ethiopia                                         37
          Figure 6: Distribution of WFP Food Assistance in Kenya                      39
          Figure 7: WFP’s Reported Food Assistance Losses in Ethiopia,
                   Kenya, and Somalia and Worldwide, 2007-2011                        49
          Figure 8: WFP Management Structure                                          73
          Figure 9: Timeline of Security and Humanitarian Events and
                   Investigations into WFP Control Weaknesses in Somalia              79




          Page ii                          GAO-12-790 World Food Program Internal Controls
Abbreviations

COSO              Committee of Sponsoring Organizations of the Treadway
                   Commission
COMPAS            Commodity Movement, Processing and Analysis System
FAO               Food and Agriculture Organization of the United Nations
EMOP              emergency operation
ISO               International Organization for Standardization
JIU               Joint Inspection Unit
NGO               nongovernmental organization
PRRO              protracted relief and recovery operation
SMCA              Strengthening Managerial Control and Accountability
UN                United Nations
UNHCR             United Nations High Commissioner for Refugees
UNDSS             United Nations Department of Safety and Security
WFP               World Food Program



This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.




Page iii                                 GAO-12-790 World Food Program Internal Controls
United States Government Accountability Office
Washington, DC 20548




                                   September 13, 2012

                                   The Honorable Ileana Ros-Lehtinen
                                   Chairman
                                   The Honorable Howard L. Berman
                                   Ranking Member
                                   Committee on Foreign Affairs
                                   U.S. House of Representatives

                                   The United States is the single largest donor to the United Nations (UN)
                                   World Food Program (WFP), contributing about $1.2 billion in cash and
                                   food in 2011—more than 30 percent of WFP’s revenue of about $3.7
                                   billion for the year. As the world’s largest humanitarian agency fighting
                                   hunger worldwide, in 2011 WFP provided food assistance to 99.1 million
                                   people in 75 countries, including a number of countries with areas that
                                   WFP has designated as high risk. 1 In these areas, WFP staff may have
                                   limited access to those in need of food assistance and be endangered by
                                   local conflict or crime. For example, in high-risk areas in Somalia and
                                   Ethiopia, several WFP staff members were killed in 2011 while performing
                                   their duties, and WFP has lost 7 staff members and 13 WFP partner staff
                                   members in attacks in Somalia since 2008.

                                   In 2009, a media report alleged that large amounts of WFP’s food
                                   assistance in Somalia were being diverted to contractors, Somali clans,
                                   and local UN staff. Following the media report, WFP’s Office of
                                   Inspections and Investigations, the UN Monitoring Group on Somalia, and
                                   WFP’s External Auditor issued reports that found weaknesses in WFP’s
                                   control of its operations in Somalia. 2 Acknowledging that operating in
                                   Somalia is difficult and dangerous, WFP suspended activities in many
                                   parts of southern Somalia in January 2010 after an Islamist terrorist group
                                   controlling those areas, known as al-Shabaab, imposed unacceptable



                                   1
                                    Unless otherwise indicated, “WFP” refers to WFP management, including management
                                   at WFP headquarters, regional bureaus, and country offices.
                                   2
                                    World Food Program, Office of Inspections and Investigations, Investigations of
                                   Allegations of Food Diversions in Somalia, OSDlI51/09-I 29/09 (2009); UN Security
                                   Council, Report of the Monitoring Group on Somalia pursuant to Security Council
                                   Resolution 1853 (2008), S/2010/91 (Geneva, Switzerland: 2010); Comptroller and Auditor
                                   General of India, External Audit Report: World Food Program’s Somalia Operations,
                                   WFP/EB.1/2011/5-B/1 (2011).




                                   Page 1                                 GAO-12-790 World Food Program Internal Controls
operating conditions. In July 2011, WFP resumed food assistance in
some areas that were no longer under al-Shabaab’s control, after the UN
reported that the situation in southern Somalia had reached famine
proportions. In its March 2010 report, the UN Monitoring Group on
Somalia noted that the aid community had come to accept a certain level
of risk, loss, theft, and diversion as “the cost of doing business” in
Somalia. 3 In addition, in its July 2012 report, the UN Monitoring Group
stated that large-scale diversion of humanitarian assistance occurs in
parts of Somalia but that WFP is taking all possible measures to
investigate and address allegations of theft. 4 International
nongovernmental organizations (NGOs) and the media also continue to
report diversion of food assistance in Somalia.

In recent years, WFP has reported having designed and implemented a
number of initiatives to strengthen its internal controls in Somalia and
worldwide, including adopting principles from the Committee of
Sponsoring Organizations of the Treadway Commission’s (COSO)
“Internal Control—Integrated Framework” (COSO internal control
framework). 5 Internal control generally serves as a first line of defense in
safeguarding assets and is broadly defined as a process designed to
provide reasonable assurance regarding (1) effectiveness and efficiency
of operations; (2) reliability of financial reporting; and (3) compliance with




3
 UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security
Council Resolution 1853 (2008), S/2010/91 (2010).
4
 UN Security Council, Report of the Monitoring Group on Somalia and Eritrea Pursuant to
Security Council Resolution 2002 (2011), S/2012/544 (2012).
5
 Committee of Sponsoring Organizations of the Treadway Commission, Internal Control—
Integrated Framework (1992). COSO was formed in 1985 to sponsor the National
Commission on Fraudulent Financial Reporting, an independent, private-sector initiative
that studied the causal factors that can lead to fraudulent financial reporting and
developed recommendations for public companies and their independent auditors; the
U.S. Securities and Exchange Commission and other regulators; and educational
institutions. In 1992, COSO issued “Internal Control—Integrated Framework” to help
businesses and other entities assess and enhance their internal control. Since that time,
COSO’s internal control framework has been recognized by regulatory standards setters
and others as a comprehensive framework for evaluating internal control, including
internal control over financial reporting.




Page 2                                  GAO-12-790 World Food Program Internal Controls
laws and regulations. 6 In 2012, WFP’s former Executive Director
described the organization’s system of internal control as designed to
identify, evaluate, and reduce and manage—rather than eliminate—the
principal risks of failure to achieve WFP’s objectives. 7

As part of our current work on international food assistance, 8 we sought
to determine whether WFP systems are designed and implemented to
help ensure that its food assistance reaches intended beneficiaries. 9 This
report examines the extent to which

1) the design of WFP internal controls related to the delivery and
   monitoring of food assistance reflects COSO principles and
2) WFP has implemented as designed certain controls related to the
   delivery and monitoring of food assistance in selected high-risk areas.

To address these objectives, we reviewed COSO’s internal control
framework as well as COSO’s “Enterprise Risk Management—Integrated
Framework” 10 and related international principles and guidelines,
including those in the International Organization for Standardization’s




6
 Committee of Sponsoring Organizations of the Treadway Commission, Internal Control—
Integrated Framework. According to COSO, an internal control system, no matter how well
conceived and operated, can provide only reasonable—not absolute—assurance
regarding achievement of an entity’s objectives. The likelihood of achievement is affected
by limitations inherent in all internal control systems, such as faulty decision-making and
resource constraints.
7
 World Food Program, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012).
The former WFP Executive Director served from April 2007 to April 2012, when Ertharin
Cousin began her tenure.
8
 Our current work on international food assistance includes a review, forthcoming in
September 2012, of USAID’s targeting of international food assistance.
9
Throughout this report, “beneficiaries” refers to recipients of WFP food assistance.
10
  Committee of Sponsoring Organizations of the Treadway Commission, “Enterprise Risk
Management—Integrated Framework (2004). According to COSO, a key objective of this
framework is to help managements of businesses and other entities better deal with risk in
achieving an entity’s objectives.




Page 3                                   GAO-12-790 World Food Program Internal Controls
(ISO) “ISO 31000 Risk Management—Principles and Guidelines.” 11 We
focused our review on WFP’s internal controls related to the delivery and
monitoring of food assistance, primarily from port-of-entry to distribution to
intended beneficiaries, because of WFP’s vulnerability to risks such as
the alleged food diversion in Somalia during these stages of food
assistance management. We did not review other processes, such as
procurement, finance, and budget processes. We analyzed relevant WFP
policies and procedures, relevant documents, and data related to internal
controls at WFP’s corporate level and at the country level for three case
study countries—Ethiopia, Kenya, and Somalia. We selected these
countries based on a range of criteria, including U.S. contributions,
amount of food assistance received, high-risk and non-high-risk
environments in each country, and logistics and budget constraints.
Because WFP operates in many countries and implements many different
activities in each country, our case studies are not generalizable to all
WFP countries and operations. We focused our review on emergency
and protracted relief and recovery operations, which represent about 80
percent of WFP’s operations, and on general food distribution activities
within these programs. In addition to reviewing WFP’s internal controls
and risk management process, we analyzed WFP’s methods for
estimating losses of food commodities after arrival at the port-of-entry. 12
We reviewed WFP and external oversight reports and also reviewed
relevant U.S. government documents, including monitoring reports on
WFP operations. We conducted fieldwork in Ethiopia and Kenya;
however, we did not conduct fieldwork in Somalia because of logistical
constraints and security concerns. We met with WFP Headquarters
officials in Rome, Italy, officials from WFP’s East and Central Africa
Regional Bureau in Nairobi, Kenya, and with WFP country officials for
Ethiopia, Kenya, and Somalia. We also met with officials from the U.S.
Agency for International Development (USAID), the U.S. Mission to the
UN Agencies in Rome, the Food and Agriculture Organization of the


11
  International Organization for Standardization, ISO 31000 Risk Management—Principles
and Guidelines (2009). ISO is intended to be a family of standards relating to risk
management codified by the International Organization for Standardization. The purpose
of “ISO 31000 Risk Management—Principles and Guidelines” is to provide principles and
generic guidelines on risk management. ISO 31000 seeks to provide a universally
recognized paradigm for practitioners and companies employing risk management
processes to replace the myriad of existing standards, methodologies and paradigms that
differed between industries, subject matters and regions.
12
  WFP refers to losses of food commodities after arrival at the port-of-entry as post-
delivery losses. Throughout this report, we refer to such losses as food assistance losses.




Page 4                                   GAO-12-790 World Food Program Internal Controls
United Nations (FAO), the UN High Commissioner for Refugees, and the
UN Office for the Coordination of Humanitarian Affairs in Rome, Ethiopia,
and Kenya. In Rome, we also met with some WFP recipient and donor
representatives who are members of WFP’s Executive Board, with
members of WFP’s Audit Committee, and with WFP’s External Auditor.
See appendix I for a detailed discussion of our objectives, scope, and
methodology.

We conducted our work from July 2011 to September 2012 in accordance
with generally accepted government auditing standards. Those standards
require that we plan and perform our work to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions
based on our objectives. We believe that the evidence obtained provides
a reasonable basis for our findings and conclusions based on our
objectives.




Page 5                            GAO-12-790 World Food Program Internal Controls
             Because of the nature of its work as a humanitarian organization, WFP is
Background   called to serve where needed. As a result, WFP often operates in
             environments with a high level of inherent risk to the security of its staff,
             its ability to deliver food to beneficiaries, and its ability to maintain high
             standards of internal control. In the countries where WFP operates, the
             United Nations Department of Safety and Security (UNDSS) assesses the
             general security environment in specific geographic areas using five
             categories of threats: armed conflict, terrorism, crime, civil unrest, and
             hazards. UNDSS rates each area at one of six security levels, with level 6
             indicating the most dangerous environment. The UN Security
             Management System uses these ratings to assess security risks to UN
             agencies, funds, and programs; on the basis of these assessments, WFP
             determines appropriate risk mitigation measures to protect its staff and
             operations. WFP’s current security philosophy emphasizes seeking
             approaches to deliver food assistance where it is needed despite the
             risks. 13

             As of August 2012, WFP had an operational presence in 78 countries and
             had designated as high risk 23 countries where it operates, including 10
             countries in Sub-Saharan Africa (see fig. 1). 14




             13
                WFP’s security philosophy acknowledges that risk is an inevitable part of operations and
             aims to (1) enhance the security of personnel and (2) manage, rather than avoid, security
             risks as one of the challenges that WFP faces in implementing its programs.
             14
                WFP’s designations of high-risk countries are not directly related to the UNDSS security
             ratings for geographic areas in the countries. WFP uses the following criteria to determine
             whether a country should be classified as high risk: volatile/insecure operating
             environment; implementation of humanitarian operations; level/volume of the operations
             (the higher the volume, the greater the need to assess/mitigate risks); and absence of a
             risk register (i.e., a document recording identified risks, their severity, actions to be taken
             to mitigate the risks, and individuals responsible for the mitigating actions).




             Page 6                                     GAO-12-790 World Food Program Internal Controls
Figure 1: WFP’s Operational Presence as of August 2012




                                       Page 7            GAO-12-790 World Food Program Internal Controls
                       WFP provides most of its assistance through emergency operations
                       (EMOP) and protracted relief and recovery operations (PRRO). 15 To
                       deliver food to intended beneficiaries, WFP works with private land
                       transporters 16 and with implementing partners, 17 including NGOs, UN
                       organizations, and recipient governments. WFP field monitors observe
                       food distributions and, a few days or weeks after the distribution, conduct
                       post-distribution monitoring, interviewing beneficiaries about the quantity
                       of food received, their use of the food, and the food’s acceptability and
                       quality. WFP uses its Commodity Movement, Processing and Analysis
                       System (COMPAS), a global database, to track commodities throughout
                       the supply chain, from the initial request for commodities by WFP field
                       offices to the distribution of the commodities to beneficiaries. WFP’s
                       logistics unit tracks and calculates losses of food assistance after delivery
                       at the port-of-entry and reports annually on these losses to WFP’s
                       Executive Board.


Contributions to WFP   WFP receives voluntary contributions from a variety of donors—
                       governments, the public, and the private sector. In 2011, WFP received
                       about $3.7 billion in contributions, 18 almost 62 percent of which came
                       from the United States, Canada, Japan, the European Commission, and
                       Germany (see fig. 2). The United States, the single largest donor,
                       provided about $1.2 billion—more than 30 percent of WFP’s 2011
                       funding—in cash and in-kind food aid. In addition to these contributions,
                       U.S. agencies and officials based in the United States, in Rome, and in
                       the field provide administrative, programmatic, technical, and operational



                       15
                         EMOPs are implemented in urgent situations and typically include food distribution or
                       projects such as food aid in exchange for reconstruction work. PRROs are intended to
                       help sustain disaster-hit communities as they reestablish livelihoods and stabilize food
                       security.
                       16
                         Private land transporters are usually truckers who may be contracted by WFP or by its
                       implementing partners.
                       17
                         WFP refers to third parties who help distribute its food to WFP beneficiaries as
                       implementing or cooperating partners. Throughout this report, we refer to these third
                       parties as implementing partners.
                       18
                         In its 2011 annual performance report, WFP reported that it spent almost $3.8 billion on
                       food assistance. Of this amount, about $2.4 billion, or 65 percent, supported EMOP and
                       PRRO projects in the 23 high-risk countries, including about $1.5 billion in the 10 high-risk
                       countries in Sub-Saharan Africa. See World Food Program, Annual Performance Report
                       for 2011, WFP/EB.A/2012/4 (2012).




                       Page 8                                    GAO-12-790 World Food Program Internal Controls
guidance to WFP and also conduct monitoring of U.S.-funded WFP
programs where the U.S. government has not restricted its staffs’
access. 19 WFP also submits reports on its operations and performance to
the U.S. government, as it does to all WFP Executive Board members.

Figure 2: Donor Contributions to WFP in 2011




19
  U.S. officials conduct field monitoring visits of U.S.-funded WFP operations to observe
and assess WFP programs, including the programs’ activities and challenges. These
monitoring visits are generally summarized in a monitoring report or cable that is shared
with the relevant program office or embassy and other U.S. officials who work on WFP
programs. In addition, if in the interest of U.S. government foreign assistance objectives,
U.S. officials might visit non-U.S. funded WFP operations.




Page 9                                    GAO-12-790 World Food Program Internal Controls
WFP Governance,        Several external and internal governance and oversight bodies are
Oversight, and         responsible for providing oversight of WFP and helping manage WFP
Management Structure   risks. Figure 3 shows WFP’s governance, oversight, and management
                       structure.

                       Figure 3: WFP Governance, Oversight, and Management Structure




                       Page 10                            GAO-12-790 World Food Program Internal Controls
•   UN governing bodies. Several UN entities, comprising
    representatives of the UN’s 193 member states, provide governance
    to WFP. These entities include the UN General Assembly, the FAO
    Conference, the UN Economic and Social Council, the FAO Council,
    the UN Advisory Committee on Administrative and Budgetary
    Questions, and the FAO Finance Committee.

•   WFP Executive Board. WFP’s Executive Board includes
    representatives of 36 UN member states who are responsible for
    providing intergovernmental support and specific policy direction and
    supervision of WFP activities. The Executive Board exercises
    oversight over senior management. The Advisory Committee on
    Administrative and Budgetary Questions and the FAO Finance
    Committee are advisory bodies to the board.

•   Independent external oversight. WFP’s independent external
    oversight is intended to assist the Executive Board in fulfilling its
    responsibility. The WFP External Auditor is appointed by, and reports
    to, the Executive Board and performs audits of WFP to satisfy him- or
    herself that the internal controls, including the internal audit, are
    adequate. The WFP Audit Committee serves in an expert advisory
    capacity to assist the Executive Board and the Executive Director in
    exercising their governance responsibilities for the financial reporting,
    internal control arrangements, risk management processes and other
    audit-related matters. The UN Joint Inspection Unit is mandated to
    conduct system-wide evaluations, inspections, and investigations
    throughout the UN.

•   Management structure. As head of WFP management, the
    Executive Director is responsible and accountable to the Executive
    Board for the administration of WFP and the implementation of WFP
    programs, projects, and other activities and for establishing effective
    internal controls and an effective independent internal oversight. WFP
    has a three-tier organizational structure, with its headquarters in
    Rome, Italy; seven regional bureaus (see app. II, fig. 8); and 77
    country offices. Headquarters is responsible for governance, strategic
    planning, policy making and macro-level monitoring. The regional
    bureaus provide technical assistance to the country offices and
    oversee their adherence to corporate guidelines, practices, and
    procedures. (See app. II for additional information on WFP’s
    governance, oversight, and management structure.)

•   Independent internal oversight. WFP’s Office of Evaluation and the
    Inspector General and Oversight Office are independent of WFP’s


Page 11                            GAO-12-790 World Food Program Internal Controls
                             management and conduct audits, investigations, and inspections of
                             WFP’s systems, processes, operations, and activities.

                        The design of WFP internal controls related to delivering and monitoring
Design of WFP           food assistance generally reflects COSO principles. However, several
Internal Controls       controls could be strengthened to better manage risks, including risks
                        affecting WFP’s ability to deliver food assistance to intended
Related to Delivering   beneficiaries. WFP’s internal control framework has five components. 20
and Monitoring Food
Assistance Generally    •    Internal environment. WFP has designed policies and procedures to
                             set the organization’s tone and emphasize internal controls, reflecting
Reflects COSO                COSO principles, but oversight by WFP’s Executive Board and Audit
                             Committee is limited. 21
Principles but Could
Be Strengthened to      •    Risk management. WFP has developed risk management policies
                             and guidance, as recommended by COSO. However, WFP has not
Better Manage Risks          fully developed guidelines for implementing risk management,
                             including guidelines for defining risk tolerance. 22

                        •    Control activities. WFP has designed numerous control activities, in
                             line with COSO principles, 23 to help ensure tracking of food
                             assistance from port-of-entry to beneficiaries. However, the design of
                             its commodity tracking system has weaknesses that limit its ability to
                             account for food in the custody of implementing partners.




                        20
                          The five components of WFP’s internal control framework are similar to those of the
                        COSO internal control framework: control environment, risk assessment, control activities,
                        information and communication, and monitoring.
                        21
                          WFP bases “internal environment,” the first component of its internal control framework,
                        on elements of the “control environment” component of COSO’s internal control
                        framework as well as on elements of COSO’s enterprise risk management framework.
                        22
                           WFP bases the second component of its internal control framework on COSO’s internal
                        control component “risk assessment,” COSO’s enterprise risk management framework,
                        and principles and guidelines of other international organizations. WFP defines “risk
                        tolerance” as representing an acceptable level of variation relative to the achievement of a
                        particular objective. Risk tolerance seeks to provide measurable indicators of the level of
                        risk tolerated in achieving a specific objective.
                        23
                          According to COSO, control activities include a range of activities as diverse as
                        approvals, authorizations, verifications, reconciliations, and reviews of operating
                        performance and security of assets.




                        Page 12                                   GAO-12-790 World Food Program Internal Controls
                                •     Information and communication. WFP has several mechanisms for
                                      identifying, capturing, and communicating information to and from
                                      WFP management, in accordance with COSO principles.

                                •     Monitoring. WFP has developed detailed policies on monitoring
                                      delivery of food assistance to beneficiaries, reflecting COSO
                                      principles, but this guidance does not call for monitoring to be risk
                                      based as recommended by WFP’s External Auditor.

Internal Environment:           In establishing its internal environment, WFP has designed policies and
WFP Has Designed                procedures, including developing a new internal control framework, to set
Policies and Procedures to      the tone of the organization and influence staff consciousness of the
                                importance of internal control. In addition, WFP plans to provide
Set Tone of Organization,       additional training and guidance to strengthen managerial control.
but Governance Oversight        However, some Executive Board members told us that their oversight is
Is Limited                      limited because of competing obligations and limited resources.
                                Moreover, statements in WFP Audit Committee’s reports, as well as
                                remarks by the committee’s current chairman and some Executive Board
                                members, indicate that the board does not fully utilize the committee to
                                provide the necessary independent oversight on internal controls. 24

                                 Internal Environment
                                 According to COSO, the internal environment sets the tone of an organization,
                                 influencing the control consciousness of its people, and is the foundation for all
                                 other components of internal control, providing discipline and structure. Internal
                                 environment factors include the integrity, ethical values, and competence of
                                 staff; management’s philosophy and operating style; the way management
                                 assigns authority and responsibility and organizes and develops its people; and
                                 the attention and direction provided by the board of directors.
                                Source: COSO, “Internal Control—Integrated Framework” (1992).




WFP Has Developed Policies      WFP has developed several policies and procedures to set the
and Procedures to Set Tone of   organization’s tone and influence staff consciousness of the importance
Organization                    of internal control, reflecting COSO principles. For example, to address
                                the integrity and ethical value of the organization, WFP established an
                                ethics office in 2008 and has developed ethics-related policies, such as
                                financial disclosure, antifraud and anticorruption, and whistleblower
                                protection. In addition, since 2009, WFP’s management has reported on



                                24
                                  The current chairman of the WFP Audit Committee was elected in December 2011, and
                                his appointment was renewed in July 2012 for a 3-year term.




                                Page 13                                                  GAO-12-790 World Food Program Internal Controls
                          several efforts aimed at strengthening elements of its internal
                          environment, taken under WFP’s Strengthening Managerial Control and
                          Accountability (SMCA). According to WFP, the SMCA initiative identified
                          key actions to further improve internal controls. In September 2011, WFP
                          issued a new internal control framework based on COSO that, according
                          to the Executive Director, took into account the views of the external and
                          internal auditors and the Audit Committee. WFP also developed guidance
                          to help staff apply the new internal control framework, including a new
                          manager’s guide to internal control, an accountability guide for managers,
                          and a new internal control self-assessment checklist. In addition, WFP
                          introduced a process that required all senior managers to provide the
                          Executive Director with assurances related to the operation of internal
                          control within their offices. Based on this new process, the former
                          Executive Director included, for the first time, a statement on internal
                          control in WFP’s 2011 audited annual accounts. 25 According to the former
                          Executive Director, this statement provides specific assurance on the
                          effectiveness of all internal controls in WFP. 26

WFP Plans to Provide      WFP’s former Executive Director reported that, to strengthen managerial
Additional Training and   control, WFP plans to increase support and training of managers and staff
Guidance to Strengthen    in key aspects of internal control, including ethics. According to WFP,
Managerial Control        ethics training is not mandatory. WFP stated that after it has identified the
                          needed funding, it will establish a directive to include mandatory training
                          in ethics and integrity to all staff. Currently, the ethics office provides
                          ethics training to all new staff, procurement staff, and 100 workplace
                          advisers in all country offices and regional bureaus. According to COSO,
                          a strong ethical climate is vital to the well-being of the organization, all of
                          its constituencies, and the public at large. In addition, the former
                          Executive Director said that WFP’s management will provide further
                          refinement of the internal control guidance and tools and improvements in
                          the assurance questionnaire that managers are required to complete.




                          25
                               WFP, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012).
                          26
                            The External Auditor did not perform an audit of WFP’s management’s assessment of
                          the effectiveness of internal controls over financial reporting for 2011 as part of its annual
                          audit, contrary to current best practices of multilateral organizations such as the World
                          Bank and the Inter-American Development Bank. WFP management informed us that an
                          audit of management’s assessments of the effectiveness of internal control, like
                          management’s statements on internal control, is considered voluntary.




                          Page 14                                    GAO-12-790 World Food Program Internal Controls
Some WFP Executive Board        Some of the members of WFP’s Executive Board told us that their
Members Say Oversight Is        oversight of WFP’s operation is constrained by competing obligations and
Constrained by Competing        limited staff resources. 27 According to COSO principles, the control
Obligations and Limited Staff   environment and “tone at the top” are influenced significantly by the
Resources                       entity’s board of directors. 28 COSO adds that factors determining the
                                board’s influence include the extent of its involvement and scrutiny of
                                activities and the degree to which it raises, and pursues with
                                management, difficult questions regarding plans or performance. Given
                                the highly decentralized and complex nature of WFP’s operation, the
                                significance of an active board has been reinforced by the more frequent
                                and extensive crises in many high-risk environments as well as by the
                                allegations of diversion of WFP’s food assistance in Somalia.

                                During our meeting with some of WFP’s Executive Board members, they
                                informed us that because of their extensive responsibilities on the boards
                                of FAO, the International Fund for Agriculture Development, and WFP,
                                they do not have sufficient time or staff resources to ensure that WFP is
                                being managed effectively. Similarly, our 2007 review of governance and
                                oversight at six UN entities, 29 including WFP, found that board members
                                described oversight as difficult because they lacked sufficient resources
                                and expertise. WFP board members also informed us that they were
                                surprised to have learned about the 2009 allegations of food diversion
                                and other lapses in internal controls in Somalia from the news media
                                rather than from WFP’s management before the allegations were made
                                public.

Executive Board Does Not        Statements in recent WFP Audit Committee reports, as well as remarks
Fully Utilize Audit Committee   by the committee’s current chairman and some Executive Board
for Oversight Assistance        members, indicate that the board does not fully utilize the committee for
                                assistance in providing the independent oversight that is needed to


                                27
                                  WFP’s Executive Board consists of 36 members of the UN member state
                                representatives. In September 2011, we met with 9 of the board members. See
                                appendixes I and II for more information on the Executive Board.
                                28
                                  In technical comments on a draft of this report, WFP noted that there is a fundamental
                                difference between a company’s board of directors, which would typically include
                                executive directors, and WFP’s Executive Board, which comprises representatives of
                                sovereign states.
                                29
                                  GAO, United Nations Organizations: Oversight and Accountability Could Be
                                Strengthened by Further Instituting International Best Practices, GAO-07-597
                                (Washington, D.C. June 18, 2007).




                                Page 15                                  GAO-12-790 World Food Program Internal Controls
strengthen accountability and governance in WFP. COSO states that an
entity’s audit committee is in a unique position to question top
management regarding how it is carrying out its financial reporting
responsibilities; the committee also has the authority to ensure that
corrective action is taken and is in the best position to identify and act in
instances where top management overrides internal controls. 30

In 2007, we recommended that WFP establish an audit committee that is
independent of management and report directly to the Executive Board. 31
We also stated at that time that an external audit committee, accountable
to the governing body, could assist the Executive Board with its
responsibility to monitor the organization oversight function. In 2009, WFP
established an external audit committee to provide independent, expert
advice to the Executive Board and the Executive Director in fulfilling their
governance responsibilities. 32 The committee’s terms of reference also
outline responsibilities for, among other things, ensuring the effectiveness
of WFP’s internal control systems, risk management, audit and oversight
functions, and governance processes. In 2010, WFP’s External Auditor
noted benefits from the Audit Committee’s activities and recommended
that the board place increasing reliance on the committee regarding audit
matters, including significant control issues such as those in Somalia. 33

However, in September 2011, the current Chairman of the Audit
Committee informed us that the committee believed its terms of reference


30
  In its technical comments on a draft of this report, WFP noted that in industry, where an
audit committee is usually a committee of the board of directors, the committee’s
communication and interaction with the board is fundamentally different than in WFP,
where the Audit Committee members are technical oversight experts and the Executive
Board comprises representatives of sovereign states.
31
  In 2007, WFP’s Audit Committee comprised both internal and external members and
was accountable only to the Executive Director. See GAO-07-597. The current Audit
Committee comprises five members who are appointed for a 3-year term, renewable for a
second and final 3-year term.
32
  According to the current Audit Committee’s terms of reference, the Executive Director is
involved in the recruitment and selection process of Audit Committee members. The
Executive Board considers candidates recommended by the Executive Director, and an
appointment to the Audit Committee may only be revoked by the Executive Board after
consulting the Executive Director. However, according to international best practices, the
Audit Committee should report, and be accountable, to the governing body.
33
  World Food Program, WFP Audited Annual Accounts, 2009, WFP/EB.A/2010/6-A/1
(2010).




Page 16                                   GAO-12-790 World Food Program Internal Controls
were too limited. Although the Audit Committee’s terms of reference do
not specifically prevent committee members from attending board
meetings, the current Chairman told us that the committee’s Chair, alone
among its members, is permitted to attend only one Executive Board
meeting per year. In contrast, according to the Chairman, the committee
believed that all members should be allowed to attend each of the
Executive Board’s three annual meetings. In addition, the current
Chairman stated that although the committee meets quarterly with several
members of the Executive Board, 34 no process exists to ensure that the
board consults with the Audit Committee regarding high-risk issues or
situations that could expose WFP to fraud allegations in the future.
Moreover, the Audit Committee reported in 2011 that, like the Executive
Board, it was not informed in advance of the allegations related to food
diversion in Somalia in 2009. In November 2011, the External Auditor
reported that the Executive Board had revised the Audit Committee’s
terms of reference to clarify, among other things, that the committee’s
Chair can inform the president of the board of any serious governance
issue at any time.

In addition, statements in the Audit Committee’s recent annual reports to
the Executive Board, as well as remarks by the committee’s current
Chairman, indicate that the committee believes that it is not being fully
utilized. In both its 2011 and 2012 annual reports, the Audit Committee
stated that it “can be only as effective as the degree of ‘buy-in’ by the
board and management of the need for an independent Audit Committee
and of their acceptance of the Audit Committee’s role.” 35 In its 2012
report, the Audit Committee also stated that because external audit
committees are new entities within the UN system, there is “an
understandable lack of clarity of how best to use an audit committee
consisting of outside experts.” In addition, the 2012 report states that
audit committees can leverage the work of the board and can provide
independent advice to senior management. Further, in both its May 2011



34
  The Audit Committee meets quarterly with the Executive Board Bureau, which consists
of five board members who are responsible for strategic planning of the board’s work, the
preparation and organization of board meetings, and promotion of dialogue. See World
Food Program, Annual Report of the Audit Committee, WFP/EB.A/2012/6-D/1 (2012).
35
  World Food Program, Annual Report of the Audit Committee, WFP/EB.A/2011/6-C/1
(2011); Annual Report of the Audit Committee (2012). As of April 2012, the Audit
Committee submits its annual report to the Executive Board; previously, the committee
submitted its annual report to the Executive Director for the board’s consideration.




Page 17                                  GAO-12-790 World Food Program Internal Controls
and 2012 reports, the Audit Committee stated that it could not secure
permission for site visits, possibly because of financial reasons. The
committee emphasized the importance of conducting site visits, which it
considers to be the norm for an audit committee in order to observe
operations for which it has an oversight fiduciary responsibility. In
September 2011, the committee’s current Chairman informed us that the
committee had proposed that its role encompass more than a review. The
Chairman also stated that site visits would allow the committee to check,
on a test basis, selected offices, such as Haiti and Kenya, to determine
whether its recommendations were implemented. In its May 2012 report,
the FAO Finance Committee stated that the “added value of these visits
would have to be clearly established to avoid duplication of efforts by the
external and internal auditors and unnecessary burdening of field office
staff with extra tasks.” 36 The FAO committee requested a proposal for
field visits, including an analysis of the costs and benefits of such visits.

Finally, some WFP Executive Board members informed us that it is
difficult for the Audit Committee to be useful, owing to its lack of
resources and on-the-ground experience of WFP’s operations and the UN
overall. The revised Audit Committee terms of reference emphasize that
members possess high qualifications and experience.




36
 The FAO Finance Committee exercises control over the financial administration of WFP.
See appendix II for additional information regarding its role.




Page 18                                GAO-12-790 World Food Program Internal Controls
Risk Management: WFP         WFP has taken a number of actions to embed risk management
Has Developed Policies for   throughout the organization, such as developing an enterprise risk
Managing Risks but Has       management policy and a risk management framework. 37 In addition,
                             WFP told us that it has recently developed or refined various tools, such
Not Yet Provided Guidance    as risk-level scales, its corporate risk profile, 38 and risk registers.
Needed to Implement Risk     However, WFP has not provided updated and adequately detailed
Management throughout        guidelines to aid staff in identifying, assessing, and responding to risks.
Organization                 Further, the board has not set risk tolerance levels for WFP’s operations
                             or communicated these in policies and guidelines, as its enterprise risk
                             management policy stipulates. 39

                             Risk Management
                             COSO defines risk management as a process designed to identify events that may affect
                             the entity and to manage risk to be within its risk appetite, to provide reasonable
                             assurance regarding the achievement of entity objectives. This process is effected by an
                             entity’s board of directors, management, and other personnel and applied in strategy
                             setting and across the enterprise.
                             Source: COSO, “Enterprise Risk Management —Integrated Framework,” 2004.




WFP Has Taken Actions to     WFP has taken a number of actions aimed at embedding risk
Embed Risk Management        management throughout the organization, as suggested by COSO.
throughout Organization      According to COSO, enterprise risk management is most effective when
                             risk management mechanisms are built into the entity’s infrastructure and
                             are part of the essence of the organization; by building in enterprise risk
                             management, an entity can directly affect its ability to implement its
                             strategy and achieve its mission.

                             In 2005, WFP’s Executive Board approved an enterprise risk
                             management policy, which provides the board’s overall intention and
                             direction regarding the management of risks. The policy states that the
                             board’s goal is to embed throughout WFP a systematic, effective, and
                             sustainable approach to managing risks and opportunities that adds value



                             37
                               WFP bases the “risk management” component of its internal control framework on
                             principles included in the “risk assessment” component of COSO’s internal control
                             framework as well as on principles included in COSO’s enterprise risk management
                             framework.
                             38
                               A risk profile describes the characteristics of a risk, mapping the change in the likelihood
                             and impact of the risk to which an organization is exposed.
                             39
                               COSO defines risk tolerance as the acceptable levels of variation relative to the
                             achievement of an objective.




                             Page 19                                                GAO-12-790 World Food Program Internal Controls
to decision making and is linked to objectives and results. The policy also
states that it envisages a risk management framework based on the
COSO enterprise risk management framework. In addition, the policy
discusses the role of WFP’s Executive Board and management and
summarizes WFP’s risk management philosophy.

In 2009, as part of its SMCA initiative, WFP continued the process of
developing a risk management system. 40 According to WFP, a major gap
in its risk architecture has been the lack of a system that enables
managers to link risks directly to their objectives and that allows for the
appropriate escalation of risk within the organization. In addition,
according to WFP, budgetary constraints limited the support available to
field offices to implement risk management effectively during 2009 and
2010. As of May 2012, WFP had taken a number of actions to help
embed risk management throughout the organization, including

•    creating an executive management council to review the effectiveness
     of risk and performance management arrangements and to review
     risks that have been escalated for its consideration;

•    establishing a network of performance and risk management
     champions across all country and regional offices to guide best
     practice;

•    beginning to develop a new organization-wide information technology
     system, intended to bridge the gap between risk management in
     country offices and at the corporate levels, which it expects to roll out
     to all business units and offices by 2013; and

•    developing training programs on integrated risk and performance
     management, which it has provided to key country offices and will
     continue to provide in 2012 to offices that have not yet received it.




40
  According to principles and benchmarks established by ISO and the UN Joint Inspection
Unit, a formal risk management system includes a formal risk management policy,
framework, and risk management process. See International Organization for
Standardization, ISO 31000 Risk Management—Principles and Guidelines; and UN Joint
Inspection Unit, Review of Enterprise Risk Management in the United Nations System:
Benchmarking Framework, (Geneva, Switzerland: 2010).




Page 20                                GAO-12-790 World Food Program Internal Controls
Also in May 2012, WFP reported that it had recently developed or refined
various tools, such as impact, likelihood, and risk-level scales and
categories; a corporate risk profile; corporate-, country-, and entity-level
risk registers; and a risk management escalation process. Moreover, the
Audit Committee stated in its April 2012 report to the Executive Board that
it welcomed the use of the corporate risk register and that in 2011, an
increasing number of offices put in place formal systems to identify,
evaluate, and record risks. In May 2012, the Executive Director reported
that, as of December 2011, 67 percent of office entities (i.e., country
offices, regional bureaus, and headquarters divisions) had formal risk
registers. According to WFP’s former Executive Director, all WFP offices
were expected to have formal risk registers by the end of 2012. Further,
in March 2012, the former Executive Director, after identifying a need for
further training and guidance on managing risk, stated that this need will
be addressed in 2012.

In addition, since 2011, WFP has identified risks based on three risk
categories—contextual, programmatic, and institutional—that reflects the
humanitarian context in which it operates. 41 WFP defines these
categories as follows: (1) Contextual risks include those over which WFP
has very little control, such as armed conflict, drought, and other
humanitarian crises. (2) Programmatic risks include not meeting WFP’s
objectives and causing harm to others, such as reduced program
oversight with possible misuse of assistance, drawing beneficiaries into a
conflict zone, and lack of donor funding. (3) Institutional risks are those
with significant implications to WFP, such as misappropriation of
assistance, corruption by partners, and reputational damage.

Finally, in May 2012, WFP developed a risk management framework,
which is embedded in its Financial Resource Management Manual. In a


41
  See Victoria Metcalfe, Ellen Martin, and Sara Pantuliano, “Risk in Humanitarian Action:
Towards a Common Approach?” a report commissioned by the Humanitarian Policy
Group (London, UK: Overseas Development Institute, 2011). In this report, the Overseas
Development Institute’s Humanitarian Policy Group—a team of independent researchers
and information professionals working on humanitarian issues—states that its research
indicates that while there is growing awareness of the nature of risk in the humanitarian
sector, there is very little structured or agreed understanding of the range of risks
prevalent in the sector, possibly with the exception of security risks. The report adds that
the humanitarian community has much to learn from other sectors in assessing, for
example, risk appetite and risk tolerance and in managing the many risks it faces. Neither
WFP’s internal control framework nor its risk management framework mentions these risk
categories.




Page 21                                   GAO-12-790 World Food Program Internal Controls
                              draft document, WFP states that this framework is based on past lessons
                              and best practices from the public and private sectors and from other UN
                              agencies. 42

WFP Has Not Yet Provided      WFP’s internal control framework identifies event identification, risk
Guidance Needed to Ensure     assessment, risk response, and risk tolerance as key principles of its risk
Effective Organization-wide   management process. However, WFP has not yet provided guidance
Implementation of Risk        operationalizing these principles to help ensure consistent and integrated
Management                    implementation of risk management throughout the organization.
                              According to COSO, while an organization may have a sound strategy,
                              competent employees, sound business processes, and reliable
                              technology, every organization is vulnerable to risk and needs an
                              effectively functioning risk management process. In addition, according to
                              the UN Joint Inspection Unit, the risk management process must be
                              formalized and operationalized through a framework, guidelines, and
                              other administrative instructions, easily accessible to all staff, for
                              consistent and correct implementation across organizational units.

                              In 2006, WFP management developed a risk management guide that
                              briefly describes a risk management process; however, the 2006 guide is
                              not clearly related to WFP’s current internal control or enterprise risk
                              management frameworks, and it does not clearly describe methodologies
                              and tools to assess risks. 43 In January 2012, WFP management produced
                              a draft facilitator’s guide for training staff in preparing country risk
                              registers. 44 According to WFP, as of June 2012, it had finalized training
                              material for preparing the risk registers that was piloted in the South
                              Africa region. WFP stated that it plans to roll out the training to the rest of
                              the regions in 2013. However, WFP management has not yet provided
                              overall guidance on the risk management process for staff in identifying,




                              42
                                World Food Program, “Facilitator’s Guide: Preparing a Country Office Risk Register”
                              (draft).
                              43
                                WFP’s 2006 guidance describes a five-step process: (1) clarify expected results and
                              critical stakeholders, (2) identify risks that can impact expected results, (3) prioritize risks’
                              importance (impact and likelihood), (4) act on risks and decide how to proceed with
                              activities, and (5) review and communicate risks. World Food Program, “Risk
                              Management Guide” (2006).
                              44
                                World Food Program, “Facilitator’s Guide: Preparing a Country Office Risk Register”
                              (draft).




                              Page 22                                     GAO-12-790 World Food Program Internal Controls
assessing, and responding to risks, among other activities. 45 Without a
comprehensive guidance on the risk management process, WFP staff
may lack appropriate methodologies and tools to assess risks, especially
at the country level, where WFP is most exposed to risks.

Further, WFP’s Executive Board and management have not set or
communicated organization-wide risk tolerance levels for WFP’s
operations or provided guidelines on setting risk tolerance levels on a
case-by-case basis. WFP’s enterprise risk management policy stipulates
that the Executive Board or the Executive Director will set risk tolerance
levels where appropriate and will communicate risk tolerance levels
through corporate policies and guidelines. The policy also states that
managers will set prudent tolerance levels within their areas of
responsibility and authority. According to COSO, based on best practices,
boards of directors are responsible for setting organization-wide risk
tolerance. COSO states that some boards have established a risk
committee to focus directly on enterprise risk management, with the
committee’s responsibilities including developing and refining the
organization-wide risk appetite and risk tolerance. 46 COSO also states
that it is not uncommon for oversight responsibility for enterprise risk
management to be assigned to the Audit Committee. COSO states that
“in many cases it is believed that with its focus on internal control over
financial reporting, and possibly a broader focus on internal control, the
audit committee already is well positioned to expand its responsibility to
overseeing enterprise risk management.” In its 2011 annual report, the
WFP Audit Committee recommended that enterprise risk management
should be a standard agenda item at each Executive Board meeting and
that this would help the board refine the risk tolerance parameters within
which it wants WFP to operate.

WFP management informed us that it is currently engaged in discussion
of how risk tolerance should be set on a case-by-case basis but
expressed reluctance to articulate an organization-wide risk tolerance
level, stating that “it is not possible to balance financial or stewardship



45
  According to ISO principles and guidelines, the risk management process is the
systematic application of management policies, procedures and practices to activities
such as identifying, analyzing, evaluating, responding, monitoring, and reviewing risk.
46
  Risk appetite is the amount of risk, on a broad level, that an organization is willing to
accept in pursuit of its objectives.




Page 23                                    GAO-12-790 World Food Program Internal Controls
                                 risks in monetary terms against the potential loss of life that would result
                                 from WFP’s withdrawal,” for example, from a country or a program.
                                 However, our review of WFP policy and guidance showed that the
                                 Executive Board has not yet provided any written guidance to
                                 management on developing risk tolerance levels on a case-by-case
                                 basis, such as by considering the levels of food losses it is willing to
                                 tolerate to achieve its objective of providing food assistance under its
                                 emergency program in a country such as Somalia. Moreover, the current
                                 emergency program document for Somalia makes no reference to risk
                                 tolerance.


Control Activities: WFP          WFP has policies and procedures designed to help ensure tracking of
Has Designed Policies and        food in its custody from port-of-entry to beneficiaries. In addition, WFP
Procedures for Tracking          has policies and procedures designed to help prevent loss of food in
                                 implementing partners’ custody, but its commodity tracking system has
Food Assistance from             weaknesses, particularly tracking food in implementing partners’ custody.
Port-of-Entry to
Beneficiaries, but Tracking       Control Activities
System Has Weaknesses             COSO defines control activities as the policies and procedures that help ensure that
                                  necessary actions are taken to address risks to achievement of an entity's objectives.
                                  Control activities include a range of activities as diverse as approvals, authorizations,
                                  verifications, reconciliations, and reviews of operating performance and security of
                                  assets.
                                 Source: COSO, “Internal Control—Integrated Framework” (1992).




WFP Has Policies and             WFP has designed policies and procedures intended to protect against
Procedures Designed to Help      the loss of food in its custody during delivery at the port-of-entry, transport
Ensure Tracking of Food in Its   to WFP warehouses, and storage in warehouses. In addition, WFP has
Custody                          designed policies and procedures for WFP staff to follow in distributing
                                 food to beneficiaries. The following are examples of WFP’s control
                                 activities.

                                 •     Port-of-entry. The WFP country office is responsible for supervising
                                       and coordinating the delivery of food commodities at the port-of-entry
                                       and for ensuring that all parties, such as recipient authorities and
                                       superintendents, 47 are aware of their roles in the operation, according
                                       to WFP’s Transport Manual. A staff member from the WFP country



                                 47
                                   Superintendents are independent cargo surveyors, employed by WFP to inspect WFP
                                 shipments at the time of delivery and ascertain their quantity and condition on delivery.




                                 Page 24                                                  GAO-12-790 World Food Program Internal Controls
    office should be present, where feasible, or should monitor the
    operation through superintendents or agents. In addition, the country
    office should ascertain how the commodities will be stored after
    delivery or moved from the port.

•   Transport. Transporters bidding on contracts to transport WFP food
    assistance receive WFP’s terms of agreement detailing, among other
    things, the transporter’s liability for any losses or damage of food in its
    custody. According to the Transport Manual, a waybill must
    accompany food in the transporter’s custody, attesting to the type and
    quantity of commodities transported; the name of the transporter; the
    vehicle details; the loading location and destination; and the departure
    and expected and actual arrival dates. At the destination, the WFP
    warehouse manager or consignee completes, signs, and stamps the
    waybill, acknowledging receipt and noting any loss or damage. The
    manager then makes a parallel entry in COMPAS—WFP’s commodity
    tracking system—which automatically adjusts data, such as for stored
    or damaged goods, at the receiving site. After the food is delivered,
    the transporter submits the completed waybill to WFP’s finance office
    to request payment for the services rendered.

•   Warehouse. Food commodities in WFP warehouses must be
    managed through the COMPAS inventory module, according to
    WFP’s Transport Manual. In warehouses not yet computerized,
    commodities are to be managed through warehouse ledgers that are
    checked against stack cards on a regular basis. 48 In addition, the
    warehouse manager is required to conduct physical inventory of stock
    in the warehouses at regular intervals, to prevent and detect losses.
    Further, WFP staff are instructed to reconcile information on incoming,
    outgoing, and on-hand stock, as well as information from manual
    systems—stack cards and ledgers—with information in COMPAS.
    WFP’s Warehouse Management Handbook documents procedures
    for the storekeeper, including procedures for maintaining warehouse
    premises—such as installing boundary fences and gates to secure the
    warehouse against unauthorized entry—and warehouse buildings;
    procedures for unloading and checking food commodities, such as
    inspecting each new container food unloaded and addressing any
    defects; and procedures for creating and maintaining records. Further,


48
  Stack cards provide information on shipping instructions, batch numbers, type of
commodity, date of arrival, quantity originally stacked, quantity out, and the balance, all
which is signed for on the card itself.




Page 25                                    GAO-12-790 World Food Program Internal Controls
    WFP’s Program Guidance Manual outlines procedures for WFP staff
    to follow in taking food from WFP warehouses for distribution to
    beneficiaries.

•   Distribution to beneficiaries. WFP’s Program Guidance Manual
    states that WFP staff must complete various tasks immediately before
    distributing food assistance, such as verifying that required food has
    arrived, that distribution documents are ready, and that local
    authorities are present at the distribution. In addition, WFP staff must
    follow detailed instructions during the distribution, including scooping
    and weighing food and requiring that beneficiaries record their receipt
    of food rations.

Figure 4 shows some of WFP’s control activities, from delivery of food
commodities at the port-of-entry to distribution of food to beneficiaries.




Page 26                            GAO-12-790 World Food Program Internal Controls
Figure 4: Examples of WFP Control Activities from Port-of-Entry to Distribution of Food Assistance




                                         Page 27                               GAO-12-790 World Food Program Internal Controls
WFP Has Policies and            WFP has policies and procedures designed to help prevent loss of food
Procedures to Help Prevent      after delivery to its implementing partners. For example, on receipt of
Loss of Food in Implementing    WFP commodities, implementing partners are required to complete, sign,
Partners’ Custody               and stamp the WFP waybill, acknowledging receipt and noting any loss or
                                damage, and WFP staff are to subsequently record information from the
                                waybill into COMPAS, according to WFP’s Transport Manual. In addition,
                                WFP requires its implementing partners to submit monthly and quarterly
                                distribution reports containing information that WFP staff also record in
                                COMPAS, such as amounts of food in the warehouse before receipt of a
                                new shipment, amounts of food received, and amounts of food
                                distributed. These reports also show the movements of received and
                                distributed food items as well as any losses that have occurred at the
                                implementing partners’ warehouses or during transport arranged by the
                                implementing partners. The WFP country office is responsible for
                                ensuring that implementing partners’ reporting is regular, timely, and
                                complete and for checking the quality of the data in the distribution
                                reports. According to WFP’s Transport Manual, these data quality checks
                                are to include the overall consistency of the commodity accounts, such as
                                accounting for the difference between opening stock and closing balance;
                                completeness of data; and reconciliation of data on losses where
                                relevant. The WFP country office is required to record in COMPAS the
                                information in the distribution reports, to enable a complete accounting for
                                the commodity logistics chain.

Commodity Tracking System       Weaknesses in the design of COMPAS limit WFP’s ability to account for
Has Weaknesses, Particularly    all food commodities, particularly in implementing partners’ custody.
Tracking Food in Implementing   According to WFP, although food commodities in WFP warehouses are
Partners’ Custody               managed and tracked through COMPAS, COMPAS does not track food
                                after delivery to implementing partners and thus cannot fully account for
                                food after it is handed over to implementing partners.

                                In 2011, the External Auditor found that COMPAS does not allow the
                                recording of accurate dates for distributions by an implementing partner at
                                multiple sites in a given location, such as a city or province. 49 The auditor
                                noted that COMPAS permits the entry of only one distribution report per
                                implementing partner for a location for a specified period. In cases where
                                implementing partners distribute food at multiple sites in a given location,



                                49
                                 World Food Program, Report of the External Auditor on WFP Operations in Somalia,
                                WFP/EB.1/2011/5-B/1 (2011).




                                Page 28                               GAO-12-790 World Food Program Internal Controls
WFP staff are able to enter in COMPAS the implementing partners’
reports for the extra sites only by entering different, and therefore
inaccurate, reporting dates. The External Auditor recommended that, to
facilitate reconciliation between WFP allocation plans and implementing
partners’ distribution reports, distribution site data should be captured in
COMPAS for all food delivered to implementing partners. WFP agreed
with the External Auditor’s recommendation, stating that COMPAS now
includes information on distribution sites, allowing offices to specify where
distributions took place. 50

In 2011, WFP’s External Auditor also identified other weaknesses in
COMPAS that hamper effective reconciliations of data in COMPAS. 51 For
example, the External Auditor observed that COMPAS does not facilitate
the generation of reports or the export of a full set of data and, as a result,
staff use other software to retrieve needed information from the system,
exporting the information to worksheets for reconciliation. 52 According to
the External Auditor, this practice impairs data integrity. The External
Auditor recommended that until WFP develops a new system to address
the weaknesses in COMPAS, standardized report-generating tools should
be used to prevent unauthorized staff from accessing COMPAS data.
WFP did not agree with this recommendation and stated that it already
uses recognized software to generate reports accessing COMPAS data
and that it controls staff’s access to the data by limiting access rights. 53 In
addition, WFP’s management said that it sees no current benefit in further
investment in reporting tools because it has begun an initiative, under the
WFP Information Network and Global System II, to build a new logistics
application—the Logistics Executions Support System—that includes
commodity-tracking capabilities. According to WFP, assuming the
availability of needed funding, WFP expects implementation of the new
system to begin by the end of 2012 and to be completed by 2015.



50
 World Food Program, WFP Management Response to the Report of the External
Auditor on WFP Operations in Somalia, WFP/EB.1/2011/5-B/1/Add.1 (2011).
51
 World Food Program, Report of the External Auditor on WFP Operations in Somalia.
52
  The External Auditor stated that, according to WFP management, COMPAS was
developed as a data entry tool and separate applications, based on Microsoft Access and
Oracle Discoverer, were subsequently developed for generating reports.
53
 World Food Program, WFP Management Response to the Report of the External
Auditor on WFP Operations in Somalia.




Page 29                                 GAO-12-790 World Food Program Internal Controls
Information and              WFP has several mechanisms to enable communications between WFP
Communication: WFP           management and stakeholders. 54 Further, WFP management has
Has Taken Steps to           recently improved its communication with the Executive Board.
Enhance Communication         Information and Communication
with Stakeholders             According to COSO, pertinent information must be identified, captured and
                              communicated in a form and timeframe that enables people to carry out their
                              responsibilities.
                             Source: COSO, “Internal Control—Integrated Framework” (1992).




WFP Has Several Mechanisms   WFP has developed mechanisms to identify, capture, and communicate
to Enable Communications     information pertinent to its assistance efforts, among other things, to WFP
between WFP Management and   management and stakeholders. For example:
Stakeholders
                             •     According to WFP’s Finance and Budget Manual, WFP management
                                   provides information about approved emergency operations and
                                   submits proposals for protracted relief and recovery operations above
                                   a given threshold to the Executive Board. 55 These documents contain,
                                   among other things, details such as the number of beneficiaries,
                                   project duration, amount of food needed, and the cost of the food.
                                   These documents also have sections that discuss, for example,
                                   related actions of the country’s government and other entities; WFP’s
                                   assistance objectives and strategy response; WFP’s implementing
                                   partners; WFP’s performance monitoring methodology, risk
                                   assessment, and contingency planning; and security considerations
                                   related to operating in the environment.

                             •     WFP country offices prepare standard project reports to inform
                                   stakeholders about the use of resources for a given project and the
                                   results obtained during the reporting year. 56


                             54
                                According to WFP, stakeholders may include implementing partners, host governments,
                             nongovernmental organizations, UN agencies, contractors, and suppliers. Other
                             stakeholders may include the media, beneficiaries, and internal entities, such as a WFP
                             regional bureau, a headquarters division, or a neighboring country office.
                             55
                                The Executive Director has the authority to approve protracted relief and recovery
                             operations with food values of $20 million or less and must inform the Executive Board of
                             the approval. The board must approve protracted relief and recovery operations with food
                             values in excess of $20 million.
                             56
                               Standard project reports are prepared for emergency operations, protracted relief and
                             recovery operations, development operations, and special operations but are not prepared
                             for bilateral projects. WFP considers a contribution to be bilateral if the donor directs that it
                             be used to support a project or operation that is not initiated by WFP.




                             Page 30                                                  GAO-12-790 World Food Program Internal Controls
                         •     WFP’s logistics unit provides annual reports to the Executive Board
                               on losses of food assistance after delivery at the port-of-entry, based
                               primarily on data entered in COMPAS and WINGS II by the country
                               offices. The country offices are responsible for quantifying losses
                               during internal transport arranged by the country offices or regional
                               bureaus as well as losses during post-delivery storage that is
                               arranged and paid for by WFP.

                         •     WFP routinely distributes updates on its operations in the Horn of
                               Africa, 57 as well as separate monthly updates on its operations in
                               Somalia, to its member states and partner organizations, including
                               those within the UN system. These documents inform stakeholders
                               about WFP activities in these areas and cover, among other things,
                               the conditions of the areas, the beneficiaries WFP intends to assist,
                               and information on resources or funding, as well as, in the case of
                               Somalia updates, data on distribution sites monitored. According to a
                               WFP official, WFP started distributing these updates in August 2011,
                               following the declaration of famine in Somalia.

WFP Management Has       Some of WFP’s Executive Board members informed us that WFP
Recently Improved Its    management improved its communications with the board after lapses in
Communication with the   communication during the time of the Somalia allegations. For example,
Executive Board          in February 2011, WFP management initiated informal quarterly
                         operational briefings with Executive Board members. 58 According to staff
                         at the U.S. Mission to the UN Agencies in Rome, WFP held four
                         operational briefings in 2011, holding its first briefing after the WFP
                         Executive Board’s initial session that year. In June 2012, the U.S. Mission
                         to the UN Agencies in Rome staff told us that they had received two such
                         briefings since January and that a third is planned for September. In
                         addition, WFP stated that it had conducted three seminars in Nairobi with
                         key stakeholders, including board members, WFP field staff, and
                         implementing partners, in June 2011 to examine the risks faced and
                         potential solutions in Somalia. Further, in September 2011, according to
                         staff at the U.S. Mission to the UN Agencies in Rome, WFP briefed the
                         Executive Board on the outcome of the Nairobi workshops. One board
                         member informed us that the discussions in Nairobi were much more


                         57
                             The Horn of Africa updates cover Djibouti, Ethiopia, Kenya, Somalia, and Uganda.
                         58
                           World Food Program, Update on the Implementation of the External Auditor
                         Recommendations on WFP’s Operations in Somalia, WFP/EB.A/2011/6-I (Rome, Italy:
                         2011).




                         Page 31                                   GAO-12-790 World Food Program Internal Controls
                                productive than the usual board meeting discussions. Also, board
                                members told us that WFP informed the board in advance about an
                                investigation of an implementing partner in Mogadishu, Somalia.

                                WFP also developed a process for staff at the country level to follow in
                                communicating information about risks to WFP management. This
                                process is currently effected through normal management channels and
                                includes the escalation of information about events from the country office
                                level, to the regional bureau, to the chief operating officer, and finally to
                                the executive management council. In addition, WFP developed
                                procedures for its staff to follow in response to a suspected case of
                                diversion or wrongdoing. However, neither the new process nor
                                procedures include clear criteria as to when issues should be escalated to
                                the board. According to WFP, the circumstances will dictate the criteria
                                for escalation to the Executive Board.


Monitoring: WFP Has             WFP has developed detailed policies to help WFP monitors conduct field
Developed Guidance for          monitoring as laid out by country offices’ monitoring plans. However,
Field Monitoring of Food        although WFP’s External Auditor recommended risk profiling as a basis
                                for focused monitoring, WFP’s organization-wide monitoring guidance
Assistance but Does Not         does not provide clear instructions to monitor distribution sites based on
Call for Risk-Based             risk, including risks to WFP’s ability to distribute food to intended
Monitoring                      beneficiaries.

                                 Monitoring
                                 According to COSO, monitoring is the means of assessing the quality of an internal
                                 control system’s performance over time to ensure that internal controls continue to
                                 operate effectively. This is accomplished through ongoing monitoring activities, separate
                                 reviews, or a combination of the two.
                                Source: COSO, “Internal Control—Integrated Framework” (1992).




WFP Has Developed Detailed      WFP has developed detailed guidelines and policies that provide
Policies for Field Monitoring   guidance to WFP staff and monitors on their roles and responsibilities in
                                designing and implementing field monitoring of WFP operations. Detailed
                                organization-wide guidance for monitors is available in WFP’s Monitoring
                                and Evaluation Guidelines and in WFP’s Program Guidance Manual,
                                which includes guidance for conducting food distribution monitoring and
                                post-distribution monitoring for emergency operations and relief activities.
                                In line with COSO’s monitoring standards, WFP’s Monitoring and
                                Evaluation Guidelines states that all WFP’s operations should be
                                regularly and systematically monitored and evaluated and that emergency
                                operations must immediately put in place a system for food distribution



                                Page 32                                                  GAO-12-790 World Food Program Internal Controls
monitoring so that reliable information is available on who is being fed
and how much food they are receiving. 59 According to COSO, monitoring
should include the existence of mechanisms for capturing and reporting
identified internal control deficiencies. In line with COSO, WFP guidance
instructs monitors to follow-up on any problems from prior distributions,
crosscheck data, and notify their supervisor of any discrepancies noted
during the collection of monitoring data.

WFP’s monitoring and evaluation guidance provides instructions for
collecting field data, including discussions of sampling options, methods
for choosing beneficiaries to interview, and instructions on collecting and
processing qualitative data. In addition, WFP has developed numerous
forms for food aid monitors to conduct on-site food distribution monitoring
and post-distribution monitoring. WFP’s job profile for its monitors states
that they are responsible for conducting continuous monitoring and
reporting of food assistance, identifying potential problems, and
periodically monitoring risk management and report on any actions taken.

According to COSO, monitoring includes communications from external
parties to corroborate internally generated information or to indicate
problems. COSO also states that effective monitoring includes following
up on corrective action where necessary. WFP guidelines reflect the
COSO guidance by stating that WFP should work together with
implementing partners to crosscheck monitoring findings, ensure that
corrective action is taken when required, and assess the reliability and
accuracy of partners’ monitoring reports.

Our review of WFP’s monitoring guidelines indicates that WFP country
offices develop their countries’ monitoring plans and goals, including
determining the number of sites to monitor and the frequency of
monitoring. WFP guidelines state that country offices are responsible for
monitoring and reporting on the progress, performance, and
achievements of operations and programs as well as the handling and
use of WFP-supplied commodities. WFP guidance also states that the
amount of monitoring required depends on the distribution system



59
  WFP’s Monitoring and Evaluation Guidelines states that the main components of a
monitoring and evaluation strategy are (1) a logical framework; (2) a monitoring and
evaluation plan for data collection and analysis; (3) reporting flows and formats; (4) a
feedback and review plan; (5) a capacity building design; (6) an implementation schedule;
and (7) a budget.




Page 33                                 GAO-12-790 World Food Program Internal Controls
                               adopted, the quantity of food being distributed, and the level of access to
                               the distribution site.

WFP’s Monitoring Guidance      WFP officials in Rome, Ethiopia, Kenya, and Somalia told us that country
Does Not Call for Risk-Based   offices often focus their monitoring efforts on areas with a history of
Monitoring Recommended by      implementation and security problems. 60 However, WFP’s organization-
External Auditor               wide monitoring guidance does not provide clear instructions or
                               guidelines stating that monitoring of warehouses and distribution sites
                               should be based on risk, including risks to WFP’s ability to distribute food
                               to intended beneficiaries. In 2006, the External Auditor recommended that
                               WFP use statistical sampling approaches based on risk profiling and
                               informed by implementing partner records, beneficiary concerns, and
                               prior history, as a basis for focusing its monitoring resources. 61 According
                               to COSO, an effective approach to monitoring includes designing and
                               executing monitoring procedures that are prioritized based on risks to
                               achieving organizational objectives.

                               WFP’s organization-wide field monitoring guidance instructs monitors to
                               follow up on issues based on prior field monitoring findings and also notes
                               that risks, along with resources, budget and other factors should be
                               captured in monitoring and evaluation plans. 62 However, the guidance
                               does not clearly instruct WFP staff and field monitors to consider risk as a
                               key factor when determining the level of monitoring needed at
                               warehouses and distribution sites. In addition, the guidance does not
                               include instructions for tailoring monitoring based on the types of risk
                               identified, including contextual risks, such as armed conflict, and
                               institutional risks that could affect WFP’s reputation. For example, WFP’s
                               organization-wide monitoring guidance does not address alternative
                               approaches to ensuring monitoring of food assistance distribution sites in
                               high-risk areas where the UN Department of Safety and Security
                               (UNDSS) has restricted WFP staff’s access. Without specific guidance


                               60
                                 WFP officials told us that they also consider including risk, context of operations,
                               capacities of implementing partners, geographical spread, and resources when
                               determining the level of monitoring.
                               61
                                 United Kingdom National Audit Office, World Food Programme: Review of the
                               Arrangements for Reporting Post Delivery Food Losses to the Executive Board,
                               WFP/EB.1/2006/6-B/1 (2006).
                               62
                                 WFP’s guidance for monitoring the performance of its programs also instructs staff and
                               monitors to document the type of risks that could affect the achievement of a program’s
                               goals and outcomes.




                               Page 34                                    GAO-12-790 World Food Program Internal Controls
                           that monitoring should be risk-based, WFP staff lack appropriate
                           instructions to develop monitoring plans for those areas that are most
                           vulnerable to waste, fraud, and abuse.


                           In the areas of Ethiopia, Kenya, and Somalia that we selected for our
Security Restrictions      review, WFP has implemented procedures for tracking food from port-of-
and Limited Internal       entry to beneficiaries, but security restrictions and limited internal controls
                           in these areas weaken WFP’s ability to track food delivered to
Controls Weaken            implementing partners. Further, although WFP has taken steps to
Assurance of Food          improve monitoring, security restrictions, a limited number of monitors,
Delivery and Accurate      and logistical challenges constrain its monitoring in these countries,
                           hampering WFP’s ability to identify problems with food distribution. WFP
Loss Reporting for         has reported low rates of food assistance losses, but we found potential
Selected High-Risk         weaknesses in its collection of loss data after food is handed over to
                           WFP’s implementing partners for distribution to beneficiaries. Moreover,
Areas                      no external evaluation of WFP’s food assistance loss data has been
                           conducted since 2006.


WFP Has Implemented        Our review of WFP operations in selected areas of Ethiopia, Kenya, and
Tracking Procedures but    Somalia showed that WFP has implemented procedures designed to
Has Limited Ability to     prevent loss of food in its custody. 63 However, limited access and lack of
                           timely reporting by some implementing partners in these areas weaken
Track Food in Custody of
                           WFP’s ability to track food in implementing partners’ custody.
Implementing Partners in
Selected Areas




                           63
                             We reviewed various documents for Ethiopia, Kenya, and Somalia that reflect controls
                           that WFP has implemented while tracking the food commodity from these countries’ ports
                           of entry to the intended beneficiaries for the period of January to June 2011. In this report,
                           we use the term “selected areas” to include the sites we visited in our case study
                           countries, the areas covered in the documents we reviewed, the areas covered in
                           interviews we conducted in our selected countries, and other reviews related to internal
                           controls in our case study countries that we determined were appropriate for our
                           researchable objectives. The areas we selected for review, like the countries we visited,
                           are not generalizable to all areas in the selected countries or to the broader universe of
                           WFP programs and operations.




                           Page 35                                    GAO-12-790 World Food Program Internal Controls
WFP Has Implemented               Our review of available documents for selected areas of Ethiopia, Kenya,
Procedures to Prevent Loss of     and Somalia, as well as our visits to sites in Ethiopia and Kenya, found
Food in Its Custody in Selected   that WFP has implemented procedures for receiving food at the port-of-
Areas of Ethiopia, Kenya, and     entry, procuring transporters, and storing food in WFP warehouses. 64 For
Somalia                           example:

                                  •   Port-of-entry. We reviewed signed superintendence reports for
                                      Ethiopia, Kenya and Somalia. Each report included description of food
                                      commodities received at the port, the quantity received, and the
                                      shipping instruction number. 65

                                  •   Transport. We reviewed signed requests for quotations from
                                      transporters in all three countries. We also reviewed samples of
                                      waybills for Ethiopia, Kenya, and Somalia that had been completed,
                                      signed by the dispatching and receiving warehouse storekeepers and
                                      the transporter, and stamped, per WFP policy.

                                  •   Warehouses. We visited three WFP warehouses—one in Ethiopia
                                      and two in Kenya. As required by WFP policy, the warehouses had
                                      fences surrounding the buildings and appeared solid and stable; the
                                      warehouses’ interiors appeared organized and were arranged to allow
                                      access to the stored commodities; and the commodities were stacked
                                      on raised platforms, with spacing between the top of the stacks and
                                      the roof. For all three countries, we viewed food release notes,
                                      reflecting requests for food that the countries’ WFP program unit had
                                      made to the logistics unit prior to the food’s release from WFP
                                      warehouses. 66 WFP staff in Ethiopia, Kenya, and Somalia informed us
                                      that they reconcile data from WFP physical inventories against data in
                                      COMPAS. In Ethiopia, we observed WFP staff had reconciled
                                      physical inventory counts at given dates against food amounts that
                                      had been recorded in COMPAS, with explanations for any noted




                                  64
                                    Because of logistical issues and security concerns, we were not able to visit sites in
                                  Somalia.
                                  65
                                    The shipping instruction number identifies a consignment and is one of the keys to
                                  tracking and pipeline management.
                                  66
                                    Instead of using food release notes, WFP Ethiopia uses document request forms to
                                  submit food requests. According to WFP, food release notes and document requests
                                  serve the same purpose.




                                  Page 36                                   GAO-12-790 World Food Program Internal Controls
                                       variations. 67 In Kenya, staff at WFP’s East and Central Africa
                                       Regional Bureau told us that WFP country office staff also complete
                                       monthly minimum closure reports, which the regional bureau staff use
                                       to verify that country offices have reconciled physical inventory counts
                                       against data in COMPAS. Further, staff at a WFP Ethiopia field office
                                       confirmed that they have segregated the duties of staff who have
                                       access to COMPAS. According to WFP, this practice is intended to
                                       maintain the integrity of the data recorded in COMPAS. For example,
                                       the head of logistics for the WFP Ethiopia office can access COMPAS
                                       to view and verify data recorded by field office staff but cannot edit or
                                       add to their inputs.


                                  Figure 5: WFP Warehouse in Ethiopia




Implementing Partners in          We visited a food distribution site at a refugee camp in Ethiopia and two
Selected Areas of Ethiopia and    distribution sites in villages in Kenya. We also observed an implementing
Kenya Have Implemented            partner’s implementation of controls during a food distribution at one of
Controls to Track Food in Their   the sites in Kenya. 68
Custody



                                  67
                                    We observed the reconciliation of physical inventory counts against data in COMPAS
                                  only in Ethiopia.
                                  68
                                   We did not visit sites where WFP distributed the food directly to the beneficiaries.




                                  Page 37                                  GAO-12-790 World Food Program Internal Controls
•    Ethiopia. At the food distribution site in Ethiopia, WFP’s implementing
     partner, the Ethiopian government, told us that every refugee
     household must have a ration card to receive food. 69 We were also
     told that before each distribution, members of a relief committee—four
     WFP beneficiaries—verify that the materials used to measure rations
     are accurate and that the distribution process is conducted properly.
     The implementing partner said that representatives of the
     implementing partner performed distribution and post-distribution
     monitoring. In addition, members of the relief committee told us that
     the implementing partner’s staff observes the food distribution
     process, and that the relief committee monitors the process and
     reports its findings to the implementing partner. Another third party,
     the UN High Commissioner for Refugees (UNHCR), also assists at
     the refugee camps. 70 Despite these controls, WFP has noted
     weaknesses in the Ethiopian government’s capacity to accurately
     account for, store, distribute, and report on food commodities in its
     care. 71




69
  According to a UNHCR representative, ration cards identify refugees and family
members eligible to receive rations. Ration cards are marked at the time of food
distribution, allowing implementing partners to verify that cardholders received their rations
for the distribution cycle.
70
  According to a 2012 WFP report, in Ethiopia, UNHCR’s chief responsibilities include
supporting the Ethiopian government with financial resources for the determination of
refugee status and registration processes and providing refugees with non-food items,
such as cooking utensils, blankets and soap, and complementary foods, to improve the
usability of the main food commodities that WFP provides. World Food Program,
Summary Report of the Joint UNHCR/WFP Impact Evaluation on the Contribution of Food
Assistance to Durable Solutions in Protracted Refugee Situations—Ethiopia,
WFP/EB.1/2012/6-E (2012).
71
  WFP has made efforts to strengthen the Ethiopian government’s capacity in food
commodity management through training and the development of a separate commodity
tracking database.




Page 38                                   GAO-12-790 World Food Program Internal Controls
Figure 6: Distribution of WFP Food Assistance in Kenya




•    Kenya. At one of the distribution sites in Kenya, we observed a food
     distribution administered by a nongovernmental organization. We also
     observed a relief committee monitoring the distribution process.
     Further, we observed that the implementing partner’s staff at the
     Kenya site organized the beneficiaries by family size, checking off
     beneficiaries from the beneficiary list as they received the ration, and
     that the implementing partner’s monitors were present for the
     distribution. In addition, beneficiaries told us that WFP monitors are
     normally present at the implementing partner’s distributions.
     According to WFP, the distribution we observed was 2 weeks late
     owing to land transport problems. At other distribution sites in Kenya,
     a 2011 WFP Office of Evaluation report on Kenya noted that some
     food distributions had frequently been missed in part because of
     logistical challenges. 72 The evaluation noted that one implementing
     partner reported that it had not delivered 10 of the past 15



72
 World Food Program Office of Evaluation, Summary Evaluation Report-Kenya Country
Portfolio, WFP/EB.2/2011/6-D (2011).




Page 39                              GAO-12-790 World Food Program Internal Controls
                                      distributions. The evaluation did not note whether the undistributed
                                      food was accounted for or held until the next distribution round.

Limited Access and Lack of       WFP staff in Ethiopia told us that they inspect the implementing partners’
Timely Reporting Weaken          warehouses to mitigate the lack of tracking through COMPAS of food
WFP’s Ability to Track Food in   delivered to implementing partners. They also said that they perform
Implementing Partners’           reconciliations of data in implementing partners’ monthly and quarterly
Custody                          distribution reports against data in COMPAS, as required by WFP’s
                                 Transport Manual. However, these efforts are constrained by limited WFP
                                 access as well as by a lack of timely reporting by implementing partners.

                                 •    Limited WFP access. According to WFP staff, security restrictions
                                      imposed by UNDSS limit WFP’s access to some areas and thus, in
                                      some cases, limit WFP’s ability to inspect implementing partners’
                                      warehouses and verify their reporting. For example, WFP Ethiopia
                                      told us that because of UNDSS security restrictions, WFP staff have
                                      not had access since May 2011 to six districts in the Somali region of
                                      Ethiopia, where about 7,500 metric tons of WFP food commodities
                                      were distributed in 2011. 73 According to WFP Ethiopia, one WFP staff
                                      was killed, one was injured, and two were taken hostage during an
                                      attack on WFP staff in this region in 2011. In addition, WFP Somalia
                                      staff told us that because of delays in finalizing a monitoring contract
                                      with a third party, there was limited WFP monitoring of implementing
                                      partners’ warehouses or distribution sites in Mogadishu for several
                                      months in late 2011. According to WFP Somalia, in December 2011,
                                      two WFP staff were murdered in central Somalia after they discovered
                                      the use of inflated beneficiary distribution lists.

                                 •    Lack of timely reporting by implementing partners. Some
                                      implementing partners in Ethiopia, Kenya, and Somalia do not submit
                                      their monthly distribution reports on a timely basis, according to WFP.
                                      To address this problem, WFP Somalia has developed standard
                                      operating procedures that outline steps that WFP staff in Somalia
                                      should take if implementation partners do not provide their distribution
                                      reports on time. WFP staff in Somalia also told us that in 2010 they
                                      distributed a warning letter to implementing partners stating that WFP
                                      will withhold payments if reports are late for 3 months or more.
                                      Further, WFP’s External Auditor stated that receiving timely monthly



                                 73
                                   According to WFP, in January 2012 UNDSS classified a 7th district in the Somali region
                                 of Ethiopia as inaccessible to WFP and other UN staff.




                                 Page 40                                 GAO-12-790 World Food Program Internal Controls
                                      distribution reports from implementing partners has historically been a
                                      challenge for WFP. In 2012, the WFP’s External Auditor reported that
                                      of a sample of 68 implementing partners, 27 (40 percent) had not
                                      submitted their monthly distribution reports at all, and as a result WFP
                                      had to estimate the figures for undistributed food. 74 The External
                                      Auditor recommended that WFP streamline the procedure for
                                      collecting timely distribution reports from implementing partners and
                                      enhance the quality of its reconciliation of data on food undistributed
                                      by the partners. WFP agreed with this recommendation and stated
                                      that it will seek to ensure that monthly distribution reports are
                                      submitted promptly and reconciled with WFP data. 75


WFP Has Taken Steps to           WFP has made efforts to increase field monitoring in Somalia and
Strengthen Monitoring, but       reported that field monitoring findings inform its programming in Ethiopia,
Limited Coverage in Some         Kenya, and Somalia. Despite these efforts, security restrictions and
                                 limited resources constrain field monitoring in some high-risk areas,
Areas Weakens Ability to         limiting WFP’s ability to identify problems with food distribution.
Identify Problems with           Furthermore, WFP and its External Auditor have identified weaknesses
Food Distribution                with WFP’s field monitoring.

WFP Has Made Efforts to          In the past 2 years, WFP has made efforts to increase its monitoring of
Increase Monitoring in Somalia   food distributions in Somalia. WFP monitoring and evaluation guidelines
                                 state that all WFP operations should be regularly and systematically
                                 monitored and evaluated. From 2009 to early 2011, the UN Monitoring
                                 Group on Somalia, WFP’s Inspector General, and WFP’s External Auditor
                                 all investigated the allegations of food diversion in Somalia and reported
                                 control weaknesses. 76 According to WFP, security restrictions prevented
                                 WFP from conducting field monitoring of general food distribution in
                                 Mogadishu in 2010. As a result, all WFP monitoring activities in the city
                                 that year consisted of “alternative monitoring,” which generally involved
                                 contacting stakeholders, such as implementing partners and



                                 74
                                  World Food Program, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012).
                                 75
                                   World Food Program, Report on the Implementation of the External Auditor
                                 Recommendations, WFP/EB.A/2012/6-H/1 (2012).
                                 76
                                   World Food Program’s Inspector General Office, Office of Inspections and
                                 Investigations, Investigations of Allegations of Food Diversions in Somalia; UN Monitoring
                                 Group on Somalia, Report of the Monitoring Group on Somalia Pursuant to Security
                                 Council Resolution 1853; Comptroller and Auditor General of India, External Audit Report:
                                 World Food Programme’s Somalia Operations.




                                 Page 41                                  GAO-12-790 World Food Program Internal Controls
beneficiaries, via telephone to inquire whether distributions had occurred
as planned.

In late 2010, WFP began contracting with third-party monitors 77 in
Somalia to increase its monitoring coverage in areas that are inaccessible
to WFP staff and monitors because of UNDSS security restrictions. 78 In
August 2012, WFP told us that a total of 25 third-party monitors were
working in three areas in Somalia—10 in Mogadishu, 10 in Central
Somalia, and 5 in the southern border areas. WFP stated that in
Mogadishu, third-party monitors conduct most of WFP’s monitoring
because of the security risks in the city. WFP noted that 47 percent of its
distribution sites in Mogadishu were monitored in January 2012,
compared with no field monitoring of distribution sites in Mogadishu in
2010. In areas that are inaccessible to WFP and third-party monitors
because of remoteness or security risks, WFP staff in Somalia continue to
telephone key stakeholders, including beneficiaries and implementing
partners, to verify that distributions took place as planned, according to
WFP. However, according to a 2011 report by WFP’s External Auditor,
this form of alternative monitoring may not always be reliable. 79 For
example, the External Auditor stated that the WFP’s Somalia country
office certified through telephone monitoring that WFP food assistance
had been delivered to a site in Somalia for 2 months in 2009, but food
was not provided to beneficiaries at this site during that time period. (See
fig. 9 in app. III for more information on investigations of the Somalia
allegations and the challenges WFP faces in that country).

Since July 2010, WFP Somalia has also maintained a beneficiary
telephone hotline, which allows beneficiaries of WFP food assistance to
provide anonymous feedback on WFP’s operations, monitors, and



77
   Third-party monitors are generally local staff hired by private firms rather than by WFP,
the recipient government, or implementing partners. According to WFP, its third-party
monitors must have the same qualifications and receive the same training as WFP
monitors. Because WFP began using third-party monitors relatively recently and provided
limited documentation on its use of third party monitors, we were unable to assess the
effectiveness and qualifications of these monitors or to verify the type of training they
received.
78
  WFP has also used third-party monitors in Afghanistan since 2007 and in Pakistan since
2009.
79
  Comptroller and Auditor General of India, External Audit Report: World Food
Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011).




Page 42                                   GAO-12-790 World Food Program Internal Controls
                             implementing partners. 80 According to WFP, as of August 2012, the
                             hotline had received a total of only 48 calls, more than half of them
                             requests to become beneficiaries or complaints that rations were smaller
                             than expected. WFP officials in Somalia attributed the low number of calls
                             to the fact that the hotline number is not posted at all distribution sites and
                             is not Somalia based, causing beneficiaries concern about the cost of
                             calling an international number. WFP officials in Somalia said that,
                             because the hotline has not been as effective as they envisioned, they
                             plan to introduce a Somalia-based number and initiate a more systematic
                             approach to informing beneficiaries about the hotline.

WFP Reports That Field       Field monitoring findings are used to inform WFP programming in
Monitoring Findings Inform   Ethiopia, Kenya, and Somalia, according to WFP officials. WFP’s
Programming in Ethiopia,     monitoring and evaluation guidelines describe monitoring as a continuing
Kenya, and Somalia           function that uses systematic data collection to inform management of
                             food aid programs’ progress and results. WFP staff in Ethiopia, Kenya,
                             and Somalia told us that field monitors’ findings are captured in a
                             narrative monthly report that is sent to the WFP country office and that
                             these findings are used to inform programming. For example, WFP staff
                             in Ethiopia told us that they increased refugees’ wheat rations by 20
                             percent in response to monitors’ findings that the additional amount was
                             needed to cover milling costs and milling losses. In addition to ensuring
                             that it received the monthly reports on field monitors’ findings, WFP also
                             set up a countrywide system in Somalia to consolidate, track, and report
                             on monitoring findings and the follow-up status for WFP operations
                             through a Somalia-specific monitoring database and a monthly monitoring
                             and evaluation report. As recommended by the External Auditor in
                             2011, 81 this report includes analysis of any significant variations between
                             distribution monitoring and post-distribution monitoring. 82 According to
                             WFP, the Somalia country office uses the monitoring findings and results
                             captured in the Somalia-specific database and report to develop each




                             80
                               WFP has also established a beneficiary hotline for operations in Afghanistan and
                             Pakistan.
                             81
                               Comptroller and Auditor General of India, External Audit Report: World Food
                             Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011).
                             82
                               Because WFP provided us with a single Somalia monitoring and evaluation report, from
                             March 2011, we were able to verify the content of only that report.




                             Page 43                                 GAO-12-790 World Food Program Internal Controls
                                   month’s monitoring plan and send field missions to further investigate
                                   program issues. 83

Several Challenges Constrain       Several factors—security restrictions limiting access to some high-risk
Field Monitoring in High-Risk      areas, limited numbers of monitors to cover all distribution sites, and
Areas, Limiting WFP’s Ability to   logistical challenges affecting field monitoring—constrain WFP's ability to
Identify Problems with Food        identify problems with food distribution in selected areas of Ethiopia,
Distribution                       Kenya, and Somalia.

                                   Security Restrictions

                                   UNDSS security restrictions, which limit WFP’s access to some high-risk
                                   areas in Ethiopia, Kenya, and Somalia, constrain WFP’s monitoring of
                                   these areas, according to WFP. COSO states that monitoring procedures
                                   should be prioritized based on risks that could affect an organization’s
                                   ability to achieve its objectives. Because of its restricted access to some
                                   high-risk distribution sites, WFP is unable to prioritize monitoring for these
                                   sites despite the risks.

                                   •     Ethiopia. Since May 2011, WFP has reported being unable to
                                         conduct any field monitoring in six districts in the Somali region in
                                         eastern Ethiopia because of UNDSS security restrictions. 84 In
                                         addition, according to WFP, it has not provided for third-party
                                         monitoring in these districts. WFP reported that it provided 193,565
                                         metric tons of food to almost 2.4 million beneficiaries at 869
                                         distribution sites and five refugee camps in Somali throughout 2011.
                                         The Ethiopian government, as WFP’s implementing partner,
                                         distributes all food assistance for WFP’s refugee and relief programs
                                         in Ethiopia. According to WFP’s monitoring plan for Ethiopia, WFP
                                         aims to monitor 100 percent of distribution sites in the Somali region;
                                         however, it is currently not possible for WFP staff to access some
                                         sites owing to UNDSS restrictions. USAID, WFP, and UNHCR have
                                         reported on a lack of WFP monitoring coverage in some parts of the
                                         Somali Region in Ethiopia. For example, a June 2011 USAID
                                         monitoring report on two Somali refugee camps found that WFP was



                                   83
                                     WFP Somalia has also created standard operating procedures to determine how the
                                   results of monitoring should be used, as recommended by WFP’s External Auditor in its
                                   2011 report on Somalia.
                                   84
                                       UNDSS classified an additional district in this region as inaccessible in January 2012.




                                   Page 44                                     GAO-12-790 World Food Program Internal Controls
      not conducting proper post-distribution monitoring. 85 Another 2011
      USAID document stated that food assistance may have been
      distributed or sold to people who were not intended beneficiaries.
      According to a 2010 joint WFP, UNHCR, and Ethiopian government
      report, some refugee beneficiaries claimed that they did not receive
      the full amount of their food rations when WFP was not present to
      observe food distributions carried out by the Ethiopian government in
      the Somali region. 86

•     Kenya. A USAID document from August 2011 notes that WFP does
      not conduct post-distribution monitoring in a limited number of districts
      in northeastern Turkana, Kenya, because of security issues. In
      February 2012, WFP officials in Kenya told us that they rely on their
      implementing partner to monitor WFP programs in Mandera, Kenya,
      owing to security risks in that area. Further, in May 2012, WFP
      reported that because of security risks at the Dadaab Refugee Camp
      in Kenya, WFP’s post-distribution monitoring at that site would be
      limited. 87

•     Somalia. According to WFP, security risks have limited its ability to
      monitor distribution sites. For example, WFP reported that it achieved
      monitoring coverage of 58 percent of about 100 distribution sites in
      Mogadishu in February 2012. However, according to WFP, only 3
      percent of these distribution sites were monitored in November and
      December 2011, owing to security risks and delays in securing a
      contract with a third-party monitoring firm. 88 WFP reported that it
      provided, through implementing partners, more than 3,500 metric tons
      of food to more than 350,000 beneficiaries in November 2011 and
      provided more than 5,000 metric tons of food to more than 400,000
      beneficiaries in February 2012 at these distribution sites in



85
  USAID conducts monitoring visits of U.S.-funded WFP operations and summarizes
these findings in a narrative document.
86
  World Food Program, United Nations High Commissioner for Refugees, and Ethiopian
Government Administration for Refugee and Returnee Affairs, Ethiopia 2010, Joint
Assessment Mission: Major Findings and Recommendations (2010).
87
    World Food Program, Horn of Africa Crisis, No. 33. (2012).
88
  Although WFP did not provide monitoring data for Mogadishu for October 2011, WFP
officials in Somalia told us that limited monitoring was conducted in Mogadishu during that
month.




Page 45                                   GAO-12-790 World Food Program Internal Controls
     Mogadishu. 89 In addition, WFP reported that only 6 percent of the
     border areas in Somalia were monitored in February 2012, owing to
     security risks in the area.

Limited Number of Monitors to Cover All Sites

WFP reported having a limited number of monitors to cover all distribution
sites in Ethiopia, Kenya, and Somalia. According to WFP, it does not
have the resources to monitor all distribution sites every month and
therefore must determine how best to allocate these resources. WFP
reports that on a monthly basis, 81 WFP monitors cover more than 3,000
distribution sites in Ethiopia; 49 WFP monitors cover more than 2,500
distribution sites in Kenya; 90 and 64 WFP and third-party monitors cover
more than 1,200 distribution sites in Somalia. In 2012, the UN Monitoring
Group on Somalia reported that when monitors were not present during
some food distributions in Mogadishu, local officials or other individuals
controlling access to food assistance often required beneficiaries to sell
the food back to them for a fraction of its value. 91 According to a USAID
document, WFP staff in Ethiopia and one of WFP’s implementing partners
in Kenya, some distributions can take 5 days or more in parts of Ethiopia
and Kenya, which, according to WFP, does not allow WFP monitors to be
present from start to finish at these distributions. During our fieldwork in
Ethiopia and Kenya, WFP beneficiaries and implementing partners told us
that WFP often is not present to conduct monitoring. 92 At the Shimelba
refugee camp in Ethiopia, WFP’s implementing partner and beneficiaries


89
  The data on monitoring coverage, beneficiaries and metric tons are provided in the
Somalia monthly updates that WFP sends to stakeholders. The most recent data on
beneficiaries and metric tons provided, from the reports that we saw for Mogadishu, are
for February 2012. The reports did not provide these data for December 2011 or January
2012.
90
  Only general food distributions and food-for-assets distributions take place at these sites
in Kenya.
91
   UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security
Council Resolution 2002 (2011), S/2012/544 (2012).
92
  According to WFP, WFP monitors’ access to some sites in Ethiopia and Kenya is limited
by UNDSS security restrictions. Using its 6-point scale, UNDSS has rated the area where
the Shimelba Refugee Camp is located at security level 3; Turkana, Kenya, at security
level 4; and Mwingi, Kenya, at security level 2. In Turkana, we witnessed a general food
distribution that occurred 2 weeks later than scheduled owing to land transport issues,
according to WFP. Because of U.S. government security restrictions, we were unable to
conduct any fieldwork in Somalia.




Page 46                                   GAO-12-790 World Food Program Internal Controls
                              told us that more WFP monitors were needed. Moreover, NGOs operating
                              in Somalia told us that WFP does not have a large enough presence in
                              the country. (See tables 4 and 5 in app. III for data on monitoring in
                              Ethiopia, Kenya, and Somalia).

                              Logistical Challenges

                              Logistical challenges make it difficult for monitors to cover many
                              distribution sites. For example, one WFP monitor we met with at the
                              Shimelba refugee camp in Ethiopia told us that every month he must
                              conduct distribution and post-distribution monitoring at 19 distribution
                              sites and one refugee camp in the Tigray region in Ethiopia, a remote
                              area of more than 20,632 square miles—larger than the combined areas
                              of Vermont and New Hampshire—with rough terrain. In the last 3 months
                              of 2011, WFP reported conducting monitoring at the Shimelba refugee
                              camp only in December. In Turkana and Shimelba, WFP staff told us that
                              WFP’s monitoring coverage is often constrained by weather conditions
                              and poor roads, which make traveling to some distribution sites difficult
                              and time consuming for monitors who must cover many sites.

WFP and External Auditor      In recent years, WFP’s Office of Evaluation and the External Auditor have
Have Found Field Monitoring   identified weaknesses in WFP’s field monitoring of its programs. Seven of
Weaknesses                    18 evaluations of WFP’s country and operation programs, including
                              evaluations covering two of our case study countries, 93 published by
                              WFP’s Office of Evaluation from 2010 to 2012 raised concerns about
                              WFP’s field monitoring. Some of these concerns included limited
                              competency of monitors, insufficient monitoring to verify under-scooping
                              of food rations, and inadequate monitoring of food storage to ensure
                              adequate programming. In addition, in 2006, WFP’s External Auditor
                              reported monitoring weaknesses, including an instance when monitors
                              had not reported some losses because they believed that WFP required
                              monitors to report only food losses representing more than 2 percent of a
                              total delivery. 94




                              93
                               Three of the 18 evaluations covered Ethiopia and Kenya.
                              94
                                United Kingdom National Audit Office, World Food Programme: Review of the
                              Arrangements for Reporting Post Delivery Food Losses to the Executive Board,
                              WFP/EB.1/2006/6-B/1 (Rome, Italy: 2006).




                              Page 47                                GAO-12-790 World Food Program Internal Controls
WFP Has Reported Low             WFP reported low rates of food assistance losses for Ethiopia, Kenya,
Rates of Food Assistance         and Somalia in 2007 through 2011. However, reports by the UN
Losses for Ethiopia, Kenya,      Monitoring Group and WFP’s External Auditor raise questions regarding
                                 WFP’s reporting of losses for Somalia in 2009. More broadly, several
and Somalia, but Its             factors—lack of timely reporting by implementing partners, limited access
Collection of Loss Data          to implementing partners’ warehouses and distribution sites in some high-
Has Potential Weaknesses         risk areas, and limited beneficiary reporting—weaken WFP’s ability to
                                 assure accurate reporting of data on losses of food in implementing
                                 partners’ custody. Despite donor and Executive Board concerns, no
                                 external evaluation of WFP food loss data has been conducted since a
                                 2006 review by WFP’s External Auditor. In that report, the auditor noted
                                 that inadequate reporting of losses presents not only risks to the
                                 effectiveness of WFP’s aid efforts and the achievement of its objectives
                                 but also reputational risks in terms of donor confidence.

WFP Has Reported Low Loss        For 2007 through 2011, WFP reported lower average loss rates for its
Rates for Ethiopia, Kenya, and   operations in Ethiopia, Kenya, and Somalia than for its operations
Somalia                          worldwide. WFP reported average loss rates of 0.30 percent for Ethiopia,
                                 0.21 percent for Kenya, and 0.25 percent for Somalia, compared with an
                                 average loss rate of 0.41 percent for $2.5 billion of total food handled
                                 annually worldwide. 95 According to WFP, short-delivery—that is, delivery
                                 of a smaller quantity of commodities than expected—and theft were the
                                 top reasons reported for global losses, with short-delivery accounting for
                                 27 percent and theft accounting for 20 percent of all losses.

                                 Figure 7 compares WFP’s annual reported food assistance loss rates for
                                 Ethiopia, Kenya, and Somalia with its global average loss rates for 2007
                                 through 2011.




                                 95
                                   We compiled data on WFP’s food assistance losses from its 2007-2011 annual reports
                                 on food assistance losses and used these data to calculate summary statistics.




                                 Page 48                                GAO-12-790 World Food Program Internal Controls
Figure 7: WFP’s Reported Food Assistance Losses in Ethiopia, Kenya, and Somalia and Worldwide, 2007-2011




External Oversight Reports             Reports by the UN Monitoring Group and WFP’s External Auditor raise
Raise Questions about WFP’s            questions regarding WFP’s reported food assistance losses in Somalia in
Reported Food Assistance               2009. As figure 7 shows, WFP reported a loss rate of 0.16 percent of the
Losses for Somalia in 2009             value of WFP food assistance handled in Somalia in 2009—the lowest
                                       rate that WFP reported for the country from 2007 through 2011. This rate
                                       reflects losses of 490.1 metric tons, valued at $239,291, from 355,760
                                       metric tons of total food assistance, valued at $152,237,880. Further,
                                       WFP’s 2009 annual report on food assistance losses shows lower loss
                                       rates for Somalia in 2009 than for 45 of the 74 countries where WFP
                                       operated that year. 96 In addition, in response to allegations in the media, 97



                                       96
                                        World Food Program, Report on Post-Delivery Losses for the Period 1 January–31
                                       December 2009, WFP/EB.A/2010/13-A/Rev.2 (2010).




                                       Page 49                               GAO-12-790 World Food Program Internal Controls
a December 2009 report by the WFP Office of Inspections and
Investigations did not find evidence of large-scale diversion. Instead, that
report estimated that up to 10 percent of food distributed each month was
sold in local markets by beneficiaries and thus was not diverted. 98
However, a report by the UN Monitoring Group on Somalia in 2010 found
that large-scale diversion of WFP food assistance had occurred in
Somalia in 2009. 99 For example, the report stated that in one instance, as
much as approximately $4.4 million in food (significantly more than WFP’s
reported losses of $239,291) may have been diverted directly to a local
market without first being distributed to beneficiaries. 100 Moreover, the
WFP External Auditor’s 2011 report on WFP operations in Somalia raised
doubts regarding the Office of Inspections and Investigations report’s
methodology. The External Auditor concluded that food sold at local
markets “may be higher than the 10 percent worked out by the Office of
Inspections and Investigations” and that its own findings “do not support
the [Office of Inspections and Investigations’] emphatic conclusion that
food sold by the beneficiaries was the only source of food aid found in the
markets.” 101

In addition, the reports by WFP’s Office of Inspections and Investigations
and External Auditor suggest that WFP’s limited monitoring of some food
distribution sites makes it difficult for the organization to ensure accurate
reporting of food assistance losses. Despite its conclusion that no large-
scale diversion of food assistance occurred in Somalia in 2009, the report
by WFP’s Office of Inspections and Investigations states that in some
areas of Somalia, WFP is not in a position to directly confirm the number
of beneficiaries in the various camps or to verify that food sent for the

97
  See Jonathan Rugman, “U.N. Probe after Aid Stolen from Somalia Refugees.” Channel
4 News (UK), June 15, 2009, accessed July 24, 2012, http://www.channel4.com/news.
98
  World Food Program, Office of Inspections and Investigations, Investigation of
Allegations of Food Diversions in Somalia, OSDI/51/09 – I 29/09 (2009).
99
 UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security
Council Resolution 1853 (2008), S/2010/91 (2010).
100
    The UN Monitoring Group on Somalia’s 2012 report found that large-scale diversions of
food assistance have continued in Somalia. According to the report, WFP has taken
measures to investigate and address allegations of diversion, including through the use of
third-party monitoring and independent audit firms. UN Security Council, Report of the
Monitoring Group on Somalia Pursuant to Security Council Resolution 2002 (2011),
S/2012/544 (2012).
101
   Comptroller and Auditor General of India, External Audit Report: World Food
Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011).




Page 50                                  GAO-12-790 World Food Program Internal Controls
                                 beneficiaries has reached them. Further, the WFP External Auditor’s
                                 report states that WFP has increasingly relied on alternative approaches
                                 to monitoring in Somalia, which the report characterizes as “subject to
                                 inherent bias.”

Several Factors Weaken WFP’s     Although WFP takes steps to collect accurate loss data, several factors—
Ability to Assure Accurate       limited access to implementing partners’ warehouses and distribution
Reporting on Losses of Food in   sites in some high-risk areas, lack of timely reporting by implementing
Implementing Partners’           partners, and limited beneficiary reporting—weaken WFP’s ability to verify
Custody                          implementing partners’ reporting on food in their custody. According to
                                 WFP’s internal control framework, WFP management and personnel must
                                 have access to relevant, reliable, and accurate information that promotes
                                 effective decision-making in line with their responsibilities. WFP’s controls
                                 over food in its custody are designed to help ensure accurate loss data;
                                 for example, WFP transporters and receiving warehouse managers must
                                 both verify and sign for food received at WFP warehouses. WFP also
                                 includes analysis of losses above predetermined thresholds in its annual
                                 report on food assistance losses. 102 Because COMPAS does not track
                                 food in implementing partners’ custody, WFP relies in part on data in
                                 implementing partners’ monthly and quarterly distribution reports to
                                 calculate losses of food in their custody.

                                 •     Limited WFP access. WFP’s lack of access to implementing
                                       partners’ warehouses and distribution sites in some high-risk areas,
                                       such as in Somalia, limits its ability to verify implementing partners’
                                       reporting. For example, WFP reported that only 3 percent of
                                       distribution sites in Mogadishu, Somalia, were monitored in the last 2
                                       months of 2011, owing in part to security restrictions and delays in
                                       recruiting a third-party monitoring firm. WFP also reported that it could
                                       not conduct any on-site field monitoring in Mogadishu in 2010
                                       because of security risks. Further, although WFP encourages




                                 102
                                     WFP’s annual report on food assistance losses includes analysis of losses in a country
                                 if (a) the country registered food assistance losses of a single food type that represent at
                                 least two percent of the tonnage handled of that food and that have an absolute value of
                                 at least $20,000 and (b) the country registered losses of a single food type that have an
                                 absolute value greater than $100,000. In addition, the report describes measures to
                                 minimize losses, reviews factors contributing to losses in specific context and the
                                 preventive actions taken, and provides updates on issues outstanding from previous
                                 reports. For example, see World Food Program, Report on Post-Delivery Losses for the
                                 Period 1 January–31 December 2011.




                                 Page 51                                   GAO-12-790 World Food Program Internal Controls
      unannounced monitoring visits, this approach is not always feasible in
      Somalia, according to WFP. 103

•     Lack of timely reporting by implementing partners. The failure of
      some implementing partners to submit the required monthly food
      distribution reports limits WFP’s ability to accurately report losses of
      food in the partners’ custody. In 2006, WFP’s External Auditor,
      commenting on problems with the timeliness of implementing
      partners’ food distribution reports, recommended that WFP include in
      its annual food assistance loss report the value and amount of
      commodities in the custody of the implementing partner whose reports
      WFP had not yet received. 104 WFP complied with this
      recommendation in its 2006 report on losses during 2005 105 but has
      not done so in subsequent reports. The External Auditor also
      recommended that WFP review, with a view to adopting a single
      global system, the country office systems being used to monitor
      implementing partner reporting. WFP stated in 2006 that it will explore
      the most appropriate means of monitoring implementing partner
      reporting and adopt a single global system by 2007; however, in
      January 2012, WFP reported that it was continuing to review country
      office systems and was still in the process of adopting a single global
      system. In addition, in its 2012 annual report, the External Auditor
      noted that getting timely distribution reports from implementing
      partners has historically been, and remains, a challenge. 106 The
      External Auditor recommended that WFP streamline the procedure for
      collecting timely distribution reports from the implementing partners


103
  The Associated Press conducted an analysis of the results of WFP’s announced and
unannounced monitoring visits, as part of a broader examination of WFP’s activities in
Somalia. See Katharine Houreld, “AP Exclusive: How Somalia Famine Aid Went Astray,”
Associated Press, March 17, 2012.
104
   United Kingdom National Audit Office, World Food Programme: Review of the
Arrangements for Reporting Post Delivery Food Losses to the Executive Board,
WFP/EB.1/2006/6-B/1 (Rome, Italy: 2006).
105
   In 2006, WFP reported having distributed a total of 4,245,359 metric tons in 2005. WFP
estimated that implementing partners had not submitted reports for 37,537 metric tons—
0.9 percent, with an estimated value of $10.7 million—of this amount. COMPAS includes
an option for marking a distribution quantity as an estimate for the last 3 months of the
year if the implementing partners’ reports have not yet been received.
106
   Comptroller General and Auditor General of India, Report of the External Auditor on the
Financial Statements: World Food Programme for the Year Ended December 2011,
WFP/EB.A/2012/6-A/1 (2012).




Page 52                                  GAO-12-790 World Food Program Internal Controls
                                        and enhance the quality of its reconciliation of data on undistributed
                                        food in the partners’ custody.

                                  •     Limited beneficiary reporting. WFP’s beneficiary hotline is intended
                                        to allow beneficiaries of WFP food assistance to report losses or short
                                        rations anonymously; however, among our case study countries, this
                                        hotline is available only in Somalia. Additionally, the hotline may not
                                        be easily accessible to all beneficiaries, because, according to WFP
                                        officials, the hotline number is not posted at all distribution sites and is
                                        not Somalia-based. WFP Somalia also told us that because the
                                        hotline has not been as effective as they envisioned, they plan to
                                        introduce a Somalia-based number and initiate a more systematic
                                        approach to informing beneficiaries about the hotline.


WFP Reported Piloting             WFP has piloted a method using statistical sampling to collect data on
Systematic Method for             losses incurred during distribution to beneficiaries, but WFP has not
Collecting Data on Losses         systematically applied this method to other country offices. According to
Incurred during Distribution to   the 2008 WFP document describing the pilot, “existing WFP loss
Beneficiaries                     monitoring systems are insufficient to capture losses during the final
                                  distribution phase to beneficiaries.” 107 The document indicates that
                                  although WFP tracks and quantifies food losses prior to distribution, it can
                                  only estimate, based on beneficiary receipts, losses during distribution.
                                  According to the WFP document, between 2007 and 2008 WFP piloted a
                                  random sampling methodology for food assistance losses in Zambia and
                                  Malawi. This methodology involved selecting distribution sites randomly,
                                  with larger sites more likely to be chosen; weighing and counting
                                  individual rations distributed at these sites; checking beneficiaries against
                                  a list; and checking food commodities at distribution sites against WFP
                                  records. This methodology identified differences between reported and
                                  actual numbers of beneficiaries; ration sizes; and amounts of food
                                  departing from, and returned to, the food stock. According to the 2008
                                  WFP document describing the pilot, this approach estimated the correct
                                  magnitude of losses and can considerably increase the losses reported
                                  by WFP. However, according to WFP, it has not systematically applied




                                  107
                                    World Food Program, Information Note on the Development and Qualification of
                                  Sampling Methodology and Statistical Analysis for Measuring Post-Delivery Losses,
                                  WFP/EB.A/2008/INF/6 (2008).




                                  Page 53                                GAO-12-790 World Food Program Internal Controls
                                 this methodology to other country offices that met criteria outlined in the
                                 2008 document. 108

WFP Annual Reports on Food       In its annual reports on food assistance losses, WFP does not update
Assistance Losses Do Not         prior years’ reported losses with the most recent information. WFP’s
Update Prior Year Losses with    annual food assistance loss reports list losses that are being verified and
More Recent Information          state that these losses will be followed up in future reports. However, after
                                 confirming the losses under verification, WFP does not update its loss
                                 totals in subsequent reports. For example, in its 2007 report on food
                                 assistance losses, WFP stated that it was verifying 11,000 metric tons of
                                 food assistance losses, and its 2008 report confirmed some of those
                                 losses. However, WFP’s food assistance loss reports for 2010 and 2011
                                 did not update the loss total for 2007.

WFP Has Not Engaged an           Despite concerns expressed by WFP donors, Executive Board members,
External Party to Evaluate       and the External Auditors, WFP has not engaged an external party to
Food Loss Data in Recent Years   conduct an evaluation of WFP’s loss reporting since the External Auditor
                                 conducted its evaluation in 2006. According to WFP’s internal control
                                 framework, independent oversight bodies may undertake periodic reviews
                                 of the effectiveness of its internal control procedures. In addition, COSO’s
                                 guidance on monitoring internal control systems states that ongoing and
                                 separate evaluations enable management to determine whether certain
                                 components (including information and communication) of internal control
                                 systems continue to function over time. During our fieldwork in Rome,
                                 some donors expressed doubts regarding WFP’s reported food
                                 assistance losses. Additionally, in 2005, WFP Executive Board members
                                 noted a possible contradiction between the low level of losses reported
                                 and the realities inherent in any food management system. According to
                                 the board members, even for the most organized and efficient commercial
                                 operations in developed countries, actual food losses exceed the levels
                                 reported by WFP.




                                 108
                                     According to the 2008 WFP document, the methodology should be applied to country
                                 offices where there is a need to reduce distribution losses and where staffing levels are
                                 adequate. The document states that good accountability along the logistics chain, up to
                                 the final delivery warehouses, is a precondition for introducing the methodology in a
                                 country office. The document further notes that stable food supplies to each project site
                                 and a steady project environment are also necessary to obtaining statistically relevant
                                 data. See World Food Program, Information Note on the Development and Qualification of
                                 Sampling Methodology and Statistical Analysis for Measuring Post-Delivery Losses.




                                 Page 54                                 GAO-12-790 World Food Program Internal Controls
              The 2006 External Auditor’s report states that for effective management
              and minimization of losses, WFP should properly identify, investigate, and
              bring losses to the board’s attention and that inadequate reporting of
              losses presents not only risks to the effectiveness of WFP’s aid efforts
              and the achievement of its objectives, but also reputational risks in terms
              of donor confidence. 109 However, according to WFP, since the External
              Auditor published its 2006 report, no external entity has evaluated WFP’s
              food assistance losses. As an example of a detailed evaluation of food
              assistance losses, in 2004, the International Food Policy Research
              Institute estimated that the highest food assistance loss rates by
              humanitarian organizations in Bangladesh occurred during the distribution
              to the beneficiaries and represented up to 8 percent of the total handled
              for the last quarter of 2002, with most of these losses resulting from short
              rationing during distribution to beneficiaries. 110 In contrast, WFP reported
              food assistance losses of 0.02 percent—$9,700 in losses of $39.3 million
              handled—in Bangladesh for all of 2002.


              WFP’s commitment to operate in some of the most challenging and
Conclusions   dangerous areas of the world presents inherent risks to its ability to
              assure the delivery of food assistance to intended beneficiaries. Given
              this context, a strong system of internal control is needed to identify the
              principal risks to the achievement of WFP’s objectives, to evaluate the
              nature and extent of those risks, and to manage them effectively. The
              design of WFP’s internal controls related to delivering and monitoring
              food assistance generally reflects COSO principles for internal control,
              but weaknesses in some of these controls affect WFP’s ability to manage
              the risks inherent to WFP operations. For example, to the extent that it
              has not fully utilized the WFP Audit Committee, the Executive Board lacks
              the committee’s assistance in overseeing internal controls and risk
              management throughout the organization. In addition, staff lack



              109
                 United Kingdom National Audit Office, World Food Programme: Review of the
              Arrangements for Reporting Post Delivery Food Losses to the Executive Board.
              110
                The report, which the International Food Policy Research Institute produced under
              contract with WFP, also included a detailed description of the food distribution system in
              Bangladesh, identified problems throughout the system, and made recommendations on
              how to solve these problems and minimize food assistance losses. See Akhter U. Ahmed,
              Shahidur Rashid, Manohar Sharma, and Sajjad Zohir, Food Aid Distribution in
              Bangladesh: Leakage and Operational Performance, FCND Discussion Paper No. 173
              (Washington, D.C.: International Food Policy Research Institute, 2004).




              Page 55                                  GAO-12-790 World Food Program Internal Controls
                      instructions on operationalizing elements of risk management in areas
                      most vulnerable to fraud, waste, and abuse. Further, without a written
                      policy stating that monitoring should be based on risk, as recommended
                      by WFP’s External Auditor, WFP country offices may not focus their
                      limited staff resources to ensure regular monitoring of all high-risk
                      distribution sites, increasing the possibility of the diversion of food from
                      intended beneficiaries.

                      In the areas of Ethiopia, Kenya, and Somalia that we selected for our
                      review, WFP has implemented procedures for tracking food delivery and
                      has made efforts to improve monitoring of food distribution in Somalia.
                      However, weaknesses in its tracking of food assistance in implementing
                      partners’ custody, as well as UN security restrictions on WFP monitoring
                      staff’s access to high-risk areas such as Mogadishu, Somalia, limit its
                      ability to verify that implementing partners distribute food assistance to
                      intended beneficiaries and to accurately report any food assistance
                      losses. Without reliable data on food assistance distributions and losses,
                      WFP has limited ability to provide accurate reporting on its operations and
                      to avoid reputational risks that could affect its credibility with its
                      stakeholders and donors and compromise its humanitarian mission of
                      providing food assistance to those who depend on it.


                      To strengthen WFP’s ability to manage the risks inherent to operating in
Recommendations for   high-risk areas such as Somalia, we are making the following five
Executive Action      recommendations.

                      We recommend that the Secretary of State work with WFP’s Executive
                      Board to

                          •     develop a plan for more fully utilizing the WFP Audit Committee to
                                assist the board in monitoring the effectiveness of WFP’s risk
                                management and internal control processes.
                      We also recommend that the Secretary of State work through WFP’s
                      Executive Board to ensure that WFP management

                          •     provides comprehensive risk management guidance addressing
                                key elements of the risk management process, such as
                                identifying, assessing, and responding to risks;
                          •     revises WFP’s monitoring guidance to specify that field monitoring
                                activities should be risk based;




                      Page 56                             GAO-12-790 World Food Program Internal Controls
                         •     provides organization-wide guidance for addressing monitoring
                               deficiencies in areas inaccessible to WFP monitors because of
                               security restrictions; and
                         •     requires periodic external evaluations to assess and improve the
                               reliability of data on food assistance losses.


                     We requested and received comments on a draft of this report from WFP
Agency Comments      and the Secretary of State. Both WFP and State—responding for itself,
and Our Evaluation   USAID, and the Department of Agriculture—provided written comments,
                     which are reproduced in appendixes IV and V, respectively. In addition,
                     State, WFP, USAID, and the U.S. Mission to the UN Agencies in Rome
                     provided technical comments, which we incorporated in the report as
                     appropriate.

                     In their written comments, both WFP and State agreed with our
                     recommendations. WFP noted that strengthening its overall internal
                     control framework and enterprise risk management will remain a priority.
                     WFP also noted that it is currently addressing a number of the points
                     raised in our report, as part of the overall organization-strengthening effort
                     it launched in April. According to WFP, this effort includes a set of
                     improvements to organization-wide monitoring and reporting, with an
                     emphasis on putting in place a system that is succinct, resourced, and
                     implementable at field level. WFP further noted that it will continue to
                     consult with its member states, through its Executive Board, as it pursues
                     further actions to ensure that its food assistance reaches intended
                     beneficiaries in both high-risk and non-high-risk environments. In its
                     written comments, State said that it will endeavor, through appropriate
                     mechanisms—including the WFP Executive Board, bilaterally with WFP,
                     and with partners—to implement all of our recommendations. State noted
                     that USAID and USDA also agree with all of our recommendations and
                     are prepared to support State as needed.


                     We are sending copies of this report to appropriate congressional offices,
                     the Secretary of State and the Administrator of USAID, and relevant
                     agency heads. The report is also available at no charge on the GAO
                     website at http://www.gao.gov.

                     If you or your staff have any questions about this report, please contact
                     me at (202) 512-9601 or melitot@gao.gov. Contact points for our Office of




                     Page 57                             GAO-12-790 World Food Program Internal Controls
Congressional Relations and Public Affairs may be found on the last page
of this report. GAO staff who made major contributions to this report are
listed in appendix VI.




Thomas Melito
Director, International Affairs and Trade




Page 58                           GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
                             Appendix I: Objectives, Scope, and
                             Methodology



Methodology

                             Our objectives were to examine the extent to which (1) the design of the
                             World Food Program’s (WFP) internal controls related to the delivery and
                             monitoring of food assistance reflects the Committee of Sponsoring
                             Organization of the Treadway Commission’s (COSO) principles and (2)
                             WFP has implemented as designed certain controls related to the delivery
                             and monitoring of food assistance in selected high-risk areas. We focused
                             our review primarily on WFP’s food assistance management from delivery
                             at port-of-entry to distribution to intended recipients, because of WFP’s
                             vulnerability to risks such as the alleged food diversion in Somalia during
                             these stages of food assistance management. We did not review other
                             processes, such as procurement, finance, and budget.


Objective 1: Examine the     To address our first objective, we reviewed COSO’s Internal Control—
Extent to Which the          Integrated Framework; Enterprise Risk Management—Integrated
Design of WFP’s Internal     Framework; Internal Control—Integrated Framework: Evaluation Tools;
                             Enterprise Risk Management—Integrated Framework: Application
Controls Related to          Techniques; and Guidance on Monitoring Internal Control Systems. 1 We
Delivery and Monitoring of   also reviewed other related international principles and guidelines,
Food Assistance Reflects     including the International Organization for Standardization’s (ISO) ISO
COSO Principles              31000—Risk Management Principles and Guidelines 2 and the UN Joint
                             Inspection Unit’s (JIU) “Review of Enterprise Risk Management in the UN
                             System—Benchmarking Framework.” 3 In addition, we reviewed WFP’s
                             internal control framework, relevant WFP policies and procedures,
                             relevant documents, and data related to internal controls.

                             In choosing COSO criteria, or “points of focus,” for our analysis, we
                             followed guidance in COSO’s Internal Control—Integrated Framework:
                             Evaluation Tools, which suggests that evaluators tailor points of focus for
                             each component of the framework to fit the entity’s facts and


                             1
                              Committee of Sponsoring Organizations of the Treadway Commission, Internal Control—
                             Integrated Framework (1992); Enterprise Risk Management—Integrated Framework
                             (2004); Internal Control—Integrated Framework: Evaluation Tools (1992); Enterprise Risk
                             Management—Integrated Framework: Application Techniques (2004); Guidance on
                             Monitoring Internal Control Systems (2009).
                             2
                              International Organization for Standardization, ISO 31000 Risk Management—Principles
                             and Guidelines (2009).
                             3
                              Cihan Terzi and Istvan Posta, Review of Enterprise Risk Management in the United
                             Nations System: Benchmarking Framework, JIU/REP/2010/4 (Geneva, Switzerland:
                             United Nations Joint Inspection Unit, 2010).




                             Page 59                                GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




circumstances. 4 We selected points of focus that are relevant to our
scope. Further, we took into consideration any points of focus in WFP’s
internal control framework that are not included in COSO’s framework.
Where possible or appropriate, we identified documents, such as policy
manuals, guidance, and circulars, that WFP has developed to address
particular points of focus. Our analysis was not intended to conclude
whether WFP’s internal control system overall is effective.

For each of WFP’s internal control components, we examined information
in the following documents, comparing it with criteria or points of focus in
COSO’s Internal Control—Integrated Framework and Internal Control—
Integrated Framework: Evaluation Tools to determine whether the design
of WFP internal controls related to the delivery and monitoring of food
assistance reflects COSO principles.

•   Control environment. We reviewed a number of WFP documents
    including, but not limited to, sections of WFP’s Financial Resource
    Management Manual; 5 internal control framework; 6 strategic plan for
    2008 through 2013; 7 annual reports for 2010 and 2011; 8 General
    Regulations, General Rules, Financial Regulations, Rules of
    Procedures of the Executive Board; 9 Accountability Guide for




4
 The five components of WFP’s internal control framework are similar to the five
components of COSO’s internal control framework. According to COSO’s Internal
Control—Integrated Framework: Evaluation Tools, each element has substantive “points
of focus” that represent some of the more important issues relevant to the component; not
all points of focus are relevant to every entity, and additional issues will be relevant to
some entities.
5
 We reviewed the following sections of WFP’s March 2012 Financial Resource
Management Manual: section 2, “Governance”; section 3, “Internal Control”; section 4,
“WFP Oversight; and section 5, “Responsibilities and Authorities.”
6
 World Food Program, “Executive Director’s Circular EDD2011—Internal Control
Framework” (2011).
7
 World Food Program, Division of Communications and Public Policy Strategy, WFP
Strategic Plan, 2008-2013.
8
World Food Program, Annual Report 2010 (2011); The Year in Review, 2011 (2012).
9
 World Food Program, General Regulations, General Rules, Financial Regulations, Rules
of Procedures of the Executive Board (2012).




Page 60                                  GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




     Managers; 10 Manager’s Guide to Internal Control; 11 Internal Control
     Self-Assessment Checklists; 12 and Oversight Framework and Reports
     Disclosure Policy. 13 To identify any findings related to the WFP control
     environment, we also reviewed WFP’s annual audited accounts for
     2008 through 2011, 14 the WFP Audit Committee’s annual reports for
     2011 and 2012, 15 the WFP Office of the Inspector General’s annual
     reports for 2011 and 2012, 16 and the Food and Agriculture
     Organization of the United Nations (FAO) Finance Committee’s 2012
     report. 17 To identify points of integrity and ethical values, we reviewed
     the Code of Ethics for United Nations (UN) Personnel, WFP’s Anti-
     Fraud and Anti-Corruption Policy, 18 and the UN Joint Inspection Unit’s
     (JIU) Ethics in the United Nations System. 19 To review for best
     practices in examining the WFP Statement of Internal Control, we



10
  World Food Program, Resource Management and Accountability Department,
Accountability Guide for Managers: A Quick Reference Guide for Managers on the
Responsibilities and Accountabilities within Key WFP Processes, v. 1.0 (2011).
11
  World Food Program, Resource Management and Accountability Department,
Manager’s Guide to Internal Control: WFP’s Guide to Internal Control for Managers
(2011).
12
  World Food Program, Resource Management and Accountability Department, Internal
Control Self-Assessment Checklists: A tool to help managers control their business better,
v. 1.0 (2011).
13
 World Food Program, Oversight Framework and Reports Disclosure Policy,
WFP/EB.A/2011/5-C/1 (2011).
14
  World Food Program, Audited Annual Accounts, 2008, WFP/EB.A/2009/6”A/1 (2009);
Audited Annual Accounts, 2009, WFP/EB.A/2010/6‑A/1 (2010); Audited Annual Accounts,
2010, WFP/EB.A/2011/6‑A/1 (2011); Audited Annual Accounts, 2011, (WFP/EB.A/2012/6-
A/1 (2012).
15
  World Food Program, Annual Report of the Audit Committee, WFP/EB.A/2011/6-C/1
(2011); Annual Report of the Audit Committee, WFP/EB.A/2012/6-D/1 (2012).
16
  World Food Program, Finance Committee, WFP Report of the Inspector General, FC
139/10 (2011); Annual Report of the Inspector General, WFP/EB.A/2012/6-E/1 (2012).
17
  United Nations Food and Agriculture Organization, Report of the 144th Session of the
Finance Committee, Rome, 11-15 June 2012 (2012).
18
 World Food Program, WFP Anti-Fraud and Anti-Corruption Policy,
WFP/EB.2/2010/4‑C/1 (2010).
19
 United Nations Joint Inspection Unit, Ethics in the United Nations System (Geneva,
Switzerland: 2010).




Page 61                                  GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




      reviewed the World Bank’s annual report for 2011 20 and the Inter-
      American Development Bank’s annual report for 2011. 21 We also
      reviewed our 2007 report on UN oversight and accountability for
      historical information regarding the WFP Executive Board and Audit
      Committee. 22 In September 2011, we interviewed nine members of
      WFP’s 36-member Executive Board—representatives of Cameroon,
      Canada, Guatemala, France, Germany, Netherlands, Sweden, United
      Kingdom, and the United States to the UN Food Agencies in Rome.
      We did not select the Executive Board members with whom we
      spoke; we requested a meeting with all available board members and
      met with those members who agreed to meet with us. In addition, we
      interviewed a director of the Comptroller and Auditor General of
      India—WFP’s External Auditor—as well as the current Chairman of
      the WFP Audit Committee.

•     Risk management. We reviewed a number of WFP documents,
      including, but not limited to, WFP’s Enterprise Risk Management
      Policy; Financial Resource Management Manual, which includes
      WFP’s risk management framework; Risk Management Guide; 23
      internal control framework; 24 WFP Strategic Plan, 2008-2013; annual
      performance reports for 2010 and 2011; Accountability Guide for
      Managers; 25 Manager’s Guide to Internal Control; 26 and Executive
      Board approval documents for protracted relief and recovery
      operations and emergency operations. We also reviewed WFP’s
      annual audited accounts for 2008 through 2011, the WFP Audit
      Committee’s annual reports for 2011 and 2012, and the Office of the



20
    World Bank, The World Bank Annual Report 2011: Year in Review (2011).
21
     Inter-American Development Bank, Annual Report 2011: The Year in Review (2012).
22
  GAO, United Nations Organizations: Oversight and Accountability Could Be
Strengthened by Further Instituting International Best Practices, GAO-07-597
(Washington, D.C.: June 18, 2007).
23
    World Food Program, “Risk Management Guide” (2006).
24
  World Food Program, “Executive Director’s Circular EDD2011—Internal Control
Framework” (2011).
25
 World Food Program, Resource Management and Accountability Department,
Accountability Guide for Managers.
26
 World Food Program, Resource Management and Accountability Department,
Manager’s Guide to Internal Control.




Page 62                                  GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




    Inspector General’s annual report for 2011 and 2012 to identify any
    findings related to the WFP risk management. In addition, we
    reviewed ISO’s ISO 31000—Risk Management Principles and
    Guidelines; JIU’s Review of Enterprise Risk Management in the
    United Nations System—Benchmarking Framework; and a
    Humanitarian Policy Group-commissioned paper, “Risk in
    Humanitarian Action: Towards a Common Approach?” 27 In addition,
    we interviewed WFP personnel regarding the risk management
    process. Further, we reviewed emergency and protracted relief and
    recovery operations documents for Ethiopia, Kenya, and Somalia to
    determine how risk management was covered.

•   Control activities. We reviewed WFP’s Transport Manual,
    Warehouse Management Handbook, and Program Guidance Manual
    for guidance that WFP has designed related to controls over handling
    of food assistance at the port-of-entry, during transportation, in WFP
    warehouses, during WFP distributions to beneficiaries, and in the
    custody of implementing partners. We also reviewed the WFP’
    External Auditor’s report related to controls observed for WFP’s
    COMPAS system.

•   Information and communication. We reviewed WFP documents
    related to emergency operations and protracted relief and recovery
    operations for 2008 through 2015 for our case study countries—
    Ethiopia, Kenya, and Somalia. We also reviewed the corresponding
    standard project reports that inform stakeholders about the use of
    resources for a given project and the results that WFP obtained during
    the reporting year. In addition, we reviewed WFP updates on the Horn
    of Africa and separate monthly updates on WFP operations in
    Somalia, which it distributes to its member states and partner
    organizations, including those within the UN system. Further, we
    reviewed WFP documents showing WFP’s risk management
    escalation process and procedures for managing potential diversion
    or wrong-doing of cooperating partners or transporters, which guides
    staff on what steps to take and whom to inform about a suspected
    case of diversion or wrongdoing. Last, we reviewed WFP’s Transport
    Manual for guidance on developing food assistance loss reports,
    which quantify WFP losses during internal transport arranged by


27
  Victoria Metcalfe, Ellen Martin, and Sara Pantuliano, Risk in Humanitarian Action:
Towards a Common Approach?, a report commissioned by the Overseas Development
Institute’s Humanitarian Policy Group, 2011.




Page 63                                GAO-12-790 World Food Program Internal Controls
                             Appendix I: Objectives, Scope, and
                             Methodology




                                 country offices or regional bureaus and during storage, arranged and
                                 paid for by WFP. We also interviewed some members of WFP’s
                                 Executive Board.

                             •   Monitoring. We reviewed and analyzed WFP manuals and guidance
                                 related to field monitoring of WFP food assistance, including WFP’s
                                 Monitoring and Evaluation Guidelines and Program Guidance Manual.
                                 We focused on guidance related to distribution monitoring and post-
                                 distribution monitoring, not on performance monitoring or evaluations.
                                 We compared WFP’s guidance and manuals with monitoring criteria
                                 in COSO’s Internal Control—Integrated Framework; Internal Control—
                                 Integrated Framework: Evaluation Tools; and Guidance on Monitoring
                                 Internal Control Systems. We also interviewed WFP staff in Rome,
                                 Ethiopia, Kenya, and Somalia to discuss how they develop their
                                 monitoring plans and goals. We reviewed internal and external
                                 oversight reports as well as WFP documents and reports related to
                                 the design of field monitoring.

Objective 2: Examine the     To address our second objective, we reviewed WFP procedures to verify
Extent to Which WFP Has      the implementation of WFP policies and guidelines at the organizational
                             level and at the country level for our three case study countries—Ethiopia,
Implemented as Designed
                             Kenya, and Somalia. We selected these countries on the basis of a range
Certain Controls Related     of criteria, including the amount of U.S. contributions, the total amount of
to Delivery and Monitoring   food assistance received, high-risk and non-high-risk environments, and
of Food Assistance in        logistics and budget constraints. Because WFP operates in more than 70
Selected High-Risk Areas     countries and implements many different activities in each country, our
                             case studies are not intended for generalization to all WFP countries and
                             operations. We focused our review on emergency operations and
                             protracted relief and recovery operations, which represent about 80
                             percent of WFP’s operations, and on general food distribution activities
                             within these programs. We focused primarily on general food distribution
                             activities because it is generally the largest program under our case study
                             countries’ operations.

                             For each country, we reviewed numerous documents that reflect some of
                             the controls that WFP has implemented in selected areas. We also
                             reviewed numerous documents for the three countries that show, for each
                             country, the movement of a selected food commodity shipment from port-
                             of-entry to distribution sites during the period January to June 2011. We
                             selected these shipments after discussion with WFP.

                             We conducted fieldwork in Ethiopia and Kenya, selecting sites in each
                             country after discussion with WFP; based on the shipment data we



                             Page 64                              GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




reviewed; and according to available time, logistical constraints, and
security concerns. We also selected the sites to reflect a range of UN
Department of Safety and Security (UNDSS) security levels, in order to
examine any similarities or differences in WFP’s operations at the various
security levels. We did not conduct fieldwork in Somalia, owing to
logistical constraints and security concerns.

For the purposes of this report, we use the term “selected areas” to
include the sites we visited in our case study countries, the areas covered
in the documents we reviewed, the areas covered in interviews we
conducted in our selected countries, and other reviews related to internal
controls in our case study countries that we determined were appropriate
for our researchable objectives. The areas we selected for review, like the
countries we visited, are not generalizable to all areas in the selected
countries or to the broader universe of WFP programs and operations.

•     Control activities. To assess WFP’s implementation of its policies
      and guidelines related to control activities, we reviewed supporting
      documents showing the movement of the selected shipments in each
      case-study country: 13,970 metric tons of wheat for Ethiopia; 2,880
      metric tons of vegetable oil for Kenya; and 45 metric tons of split peas
      for Somalia. According to the supporting documents, all of the noted
      shipments were delivered to the respective countries between
      January and June 2011. In the field, we interviewed WFP East and
      Central Africa Regional Bureau staff, country staff, implementing
      partners, and transporters in Ethiopia and Kenya. 28 In addition, we
      visited WFP warehouses and an implementing partner warehouse in
      each country, and we visited one food distribution site in Ethiopia and
      two in Kenya, where we interviewed the beneficiaries. We also
      observed an implementing partner’s use of controls during a food
      distribution at one of the sites in Kenya. We interviewed staff from the
      U.S. Agency for International Development (USAID) and Department
      of State (State) in Ethiopia and Kenya, as well as staff from the UN
      High Commissioner for Refugees (UNHCR) and the UN Office for the
      Coordination of Humanitarian Affairs in Ethiopia, to obtain their
      insights on WFP operations in the country. We also reviewed the
      following WFP documents: Protracted Relief and Recovery




28
    We visited the WFP Somalia country office located in Nairobi, Kenya.




Page 65                                   GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




      Operation—Ethiopia 200365, 29 Summary Report of the Joint
      UNHCR/WFP Impact Evaluation on the Contribution of Food
      Assistance to Durable Solutions in Protracted Refugee Situations—
      Ethiopia; 30 a February 2012 biweekly report on Ethiopia; 31 WFP
      Management Response to the Report of the External Auditor on WFP
      Operations in Somalia; 32 standard operating procedures for Somalia,
      dated April 2010; Summary Evaluation Report—Kenya Country
      Portfolio; 33 Audited Annual Accounts, 2011; 34 and Report on the
      Implementation of the External Auditor Recommendations. 35

•     Monitoring. To assess WFP’s implementation of, and challenges
      related to, distribution and post-distribution monitoring in Ethiopia,
      Kenya, and Somalia and the extent to which monitoring helps assure
      the delivery of food assistance to intended beneficiaries in selected
      high-risk environments, we reviewed numerous WFP program and
      monitoring documents related to WFP operations in Ethiopia, Kenya,
      and Somalia. Some of these documents included WFP’s country
      monitoring plans, monitoring reports, and written responses to our
      questions. We also reviewed internal and external oversight and
      program reports for information on implementing field monitoring and
      related challenges. We also reviewed WFP’s evaluations published
      from 2010 through 2012 for findings related to field monitoring.
      Further, we conducted interviews in Ethiopia and Kenya with WFP
      staff and monitors, implementing partners, USAID, UNHCR, the UN
      Office for the Coordination of Humanitarian Affairs, and WFP
      beneficiaries. We were not able to assess the data on monitoring that


29
  World Food Program, Protracted Relief and Recovery Operation: Ethiopia 200365,
WFP/EB.1/2012/8/3 (2012).
30
  World Food Program, Summary Report of the Joint UNHCR/WFP Impact Evaluation on
the Contribution of Food Assistance to Durable Solutions in Protracted Refugee
Situations—Ethiopia, WFP/EB.1/2012/6-E (2012).
31
    World Food Program, Ethiopia Biweekly Report No. 3 (10 February 2012).
32
  World Food Program, WFP Management Response to the Report of the External
Auditor on WFP Operations in Somalia, WFP/EB.1/2011/5-B/1/Add.1 (2011).
33
  World Food Program, Summary Evaluation Report—Kenya Country Portfolio,
WFP/EB.2/2011/6-D.
34
    World Food Program, Audited Annual Accounts, 2011, WFP/EB.A/2012/6-A/1 (2012).
35
 World Food Program, Report on the Implementation of the External Auditor
Recommendations, WFP/EB.A/2012/6-H/1 (2012).




Page 66                                  GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




     WFP staff provided to us, because we did not have full access to
     information about the data’s sources. Therefore, we present a few
     examples of WFP-reported monitoring data in our report that we
     attribute to WFP and, for additional context, two tables of WFP’s
     reported data in appendix III.

•    Food assistance losses. To assess the reliability of WFP’s data on
     losses of food assistance after arrival at ports-of-entry, we reviewed
     WFP’s policies and procedures and other documents on food
     assistance losses; a 2004 International Food Policy Research Institute
     report on food assistance losses; 36 The WFP External Auditor’s 2006
     report on food assistance losses; 37 WFP’s Office of Investigations and
     Inspections’ December 2009 report on Somalia; 38 the UN Monitoring
     Group on Somalia’s March 2010 and July 2012 reports; 39 and the
     WFP External Auditor’s January 2011 report on Somalia and 2012
     annual report. 40 We compared our case study countries’ loss rates
     with the global loss rate and compared Somalia’s loss rate in 2009
     with other accounts of losses in Somalia for 2009. To calculate WFP’s
     global food assistance loss rates, the food assistance loss rates for
     Kenya, Ethiopia, and Somalia, and the top reasons reported for losses
     for 2007 through 2011, we analyzed data compiled from WFP’s




36
  Akhter U. Ahmed, Shahidur Rashid, Manohar Sharma, and Sajjad Zohir, Food Aid
Distribution in Bangladesh: Leakage and Operational Performance, FCND Discussion
Paper No. 173 (Washington, D.C.: International Food Policy Research Institute: 2004).
37
  United Kingdom National Audit Office, World Food Programme: Review of the
Arrangements for Reporting Post Delivery Food Losses to the Executive Board,
WFP/EB.1/2006/6-B/1 (Rome, Italy: 2006).
38
  World Food Program, Office of Inspections and Investigations, Investigation of
Allegations of Food Diversions in Somalia, OSDI/51/09-I 29/09 (2009).
39
  UN Security Council, Report of the Monitoring Group on Somalia Pursuant to Security
Council Resolution 1853 (2008) S/2010/91 (2010); Report of the Monitoring Group on
Somalia and Eritrea Pursuant to Security Council Resolution 2002, S/2012/544 (2012).
40
  Comptroller and Auditor General of India, External Audit Reports: World Food
Programme’s Somalia Operations, WFP/EB.1/2011/5-B/1 (2011); Report of the External
Auditor on the Financial Statements: World Food Programme for the Year Ended
December 2011, WFP/EB.A/2012/6-A/1 (2012).




Page 67                                  GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




     annual reports on food assistance losses for 2007 through 2011. 41 We
     also assessed these food assistance loss reports for consistency
     across years. We examined WFP’s data collection process via WFP’s
     policies and procedures, such as WFP’s Transport Manual 42 and
     COMPAS user guide, 43 and other WFP documents, such as WFP’s
     2008 information note on the development and qualification of
     sampling methodology and statistical analysis for measuring food
     assistance losses. 44 We interviewed cognizant WFP officials in
     Washington, D.C.; Rome, Italy; Kenya; Ethiopia; and Somalia
     regarding COMPAS data. We also interviewed representatives of the
     International Food Policy Research Institute regarding its report on
     food assistance losses. 45 As a result of our assessment, we
     determined, for reasons that we discuss in our report, that WFP’s data
     on food assistance losses were not sufficiently reliable for the purpose
     of accurately reporting losses for all countries.

For both objectives, we met with WFP officials in Rome, Italy, and in
Washington, D.C. In addition, we conducted site visits in Ethiopia and
Kenya and met with WFP country officials for Ethiopia, Kenya, and
Somalia and officials from WFP’s East and Central Africa Regional
Bureau in Nairobi. During our site visits, we also met with representatives
of UNHCR and the UN Office for the Coordination of Humanitarian
Affairs, WFP’s partners in some food assistance activities. In addition, in
Rome, we met with the U.S. Mission to the UN Agencies in Rome; FAO;



41
  World Food Program, Report on Post-Delivery Losses for the Period 1 January–31
December 2007, WFP/EB.A/2008/13-A (2008); World Food Program, Report on Post-
Delivery Losses for the Period 1 January–31 December 2008, WFP/EB.A/2009/13-A
(2009); World Food Program, Report on Post-Delivery Losses for the Period 1 January–31
December 2009, WFP/EB.A/2009/13-A/Rev.2 (2010); World Food Program, Report on
Post-Delivery Losses for the Period 1 January–31 December 2010, WFP/EB.A/2010/13-A
(2011); World Food Program, Report on Post-Delivery Losses for the Period 1 January–31
December 2011, WFP/EB.A/2012/13-A (2012).
42
 World Food Program, Transport Manual (2011).
43
  World Food Program, Commodity Movement Processing and Analysis System: User
Guide (2004).
44
  World Food Program, Information Note on the Development and Qualification of
Sampling Methodology and Statistical Analysis for Measuring Post-Delivery Losses,
WFP/EB.A/2008/INF/6 (2008).
45
  Ahmed, Rashid, Sharma, and Zohir, Food Aid Distribution in Bangladesh: Leakage and
Operational Performance.




Page 68                                GAO-12-790 World Food Program Internal Controls
Appendix I: Objectives, Scope, and
Methodology




some of WFP’s donor and recipient country representatives who are
members of WFP’s Executive Board; a member of WFP’s Audit
Committee; and a senior official of the Comptroller and Auditor General of
India, which is WFP’s External Auditor. We also met with officials from
State, USAID, and the U.S. Department of Agriculture in Washington,
D.C., and during site visits.

We conducted our work from July 2011 to September 2012 in accordance
with generally accepted government auditing standards. Those standards
require that we plan and perform our work to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions
based on our objectives. We believe that the evidence obtained provides
a reasonable basis for our findings and conclusions based on our
objectives.




Page 69                              GAO-12-790 World Food Program Internal Controls
Appendix II: World Food Program
                     Appendix II: World Food Program Governance,
                     Oversight, and Management Structure



Governance, Oversight, and Management
Structure
                     WFP’s General Regulations establish the governance and oversight
                     structure for WFP with clear distinctions among (1) governing bodies that
                     involve member states, 1 including WFP’s Executive Board; (2)
                     independent external oversight bodies; and (3) independent internal
                     oversight bodies. WFP’s management is headed by an Executive Director
                     and includes functional offices, regional bureaus, and country offices.


WFP Governance and   Several external and internal WFP governance and oversight bodies are
Oversight Bodies     responsible for providing oversight and helping to manage WFP risks.

                     •   UN governing bodies. Several UN entities, comprising
                         representatives of the UN’s 193 member states, provide governance
                         to WFP. These entities include the UN General Assembly, the FAO
                         Conference, the UN Economic and Social Council, the FAO Council,
                         the UN Advisory Committee on Administrative and Budgetary
                         Questions, and the FAO Finance Committee.

                     •   WFP’s Executive Board is a governing body that includes 36 of the
                         UN’s 193 member states. According to WFP regulations, the board is
                         responsible for providing intergovernmental support and specific
                         policy direction to, and supervision of, WFP’s activities in accordance
                         with the overall policy guidance of the General Assembly of the UN,
                         the FAO Conference, the Economic and Social Council, and the
                         Council of FAO. The board is also responsible for intergovernmental
                         supervision and direction of WFP’s management. In addition, the
                         Executive Board exercises an oversight function over WFP’s Office of
                         Evaluation by providing strategic guidance, reviewing and approving
                         the work plan and budget, and reviewing the independence of the
                         evaluation function.

                     •   WFP’s Office of Evaluation and Oversight Office provide
                         independent internal oversight. Both offices are independent from
                         WFP’s management, and they conduct audits, investigations, and
                         inspections on the systems, processes, operations, and activities
                         WFP undertakes. The Director of the Office of Evaluation is
                         responsible for implementing the evaluation policy, in particular for
                         making institutional arrangements for independent evaluations and



                     1
                      Member states are involved in WFP’s governance and oversight through various bodies
                     and at different levels.




                     Page 70                                GAO-12-790 World Food Program Internal Controls
Appendix II: World Food Program Governance,
Oversight, and Management Structure




    ensuring adherence to the evaluators’ code of conduct. The Director
    of the Office of Evaluation is also accountable for ensuring the quality,
    credibility, and utility of evaluations. The Director of the Oversight
    Office, with the combined roles of inspector general and chief audit
    executive, has the responsibility for ensuring the integrity, efficiency,
    and effectiveness of WFP’s management, administration, and
    operations. The Director of the Office of Oversight is also responsible
    for preparing an annual report on the office’s activities, including a
    summary of significant oversight findings and the implementation
    status of recommendations, and for submitting this report to the
    Executive Director and the Executive Board.

•   Independent external oversight bodies include the WFP External
    Auditor, the WFP Audit Committee, and JIU.
    •     The WFP External Auditor is appointed by, and reports to, the
          Executive Board. According to WFP regulations, the External
          Auditor is responsible for auditing WFP’s accounts, including all
          trust funds and special accounts, as deemed necessary to ensure
          that internal controls, including the internal audit, are adequate in
          light of the extent to which they are relied upon. The board may
          request the External Auditor to perform specific examinations and
          issue separate reports thereon.

    •     The WFP Audit Committee serves in an expert advisory capacity
          to assist the Executive Board and the Executive Director in
          exercising their governance responsibilities for the financial
          reporting, internal control arrangements, risk management
          processes, and other audit-related matters. The board approves
          the Audit Committee’s terms of reference. The committee’s
          mandate includes reviewing and advising on policies significantly
          affecting accounting and financial reporting issues and the
          effectiveness of WFP’s internal controls, internal audit function,
          and operational procedures; providing a forum to discuss internal
          control and risk management issues, operational procedures, and
          matters raised by internal and external audits; and providing
          comments on the work plans of the internal and external audit
          functions.

    •     JIU is an independent external oversight body of the UN system,
          mandated to conduct evaluations, inspections, and investigations
          system-wide. Its reports are submitted to the UN General
          Assembly and the governing bodies of participating specialized
          agencies, funds, and programs of the UN. The WFP Executive



Page 71                                GAO-12-790 World Food Program Internal Controls
                 Appendix II: World Food Program Governance,
                 Oversight, and Management Structure




                           Board reviews JIU’s recommendations on a regular basis and also
                           reviews reports by the WFP secretariat on the implementation of
                           these recommendations.

                     •     The FAO Finance Committee assists the FAO Council in
                           exercising control over the financial administration of WFP. The
                           committee’s functions include reviewing reports submitted by the
                           WFP Secretariat and providing advice to the Executive Board.

WFP Management   WFP’s management is headed by an Executive Director who is
Structure        responsible and accountable to the board for the administration of WFP
                 and the implementation of WFP programs, projects, and other activities.
                 The Executive Director is also responsible for establishing effective
                 internal controls in management and an effective system of independent
                 internal oversight through the Office of Evaluation and the Oversight
                 Office.

                 WFP has a three-tier organizational structure, including headquarters in
                 Rome, Italy; seven regional bureaus; and 77 country offices. WFP’s
                 headquarters is in charge of governance, strategic planning, policy
                 making, and macro-level monitoring. The regional bureaus provide
                 technical assistance to the country offices and perform oversight over the
                 country offices on adherence to corporate guidelines, practices, and
                 procedures. Figure 8 reflects WFP’s management structure.




                 Page 72                                GAO-12-790 World Food Program Internal Controls
                                     Appendix II: World Food Program Governance,
                                     Oversight, and Management Structure




Figure 8: WFP Management Structure




                                     Page 73                                GAO-12-790 World Food Program Internal Controls
Appendix III: Information on Case Study
              Appendix III: Information on Case Study
              Countries—Ethiopia, Kenya, and Somalia



Countries—Ethiopia, Kenya, and Somalia

              In examining whether the World Food Program (WFP) has implemented
              as designed certain controls related to delivering and monitoring food
              assistance in selected high-risk environments—our second objective—we
              focused our review on three countries: Ethiopia, Kenya, and Somalia.
              (App. I provides a description of our methodology for choosing these
              three as our case study countries.) The following provides background
              information on each country, including the UN Development Program’s
              (UNDP) Human Development index ranking, UNDSS security levels,
              statistics on food insecurity and malnutrition, percentage of the population
              requiring emergency food assistance, and WFP’s direct expenses. 1 In
              addition, we present a timeline of security and humanitarian events in
              Somalia as well as investigations into allegations of control weaknesses
              in WFP operations in Somalia, including food diversion. Further, we
              include beneficiary and monitoring data for the three countries, including
              the areas where we conducted site visits, including number of monitors,
              number of distribution sites, and security levels.


Ethiopia      State estimates that Ethiopia has a total population of about 84 million.
              Ethiopia is one of the world’s poorest countries, ranking 174 out of 187
              countries on the 2011 UNDP Human Development Index, with 23 million
              people living below the national poverty line. UNDSS has assessed
              security threats in the regions of Ethiopia at levels ranging from 1
              (minimal) to 4 (substantial).

              WFP reports that malnutrition and food insecurity are significant problems
              in Ethiopia and that undernutrition contributes to 57 percent of deaths of
              children younger than 5 years. WFP also reported that from the end of
              2010 to the end of 2011, the food security situation deteriorated in
              Ethiopia, with 4.5 million people requiring emergency food assistance. In
              addition, UNHCR reports that, as of January 2012, Ethiopia was hosting
              more than 288,000 refugees from neighboring countries, such as Eritrea
              and Somalia.

              In 2011, WFP’s direct expenses in Ethiopia totaled about $392 million,
              most of which was used to support the implementation of protracted relief
              and recovery operations (PRROs), as shown in table 1. One of the



              1
               We are providing the data on WFP expenses for background purposes only and
              therefore did not assess their reliability.




              Page 74                                   GAO-12-790 World Food Program Internal Controls
                                        Appendix III: Information on Case Study
                                        Countries—Ethiopia, Kenya, and Somalia




                                        PRROs addresses acute food insecurity through relief, safety nets,
                                        supplementary feeding, and HIV programs, while the other provides food
                                        assistance to refugees in Ethiopia. WFP Ethiopia’s guiding principle is to
                                        support government programs in addressing hunger by using food
                                        assistance where it adds value. WFP further assists the Ethiopian
                                        government through capacity building projects, such as Purchase for
                                        Progress (P4P), a food management improvement project, and
                                        vulnerability and assessment mapping. WFP is also a major contributor to
                                        supporting disaster risk management capacity in Ethiopia.

Table 1: WFP Direct Expenses for Ethiopia, 2007-2011

                                                 2007                     2008                        2009            2010                  2011
Reliefa                              $148,862,000             $261,831,000               $354,215,000         $416,298,000        $339,050,000
Developmentb                           17,836,000                19,658,000                 26,414,000          26,247,000           27,029,000
                     c
Special operations                           164,000               2,578,000                  4,041,000          3,125,000            3,837,000
Bilateral trust funds and othersd       2,040,000                  3,337,000                15,178,000          32,859,000           21,981,000
Total                                $168,902,000             $287,404,000               $399,847,000         $478,529,000        $391,897,000
                                        Source: WFP’s 2011 Annual Performance Report, May 14, 2012.

                                        Note: Expenses do not include program support and administrative costs.
                                        a
                                         Includes activities under protracted relief and recovery programs, such as relief activities for both
                                        Ethiopians and refugees residing in Ethiopia, according to WFP.
                                        b
                                         Development activities are intended to temporarily free the poor from the need to provide food for
                                        their families and to develop assets such as better houses and new agricultural skills, according to
                                        WFP.
                                        c
                                            Special operations typically involve short-term logistics and infrastructure work, according to WFP.
                                        d
                                            Includes all expenses for WFP’s bilateral trust funds, General Fund, and Special Accounts.




Kenya                                   State estimates that Kenya had a population of approximately 39 million
                                        people in 2010. In the UNDP Human Development 2011 Index, Kenya
                                        ranked 143 out of 187 countries. UNDSS has assessed security threats in
                                        the regions of Kenya at levels ranging from 2 (low) to 4 (substantial).

                                        In 2011, a complex crisis unfolded as severe drought affected the Horn of
                                        Africa and deepened into famine in parts of Somalia. WFP reported that
                                        in mid-2011, tens of thousands of Somalis arrived in Kenya’s Dadaab
                                        refugee camps each month, fleeing famine conditions and insecurity in
                                        southern Somalia. In addition, according to UNHCR, in September 2011
                                        the Kakuma refugee camp was home to more than 80,000 refugees and
                                        asylum-seekers, over half of them from Somalia, and the Dadaab and
                                        Kakuma camps had a combined population of more than half a million,




                                        Page 75                                                 GAO-12-790 World Food Program Internal Controls
                                           Appendix III: Information on Case Study
                                           Countries—Ethiopia, Kenya, and Somalia




                                           predominantly Somalis. Further, WFP reports that the drought made
                                           about 4 million Kenyans acutely food insecure.

                                           In 2011, WFP’s direct expenses in Kenya totaled about $252 million, with
                                           most of this money used to support relief programs, including PRROs, as
                                           shown in table 2. WFP reported that, through one of the PRROs, it
                                           provided food assistance to refugees living in Dadaab and Kakuma
                                           camps and their host communities. The second PRRO supported families
                                           most affected by drought and rising food prices in the arid or semi-arid
                                           land, according to WFP. Both PRROs implemented general food
                                           distributions, nutrition support programs, and projects that paid in food for
                                           beneficiaries to build productive assets, such as those focused on
                                           harvesting and managing rainwater and conserving soil. In addition,
                                           where market conditions allowed, WFP delivered assistance through
                                           conditional and unconditional cash transfers.

Table 2: WFP Direct Expenses for Kenya, 2007-2011

                                                   2007                     2008                         2009            2010                  2011
         a
Relief                                 $153,561,000             $136,528,000               $222,834,000         $191,706,000         $228,590,000
Developmentb                             28,532,000                25,022,000                 23,722,000           21,655,000           21,702,000
                     c
Special operations                        8,205,000                    681,000                              0               0                         0
                                   d
Bilateral trust funds and others                       0                 61,000                    449,000          1,264,000            1,373,000
Total                                  $190,298,000             $162,293,000               $247,005,000         $214,625,000         $251,665,000
                                           Source: WFP’s 2011 Annual Performance Report, May 14, 2012.

                                           Note: Expenses do not include program support and administrative costs.
                                           a
                                            Includes activities under protracted relief and recovery programs, such as general food distribution
                                           for both Kenyans and refugees residing in Kenya, according to WFP.
                                           b
                                            Development activities are intended to temporarily free the poor from the need to provide food for
                                           their families and to develop assets such as better houses and new agricultural skills, according to
                                           WFP.
                                           c
                                               Special operations typically involve short-term logistics and infrastructure work, according to WFP.
                                           d
                                               Includes all expenses for WFP’s bilateral trust funds, General Fund, and Special Accounts.




Somalia                                    State estimates that Somalia had a population of approximately 9.9
                                           million people in 2011. Due to a lack of data on Somalia, the UNDP’s
                                           Human Development Index does not include Somalia in its ranking. WFP
                                           reports that Somalia has been affected by conflict and without a
                                           functioning government for more than two decades. UNDSS has
                                           assessed security threats in the regions of Somalia at levels ranging from
                                           3 (moderate) to over 5 (high).




                                           Page 76                                                 GAO-12-790 World Food Program Internal Controls
Appendix III: Information on Case Study
Countries—Ethiopia, Kenya, and Somalia




According to WFP, Somalia is classified as among the poorest and most
food-insecure countries in the world. Six regions of southern Somalia
were declared as famine zones by the Food Security and Nutrition
Analysis Unit in 2011. Three of these regions were still classified as
famine zones at the end of 2011. In many regions of Somalia, the global
acute malnutrition rate remains near or above famine levels, and death
rates remain high, especially for children, mainly because of continued
outbreaks of measles, cholera, and malaria. WFP reports that current
levels of malnutrition and mortality remain two to four times higher than
typical levels in Somalia for this time of the year and six times the typical
level for Sub-Saharan Africa.

In 2011, WFP’s direct expenses in Somalia totaled about $137 million,
with most of this money used to support relief programs, including
emergency operations, as reflected in table 3. WFP supported vulnerable
Somalis through an emergency operation and three special operations. 2
The main pillars of WFP’s emergency operations are general food
distribution and nutrition programs to provide support to families living in
emergencies and ensuring their adequate food consumption. An
emergency school meals program provides a daily meal while increasing
access to education of vulnerable children. Early recovery activities,
including institutional feeding, and Food for Assets projects, including
training, support the reestablishment of basic livelihoods of targeted
households.




2
 To support the provision of emergency humanitarian food assistance, WFP implemented
three special operations in Somalia: (1) emergency rehabilitation of logistics and
infrastructure, (2) humanitarian air service, and (3) logistics and emergency
telecommunications.




Page 77                                   GAO-12-790 World Food Program Internal Controls
                                         Appendix III: Information on Case Study
                                         Countries—Ethiopia, Kenya, and Somalia




Table 3: WFP Direct Expenses for Somalia, 2007-2011

                                                 2007                     2008                         2009            2010                  2011
         a
Relief                                 $64,508,000            $168,086,000               $247,236,000         $104,916,000         $116,098,000
Developmentb                                         0                         0                          0               0                         0
                     c
Special operations                       3,169,000               10,696,000                 20,057,000           13,362,000           20,657,000
                                   d
Bilateral trust funds and others                     0                         0                 596,000          1,611,000               728,000
Total                                  $67,678,000                  $178,781                   $267,889       $119,889,000         $137,483,000
                                         Source: WFP’s 2011 Annual Performance Report, May 14, 2012.

                                         Note: Expenses do not include program support and administrative costs.
                                         a
                                          Includes activities under emergency operations, such as general food distribution for Somalis,
                                         according to WFP.
                                         b
                                          Development activities are intended to temporarily free the poor from the need to provide food for
                                         their families and to develop assets such as better houses and new agricultural skills, according to
                                         WFP.
                                         c
                                             Special operations typically involve short-term logistics and infrastructure work, according to WFP.
                                         d
                                             Includes all expenses for WFP’s bilateral trust funds, General Fund, and Special Accounts.


                                         In June 2009, the United Kingdom-based Channel 4 News reported on
                                         allegations that WFP food assistance in Somalia had been diverted from
                                         intended beneficiaries. Since that time, the UN Monitoring Group on
                                         Somalia, WFP’s Office of Inspections and Investigations, and WFP’s
                                         External Auditor have conducted audits and investigations of these
                                         allegations and related control weaknesses. The allegations of food
                                         diversion and ensuing investigations added to the challenges WFP faced
                                         in Somalia due to drought, famine, and increased security risks and
                                         conflict related to the al-Shabaab terrorist group. Increased security risks
                                         in Somalia led many nongovernmental organizations, including WFP, to
                                         suspend their operations in some parts of Somalia in 2010. In 2011, WFP
                                         began providing assistance to some of the areas in Somalia it had exited
                                         in early 2010. Figure 9 shows a timeline of security and humanitarian
                                         events in Somalia as well as internal and external investigations into
                                         allegations of control weaknesses in WFP’s operations there, including
                                         food diversion.




                                         Page 78                                                 GAO-12-790 World Food Program Internal Controls
                                        Appendix III: Information on Case Study
                                        Countries—Ethiopia, Kenya, and Somalia




Figure 9: Timeline of Security and Humanitarian Events and Investigations into WFP Control Weaknesses in Somalia




                                        Page 79                                   GAO-12-790 World Food Program Internal Controls
                                         Appendix III: Information on Case Study
                                         Countries—Ethiopia, Kenya, and Somalia




Monitoring Data Reported                 WFP country offices in Ethiopia, Kenya, and Somalia set their own
by WFP                                   monitoring goals and monitoring plans. Tables 4 and 5 provide monitoring
                                         data reported by WFP, such as planned numbers of beneficiaries,
                                         UNDSS security levels, numbers of distribution sites, and numbers of
                                         monitors, for Ethiopia, Kenya, and Somalia as well as for selected
                                         fieldwork sites in Ethiopia and Kenya and high-risk areas in all three
                                         countries.

Table 4: Monitoring Data Reported by WFP for Ethiopia, Kenya, and Somalia

                                                                                                         Monthly            Monthly post-
               Number of                                                        Number of            distribution             distribution
                 planned              UNDSS                Number of          monitors for            monitoring               monitoring
             beneficiaries      security level      distribution sites         all program         coverage goal            coverage goal
Ethiopia        3,033,000       1 (minimal) to         3,053 sites and                    81     100 percent of all       100 percent of all
                                4 (substantial)      16 refugee camps                             refugee campsa           refugee campsa
                                                       for all relief and
                                                    recovery programs
Kenya           2,780,000            2 (low) to          2,668 sites for                  49        For nonrefugee     120 households for
                                4 (substantial)           General Food                                 general food each distribution site
                                                        Distribution and                                 distribution     for non-refugee
                                                       Food for Assets                              activities within        general food
                                                        activities within                       relief and recovery distribution activities
                                                    relief and recovery                                  programs -       within relief and
                                                               programs                            10 percent of all recovery programsa
                                                                                                                sitesa
Somalia         1,900,000      3 (moderate) to          1,241 sites for all               64           40 percent;              40 percent;
                                  over 5 (high)                programs        (39 WFP and          30 percent for           30 percent for
                                                                              25 third-party)    areas covered by         areas covered by
                                                                                                        third-party              third-party
                                                                                                      monitoringb                monitoring
                                         Source: WFP.
                                         Note: Data shown under “Number of planned beneficiaries” are as of May 2012. All other data shown
                                         are as of August 2012.
                                         a
                                          The WFP country offices in Ethiopia and Kenya have established different monitoring goals for the
                                         various programs operating in their respective countries (e.g., relief and recovery, refugees, school
                                         feeding, HIV/AIDS). We show the monitoring goals for the programs that we focused on and the sites
                                         that we visited during our fieldwork.
                                         b
                                          According to WFP, WFP area offices in Somalia were also required to monitor each distribution site
                                         once every 3 months in 2011.




                                         Page 80                                        GAO-12-790 World Food Program Internal Controls
                                          Appendix III: Information on Case Study
                                          Countries—Ethiopia, Kenya, and Somalia




Table 5: Monitoring Data Reported by WFP for Selected GAO Fieldwork Sites and High-Risk Areas in Ethiopia, Kenya, and
Somalia

                                   UNDSS                           Number of                    Number of
                             security level                 distribution sites                beneficiaries           Number of monitors
Tigray, Ethiopia              1 (minimal) to        332 distributions sites and                      386,529                                 4
                               3 (moderate)                   3 refugee camps
Somali, Ethiopia            3 (moderate) to          869 distribution sites and                   2,374,374                                 40
                             4 (substantial)                 5 refugee camps
Garissa, Kenya                     2 (low) to                              764a                     694,832                                  6
(includes Mwingi)             4 (substantial)
Turkana, Kenya                4 (substantial)                               273                     427,400                                  5
Mogadishu, Somalia                  5 (high)                                 93                     433,664                              13
                                                                                                                      (4 WFP monitors and
                                                                                                                     9 third-party monitors)
Puntland, Somalia             4 (substantial)                               312                     337,346                             11
                                                                                                                         (all WFP monitors)
                                          Source: WFP.
                                          Note: Data shown are as of August 2012.
                                          a
                                           According to WFP, although the WFP Garissa field office oversees 764 distribution sites, only 148 of
                                          these sites are monitored by WFP Garissa staff.




                                          Page 81                                       GAO-12-790 World Food Program Internal Controls
Appendix IV: Comments from the World Food
             Appendix IV: Comments from the World Food
             Program



Program




             Page 82                               GAO-12-790 World Food Program Internal Controls
Appendix IV: Comments from the World Food
Program




Page 83                               GAO-12-790 World Food Program Internal Controls
Appendix V: Comments from the U.S.
             Appendix V: Comments from the U.S.
             Department of State



Department of State




             Page 84                              GAO-12-790 World Food Program Internal Controls
Appendix V: Comments from the U.S.
Department of State




Page 85                              GAO-12-790 World Food Program Internal Controls
Appendix V: Comments from the U.S.
Department of State




Page 86                              GAO-12-790 World Food Program Internal Controls
Appendix VI: GAO Contact and Staff
                  Appendix VI: GAO Contact and Staff
                  Acknowledgments



Acknowledgments

                  Thomas Melito, (202) 512-9601 or melitot@gao.gov.
GAO Contact
                  In addition to the individual named above, Phillip Thomas (Assistant
Staff             Director), Barbara Shields (Analyst-in-Charge), Martin De Alteriis, Mark
Acknowledgments   Dowling, Etana Finkler, Fang He, Teresa Heger, Sabur Ibrahim, Jeffrey
                  Isaacs, Reid Lowe, and Kimberly McGatlin made key contributions to this
                  report. Other contributors include Ming Chen, Joy Labez, Armetha Liles,
                  and Jeremy Sebest.




                  Page 87                              GAO-12-790 World Food Program Internal Controls
Related GAO Products
             Related GAO Products




             Farm Bill: Issues to Consider for Reauthorization. GAO-12-338SP.
             Washington, D.C.: April 24, 2012.

             International Food Assistance: Funding Development Projects through
             the Purchase, Shipment, and Sale of U.S. Commodities Is Inefficient and
             Can Cause Adverse Market Impacts. GAO-11-636. Washington, D.C:
             June 23, 2011.

             International School Feeding: USDA’s Oversight of the McGovern-Dole
             Food for Education Program Needs Improvement. GAO-11-544.
             Washington, D.C: May 19, 2011.

             International Food Assistance: Better Nutrition and Quality Control Can
             Further Improve U.S. Food Aid. GAO-11-491. Washington, D.C: May 12,
             2011.

             Global Food Security: U.S. Agencies Progressing on Governmentwide
             Strategy, but Approach Faces Several Vulnerabilities. GAO-10-352.
             Washington, D.C.: March 11, 2010.

             International Food Assistance: USAID Is Taking Actions to Improve
             Monitoring and Evaluation of Nonemergency Food Aid, but Weaknesses
             in Planning Could Impede Efforts. GAO-09-980. Washington, D.C.:
             September 28, 2009.

             Somalia: Several Challenges Limit U.S. International Stabilization,
             Humanitarian, and Development Efforts. GAO-08-351. Washington, D.C.:
             February 19, 2008.

             United Nations Organizations: Oversight and Accountability Could Be
             Strengthened by Further Instituting International Best Practices.
             GAO-07-597. Washington, D.C.: June 18, 2007.

             Foreign Assistance: Various Challenges Impede the Efficiency and
             Effectiveness of U.S. Food Aid. GAO-07-560. Washington, D.C.: April 13,
             2007.

             Darfur Crisis: Progress in Aid and Peace Monitoring Threatened by
             Ongoing Violence and Operational Challenges. GAO-07-9. Washington,
             D.C.: November 9, 2006.




             Page 88                          GAO-12-790 World Food Program Internal Controls
           Related GAO Products




           United Nations: Lessons Learned from Oil for Food Program Indicate the
           Need to Strengthen UN Internal Controls and Oversight Activities.
           GAO-06-330. Washington, D.C.: April 25, 2006.

           Foreign Assistance: U.S. Food Aid Program to Russia Had Weak Internal
           Controls. GAO/NSIAD/AIMD-00-175. Washington, D.C.: September 29,
           2000.

           Foreign Assistance: U.S. Bilateral Food Assistance to North Korea Had
           Mixed Results. NSIAD-00-175. Washington, D.C: June 15, 2000.

           World Bank: Management Controls Stronger, but Challenges in Fighting
           Corruption Remain. GAO-00-73. Washington, D.C.: April 6, 2000.

           Foreign Assistance: North Korea Restricts Food Aid Monitoring.
           NSIAD-00-35. Washington, D.C: October 8, 1999.




(320845)
           Page 89                         GAO-12-790 World Food Program Internal Controls
GAO’s Mission         The Government Accountability Office, the audit, evaluation, and
                      investigative arm of Congress, exists to support Congress in meeting its
                      constitutional responsibilities and to help improve the performance and
                      accountability of the federal government for the American people. GAO
                      examines the use of public funds; evaluates federal programs and
                      policies; and provides analyses, recommendations, and other assistance
                      to help Congress make informed oversight, policy, and funding decisions.
                      GAO’s commitment to good government is reflected in its core values of
                      accountability, integrity, and reliability.

                      The fastest and easiest way to obtain copies of GAO documents at no
Obtaining Copies of   cost is through GAO’s website (http://www.gao.gov). Each weekday
GAO Reports and       afternoon, GAO posts on its website newly released reports, testimony,
                      and correspondence. To have GAO e-mail you a list of newly posted
Testimony             products, go to http://www.gao.gov and select “E-mail Updates.”

Order by Phone        The price of each GAO publication reflects GAO’s actual cost of
                      production and distribution and depends on the number of pages in the
                      publication and whether the publication is printed in color or black and
                      white. Pricing and ordering information is posted on GAO’s website,
                      http://www.gao.gov/ordering.htm.
                      Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                      TDD (202) 512-2537.
                      Orders may be paid for using American Express, Discover Card,
                      MasterCard, Visa, check, or money order. Call for additional information.
                      Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO      Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                      Visit GAO on the web at www.gao.gov.
                      Contact:
To Report Fraud,
Waste, and Abuse in   Website: http://www.gao.gov/fraudnet/fraudnet.htm
                      E-mail: fraudnet@gao.gov
Federal Programs      Automated answering system: (800) 424-5454 or (202) 512-7470

                      Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-
Congressional         4400, U.S. Government Accountability Office, 441 G Street NW, Room
Relations             7125, Washington, DC 20548

                      Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs        U.S. Government Accountability Office, 441 G Street NW, Room 7149
                      Washington, DC 20548




                        Please Print on Recycled Paper.