Key Achievements in 2005

Risk Management

The IAU worked with client Centers to develop their risk management systems. Supporting Center Boards of Trustees statements on risk management and internal control remains a major activity of the IAU. Although the focus of the IAU's work in 2005 was on high-level, centerwide risk analysis, important progress was made in developing tools to help Centers with "drill-down" or "bottom-up" analysis to supplement center-level analysis. IAU developed templates to guide Center risk analysis related to

• genetic resource collections (completing work in 2004),
• information and communications technology, and
• regional offices and experimental stations.

Good Practice Notes

Good Practice Notes are the means by which IAU shares lessons and good practices from its audits, as well as from research on external benchmarks, across the CGIAR Centers. The current versions of all notes are posted in the IAU website within the www.cgiar.org domain. During 2005, notes were issued on the following six topics:

• Selection of external auditors,
• Evaluation of incumbent external auditors,
• Audit committee self-assessment,
• HR management,
• Management of information security,
• Development, acquisition, implementation, and maintenance of application systems.

Broadening the Coverage of Internal Audit

The IAU conducted assignments on various aspects of Center financial, administrative, and research operations in 13 of the 15 CGIAR Centers. This function accounts for the main use of IAU resources. The unit conducted or managed audits in some new, nontraditional areas, exemplifying how the IAU can add value to Center operations and can help verify Center risk-mitigation plans. Audits included the following areas:

• Occupational health and safety, covering not only offices but laboratories, workshops, food and housing facilities, and experimental farms,
• Resource mobilization strategy,
• Research pipeline management,
• Publications performance data.

Collaboration with Other SO Units

In mid-2005 the IAU and the CGIAR Secretariat undertook a joint review at the Forum for Agricultural Research in Africa (FARA), headquartered in Accra, Ghana. This review, the first of its kind by the SO, was undertaken at FARA's request. It examined FARA's readiness to manage the SSA Challenge Program, identified strengths and areas for improvement, and shared various ideas on good practices to support the organization.

During 2005, the IAU provided support to the CIO on a number of important ICT-KM activities. The IAU assisted with the restructuring of the former Data Resilience Project into a broader Enterprise Security and Business Continuity Project funded under the ICT-KM Program. The project will help address concerns raised in Center internal audits and risk analyses. The IAU has been providing assistance to the new project since its launch and will continue to do so during the main implementation and validation phases.

IAU also assisted the CIO with preparations for the retendering of the shared ICT services contract. The IAU Director was invited to join the annual IT managers meeting in 2005 and presented, with ICARDA, a common approach for Center analysis of ICT risks as part of centerwide risk management programs. The approach was later agreed to by the IT managers. The participation of IAU in the IT managers' meetings has become a productive means of exchanging views between IAU and the IT community and promoting priority setting of ICT internal audit efforts across the CGIAR system.

In late 2005 the IAU and CIO jointly initiated a survey of financial and administrative systems in the CGIAR Centers to benchmark the current situation, exchange information on experience with the various systems, and assess interest among the Centers for closer collaboration on the acquisition and use of new systems. IAU and CIO made a preliminary presentation of the results at the internal audit sponsors meeting in December 2005. Feedback indicates that Centers have a strong interest in moving to shared systems, provided a compelling business case is developed. A report on the survey was issued in early 2006.

The IAU continued work during 2005 on a series of joint Good Practice Notes and risk management guides with other SO units. A draft Good Practice Note on HR management, prepared with assistance from SAS-HR and G&D, was released. Two new Good Practice Notes on ICT topics (Management of Information Security and Development, Acquisition, Implementation and Maintenance of Application Systems) were prepared with CIO assistance and have been released as exposure drafts to the IT manager community for comment.