August 2007 - Implementing Whistleblowing Systems There is increasing interest in organizations establishing whistleblowing systems as part of good governance. They provide a confidential channel, bypassing normal supervisory communication channels in an organization, for staff or others to convey concerns regarding conduct by Board members, managers or staff which they feel:

• Is against or circumvents the Organization’s governing rules, policies and established standards and codes of conduct;
• Is improper, unethical or unlawful;
• Is, or will result in, a waste of the Organization’s resources;
• Is inconsistent with the standards they believe the Organization subscribes to;
• Is an attempt to cover up any of these types of actions; or
• Is already known to, but not being diligently reviewed and acted upon by, the Organization’s managers.

The benefits of having a whistle-blowing policy are that it helps to create an environment of efficiency, openness and transparency, and demonstrates a commitment on the part of the organization to operate in a manner intended to facilitate high levels of honesty and integrity amongst its staff. Such a policy can also act as an effective early warning system in identifying possible illegal activity or mismanagement, since staff are generally in the best position to identify these types of problems. Finally, a whistle-blowing policy makes it clear that it is every staff member’s duty to report evidence of misconduct, and then provides them with a clear avenue to do so. Not knowing where to turn to when confronted with evidence of this type of problem in the absence of such a policy can be extremely stressful for employees.

A commonly heard argument against whistle-blowing policies is that they are an invitation for anonymous griping, or may lead to a culture of denunciation. This, however, can be avoided by a well-designed policy, with appropriate implementation procedures.

However, implementing whistleblowing systems effectively is a complex undertaking. The CGIAR Internal Auditing Unit has produced a good practice guide and policy template to assist CGIAR Centers implement such systems. Important elements of an effective whistleblowing system, which are explained in the Note, are:

• Make the whistleblower channels part of a broader set of communication channels which promote open communication about concerns and use of whistleblowing channels as a last resort.
• Ensure employee communication channels reinforce the Center’s Codes of Conduct, conflict of interest policies, business integrity strategies and risk management systems and promote compliance. They should enable and promote a trustful, fair and transparent organizational culture in the Center.
• Implement an employee reporting system that is broad in scope, permitting employees to register concerns about any aspect of Center compliance with internal policies, laws or regulations.
• Include, in ethics policies or codes of conduct, a duty to disclose serious violations of Center policy and laws. Employee reporting policy and/or orientation material and presentations should provide guidance on the steps taken to protect employees against retaliation and reporting systems should ensure confidentiality and permit anonymity that will protect genuine complainants.
• Ensure the employee reporting system includes appropriate procedures for the timely assessment of the merits of complaints received, for protecting the system against frivolous or malicious use by disgruntled employees, and for maintaining the strict confidentiality of complaint information to protect reputations of complaint targets while the complaints are investigated.
• Implement an employee reporting system which can support the identification of “hotspots” that indicate a need for policy or other institutional changes beyond the actions specific to particular complaints.
• Analyze the costs and benefits of in house versus co-sourcing solutions to providing confidential employee reporting, case management and analysis systems. An appropriate balance between cost and best practice should be determined and explicitly considered by the Center.

The CGIAR Internal Auditing Unit promotes the use of an external provider to provide secure web and telephone contact points for whistleblowers and to provide an established system to track reports. However it believes one provider should be selected by all Centers, or at least a group of Centers, to make this option economical. In the meantime, Centers are opting to use the Board Chair, Audit Committee Chair or Internal Audit as the contact point for whistleblowers.

The Good Practice Note on Whistleblowing has been circulated to Centers but can also be downloaded from the restricted (CGIAR only) section of this website.

March 2007 - Of Genebanks and Crop Databases. When you think of internal auditors, what comes to mind? Probably for many of you it will be people with their noses in the financial records, checking whether numbers add up, appropriate documentary evidence supports accounting entries, the cash is under lock and key, and vehicles, stores and equipment are tracked and can be found at all times. This is certainly important bread and butter work for auditors.

But there is more to the work of CGIAR internal auditors than this. Take for instance our work related to what may be the most visible and enduring activity of the CGIAR System, the one that will continue perhaps in perpetuity: the ex situ conservation of genetic resources relating to the staple food crops for which the CGIAR has an internationally recognized mandate to research. Just as critical as the CGIAR Centers’ reputation for sound management of financial resources, is their reputation for being responsible and reliable custodians of the priceless assets which these genetic resource collections comprise.

It is no accident that number 1a. of the CGIAR’s Research Priorities is promoting conservation and characterization of staple crops.

Conserving plant genetic resources in genebanks – as seeds, in vitro or cryogenically – and recording and disseminating the information that will make the collections useful for agricultural development, is a complex, intensive and expensive activity. But getting it right is essential for ensuring that the germplasm collections are always available for research to aid, even save, many poor people around the world and, if necessary for the restart of agriculture in countries devastated by natural or man-made disaster.

As part of its advisory work for Centers on the implementation of enterprise risk management, the CGIAR Internal Auditing Unit has been working with the Center genebank managers and the System-wide Genetic Resources Program (SGRP) to develop an appropriate framework of analysis for the risks relating to conservation and use of genetic resources, and using this framework to articulate the priority areas for improvement efforts in managing the genebank collections and the information on them.

Under Phase 2 of a World Bank-funded Global Public Goods project, starting in early 2007, the IAU will be assisting the Centers with an extensive re-assessment of the risk management framework and extending this framework to consider inter-Center collaboration on crops in common, and wider collaborative activities with national and regional genebanks under an emergent global system of conservation and use as envisaged under the International Treaty for Plant Genetic Resources for Food and Agriculture. It is also expected that the products of this re-assessment, along with the best practice material to be developed in parallel under other activities of the Project, will become valuable global public goods that national and regional genebanks can also use for the management of their own collections and their collaborative activities in a global system.

As internal auditors, we are not about to drop our interest in traditional areas, but don’t be surprised if some of us show more interest these days in such matters as material transfer agreements, phytosanitary protocols, strategies to manage somaclonal variations in vegetatively propagated collections, the correct use of pollination bags during seed regeneration, black box safety duplication arrangements and the quality of crop database records!

December 2006 - From Afghanistan to Zimbabwe. Did you know that, beside the 15 headquarters, the CGIAR Centers have a collective presence in well over 100 other locations around the world? In every Center, internal auditors are requested by Boards of Trustees and management to undertake assurance and advisory work in such locations, including facilitation of the roll out of risk management programs. Not every CGIAR location can be covered every year, and some locations are very small or fully hosted by other CGIAR Centers. However, in the twelve months of 2006 CGIAR internal auditors audited offices and experimental stations in such diverse countries as Afghanistan, Brazil, Costa Rica, Egypt, Ethiopia, France, Malawi, Mali, Mozambique, Nepal, New Caledonia, Niger, Senegal, Solomon Islands, Turkey, Uganda and Zimbabwe, in addition to the 14 countries where the CGIAR Centers have their main headquarters campuses. Even within headquarter countries, internal auditors have been called on during 2006 to visit remote stations and project offices such as in the Sonora Desert of Mexico, Gujarat in India and western and northern Nigeria. Coverage of the widely decentralized presence of the CGIAR Centers represents a major component of internal audit work every year. To respond, the CGIAR Internal Auditing Unit has prepared a good practice note on Regional/Country Office Business Objectives and performance Indicators. This note is aimed at helping Centers to have clear rationale for maintaining their investments in the various locations and to monitor expected deliverables from the investments. In addition the IAU has developed a detailed risk analysis template for regional and country offices and experimental stations away from headquarters. These help the offices to self-assess the adequacy of controls and other measures for typical risks and/or prepare for future internal audit visits. The template also helps the internal auditors efficiently manage their planning for their audit visits, using them as communication tools to help the offices prepare and send much information ahead of time. Audit visits are not just carried out to check the cash box and the local bank account. Internal auditors review and advise on such diverse topics as decentralized program and project management, research data practices, occupational health and safety, sale of station produce, local taxation and labor law compliance, asset management and partner contracting. And we take back lessons and recommendations to the headquarters for wider application across the Centers….. Truly A-Z auditing!

August 2006 - CGIAR Internal Auditors Meet in Nairobi - Approximately every two years, all the internal auditors of the CGIAR System get together, along with a number of guests, to share experience, participate in professional development activities and consult on the best ways of applying the international internal auditing standards to their work. This year the meeting, lasting 5 days, was held in Nairobi at the end of June and beginning of July 2006 and the venue rotated between the World Agrofrestry Center (ICRAF) and the International Livestock Research Institute (ILRI), both headquartered in Nairobi.

The meeting was sponsored by the CGIAR Internal Auditing Unit. Internal Auditors based in Kenya, Nigeria, Benin, India, Philippines, Mexico, Cali and Washington DC attended, as well as a number of Center corporate services / finance staff and the Lead Financial Officer from the CGIAR Secretariat who provided a client perspective to the discussions. The group was joined by a number of invited guest speakers providing multiple perspectives under the broad theme of “Challenges and Opportunities for Internal Audit”. Guests included the Acting Regional Inspector General of USAID based in South Africa; the Internal Auditor General of the Government of Kenya; the Regional Partner for Sub-Saharan Africa from PricewaterhouseCoopers; and the Managing Partner of UHY Advisors, which is assisting with a number of donor-funded initiatives on the development of the internal auditing profession in Africa.

Part of the week also involved collaboration with the Kenya Chapter of the Institute of Internal Auditors Inc. - the worldwide professional body. Some high quality sessions on various internal audit topics were led by a number of leading internal auditors and risk managers from the Kenyan private sector. These sessions enabled the CGIAR internal auditors to update themselves on various specific aspects of professional best practice, and showcased some of the remarkable internal audit talent from the continent.

Drawing on the various discussions, the internal audit group worked on the last day of the meeting on the development of a common CGIAR Internal Auditing Manual – a work in progress whose first edition is planned to be completed in 2006.

The agenda for the week, a record of proceedings and copies of various presentations made are available in the “CGIAR-only” section of this website.

2005 - The Good, the Bad and the Ugly : Audit as a tool for institutional learning and change - The environment for audit is changing. With rapid evolution in such areas as technology, markets, competition for funds, and cost structures, the idea of a single, fixed model of good practice often no longer applies in many aspects of CGIAR Center operations. Multiple business objectives add complexity. There are also risks versus opportunity considerations to be considered: the what, where, when and how of internal control depends on a “risk appetite” not a “golden standard”. What does this mean for Internal Audits’ work? Click to see the presentation.

January 2005 - Risk Management Initiative Underway : The CGIAR Internal Auditing Unit is working with client Centers to develop their risk management systems. Spurred by recent spectacular governance failures in the private and public sectors, a number of CGIAR member countries have developed standards and codes on risk management, and for some public and private sector enterprises the implementation of systematic organization-wide risk management processes and public reporting on these by governing boards is now mandatory. An influential CGIAR donor wrote to all Centers in 2003 encouraging them to adopt a similar approach. The CGIAR Internal Auditing Unit believes that this will aid Centers to avoid surprises, better manage risks and opportunities, and strengthen donor confidence in their overall governance - a key ingredient in any strategy to stem the erosion of unrestricted funding of the Centers.

A Good Practice Note on Center-wide Risk Management and a Discussion Paper on Board Statements on Risk Management have been prepared by the Unit after extensive research on standards, codes and practices in CGIAR member countries. These documents, as well as a summary presentation on Center-wide Risk Management, are available to staff of the CGIAR Centers, System Office and CGIAR partners in the restricted section of this website. Access to this section is being developed through Center intranets.

The planned outcome of the Unit's work this year is the adoption by client Center Boards of a risk management policy and a format for an annual Board statement on risk management (for the Center's annual report or equivalent).

November 30, 2003 : New Internal Audit Web Pages Launched

These pages were launched during the IWMI Board of Governors meeting in New Delhi in November 2003. The IWMI Board of Governors Chair Ambassador Remo Gautschi and Director General Frank Rijsberman joined The Audit Committee Chair, Ms. R. Daba Fall and Audit Committee members Ms. Joan Joshi and Dr. Rivka Kfir to view the new pages.
The web pages are aimed at providing information on the internal auditing functions in the CGIAR System, and a database of good practice and discussion notes on topics related to risk management, internal control and corporate governance, for CGIAR Centers and CGIAR System Office components and for CGIAR partners. Photo caption: The IWMI Board Chair, Audit Committee members and Director General view the new internal audit web pages with the CGIAR Internal Auditing Unit Director, John Fitzsimon.