OIG Recommendations Monitoring Plan - November 2017

1. Office of the Inspector General Status of OIG Recommendations & Plan to enhance their monitoring OAS/OIG, November 2017

2. Agenda • Status of OIG Recommendations as of November 17, 2017 • Plan to Enhance Monitoring of OIG Recommendations Review of OIG Recommendations with the CAAP

3. Overview of OIG Recommendations Activity 13 out of 66 closed recommendations in 2017 correspond to an OIG’s review of no longer applicable ones as recommended by the Board of External Auditors. Corrections: 2015 and 2016 Investigations recommendations not accounted for in previous reports Review of OIG Recommendations with the CAAP

4. Overview of OIG Recommendations Activity by Secretariat Review of OIG Recommendations with the CAAP

5. High risk recommendations • 49 recommendations rated as “high-risk” remained open as of November 15, 2017. • The Board of External Auditors (BEA) advised the OIG to review all open audit recommendations including a reevaluation of its rating. They noted that at the time of their review approximately 65% of all audit recommendations were ranked as “high”, which in their opinion can be not practical for management to immediately act on every recommendation. • The quarterly review process of OIG’s recommendations introduced by the CAAP has demonstrated to be a valuable support the Organization, to ensure the Secretariat moves ahead in implementing recommendations. Nonetheless , the review suggested by the BEA should be addressed by the OIG to ensure a prompt response from Management to the most important and relevant subjects. • Considering the existing OIG’s ongoing initiatives and priorities (details in Appendix 2&Appendix 3), the OIG plans to address the BEA’s recommendationon Q1/2018. That activity should lead to a reduction of the number of recommendations rated as “high-risk” which are the ones the Organization should focus with priority and act upon. • Appendix 1 shows the list of all current open “high-risk” recommendations. Review of OIG Recommendations with the CAAP

6. Agenda • Status of OIG Recommendations as of November 17,2017 • Plan to Enhance Monitoring of OIG Recommendations Review of OIG Recommendations with the CAAP

7. Open OIG recommendations have remain steady in around 100/year which suggests the monitoring process should be reviewed in order to pursue a higher level of effectiveness Process Strengths • Quarterly review process of OIG’s recommendations introduced by the CAAP is enhancing management’s attention. • A best in class software (TeamMate) for audit management in place at the OIG. Improvement Opportunities • Increase the frequency of OIG’s monitoring and reporting. • Ensure an appropriate prioritization of recommendations by introducing rating criteria. • Enhance clarity of specific actions required from management to close recommendations. • Ensure new audit recommendations are valid, feasible and understood by discussing them in audit exit meetings. Review of OIG Recommendations with the CAAP

8. Objectives in the OIG Mid-Term Plan 2017-2019 addressing the improvement opportunities noted Review of OIG Recommendations with the CAAP

9. 2017: Fostering management’s engagement with audit recommendations • As part of our quality assurance process, we are ensuring that our audit observations are risk-based. • In order to promote management’s engagement with audit observations, the OIG is now coordinating exit meetings after audit completions. Mutual understanding is pursued in those meetings and the following principles are promoted: • The audit process should be seen as a tool for continuous improvement. • Every finding only once! (i.e. focus on addressing the root cause of the issue). Review of OIG Recommendations with the CAAP

10. 2018: Plan to enhance OIG’s recommendations monitoring • LIST OF ACRONYMS USED: IIA = The Institute of Internal Auditors; SMART = Specific, Measurable, Achievable, Responsible person, Time; CAAP=Committee on Administrative and Budgetary Affairs

11. Introduction of agreed SMART actions in the audit reports SMART acronyms stands for: Specific, Measurable, Achievable, Responsible person, Time. • Current audit reports have: • OIG recommendation • Management response • New audit reports will include: • OIG recommendation • Management comments (if any). • Specific agreed management action, including due date and person responsible for its implementation. Review of OIG Recommendations with the CAAP

12. Introduction of criteria for observation’s ratings DRAFT FOR ILLUSTRATION PURPOSES Review of OIG Recommendations with the CAAP

13. IIA’s recommendations for small internal audit activities - * In Compliance with Standard 2500 – Monitoring Progress • Existing open recommendations: • Once re-assessed, hand over to management those rated Medium or Low Priority • New recommendations: • OIG commits to follow - up only on those rated High or Medium Priority *The Institute of Internal Auditors (IIA) defines a small audit activity as one which typically will have one or more of these characteristics: One to five auditors; Productive internal audit hours below 7,500 a year; Limited level of co-sourcing or out-sourcing.

14. Appendixes Review of OIG Recommendations with the CAAP

15. Appendix 1 – List of all Open High-Risk Recommendations as of November 15 2017 Review of OIG Recommendations with the CAAP

16. Appendix 2: OIG – Operational Road Map 2017 - 2019 2017 2018 2019 Long Term Ambition Optimized processes led by a learning organization. - Define and establish performance indicators • - Promote an AC • - OIG’s Online Portal • - Update Executive Order 95-05 - Explore Data Analytics Continuous Improvement - Implement Quality Assessment recommendations - Develop Standard Audit Programs - Automated follow - up (Team Central) - Conclude audits 2017 - Enhance monitoring process - Update risk-based plan - Audit Charter - Quality Assessment - Update manual Certified audit activity that provides value added recommendations, monitors agreed actions and ultimately helps OAS achieve its objectives through world-class audit services. - Self-assessment - Foster management’s engagement with audit recommendations - Complete or substantially finalize the audit plan Audit Activities Diligent and expeditious investigations that strengthen OAS transparency & accountability. Investigation Activities - Update manual - Review Harassment Policy - Conduct a Peer Review - Reduce backlog - CPE fulfillment - IDP monitoring - Increase CIA/CFE team members - CPE fulfillment - Conclude recruitment process - Introduce IDPs - CPE fulfillment - Preparation for Quality Assessment - Initiate recruitment process A team that attracts and develops talent. People • LIST OF ACRONYMS USED: OIG= Office of the Inspector General, AC= Audit Committee, QAIP=Quality Assurance and Improvement Program, CPE=Continuing Professional Education, IDP=Individual Development Plan, CIA = Certified Internal Auditor, CFE= Certified Fraud Examiner • Objectives in red are those related to the plan to improve the monitoring of OIG Recommendations

17. Appendix 3: Overview of OIG’s activity 2017 OIG Mid Term Plan