How Time Flies: Leadership Insights from a Career in Internal Oversight IIA Chapter Event Olympia WA 9 December 2015 Carman L. Lapointe Under-Secretary-General for Internal Oversight (Retired), United Nations Secretariat

Overview A bit of context—a few examples of what the UN does Internal Oversight in the UN context How I got hooked on internal auditing Why you should care about it Lessons learned on my (long) watch that might be useful…

All in a day’s work for the UN Feeding 90 million people in 75 countries Assisting 34 million fleeing refugees Vaccinating 58% of the world’s children Monitoring 80 Human Rights treaties Aiding 12.5 million victims of emergencies Peacekeeping in 16 operations ($22 million/day) Plus poverty reduction, maternal health, climate change and much, much more

UNODC Combats Organized Crime Human Trafficking Money Laundering Illicit Crop Replacement

United Nations Landmine Assistance 110 Million Landmines in 68 countries, and as many stockpiled 2,000 fatalities or serious injuries every month For every mine cleared, 20 are laid Used for terrorism and denying access to land, water, roads, utilities

United Nations Peacekeepers at work Peacekeeper on Patrol in DRC Women discussing Peacekeeping strategies (UNICEF/DRCongo) Average # lives lost per year in first 43 years: 20 Last 10 years: 118

Refugees and Humanitarian Aid Line-ups for UNHCR services A Somali boy in an IDP settlement in Mogadishu, Somalia. Credit: AU/UN IST/Price

Emergency Operations in Haiti Cholera Patient Consultation Only 30% have direct access to potable water; only 25% to sanitary toilets 9,000 deaths and 800,000 cases since 2010; 1,000 new cases per week in 2015 in Haiti

Rule of Law and Development projects Rule of Law: Monitoring Conditions in Women’s Prison in South Sudan Irrigation Project in development doubles as fish farm

The UN is Risky Business…on a grand scale But it all has to be managed and supported too Administrative functions related to operations $55 Billion pension fund that operates in most countries and currencies In short, the UN faces risks no other organization would contemplate Factor in a governance structure comprised of 193 member governments, all trying to micro manage by consensus New mandates, none dropped, no new funding no new funding,

Under Secretary General & Assistant Secretary General Internal Auditing Investigations Division Inspection & Evaluation 160 Posts (NY, Geneva, Nairobi, Peacekeeping Missions) 90 Posts (NY, Vienna, Nairobi, Peacekeeping Missions) 26 Posts in NY Executive Office Front Office 16 separate funding sources Annual resources: $50 Million

A Look at the Work of OIOS in the UN

Internal Audit Results: Non PKO Overall Ratings for 89 Reports Issued Recommendations By COSO Control Component

PKO Investigations Completed Sexual Exploitation & Abuse Financial (Insurance Fraud)

Inspection and Evaluation Each evaluation begins with an inception paper A program impact pathway (PIP) is developed, usually for the first time (first deliverable) Biennial reviews of self-evaluation capacity – Scorecards issued in 2013 and 2015 Approximately 10 evaluations per year Peacekeeping moving from location to thematic evaluations (e.g. protection of civilians, prevention of Sexual Exploitation and Abuse)

InputsActivitiesOutputsOutcomesImpacts Resources we have, develop or adopt to do our work Things we do day to day Products we produce Changes we influence Long-term changes Examples: Staff, $$$, procedures, systems, standards Planning, recruiting, coordinating, consulting, supervising, QA reviews Reports, results, advice, updates, summaries, recommend- ations Assurance, informed decision- making, awareness Stronger, more effective delivery of all programmes, improved lives PIPs: Logical pathways to manage risks and measure success Performance targets are set and monitored for each element; Used in OIOS divisions and for client programs evaluated.

Legislated Reporting Requirement Annual Financial Implications of OIOS work Results for (US$ millions) Fraud by external parties3.3 Fraudulent staff claims, payroll fraud0.8 Overpayments4.5 Cost recoveries5.3 Efficiency gains0.1 Total US$13.8 M

Why does internal auditing matter? Accounting versus accountability Internal auditing (IA) versus external auditing IA as a leadership development program (CPC) Learning opportunity for potential candidates (World Bank guest auditor program) Capacity Development as a contribution to the profession (IIA Capability Model & World Bank)

How I got hooked on internal auditing The Kapuskasing “opportunity” Export Development Canada role/condition Four years of college in night school as single parent Special dispensation to write CIA exam Involvement in Ottawa Chapter and at IIA Global Lesson # 1: It’s never too late to make a career change; our lives are shaped by our choices

Positioning internal audit EDC and its TQM journey – Internal Audit as workshop facilitators – Results became basis of risk-based audit plan Bank of Canada (Canada’s central bank) – Basel Committee framework for evaluating internal controls Canada Post (lean) IIA CCSA designation developed Lesson #2: Tailor audit language and processes to suit your organization

Balancing Advisory and Assurance Roles Independence promotes objectivity Independence does not require isolation Involvement of CAE in strategic forums and discussions, as observer and advisor Assurance results backed by facts and evidence Lesson #3: Resist isolating the audit function and ensure role clarity as observer/advisor versus assurance

Focus audit work strategically Align risk-based audit plans to strategic challenges and emerging issues Collaborate with and leverage the work of other assurance functions (ERM, external auditors) Involve internal audit in early phases of key initiatives, before they become fatal Examples: air operations, waste management, UMOJA Lesson #4: Don’t start from scratch, leverage competent, relevant work done by others

Communicate plans and results effectively Pursue risks that resonate with management and the Board (or Audit Committee) Never leave significance to interpretation; use ratings; follow up according to significance Beware of language that implies audit ‘ownership’ of the results (revealed, found, etc) Lesson # 5 (a): Don’t allow big issues to get lost in the fog of ‘nitpicking negativity’ # 5 (b): When things go wrong, it isn’t because we ‘found’ it; seek change, not credit for results

Lead by example Being accountable for our own results is the best way to demonstrate commitment & usefulness Develop KPIs that are relevant Share targets and Share results of regular quality assessments Lesson # 6: A taste of our own medicine helps us appreciate the challenges faced by our clients

A taste of our own medicine…

OIOS Internal Audit PIP

Quarterly Activity Reports include Scorecard: 41 KPIs: IAD – 15 ID – 14 IED – 12 OIOS Scorecards: Measuring what matters

A word on politics (and surviving) Best to follow professional standards, be sure Brief management and Board (or AC) on strategy Know where you stand before making a stand Involve CAE and management in critical issues early; allow opportunities for action Escalate issues as appropriate, and warn mgmt Consider incentives for early resolution Lesson # 6 (a): Bad news easier with a plan in hand #6 (b): Sometimes it is what it is, nothing you do will make it easier; accept it & move on

One thought on our future role Periodic (annual?) overall opinions on internal control Comparable to external audit opinions Requires rigorous planning and professional execution Adequate resources, clear basis and limitations Consider stakeholder expectations

Questions and comments Thank-you!