Safeguarding Bank Operations

1. Safeguarding Bank Operations Strategies and Current Approaches to Address Fiduciary Risk in the Bank: A Case Study of Corruption in Bank Operations in Kenya

2. Main aim of Bank’s governance work is to help develop capable and accountable states and institutions that devise and implement sound policies, provide public services, set the rules governing markets, and control corruption, thereby helping reduce poverty. Governance Work in the Bank

3. Maintaining strong fiduciary practices in Bank-financed operations to sustain the confidence of its shareholders, other stakeholders and the public at large. This includes: (a) assisting partner countries in improving governance and reducing corruption by strengthening their PFM systems, improving their corporate financial reporting standards and practices and increasing the number of qualified financial management professionals that work in the public and private sectors; (b) strengthen fiduciary practices in Bank-financed projects and (c) work with global partners in harmonization practices and development of international standards. Financial Management’s Sector Role

4. Financial management is a core element of the Bank’s fiduciary framework, in conjunction with procurement and disbursement. Together these arrangements are intended to provide assurance that the funds provided by the Bank are used appropriately and only for the purposes intended. The Bank has a robust FM policy framework and risk-based operating model outlined in OP/BP 10.02, Financial Management and a FM Practices Manual. The aim is to ensure that each investment project has satisfactory arrangements for budgeting, funds flow, internal controls, accounting, financial reporting, and auditing. The use of country FM systems—use of the country’s institutions and applicable laws, regulations, rules and procedures for the operation being supported by the Bank—is actively encouraged, where the Bank has assessed these systems to be adequate. Fiduciary Practices in Bank-Financed Operations

5. The primary responsibility for the prevention and detection of fraud and corruption rests with the borrower, which is required to establish and maintain a control environment adequate to provide reasonable assurance that Bank loan proceeds will be used only for the intended purposes. Consistent with international assurance industry standards, FM staff review that the control environment established by the borrower continues to provide reasonable assurance that Bank loan proceeds are used for the intended purposes Clarification of Responsibilities

6. Ongoing implementation experience has highlighted the need for fully implementing the FM Practices Manual. A range of possible practice enhancements, in the context of the enhanced anticorruption focus include the following: Internal Controls. INT’s investigations indicate that fraud and corruption are often related to breakdown or weaknesses in the internal control environment. More rigorous attention will be paid during project preparation to the design of project internal control systems, including documentation and audit trails, and adherence to good corporate governance principles. As appropriate, detailed internal control reviews by independent auditors/reviewers will be built into project FM design – to review the appropriateness and actual functioning of internal control systems (in some cases as part of project external audits). Such review teams would typically include both traditional auditing skills and technical/function specialist skills relevant to the nature of the project. Increased attention will also be given to project internal audit arrangements. Enhancing FM Practices and Improving Quality

7. Technical / Physical audits. Where needed, project FM designs would include independent checks to verify quality and quantity of output and appropriateness of unit costs. Such arrangements would be designed working jointly with the sectors concerned and the Procurement sector. Improving Quality of Audits

8. Increasing Effectiveness of Project Audits. More rigorous attention would be paid to the design and functioning of audit arrangements. Particular attention would be paid to ensuring that the audit scope/terms of reference are appropriate (with expansion from the “normal” audit scope wherever needed, going beyond financial statements certification to focus more on internal controls and detection of fraud and corruption); and that requirements/expectations are clearly spelt out, including the auditors responsibilities to consider fraud in the audit of financial statements. Quality of the audit work (including the audit report and management letter) and audit timeliness would be monitored more closely. More rigorous follow of audit reports and management letters by the borrower and the Bank, including audit committees with external stakeholders (such as civil society, professional organizations, and government representatives from outside the project entity) would be emphasized. Improving Quality of Audits

9. Readiness for Implementation of Project FM Arrangements. More attention would be paid to ensuring that various aspects of the FM system – manuals/procedures, staffing, organization, internal controls and audit, external audit, etc – are well in place before project start. Appropriate Project Budgets. Increased attention would be paid to ensure that project cost estimates/budgets are correctly estimated (jointly with sector specialists). Project Readiness

10. Disclosure of project FM information by the borrower/project entity would be strongly encouraged as part of project FM design. Examples include: project financial statements (interim and annual), audit reports and Management letters, follow-up actions taken on audit reports and management letters, contract information, adherence to service standards (e.g., timeliness of financial reporting, the extent of audit reports followed-up on and satisfactory actions taken, adherence to payment schedules and payment sequencing procedures), remuneration to project staff and consultants, project expenditures linked to physical/project progress. Further, project FM design would incorporate measures such as civil society monitoring / oversight to enhance the demand for accountability. Transparency of Project FM Information

11. To enhance impact, efforts would be made to better integrate FM arrangements with overall project design, and procurement, disbursement and project monitoring arrangements. A more holistic approach to controls to ensure that responsibilities among Bank teams for control and monitoring during all stages of the cycle are well defined and that Bank supervision effectively covers the entire cycle (particularly at the post contract-award stage). More Emphasis on Integrated Design of Project Arrangements

12. Better coordination of financial transparency measures with community participation and monitoring measures such as social audits, and of project FM design with overall project monitoring and evaluation (M&E) arrangements would be pursued. FM staff would play a significant role in country anticorruption teams and in developing project-specific anticorruption plans envisaged in high-risk environments. Standard FM controls and monitoring measures would be an important element in such plans. Project Arrangements

13. Selective portfolio fiduciary reviews would be carried out to look at control issues in more depth, obtain a cross-cutting and systemic view, and combine elements of preventive and investigative approaches. This would help to identify areas of vulnerability, provide more specifics on particular areas of attention in the given country context, and identify areas/ sectors/ types of projects for focused attention. In-depth Fiduciary Reviews

14. To further the linkages between the preventive and investigative dimensions of project-level efforts, the FM Team plans to work more closely with INT. Potential areas of increased collaboration include: (a) joint work on Detailed Implementation Reviews or Fiduciary Reviews; (b) flag potential issues from internal control reviews, audit reports and management letters to INT; (c) follow-up on INT findings e.g., informing proving cases of fraud and corruption in Bank-financed project to the relevant partner country authorities such as supreme audit institution and anti-corruption institutions, and to relevant authorities in the source country; Collaboration with INT

15. (d) actively seek and incorporate lessons from INT’s Detailed Implementation Reviews and other work into FM arrangements in new and ongoing projects; (e) selective in-depth forensic audits in projects e.g., where internal or external audits indicate “red flags” or possible issues of fraud or corruption; and (f) joint training to staff and clients with INT. INT Collaboration

16. The use of country FM systems will continue to be encouraged, where assessed to be adequate. Within a given country context, country systems could be used for all or for selected aspects of project FM arrangements, or in specific sectors or institutions, as appropriate. Where ring-fencing or special arrangements are instituted as demanded by country or project circumstances, these would be designed in a manner that would strengthen (rather than undermine) country FM systems e.g., supplementing rather than bypassing the country’s regular systems and institutions, with such supplemental measures phased out as country performance increases. Simultaneously, developing country capacity and human resources would continue to be strongly emphasized, thus facilitating the greater use of country systems over time. No Change in Use of Country Systems

17. The Bank’s GAC strategy proposes an upstream risk rating of projects to identify the subset of projects that are most at risk, more senior level review of riskier projects, and a regular risk review of the project portfolio and pipeline to focus resources and managerial attention in areas of higher risk, particularly during supervision. Clusters of projects that share common features and risks—for example, projects incorporating block grants, cash transfers, compensation payments, or sub-national components—will also receive further in-depth review. FM staff will provide inputs into the institutional risk management exercise, which includes FM risk. The established project FM risk model would continue to be used. Inputs into Project Risk Rating

18. FM supervision plans and resources would be better linked with FM and project risk ratings.More senior FM staff would be deployed to work on project design and supervision of riskier projects. Peer review inputs by senior FM sector staff from a different region would also be used as appropriate in high-risk operations. Resource Allocations

19. INT investigations on Indonesia projects provide examples of fraud and corruption arising from weaknesses in internal controls such as weak accounting evidence—forged and fictitious documents (invoices, training attendance sheets, travel expenses, altered quantities and amounts), poor documentary trail (“informal” receipts), diversion of funds (project funds disbursed by treasury to wrong accounts and diverted), and excessive amounts paid out (e.g., manipulation of quantities). Weaknesses in Internal Controls: Findings from INT Investigations

20. Lessons learnt include: (a) need for early warning measures (awareness of fiduciary risk flags during supervision, attention to proper payment validation, segregation of financial functions in project organization, need for seamless link between different audit levels); (b) supervision is critical (internal audits within the project, Bank supervisions and SOE reviews, ex-post reviews to focus on internal controls, analysis of audit management letters for patterns of control lapses, linking frequency of supervision to fiduciary risks); (c) the nature of vulnerability varies by type of expenditure. “Soft” expenditures are very vulnerable to forgery and financial fraud (workshops, training, travel, operating expenditures). Goods and works expenditures are more vulnerable to collusion in procurement. In consultancies, reimbursable expenditure are vulnerable to mark ups and fictitious claims; Lessons Learnt

21. (d) there is need for audit beyond the documentation (in projects where fraud and corruption were substantiated, financial statements were prepared in time and obtained clean audit opinions). Increased sampling for audit may help; (e) preventive mechanisms are important e.g., transparency and disclosure of outputs and audit reports; easy complaints mechanisms and complaint handling systems; improve quality of accounting evidence; and improved internal controls and internal audits. Cont’d.

22. The Kenya Urban Transport Infrastructure Project (KUTIP), is an example of a situation that involved corruption in a Bank-funded project in which both Government officials and Bank staff members were found to have been involved in corruption. KUTIP was initiated in June 1996, with the aim of improving the road network in 26 towns and the capacity of the local authorities to maintain them. Some $ 79.86 million (sh6.2 billion) of the loan had been spent with some $21.67 (Sh1.69 billion) remaining unspent, before disbursements were suspended.. A senior World Bank employee who was a Washington-based Task Manager supervising this project pleaded guilty to charges of corruption. He admitted to entertaining a request for a kickback from a Kenyan government official involved in the project. The bank's own investigations have also shown that a company which had been given two contracts under the roads project, paid bribes to one of its employees and a Kenyan official. The investigations uncovered proof that a consulting firm, which had been awarded two World-Bank financed contracts under KUTIP, had made payments to the World Bank official. Kenya Portfolio—KUTIP Problem

23. The government and the Bank have taken steps to mitigate risks to the portfolio: Forensic audits were carried out on several projects in the portfolio (completed in June 2005; the Bank’s Department of Institutional Integrity carried out the Detailed Implementation Review Audits of Projects in Kenya Portfolio

24. While policy-level work in the fight against corruption is ongoing, the Bank has taken a number of steps to protect its portfolio against corruption. Many of these are based on the findings of forensic audits (November 2004 and June 2005) of the portfolio such as the following: projects were generally not controlled using a balancing general ledger system that was fully integrated and regularly reconciled with the rest of the government’s central accounting system; project designs did not identify fraud risks and management of such risks was not an integral part of each project; senior government oversight of the projects is weak; World Bank procurement guidelines are not properly understood and inconsistently implemented; management accounts and project quarterly reports reflect levels of activity but do not necessarily identify major issues so that actions can be taken; and lessons learned and best practices are not shared among similar projects or passed into the wider government structure. Forensic Audit Findings

25. Of four projects reviewed, INT confirmed the earlier forensic audit findings by identifying significant additional indicators of fraud and corruption in the now-closed HIV/AIDS project and in the Decentralized AIDS and Reproductive Health projects but found the Free Primary Education Project to be free of serious indicators of corruption. The DIR found indicators that suggest that there may have been collusion in the bidding under the Northern Corridor Transport Improvement Project but found no evidence of such collusion. The DIR’s conclusions form the basis of a Management Action Plan (MAM). This plan addresses each of INT’s recommendations explaining what actions are completed, underway or to be achieved. Accomplishment of action items in the MAM will be among the critical pre-conditions for continued lending, particularly in the health sector, going forward. DIR Recommendations

26. In response to “red flag” corruption risks identified by the forensic audit, the Bank, working with the Government has taken several critical risk-management measures, as follows: all project activities have been integrated into the central Government general ledger system, while ongoing projects have established subsidiary general ledgers that are required to be integrated into and reconciled with the central Government general ledger; all new projects are integrating control elements recommended by the auditors while including a risk management function within their institutional arrangements (for example, within project steering committees), and risk-based audit procedures have been mainstreamed into project audit requirements; and Ministerial and project-level audit committees have been established, the Government’s internal audit function has been redefined to effectively deal with institutional risks, and quarterly financial monitoring reports are now required to be presented by all projects. Conclusions: Country Team Response