What GAO FoundThe design of the United Nations (UN) World Food Program’s (WFP) internal controls related to delivery and monitoring of food assistance generally reflects principles for internal controls and enterprise risk management developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). WFP has developed an internal control framework that has, like the COSO internal control framework, five components: internal environment, risk management, control activities, information and communication, and monitoring. However, the design of some of WFP’s controls has weaknesses that could expose WFP to risks such as waste, fraud, and abuse. For example, WFP’s Executive Board oversight is limited, and it does not fully utilize the WFP Audit Committee to assist in overseeing the effectiveness of WFP’s risk management and internal control processes. Also, WFP has designed risk management policies but has not developed detailed guidance to instruct staff in addressing risks, especially at the country level where WFP is most vulnerable. Additionally, as recommended by COSO, WFP has established control activities that address risks to its objectives–for example, policies and procedures designed to help ensure tracking of food assistance from delivery at the port-of-entry to distribution to beneficiaries. However, weaknesses in the design of its commodity tracking system, including lack of capacity to track food in implementing partners’ custody, limit WFP’s ability to account for all food in these partners’ custody. Further, WFP has developed detailed policies for monitoring distribution of food assistance to beneficiaries, in line with COSO principles, but has not provided guidance that instructs staff to consider risk when determining needed levels of monitoring, including in high-risk areas where WFP staff have limited access.In the areas of Ethiopia, Kenya, and Somalia that GAO selected for its review, WFP has implemented procedures as designed for tracking and monitoring food assistance in its custody from port-of-entry to beneficiaries. However, WFP’s ability to account for food in the custody of implementing partners is constrained by the lack of tracking through its commodity tracking system, lack of timely reporting by some partners, and a limited number of monitors. In addition, security restrictions have limited WFP monitors’ access to partners’ warehouses and distribution sites in some high-risk areas. For example, in six districts in the southeast area of Ethiopia, WFP has not monitored implementing partners’ distribution sites since May 2011. Some of these factors may also limit WFP’s ability to provide accurate reporting of food assistance losses. Because its system does not track food in implementing partners’ custody and because of WFP’s restricted access to some sites, its calculation of food losses relies in part on partners’ distribution reports. However, these reports are sometimes late and inaccurate. Although operating in Somalia is inherently challenging, WFP reported an average loss rate of 0.25 percent for Somalia from 2007 through 2011, compared with 0.41 percent for WFP’s operations globally. Moreover, despite concerns expressed by some WFP donors and Executive Board members, no external evaluation of WFP’s food loss data has been conducted since a 2006 review by WFP’s External Auditor. In that report, the Auditor noted that inadequate reporting of losses not only presents risks to the effectiveness of WFP’s aid efforts and the achievement of its objectives but also presents reputational risks in terms of donor confidence.Why GAO Did This StudyIn 2011, WFP provided about $4 billion in food assistance–including U.S. contributions of about $1.2 billion–to about 99 million beneficiaries in 75 countries. Many of these countries include high-risk areas where WFP staff have limited access. In 2009, a media report alleged that large amounts of WFP’s food assistance were being diverted in one of these countries, Somalia. Subsequent external and internal audits found deficiencies in WFP’s control of its Somalia operations. In response, WFP took steps to strengthen its controls, including adopting the COSO internal control framework. To assess WFP’s ability to help assure that food reaches intended beneficiaries in high-risk areas, GAO examined the extent to which (1) the design of WFP internal controls related to delivery and monitoring of food assistance reflects COSO principles and (2) WFP has implemented as designed certain controls in selected high-risk areas. GAO reviewed COSO and other international principles; reviewed WFP policies, documents, and data; and interviewed WFP and U.S. officials. GAO conducted case studies of Ethiopia, Kenya, and Somalia.What GAO Recommends GAO recommends that the Department of State work through WFP’s Executive Board to ensure that management and the board take several actions to strengthen WFP’s ability to manage risks inherent in some environments as well as utilize the Audit Committee more fully and report losses more accurately. WFP, State, and other relevant U.S. agencies agreed with GAO’s recommendations.For more information, contact Tom Melito at (202) 512-9601 or melitot@gao.gov.