ICAI Follow-up: DFID’s approach to managing fiduciary risk in conflict-affected environments

Default chapter title

The Independent Commission for Aid Impact works to improve the quality of UK development assistance through robust, independent scrutiny. We provide assurance to the UK taxpayer by conducting independent reviews of the effectiveness and value for money of UK aid.

We operate independently of government, reporting to Parliament, and our mandate covers all UK official development assistance.

Executive summary

Each year, ICAI follows up on the response to the recommendations it made in reviews published the previous year. The process is a key link in the accountability chain, providing Parliament and the public with an account of how well DFID and other government departments have responded to ICAI reviews. It also provides feedback to the responsible staff, and serves as a useful learning exercise for ICAI in our quest to achieve greater uptake of our findings and recommendations.

This document is a summary which focused only on the results of our follow up of DFID’s approach to managing fiduciary risk in conflict-affected environments. The full Follow Up report of all our year five reviews, including overall conclusions from the process and details of our methodology, can be found on our website.

Findings

DFID’s approach to managing fiduciary risk in conflict-affected environments

DFID has committed to spending half of its budget in fragile and conflict-affected states, where the risks involved in delivering aid, including risks of corruption and diversion of aid, are high. In August 2016, we published a performance review of how well DFID manages fiduciary risk in such environments. We awarded DFID an overall green-amber score, in recognition of its active approach to managing fiduciary risks, including fraud and corruption, and of a series of useful ongoing reforms on risk management. However, we also identified a number of areas where improvements were needed. We made four recommendations, in the areas indicated in Table 1.

DFID reacted well to the review, accepting the analysis and all the recommendations. So far it has taken positive action in response to the first two recommendations, as part of the ongoing process of strengthening its approach to risk management, but progress on the remaining two has been limited. Our report has also encouraged DFID’s Internal Audit Department to look in more detail at risk management practices in conflict-affected countries.

Smart Rules: Better Programme Delivery, DFID, April 2017, p. 18, link

Fiduciary risks relate to the funds not being used for the intended purposes and/or not being properly accounted for.

Risk appetite and risk-return balance

At the time of our review, DFID was in the process of introducing a new risk management framework and accompanying guidance. However, it did not yet have a consistent approach to defining its risk appetite, or tools for balancing risk and return across its country portfolios. This led to considerable diversity of approach across country offices, and differences in the interpretation of how to reconcile DFID’s high risk appetite and its zero tolerance approach to fraud and corruption.¹ We therefore recommended that DFID accelerate the introduction of new policies and guidance in this area.

In December 2016, DFID approved a new risk appetite statement and risk management policy, with accompanying tools and training materials. The new policy breaks down risk appetite by type of risk, noting DFID’s willingness to work in high-risk environments but emphasising its low appetite for reputational and fiduciary risk. The country office staff we spoke to confirmed that the guidance and training had given them a better understanding of the department’s approach.

Smart Rules: Better Programme Delivery, DFID, April 2016, p. 31, link.

DFID has also piloted a new ‘risk and development return’ tool for portfolio management. Country business plans now include some analysis of how to balance risk and development return across their portfolios.

We will do all we reasonably can to ensure our funds are not used fraudulently… We have a zero tolerance approach towards, and will work to prevent, fraud and corruption, reporting and acting upon all suspicions.

Risk transfer

Our 2016 review found that DFID did not have a clear position on risk transfer down the delivery chain, where its primary implementers work through subcontractors. Staff were unsure of the extent to which risks were transferred to subcontracted parties and the consequences of transferring risk down the delivery chain. We recommended that DFID clarify its rules around risk transfer and the residual responsibilities of DFID managers.

DFID’s new risk management policy states that partners are responsible for the robust monitoring of their subcontractors, including taking a zero tolerance approach to fraud and corruption. Programme managers are now required to map the delivery chain for each bilateral programme and a new smart guide on how to do so was adopted on 1 April 2017 (later than planned). It includes a section on matters to consider when transferring risk management responsibilities, including the capacity of third parties to absorb risks and the potential costs. This new guidance is a welcome development that, once implemented, should improve DFID’s management of complex delivery chains, particularly in insecure environments where the risks tend to be greatest.

Monitoring of multilateral partners

Where DFID engages multilateral agencies as implementers of bilateral programmes, there are limits on its ability to ensure adequate fiduciary risk management. In our 2015 report, we found that oversight arrangements were negotiated at the local level, rather than based on an objective risk assessment. We therefore recommended that DFID explore ways of improving the transparency of multilateral partners and its ability to monitor their management of fiduciary risks.

DFID accepted this recommendation and its new smart guide requires delivery chain mapping for multilateral partners. However, the core issue of DFID’s entitlement to supervise multilateral delivery partners remains unresolved. Although there have been efforts to improve the accountability of multilaterals at the central level through the Multilateral Development Review process, DFID’s oversight of multilateral partners at country level remains fairly ad hoc. DFID acknowledged that this is an area that it is still working on.

Allocation of staff

The review found that DFID did not have a system for assigning experienced staff to manage its riskiest programmes. Furthermore, when staff were redeployed rapidly in response to humanitarian crises, programme management skills were not prioritised. We therefore recommended that DFID introduce a system for matching fiduciary risk management skills to its highest-risk programmes in conflict-affected countries.

While DFID accepted this recommendation, its departmental response was not specific as to what measures would be undertaken and progress since then has been limited. DFID has incorporated risk management into staff training and established a risk management community of practice. Staff report that this has helped to improve risk management capabilities. DFID has also established a crisis response network, which is a register of staff able to offer surge support in humanitarian emergencies. Members of the network identify their programme management experience, which in principle makes it possible to assign them accordingly. While these measures may prove helpful, they have not addressed the substance of the recommendation. This appears to reflect a wider uncertainty within DFID over whether to create a specialised programme management cadre or to mainstream programme management functions across the whole department.

Conclusion

This has been a mixed response from DFID. We have seen positive action on the first two recommendations, with new policies, guidance and staff training. These have been well received by staff, and are reportedly beginning to improve risk management practice in the field. On the rules governing risk transfer through complex delivery chains, oversight of multilateral partners and matching staff skills with programme risk levels, the response has been uneven. We recognise that it takes time to change business processes, and that some issues, particularly the oversight of multilateral partners at country level, require sensitive handling. We nevertheless expect to see DFID continuing to push forward in these areas. We therefore propose to revisit the question of delivery chain and multilateral partner oversight in next year’s follow-up.

Footnotes

1. Smart Rules: Better Programme Delivery, DFID, April 2016, p. 31, link. ↩