Internal controls in an international financial institution

Abstract

In 2005 the World Bank decided to undertake a review of the internal controls under the COSO framework which governed the operational compliance of its concessionary funding agency, the International Development Association (IDA). This was the first such review within the Bank and the first by any international financial institution. This article describes the purpose, scope, methodology and execution of that review, touching also on the main findings. The review involved both entity and transactions level design and controls testing, it used creative empirical tools to establish ‘pass rates’ and it provided the basis to uncover a material weakness and several significant deficiencies.

Keywords:

• COSO
• internal controls
• World Bank

Acknowledgements

The author, a former World Bank director now retired, was recruited in late 2005 as a consultant by the Bank's Independent Evaluation Group (IEG) to be the lead author of the IEG segment of the review. His perspective may, therefore, be coloured by that position which he held throughout the five years of the study. However, this article has been reviewed by a number of colleagues from both the Bank's management and Internal Audit Department (IAD), for accuracy and aptness. IEG has given permission for the author to use the information gained from his tenure in IEG in this presentation and has cleared this article for publication. All volumes of the original IEG review can be viewed at: http://ieg.worldbankgroup.org/content/ieg/en/home.html

Acknowledgements are due to many colleagues in the World Bank's management and IAD staff who contributed to the huge volume of work, and some of whose charts and methods are described here. Special thanks also need to be given to Nils Fostvedt (senior advisor to the director general IEG), and to Dexter Peach, Rosemary Jellish and James Campbell.

The views expressed here, however, are solely those of the author and any errors are the author's alone.

Notes

* All references in this article to ‘the Bank’ refer only to the Bank and IDA, not to other members of the World Bank Group.

* In the case of privately operating commercial companies, the COSO compliance principle refers more to compliance with the legal and regulatory frameworks under which such companies operate. In IDA's case it was not that these legal and regulatory frameworks were thought not to apply (the assumption was that they did, and that IDA operated in conformity to local laws, country by country), but that the most immediate and relevant notion of ‘compliance’ was that which was required by its articles which established the IDA, and the policies and procedures which it set in place to pursue its objectives.

Additional information

Notes on contributors

Ian Hume

Ian Hume is a retired World Bank director now a consultant in Washington, D.C.