Regional multilateral development banks [electronic resource] : external audit reporting could be expanded.

a

GAO

United States General Accounting Office

Report to Congressional Committees

December 2001 REGIONAL 

MULTILATERAL 

DEVELOPMENT 

BANKS

External Audit 

Reporting Could Be 

Expanded

GAO-02-27
Page i GAO-02-27 Regional MDBs

Letter 1

Results in Brief 2

Scope and Methodology 5

Background 7

MDB External Audits Could Be Enhanced by Reporting on Internal

Control and Compliance 12

Importance of Internal Control Standards and Reporting

Worldwide 21

Audit Committees Are Key to Strengthening MDB Accountability 26

Conclusions 28

Recommendations for Executive Action 30

Agency Comments and Our Evaluation 30

Appendix I Transparency International’s 2001 Corruption

Perception Index 35

Appendix II Summary of World Bank’s Implementation of the 

COSO Internal Control Framework as of April 2000 37

Management Controls Components 37

World Bank Implementation Schedule 38

Appendix III Sample External Auditor’s Report on Internal Control

Over Financial Reporting 40

Independent Auditor’s Report 40

Appendix IV Comments From the Department of the Treasury 41

Tables

Table 1: Regional MDB Groups’ Lending Arms and Functions 10

Table 2: U.S. Resources Provided to Regional MDBs Through

December 31, 2000 11

Table 3: Regional MDB Operational Lending Arms’ Bases of

Accounting and Auditing Standards 12

Contents
Page ii GAO-02-27 Regional MDBs

Figures

Figure 1: MDBs’ Flow of Government Funding and External Audit

Reporting 14

Figure 2: Regional MDBs as Financial Intermediaries 17

Figure 3: Audit Committee Accountability Relationship 27

Figure 4: Countries Included in Transparency International’s 2001

CPI 36

Abbreviations

AfDB African Development Bank

AfDF African Development Fund

AsDB Asian Development Bank

AsDF Asian Development Fund

ASB Auditing Standards Board

COSO Committee of Sponsoring Organizations of the Treadway

Commission

CPI Corruption Perception Index

EBRD European Bank for Reconstruction and Development

FDICIA Federal Deposit Insurance Corporation Improvement Act

of 1991

IAS International Accounting Standards

IDB Inter-American Development Bank

IIC Inter-American Investment Corporation

INTOSAI International Organization of Supreme Audit Institutions

ISA International Standards on Auditing

MDB Multilateral Development Bank

SAS Statement on Auditing Standard

U.S. GAAP U.S. Generally Accepted Accounting Principles

U.S. GAAS U.S. Generally Accepted Auditing Standards
Page 1 GAO-02-27 Regional MDBs

December 14, 2001

Congressional Committees

Multilateral Development Banks (MDBs) were established to provide

financial support for projects and programs designed to promote social

and economic progress in developing countries and the countries of

central and eastern Europe and the former Soviet Union. Under the Fiscal

Year 2001 Foreign Operations, Export Financing, and Related Programs

Appropriations Act (Public Law 106-429), the United States is providing

approximately $1.3 billion to support the missions of the MDBs, with

about $460 million going to the regional development banks and about

$840 million going to the World Bank Group.1

 Section 803(a) of the act

provides that we report annually on the sufficiency of audits of the

financial operations of each MDB conducted by the persons or entities

outside the bank.

We will be issuing a series of reports in response to the reporting

requirements in Public Law 106-429. The first in this series was

Multilateral Development Banks: Profiles of Selected Multilateral

Development Banks.

2

 As agreed with your offices, this second report

provides our assessment of the external financial statement audit

reporting process for the following four regional MDB groups:

• African Development Bank Group,

• Asian Development Bank,

• European Bank for Reconstruction and Development, and

• Inter-American Development Bank.

Financial statement audits and the related assurance provided by external

auditors are important for MDBs because MDBs

• operate in countries where transparency and accountability are ranked

among the lowest in the world,

• are multilateral entities not subject to oversight by any single national

government, and

 1

Public Law 106-429 states that these funds are available to the MDBs until expended.

2

See GAO-01-665, May 2001.

United States General Accounting Office

Washington, DC 20548
Page 2 GAO-02-27 Regional MDBs

• have missions that emphasize distributing funds for development, which

need to be balanced with accountability for the use of those funds.

As agreed, this report addresses the following two specific areas related to

the external financial statement audit process:

1. the extent to which these MDB groups are obtaining assurance from

the external auditors on internal control3 over financial reporting,

lending operations, and compliance with key provisions of their

charters and policies in conjunction with their financial statement

audits and

2. whether these MDB groups have audit committees in place to provide

oversight of external financial statement audits and the MDBs’ internal

control.

We have begun similar work at the World Bank Group and will report on

that work at a later date.

All of the MDBs we reviewed have received unqualified or “clean” audit

opinions on the external audits of their financial statements. The MDBs

used widely accepted accounting standards to prepare their financial

statements, except in cases where special purpose statements were called

for.4

 Large international certified public accounting firms, using widely

accepted auditing standards, performed these audits. The audits cover the

MDBs’ financial statements showing the MDBs’ financial position at a

point in time and the financial results of operations and cash flows for a

given fiscal year. However, none of the MDBs in our review are required to

engage, nor have they engaged, their external auditors to report on their

internal control over financial reporting, lending operations, or

compliance with their governing charters or policies.

 3

Internal control comprises the plans, methods, and procedures used to meet missions,

goals, and objectives and, in doing so, supports performance-based management. Internal

control also serves as the first line of defense in safeguarding assets and preventing and

detecting errors and fraud. In short, internal control, which is synonymous with

management control, helps program managers achieve desired results.

4

The African Development Fund and the Inter-American Development Bank’s Fund for

Special Operations prepared Special Purpose financial statements to comply with the

Agreements Establishing the Funds.

Results in Brief
Page 3 GAO-02-27 Regional MDBs

In addition, the regional MDBs’ external financial statement audits are not

intended to and do not provide specific assurance about the internal

control over the MDBs’ lending operations and whether the MDBs’ funds

are being spent for their intended development purposes. At the same

time, for the regional MDB groups included in this report, their charters

state that they are to take the necessary measures to ensure that the

proceeds of any loan made, guaranteed, or participated in by them are

used only for the purposes for which the loan was granted.

Most of the regional MDBs that we looked at have developed anticorruption strategies that state that they recognize the importance of

strong internal control systems. They acknowledge that a strong control

environment within the regional MDBs and borrowing country institutions

is critical for effectively implementing the regional MDBs’ systems of

project management control. We also found that each of the regional

MDBs included in this report has established internal audit functions that

are part of their control environment.

The regional MDBs operate in a difficult and challenging environment in

countries where transparency (openness) and accountability are often

lacking, and corruption—broadly defined as the abuse of public office for

private gain—sometimes flourishes. Within that environment, the regional

MDBs face a dual mandate of providing development assistance and

exercising their fiduciary responsibility, which includes ensuring that

corruption is minimized in the projects they finance. The regional MDBs

are unique entities. They are multilateral, international institutions with

some commercial objectives and goals, as well as social advancement and

human development goals that are often characteristic of government

entities. These international financial organizations have a mission of

economic growth and poverty reduction in their borrowing countries.

Because of their multilateral, international focus, they do not have direct

accountability to a single national electorate, but their members exercise

daily control over their activities through the executive boards of the

MDBs.

Member countries provide funding for the MDBs’ mission—the economic

development and social progress of their regional borrowing members.

Member countries currently do not have audit assurance provided by an

external auditor’s attestation on the controls over the use of their

contributed funds or whether those funds were used for their intended

development purpose.
Page 4 GAO-02-27 Regional MDBs

Given the control environment in borrowing countries, MDBs and member

countries could benefit from the assurance and transparency provided by

additional examination and reporting by external auditors through the

MDBs’ annual financial statement audit process, in the area of internal

control over lending operations and internal control over compliance with

key provisions of bank charters and policies. A structured, disciplined

process for establishing, monitoring, and reporting on internal control is

critical to providing reasonable assurance over the reliability of an entity’s

financial reporting; its operations; and its compliance with regulations,

charters, or policies. An external auditor’s attestation report on internal

control could provide an assessment of the effectiveness of the MDB’s

internal control over lending and compliance and the MDB’s processes in

place designed to provide MDB management with assurance. The external

auditor’s assessment could also consider the role and activities of the

internal audit function in the MDB’s internal control.

The audit committee, a subgroup of the board of directors at the MDBs, is

a key part of the structured, disciplined process for providing assurance.

One of the functions of the regional MDB audit committees is to

understand the adequacy of the banks’ internal control. Regional MDBs’

audit committees have the authority, through the contracting process, to

expand the external reporting for their MDBs and thus strengthen MDB

accountability and transparency and enhance member country assurance

that funds are spent as intended. All of the regional MDBs in our review

have set up audit committees to provide oversight of external financial

statement audits and communicate audit results to the boards of directors.

Information we reviewed indicated that the audit committees are active

components of the MDBs’ internal governance structure in overseeing the

external auditors and communicating to the boards of directors.

To provide additional accountability, transparency, and assurance over the

regional MDB groups’ lending operations and ensure that project funds are

spent as intended, we are making recommendations to the Secretary of the

Treasury—who is responsible for the federal government’s interactions

with the MDBs—to instruct the U.S. Executive Directors of the four

regional MDBs included in this report to take the lead in working with

other Executive Directors to develop a policy requiring these MDBs and

their audit committees to adopt a phased approach to enhance the

external audit function and reporting by (1) engaging an external auditor

to report on internal control over financial reporting in conjunction with

their financial statement audits or through separate engagements,

(2) developing a plan to engage the external auditor to report on internal

control over lending operations and internal control over compliance with
Page 5 GAO-02-27 Regional MDBs

key provisions of bank charters and policies and report on the progress

made annually, and (3) reporting the results of the external auditor’s

reports and management’s progress reports to the MDBs and their member

countries annually. We are calling for a phased approach in recognition

that significant time and effort could be needed to thoroughly document,

audit, and report on MDBs’ lending operations and compliance controls.

In written comments, the Department of the Treasury acknowledged the

importance of establishing and maintaining an effective control

environment at the regional MDBs, but questioned the cost-effectiveness

of expanding the existing scope of the external auditors’ engagements to

provide the requisite assurances that regional MDB internal control is

operating effectively. Treasury also stated that in its view, the entity is in a

better position to assess internal control than the external auditor. As

discussed in the “Agency Comments and Our Evaluation” section of this

report, we do not agree with some of Treasury’s comments. Our

recommendations would increase accountability and transparency to

member governments by providing an independent third party assessment

of the MDBs’ internal controls. Increased assurance through external

auditor attestation would provide a comprehensive, independent

assessment of the effectiveness of the MDBs’ control over lending

operations and help ensure that project funds are spent as intended. We

view such additional assurance as especially important due to the risky

control environment in the countries where the MDBs operate. The

department’s comments are reprinted in their entirety in appendix IV.

Public Law 106-429, Appendix A, Title VIII, identifies 10 MDBs to be

included in the scope of our work. As agreed with your offices, this report

focuses on external audits of four regional MDB groups5

 and related

entities:6

• African Development Bank Group

• African Development Bank (AfDB)

 5

For purposes of this report, each of the four regional MDBs listed, along with any related

entity, is referred to as a group. See table 1 for a discussion of these entities and their

functions.

6

We have added the following concessional lending arms to the scope of our work: the

Asian Development Bank’s Asian Development Fund and the Inter-American Development

Bank’s Fund for Special Operations. Both of these concessional lending arms are integral

parts of their affiliated bank and are not separate legal entities.

Scope and

Methodology
Page 6 GAO-02-27 Regional MDBs

• African Development Fund (AfDF)

• Asian Development Bank (AsDB)

• Ordinary Capital Resources (OCR)

• Asian Development Fund (AsDF)

• European Bank for Reconstruction and Development (EBRD)

• Inter-American Development Bank (IDB)

• Ordinary Capital (OC)

• Fund for Special Operations (FSO)

• Inter-American Investment Corporation (IIC)

The 4 MDB groups included in our scope include 6 of the 10 MDBs listed in

Public Law 106-429: AfDB, AfDF, AsDB, EBRD, IDB, and IIC. As agreed,

we focused our work on the regional MDBs because of congressional

interest in these regional banks. In subsequent work we will address the

four remaining MDBs listed in the law: the International Bank for

Reconstruction and Development, International Development Association,

International Finance Corporation, and the Multilateral Investment

Guaranty Agency—which are all part of the World Bank Group.

Our objectives were to determine (1) the extent to which these MDB

groups are obtaining assurance from the external auditors on internal

control over financial reporting, lending operations, and compliance with

key provisions of their charters and policies in conjunction with their

financial statement audits and (2) whether these MDB groups have audit

committees in place to provide oversight of external financial statement

audits and the MDBs’ internal control. To meet our objectives, we held

meetings and interviews with Department of the Treasury officials,

including the U.S. Executive Director for the Inter-American Development

Bank. We also

• reviewed the regional MDBs’ 1997 through 2000 audited financial

statements and auditors’ opinions on the financial statements and

identified the accounting and auditing standards used by each MDB,

• analyzed and compiled information from the regional MDBs’ annual

reports and their audited financial statements,

• analyzed the external audit reports to determine the extent of the external

auditors’ reporting on internal control and compliance in conjunction with

the financial statement audits,

• reviewed the banks’ terms of reference (charters) to identify the scope of

their audit committees’ oversight and compared them to relevant guidance

on widely accepted internal control frameworks and principles on banking

supervision,
Page 7 GAO-02-27 Regional MDBs

• obtained information from the U.S. Executive Directors of each MDB

group on the MDBs’ audit committees, external audits, and the extent of

external auditor reporting on internal control and compliance,

• reviewed widely accepted internal control frameworks, such as the

Guidelines for Internal Control Standards developed by the International

Organization of Supreme Audit Institutions, and

• discussed various options for external auditor reporting with

representatives from three international accounting firms that were

responsible for some of the MDB audits.

MDBs are multilateral, international entities, and the United States, as an

individual member country, generally does not have audit authority over

their operations. As such, it was not part of our scope to evaluate whether

the regional MDBs have implemented internal control, nor did we evaluate

the quality of the external auditors’ work on the financial statement audits.

It was not part of our scope to determine whether the audit committee

members were independent of the regional MDBs they served, nor did we

evaluate other components of the regional MDBs’ internal governance

structure.

We conducted our work in Washington, D.C., from April through October

2001 in accordance with generally accepted government auditing

standards. On November 30, 2001, we received comments from the

Department of the Treasury, which are reproduced in their entirety in

appendix IV. In addition, the department also provided a number of

suggested technical changes to our report, which we incorporated as

appropriate.

MDBs are multilateral, international entities that finance economic and

social development projects and programs in developing countries and

countries of central and eastern Europe and the former Soviet Union.

National governments are the shareholders—referred to as members—of

the MDBs.7

 MDB members include developing countries that borrow from

the MDB as well as industrialized member countries.8

 All members,

 7

The European Bank for Reconstruction and Development has two members, the European

Investment Bank and the European Community, that are not country governments and the

Asian Development Bank has one member, Hong Kong, that is not a country government.

8

Member countries that borrow from MDBs are generally low- and middle-income

countries in need of social or economic development.

Background
Page 8 GAO-02-27 Regional MDBs

including borrowing members, contribute to the capital of the MDBs and

participate in oversight and in the setting of operating policies through

their participation on the boards of governors and executive boards. The

MDBs provide development assistance in the form of loans, equity

investments, loan and equity guarantees, and technical assistance. The

primary vehicle of development assistance is direct lending. In 2000, the

regional MDBs included in this report approved about $16.3 billion of

development assistance consisting of loans, loan guarantees, and equity

investments for economic and social development.

The regional MDBs’ lending activities can be grouped primarily into the

following two types: market-based lending and concessional lending.

Operations of regional MDBs that provide loans with market-based rates

are financed primarily through borrowings from world capital markets,

members’ paid-in capital, and retained earnings. Members also provide

support through subscriptions of callable capital.9

 Because of the

significant proportion of callable capital that is subscribed by members

with strong credit ratings, including the United States, MDBs are able to

use callable capital as backing to obtain more favorable financing terms

when borrowing from world capital markets than would otherwise be

available without the callable capital. To date there has never been a call

on this capital for any of the MDBs included in this report.

The lending arms of the regional MDBs that provide concessional loans to

the poorest of the developing countries—those meeting certain eligibility

requirements—are financed through contributions from member countries

and borrower repayments of outstanding loans. These loans are called

“concessional” because they are provided with below-market interest rates

and extended repayment terms. Due to the nature of concessional lending

and the credit risks10 of borrower countries, the concessional lending arms

do not have callable capital subscriptions and do not borrow from world

capital markets to finance their operations. Unlike the market-based

lending arms of the MDBs, which borrow from world capital markets to

fund lending, concessional lending arms rely on capital replenishments or

 9

Callable capital is a form of capital that is subscribed by members and resembles

promissory notes from members to honor MDB debts if the MDB cannot otherwise meet its

obligations through its other available resources.

10Credit risk refers to the risk of default by a borrower or guarantor that may result from

nonperformance under the terms of lending agreements.
Page 9 GAO-02-27 Regional MDBs

periodic contributions by members in addition to repayments from loans

in order to continue lending operations.

An MDB’s activities are overseen through a board of governors, with a

governor from each member country. In general, a board of governors is

responsible for admitting new members, authorizing agreements for

cooperation with other international organizations, making decisions

about the board of executive directors, approving the MDB’s financial

statements, determining the reserves and the distribution of profits, and

making decisions about the scope of MDB operations. Each MDB also has

a board of executive directors, which is responsible for, among other

things, overseeing the bank’s daily operations, ensuring the

implementation of the decisions of the board of governors, and approving

the budget of the bank. The MDB’s own management and staff of

international civil servants carry out the MDB’s daily operations.

The four regional MDB groups included in this report are referred to as

regional MDBs because they focus their activities on a particular region.

The regional MDBs’ memberships consist of developing or borrowing

countries within a particular region of the world plus industrialized and

other member countries located throughout the world. All members

participate in oversight and the setting of operating policies of the MDBs

through their participation on the executive boards and boards of

governors. See table 1 for a discussion of the regional MDBs and their

functions.
Page 10 GAO-02-27 Regional MDBs

Table 1: Regional MDB Groups’ Lending Arms and Functions

The African Development Bank Group includes the following

two entities, which serve the development needs of Africa.

• The African Development Bank provides market-based

loans, equity investments, loan guarantees, and technical

assistance to the public and private sectors.

• The African Development Fund is the concessional lending

arm that provides loans and technical assistance to the bank’s

poorer members.

The Asian Development Bank includes the following two

operational lending arms, which serve the development needs of

Asia and the Pacific region.

• The Asian Development Bank’s Ordinary Capital Resources

provides market-based loans, equity investments, and loan

guarantees to the public and private sectors and it provides

technical assistance to middle-income countries and creditworthy poorer countries.

• The Asian Development Fund is the concessional lending arm

that provides loans and technical assistance to the bank’s

poorer members.

The European Bank for Reconstruction and Development

serves countries in central and eastern Europe and the former

Soviet Union. It provides development assistance through marketbased loans, co-financing, loan guarantees, and equity

investments for public and private sector projects, as well as

technical assistance through its technical cooperation fund.

The Inter-American Development Bank includes the following

three lending arms, which serve the development needs of Latin

America and the Caribbean.

• The Inter-American Development Bank’s Ordinary Capital

provides market-based loans, guarantees, and technical

assistance to the public and private sectors

• The Inter-American Development Bank’s Fund for Special

Operations is the concessional lending arm that provides

loans and technical assistance to the bank’s poorer members.

• The Inter-American Investment Corporation is the InterAmerican Development Bank group’s entity that provides

loans, equity investments, and technical assistance to small

and midsize private enterprises.

The United States is a member of all the regional MDBs discussed in this

report, contributing significant amounts to support the missions of the

MDBs and subscribing to a significant amount of the MDBs’ callable

capital. The Congress appropriates funds for the United States’

contributions and capital subscriptions to the MDBs. In fiscal year 2001,

the Congress appropriated about $239 million for the regional MDBs

included in this report. During fiscal year 2001, the Congress also

approved $221 million of new subscriptions to callable capital for those

regional MDBs. The Department of the Treasury oversees the United

States’ interests in the regional MDBs. See table 2 for a summary of U.S.

resources provided to the regional MDBs through December 31, 2000.
Page 11 GAO-02-27 Regional MDBs

Table 2: U.S. Resources Provided to Regional MDBs Through December 31, 2000

Dollars in millions

Regional MDBs

U.S. paid-in

capital or

contributions

U.S. callable

capital

African Development Bank Group

African Development Bank $150 $1,699

African Development Fund 1,603 -

Asian Development Bank

Asian Development Bank – Ordinary Capital

Resources

504 6,691

Asian Development Fund 2,725 -

European Bank for Reconstruction and

Development

489 1,372

Inter-American Development Bank

Ordinary Capital 1,303 29,007

Fund for Special Operations 4,806 -

Inter-American Investment Corporation 176a-

Total $11,756 $38,769

a

The majority of this amount was a receivable at December 31, 2000.

In 2000, the regional MDBs we reviewed approved about $16.3 billion of

development assistance11 consisting of loans, loan guarantees, and equity

investments for economic and social development. Asia and the Pacific

region received the largest portion of this development assistance, about

$5.8 billion, while the Latin American and Caribbean region received

approximately $5.4 billion, Africa received about $2.6 billion, and Europe

and Central Asia received about $2.5 billion. Loans with market-based

interest rates, equity investments, and loan guarantees accounted for

about $12.9 billion of the total financial support provided by these MDBs

during 2000, while concessional lending amounted to about $3.4 billion.

All of the regional MDBs we reviewed have annual financial statement

audits. The regional MDBs’ external auditors are international certified

public accounting firms that were contracted by the MDBs to audit the

MDBs’ financial statements. All of the regional MDBs included in our

report received unqualified or “clean” audit opinions on their financial

statements for the 4 most recent years.

 11These amounts are based on the MDBs’ annual reports and MDB-reported approvals

during fiscal year 2000.
Page 12 GAO-02-27 Regional MDBs

MDBs prepare their financial statements to comply with different bases of

accounting. The MDBs present their financial statements using U.S.

generally accepted accounting principles (U.S. GAAP) or international

accounting standards (IAS), as shown in table 3. Due to the special nature

and organization of the concessional lending arms of the MDBs, some of

these entities prepare special-purpose financial statements that are meant

to show the sources and uses of resources and to comply with accounting

standards specific to the affiliate’s operations. The African Development

Fund and the Inter-American Development Bank’s Fund for Special

Operations, both concessional lending arms, prepared special-purpose

financial statements in 2000.

Table 3: Regional MDB Operational Lending Arms’ Bases of Accounting and Auditing Standards

Regional MDBs

Accounting standards used to prepare

financial statements

Auditing standards used to perform

audit work

African Development Bank International Accounting Standards (IAS) International Standards on Auditing

(ISA)

African Development Fund Special Purpose Financial Statements ISA

Asian Development Bank—Ordinary Capital

Resources

U.S. Generally Accepted Accounting

Principles (U.S. GAAP)

U.S. Generally Accepted Auditing

Standards (U.S. GAAS)

Asian Development Fund U.S. GAAP U.S. GAAS

European Bank for Reconstruction and

Development

IAS ISA

Inter-American Development Bank—Ordinary

Capital

U.S. GAAP U.S. GAAS

Inter-American Development Bank—Fund for

Special Operations

Special Purpose Financial Statements U.S. GAAS

Inter-American Investment Corporation U.S. GAAP U.S. GAAS

Agreements establishing the MDBs we reviewed call for external auditors

to examine the banks’ financial operations. The external auditors for the

MDBs included in our review conduct audits and prepare financial

statement audit reports based on the international standards on auditing

(ISA) or U.S. generally accepted auditing standards (U.S. GAAS). These

standards require independent auditors to obtain a sufficient

understanding of internal control to plan the audit and determine the

nature, timing, and extent of tests to be performed. As part of an audit, the

auditors are to communicate to the audit committee any internal control

material weaknesses and reportable conditions that come to their

attention during the course of their work. A frequent practice is for the

auditors to issue a written document known as a management letter to

communicate these weaknesses. The management letter, however, only

MDB External Audits

Could Be Enhanced

by Reporting on

Internal Control and

Compliance
Page 13 GAO-02-27 Regional MDBs

addresses issues detected as part of the financial statement audit work,

and it is not meant to be a comprehensive attestation on the sufficiency of

an entity’s internal control. In order to obtain such assurance, the regional

MDBs could engage their auditors to add this work to their annual audit or

to perform a separate attestation engagement.

To date, none of the regional MDBs are required to engage, nor have they

engaged, their external auditors to report on the MDBs’ internal control

and compliance with key provisions of bank charters and policies. All of

the charter agreements establishing the regional MDBs require them to

take the necessary measures to ensure that the proceeds of any loan made,

guaranteed, or participated in by them are used only for the purposes for

which the loan was granted and with due attention to considerations of

economy and efficiency. However, the charters do not contain

requirements for an external auditor’s report on the regional MDBs’

internal control over these key objectives and requirements. In addition,

the supporting documents provided to us by the regional MDB U.S.

Executive Directors regarding the scope of audit services did not contain

any requirements for the external auditor to provide a comprehensive

report on internal control or compliance matters. Because the regional

MDBs operate in a difficult and risky control environment, the member

countries that provide financial backing and contributions to the MDBs

could benefit from additional external audit assurance over the MDBs’

internal control over lending operations and internal control over

compliance with key provisions of their charters.

The MDBs’ external financial statement audits provide assurance over the

MDBs’ reported financial position at a point in time and the financial

results of its operations and cash flows for a given fiscal year. After the

MDBs make loans to member countries, it is at the project and program

levels where the money is ultimately spent by the borrowers for

development purposes. The MDBs’ external financial statement audits do

not specifically cover the use of funding at the project and program levels,

once the MDB has lent funds to borrowers for development purposes. The

MDBs’ external financial statement audits also do not provide and are not

intended to provide specific assurance about the internal control over the

MDBs’ lending operations and whether the funds are spent for their

intended purposes.

A key control over the lending process at one of the regional MDBs is that

as a condition of the loan, the MDB requires each project or program to

receive audits from either the member government or an accounting firm.

Financial Statement Audit

Coverage of MDBs
Page 14 GAO-02-27 Regional MDBs

The MDBs’ financial statement audits are currently not designed to report

on the results of the project and program level audits, or their

effectiveness as a control in the lending process. However, the external

auditor could be engaged to provide a report on the MDBs’ internal control

over lending operations and internal control over compliance with key

provisions of the charters—if requested by the regional MDB. Figure 1

shows the relationship of the MDBs’ flow of government funding with their

external audit and reporting.

Figure 1: MDBs’ Flow of Government Funding and External Audit Reporting

Note: This figure refers only to government funding; the role of private sector funding is shown in

figure 2.

Source: GAO analysis based on our review of MDB documents and discussions with representatives

of the international financial and audit communities.

Standards and guidance for financial statement audits do not require the

auditor to provide an opinion on the effectiveness of internal control when

External financial statement 

audit reporting

Audits

performed by

member

government

or private

sector

auditors

Projects and

programs in

member 

countries 

Member

governments

Multilateral 

Development

Banks

Technical Education assistance

Health

Infrastructure

$

$

Disbursements to borrowers/end-users below this line are in the hands of member governments, 

private contractors, or both. These disbursement are not specifically 

covered by the MDBs' financial statement audit processes.

External

audit process

Agriculture
Page 15 GAO-02-27 Regional MDBs

performing a financial statement audit. Financial statement audits are not

intended to provide a basis for the evaluation of the overall quality of the

entity’s system of internal control. Therefore, in a typical financial

statement audit, many controls designed to ensure the reliability of

financial reporting, effectiveness and efficiency of operations, and

compliance with key provisions of bank charters may not be tested.

For financial statement audits, the International Federation of

Accountants and the U.S.’ Auditing Standards Board (ASB) generally have

similar audit requirements for internal control. It is important to note,

however, that the standards for financial statement audits described below

do not require the auditor to comprehensively review and report on

internal control when performing external audits of financial statements.

• International Standard on Auditing (ISA) 400, Risk Assessments and

Internal Control, calls for the auditor to obtain an understanding of the

accounting and internal control systems sufficient to plan the financial

statement audit and develop an effective audit approach. In the audit of

financial statements, the auditor is concerned with those policies and

procedures within the accounting and internal control systems that are

relevant to the financial statements. As such, a financial statement audit is

not intended to provide explicit assurance that the entity’s funds were

used for their intended purposes, or that management controls are in place

to ensure the effective and efficient use of the funds. The auditor should

make management aware, however, as soon as practical and at an

appropriate level of responsibility, of any material weaknesses in the

design or operation of the accounting and internal control systems that

have come to the auditor’s attention during the course of the financial

statement audit. In addition, ISA 260, Communication of Audit Matters

with Those Charged with Governance, states that the auditor should

promptly communicate audit matters of governance interest arising from

the audit of financial statements with those charged with governance of an

entity.

• The ASB’s Statement on Auditing Standard (SAS) No. 55, as amended by

SAS No. 78, Consideration of Internal Control in a Financial Statement

Audit, also requires the auditor, in all financial statement audits, to obtain

a sufficient understanding of a company’s internal control to assist in

planning and performing the audit. The ASB has also issued guidance for

auditors to use in identifying and reporting certain internal control

deficiencies noted during an audit of financial statements. These matters,

termed “reportable conditions,” are matters noted during the course of the

financial statement audit that the auditor feels should be reported to the

Standards for Financial

Statement Audits
Page 16 GAO-02-27 Regional MDBs

audit committee or its equivalent because they represent significant

deficiencies that could adversely affect the organization’s ability to

produce reliable financial statements.

Although current financial statement auditing standards established in the

private sector do not require the auditor to report on internal control and

compliance when performing a financial statement audit, the auditor can

be engaged to provide a level of assurance on control and compliance in

what is referred to as an attestation engagement. Attestation standards

apply whenever an independent auditor has been engaged to provide

assurance or report on a subject matter that is the responsibility of

another party. For example, the regional MDB management would

evaluate the effectiveness of its internal control and make an assertion

about its effectiveness. In turn, the external auditor attests, or provides

assurance on, the MDBs’ internal control or MDB management’s assertion

about internal control. Attestation services can cover internal control over

financial reporting, operations, and compliance with laws, regulations, or

key policies. Internal control reporting by external auditors is quickly

becoming not only a best practice but also a commonly implemented

practice around the world.

The regional MDBs operate in a difficult and challenging environment in

countries where transparency and accountability are often lacking, and

corruption sometimes flourishes. In fact, concerns about corruption have

intensified in recent years as international financial donors have become

increasingly aware that corruption may undermine development by

deterring investment and growth and exacerbating poverty. Levels of

perceived corruption vary from country to country, as shown in appendix

I. Within this challenging environment, the regional MDBs must satisfy

their dual mandate of providing development assistance and exercising

their fiduciary responsibility. At the same time, MDBs must ensure that

corruption is minimized in the projects they finance.

As shown in figure 2, the MDBs’ operations are funded through member

countries’ paid-in capital and borrowing from capital markets, backed by

members’ pledges of callable capital. Regional MDBs provide loans with

market-based interest rates and loans on concessional terms. For example,

the Asian Development Bank group uses its Ordinary Capital Resources

for market-based lending and its Asian Development Fund for

concessional lending. Figure 2 shows graphically how each arm serves as

a financial intermediary, obtaining funds from world capital markets and

member governments and providing loans to borrowers.

Member Countries Could

Benefit From Additional

Assurance Provided by an

External Auditor’s

Attestation Over Internal

Control
Page 17 GAO-02-27 Regional MDBs

Figure 2: Regional MDBs as Financial Intermediaries

Source: GAO analysis based on our review of MDB documents and discussions with representatives

of the international financial and audit communities.

Operations of MDBs that provide loans with market-based rates are

financed primarily through borrowings from world capital markets,

members’ paid-in capital, and retained earnings. Their borrowings from

world capital markets are at favorable terms because they have high credit

ratings, based on their record of obtaining repayment on the loans they

make to borrowers and on the backing provided by member countries’

Sources of 

funds

 Callable capital

(Credit enhancement)

Paid-in capital and

contributions 

Purchase Principal

and interest

payments 

MDB debt

Loans

Payment of

principal and

interest on

market terms

Repayment of loans 

on concessional 

terms

Loans

Users of

funds 

Projects 

and programs

in member 

countries 

Capital 

markets

$ $

$ $

$

Concessional

lending arm

Market-based

lending arm

Education Technical

assistance

Health

Infrastructure

Member

governments

Multilateral Development Banks

Disbursements to borrowers/end-users below this line are in the hands of member governments, 

private contractors, or both. These disbursement are not specifically 

covered by the MDBs' financial statement audit processes.

Agriculture
Page 18 GAO-02-27 Regional MDBs

subscriptions to callable capital. To date, there has never been a need for

the MDBs that are the subject of this report to make a call on their callable

capital.

The concessional lending arms, which do not borrow from world capital

markets, rely on capital replenishments by members in order to continue

lending operations. Unlike the market-based lending arms of the MDBs,

the concessional lending arms need such replenishments because they

have very long repayment terms and are lending to the less developed

countries with high credit risk.

As of December 31, 2000, regional MDBs had outstanding loans of

$116 billion. Concessional loans comprised 26 percent, $30 billion dollars,

of that total. The total of concessional loans for the MDBs we reviewed is

considerable. At the same time, concessional loans are exposed to the

following three types of risk:

• First, due to conditions in concessional lending countries, which are

among the poorest countries in the world, MDBs are exposed to

considerable country12 and credit risks.

• Second, concessional loans are designed to aid the needs of developing

countries, some of which are perceived to have the worst corruption

problems in the world. See appendix I.

• Third, because concessional lenders rely on contributions from members,

they are not subject to the same market discipline and monitoring that

come into play when borrowing from world capital markets to fund

lending activities.

Moreover, even for the market-based lending MDBs, the discipline and

monitoring that derive from their borrowing in the capital markets is not

sufficient assurance to member countries that the MDBs have adequate

controls over their lending operations or that controls are adequate to

ensure that funds are used for the purpose for which the loan was granted.

Capital-market investors are primarily interested in the financial

soundness of the debt issuer. The assurance they receive from high credit

ratings and the MDBs’ satisfactory record of obtaining loan repayments

satisfies their needs.

 12Country risks refer to risks associated with the economic, social, and political

environments of the borrower’s home country.
Page 19 GAO-02-27 Regional MDBs

Given this control environment, MDBs and member countries could

benefit from the assurance and transparency provided by additional

reporting on the part of external auditors on the MDBs’ assertions on

internal control, especially in the area of internal control over lending

operations and internal control over compliance with key provisions of

bank charters and policies. A structured, disciplined process for

establishing, monitoring, and reporting on internal control is critical to

providing reasonable assurance over the reliability of an entity’s financial

reporting, the effectiveness and efficiency of its operations, and its

compliance with laws, regulations, charters, or policies.

Increased assurance through external auditor attestation and reporting to

member countries on internal control would provide additional assurance

and transparency to member country governments regarding the internal

control over MDBs’ financial reporting, lending operations, and the use of

their funds. The external auditor’s assessment could also consider the role

and activities of the internal audit function in the MDBs’ internal control.

Such reporting could be based on a structured and widely accepted

framework and include the auditor’s examination and conclusions

regarding management’s evaluation and assertion over the effectiveness of

control in the following areas:

1. Reliability of financial reporting: financial reporting controls are the

policies and procedures that pertain to an entity’s ability to record,

process, summarize, and report financial data consistent with the

assertions in the financial statements.

2. Effectiveness and efficiency of operations: Operations controls relate

to managing the entity’s business and include policies and procedures

to carry out organizational objectives, such as economy, efficiency,

and effectiveness of operations.

3. Compliance with applicable provisions of the MDBs’ charters and

policies: Compliance controls are the policies and procedures

management uses to comply with specified provisions of the MDBs’

charters and policies.

In order for the MDBs’ external auditors to report on controls over

financial reporting, lending operations, and compliance, it will be

necessary to adopt a phased-in approach. According to our work,

reporting on internal control over financial reporting should be a relatively

straightforward step for the MDBs to take because their external auditors

are already performing financial statement audits; thus, the inclusion of
Page 20 GAO-02-27 Regional MDBs

internal control over financial reporting would be a natural addition. For

example, the Federal Reserve Board in the United States has recently

undergone this process and was able to report externally on internal

control over financial operations by its third year.

While reporting externally on internal control over lending operations and

use of funds is vital to MDB accountability, it is a more complex process

that could take longer to implement. Before the external auditor can

conduct its review, we believe that significant issues need to be addressed

to lay the foundation for the internal control review. For example, while

internal control frameworks, such as those recognized by the International

Organization of Supreme Audit Institutions (INTOSAI),13 are available,

internal control criteria for the MDBs will need to be specified and

adopted by the MDBs. The MDBs could work together in developing

specified criteria that can be used as a benchmark for implementing

internal control and subsequently defining, measuring, and assessing the

reasonableness of internal control over lending operations and

compliance. The MDBs’ management and audit committees, along with

their external auditors, would play an important role in defining the

specific criteria in terms of applicability, significance, and materiality.

Another important issue we believe needs to be addressed by the key

players would be to identify the key charter provisions to be included in a

review of compliance controls and to define what would constitute

“substantial” compliance with those key provisions of bank charters. After

these significant issues are addressed, MDB management would be able to

comprehensively document and assess the specific controls identified as

material and applicable and subsequently provide its assertions on the

effectiveness of those controls. Finally, the external auditor would then

report on the reasonableness of management’s assertions related to the

relevant lending operations and compliance controls.

We recognize that resolving these significant issues and developing this

additional audit function could take several more years, which is why it is

imperative that the MDBs begin phasing in a strategy as soon as possible.

We also recognize that the costs of undertaking this effort may be

considerable for the regional MDBs. However, the amount of funds at risk

is also considerable.

 13INTOSAI is the professional organization of national audit offices, also known as supreme

audit institutions, in countries that belong to the United Nations or its specialized agencies.
Page 21 GAO-02-27 Regional MDBs

Effective internal control is critical in providing reasonable assurance over

the reliability of financial reporting, effectiveness and efficiency of

operations, and compliance with laws and regulations. Furthermore,

expanded reporting on internal control is becoming a widely accepted

standard of reporting. As discussed in the following sections, a broad

range of standard-setting organizations from around the world has issued

guidance supporting the establishment, assessment, and reporting on

internal control.

• Bank regulators from a range of countries have endorsed the importance

of internal control, sound management, and independent audits. In 1997,

bank regulators from 19 industrial and developing countries, with input

from an additional 9 countries, developed Core Principles for Effective

Banking Supervision.

15 These principles, published by the Basel

Committee, identified 25 basic principles that need to be put in place for a

supervisory system to be effective. A number of the principles address the

importance of internal control and the audit function. For example, the

principles call for

• policies and procedures not only for the granting of loans but also for

the ongoing management of loans;

• internal controls, including independent internal audit activities; and

• external audit and compliance functions, to test adherence to these

controls as well as applicable laws and regulations.

• INTOSAI also recognizes the importance of effective internal control. In

June 1992, INTOSAI issued its Guidelines for Internal Control Standards

and defined an internal control structure as the plans of an organization,

including management’s attitude, methods, procedures, and other

measures that provide reasonable assurance that an organization is

achieving the following general objectives:

• promoting orderly, economical, efficient, and effective operations and

quality products and services consistent with the organization’s

mission;

 14Although the term standards is used throughout this report, it is understood that these

standards are guidelines and that each MDB retains the authority to require the standards’

use. They reflect a “best practices” consensus among the countries or regions that

developed them.

15Basel Committee on Banking Supervision, September 1997. The committee consists of

bank supervisors from the Group of Ten countries: Belgium, Canada, France, Germany,

Italy, Japan, Luxembourg, Netherlands, Sweden, Switzerland, United Kingdom, and the

United States. (“Group of Ten” now includes more than 10 countries, but retained its

original name.)

Importance of

Internal Control

Standards14 and

Reporting Worldwide
Page 22 GAO-02-27 Regional MDBs

• safeguarding resources against loss due to waste, abuse,

mismanagement, errors, fraud, and other irregularities;

• adhering to laws, regulations, and management directives; and

• developing and maintaining reliable financial and management data

and fairly disclosing the data in timely reports.

In this guidance, INTOSAI prescribes the internal control standards that

form a framework for an internal control structure that meets the above

objectives. Upon issuance of its guidance, INTOSAI’s Internal Control

Standards Committee called for supreme audit institutions to encourage

and support the establishment of internal controls. This would encompass

(a) management understanding its responsibilities for implementing and

monitoring the control structures and (b) auditing those structures to

assure that controls are adequate to achieve the desired result. INTOSAI

member countries have reported to the INTOSAI Internal Control

Standards Committee that they have achieved a wide range of positive

results.

• In 1992, the United Kingdom Committee on Financial Aspects of Corporate

Governance published its study on corporate governance. A principal

underlying motivation for the study was the perceived low level of

confidence in financial reporting and the inability of external auditors to

provide safeguards needed by the private and public sector financial

statement users. Under the United Kingdom’s Principles of Good

Governance and Code of Best Practices (the Combined Code), a narrative

statement from management on how it applied the principles of good

governance and whether it has complied throughout the accounting period

with the Combined Code’s provisions is required. The external auditor

then is required to report on whether the entity complied with the

specified provisions of the Combined Code.

• In the United States, the Committee of Sponsoring Organizations of the

Treadway Commission16 (COSO) was formed to support the

implementation of the recommendations by the National Commission on

Fraudulent Financial Reporting, commonly referred to as the Treadway

Commission. The Treadway Commission issued its report in 1987

recommending that the sponsoring organizations cooperate in developing

additional, integrated guidance on internal control to provide a common

 16COSO is a private sector initiative sponsored by the American Institute of Certified Public

Accountants, the American Accounting Association, the Institute of Internal Auditors, the

Institute of Management Accountants, and the Financial Executives Institute.
Page 23 GAO-02-27 Regional MDBs

reference point that entities can use to assess the quality of their internal

control systems. In 1992, COSO issued its report on internal control,

Internal Control—Integrated Framework. This framework is designed to

assist management in assessing its internal control system against an

established standard to help identify basic weaknesses in operation,

financial reporting, and legal/regulatory compliance controls and take

action to strengthen them. In 1994, COSO also issued an addendum,

Reporting to External Parties, that addresses reporting guidelines where

reports of internal control are issued in annual reports to shareholders. In

a previous report, we reported that the World Bank had adopted a COSO

framework.17 An excerpt of this report is provided in appendix II.

• The U.S. Congress recognized the link between weak internal control and

past failures of financial institutions when it enacted the Federal Deposit

Insurance Corporation Improvement Act of 1991 (FDICIA). FDICIA

requires the management of an insured depository institution to state its

responsibility for establishing and maintaining an adequate internal

control structure and procedures for financial reporting. FDICIA also

requires management to report on the effectiveness of this internal control

system and an independent external auditor to attest to management’s

assertions on internal control in a separate report. As implemented,

management’s report on internal control and the auditor’s related

attestation includes control over safeguarding of assets. Further, FDICIA

requires large institutions to have independent audit committees and

establishes a reporting link between the audit committee and the external

auditor.

• The General Accounting Office issues standards for internal control in the

federal government as required by 31 U.S.C. 3512 (c), commonly referred

to as the Federal Managers’ Financial Integrity Act of 1982. The Standards

for Internal Control in the Federal Government18 provide the overall

framework for establishing and maintaining internal control and for

identifying and addressing major performance and management

challenges and areas at greatest risk of fraud, waste, abuse, and

mismanagement. According to these standards, internal control should

provide reasonable assurance that the objectives of the agency are being

achieved in the following categories:

• reliability of financial reporting,

 17See World Bank: Management Controls Stronger, but Challenges in Fighting Corruption

Remain (GAO/NSIAD-00-73, April 6, 2000).

18See GAO/AIMD-00-21.3.1, and GAO-01-1008G, issued November 1999 and August 2001,

respectively.
Page 24 GAO-02-27 Regional MDBs

• effectiveness and efficiency of operations, including the use of the

entities’ resources, and

• compliance with applicable laws and regulations.

See appendix III for a sample report on internal control over financial

reporting.

The MDBs have stated that internal control plays an integral role in

providing assurance in the use of MDB funds. In addition to providing

reasonable assurance over the use of public funds, MDBs have stated that

effective internal control assists management and helps to ensure

corporate accountability over the reliability of financial reporting, the

effectiveness and efficiency of operations, and compliance with laws and

regulations for any entity.

Based on our review of the regional MDBs’ Web sites, most of the regional

MDBs that we reviewed have developed anti-corruption strategies that

state that they recognize the importance of strong internal control

systems. The regional MDBs have made public their anti-corruption

concerns and strategies in their annual reports and Web sites. They

acknowledge that a strong control environment within the regional MDBs

and borrowing country institutions is critical for effectively implementing

the regional MDBs’ systems of project management control.

In its 2000 annual report, AfDB stated that the main objective of financial

control is to ensure a strong internal control framework within the AfDB’s

overall processes involving financial risk, including payment processes

and related computer systems. According to the AfDB, financial control

also seeks to ensure that all disbursements of loans approved by the Bank

comply with its rules, regulations, and processes. Similarly, according to

its stated policy, AsDB has developed an anti-corruption policy that is

designed to ensure that the fundamental building blocks for transparent,

predictable, and accountable administration are in place. According to the

AsDB, these building blocks include “...transparent procurement

practices; effective internal control systems; and a well-functioning

independent audit office.”

19 In another example, EBRD has stated in its

2000 annual report that its financial management aims to “...ensure

transparency and accountability at all levels and support effective

 19AsDB’s Anticorruption Policy, June 1998.

MDBs Emphasize the

Importance of Internal

Control
Page 25 GAO-02-27 Regional MDBs

corporate governance.” Finally, IDB has reported that a “simultaneous

systemic effort will be undertaken to...minimize the risk of corruption in

the allocation, commitment and disbursement of the Bank’s resources in

its lending program and ensure that Bank operations are designed so as to

be executed with transparency and within the framework of a proper

control environment....”

20

We also found that each regional MDB has established an internal audit

staff that is part of their organizational structure’s control environment.

Generally, the internal auditors are responsible for providing analyses,

evaluations, assurances, and recommendations on MDB operations to

audit committees, boards of directors, and others with equivalent

authority and responsibility. Standards established by the Institute of

Internal Auditors21 specify that internal auditing is an independent,22

objective assurance and consulting activity designed to add value and

improve an organization’s operations. It helps an organization accomplish

its objectives by bringing a systematic, disciplined approach to evaluate

and improve the effectiveness of risk management, control, and

governance processes.

While internal auditors do provide a level of assurance over operations

and financial reporting to management, the responsibility to provide an

audit opinion on the financial statements rests solely with the external

auditor. The external auditor follows relevant auditing standards in

rendering an audit opinion. The external auditor brings to management

and the boards of directors a unique independent and objective view and

contributes to an entity’s achievement of its financial reporting objectives,

as well as other objectives. While the external auditor has sole

responsibility for the audit report and for determining the nature, timing,

and extent of audit procedures, much of the work of the internal audit

department can be useful to support the external auditor in the audit of

 20Strengthening a Systemic Framework Against Corruption for the IDB, February 2001.

21Standards for the Professional Practice of Internal Auditing, 2001.

22The Institute of Internal Auditors’ Standards for the Professional Practice of Internal

Auditing defines internal auditing as an independent appraisal function and requires

internal auditors to be independent of the activities they audit. This concept of

independence is different from the independence the external auditor maintains under the

American Institute of Certified Public Accountants’ Code of Professional Conduct, which

does not regard internal auditors as independent of their employing entity. To be

recognized as independent, the Code of Professional Conduct, among other things, requires

that the external auditor be free from any interest in the client and its management.
Page 26 GAO-02-27 Regional MDBs

the financial statements. This same relationship holds true for reporting on

internal control; the internal auditor provides internal assurance to

management, while the external auditor provides an opinion, or

attestation, following relevant standards. The external auditor’s

assessment could consider the role and activities of the internal audit

function in an MDB’s internal control.

Audit committees are established components of the control environment

that strengthen the internal governance structure of an organization. An

effective audit committee facilitates the successful performance of the

board of directors’ oversight responsibilities for financial operations. An

effective audit committee also normally oversees the internal and external

auditors and communicates with them on the results of their audit work to

facilitate fraud prevention and reliable financial reporting. As shown in

figure 3, an audit committee—made up of a subcommittee of the board of

directors—can establish an MDB’s accountability relationship with its

external auditor, board of directors, and internal parties, which could

result in information openly flowing to member countries and the general

public.

Audit Committees Are

Key to Strengthening

MDB Accountability
Page 27 GAO-02-27 Regional MDBs

Figure 3: Audit Committee Accountability Relationship

Source: Adapted from The Audit Committee Handbook, 3rd edition, Louis Braiotta, Jr., © 1999 John

Wiliey & Sons, Inc. Reprinted by permission of John Wiley & Sons, Inc.

In a recent report, the Blue Ribbon Committee panel listed a diligent and

knowledgeable audit committee membership as one of the best practices

aimed at making audit committees more effective.23 For the four regional

MDBs in our review, information provided to us on the audit committee

members’ education and job experiences indicated that generally the audit

committee members have accounting or related financial management

expertise. Qualifications in accounting or financial management are an

important factor in audit committees’ effectiveness in fulfilling their

governance responsibilities.

 23Report and Recommendations of the Blue Ribbon Committee on Improving the

Effectiveness of Corporate Audit Committees, February 1999. The panel was created in

1998 and drawn from various U.S. constituencies of the financial community to make

recommendations on strengthening the role of audit committees in overseeing the

corporate financial reporting process.

Member

government

The general

public 

Audit

committee

Internal 

auditors

Chief 

executive 

officer

External

Internal

Independent 

auditors

Chief 

financial 

officer

Board of 

directors
Page 28 GAO-02-27 Regional MDBs

Another Blue Ribbon Committee best practice is the audit committee’s key

role in monitoring the component parts of the audit process. Information

provided to us indicated that the MDB audit committees were involved

with the external auditors throughout the audit process. For the MDBs

included in this report, the audit committee oversight activity generally

included integral steps such as selecting the external auditor, monitoring

the progress and the results of the audit, and communicating with the

auditors. Documentation provided to us indicated that communication

with the external auditor was regular and included discussions on issues

such as internal control deficiencies noted during the course of the audit

and the appropriateness of accounting principles and financial reporting.

The United Kingdom’s Combined Code addresses the role of corporate

audit committees in a manner consistent with the Blue Ribbon Committee

report. Among other things, the Combined Code requires all listed

companies to establish an audit committee with a formal written terms of

reference. This is a list of functions that audit committees are to perform

to satisfy themselves that banks’ financial reporting and internal control

are adequate and efficient. The Combined Code also recommends that a

majority of the audit committee members be independent of management

and free from any business or other relationship that could materially

interfere with the exercise of their independent judgment.

According to the terms of reference, a key function of the regional MDB

audit committees is to understand the adequacy of the banks’ internal

control. Although the information provided to us indicated that the

regional MDB audit committees were actively involved with the external

auditors, the committees have not engaged the external auditors to report

on internal control or compliance in conjunction with their financial

statement audits. A main function of the audit committee is to contract for

the audits and determine the scope of the auditors’ work and the reports

to be submitted by the auditors. In that respect, the audit committees have

the authority to expand and strengthen the MDBs’ financial statement

audit reporting processes by requiring the external auditors to report on

internal control and compliance, since none of the MDBs’ external

auditors are currently engaged to report on these matters.

While the traditional role of the external audit function is to express an

independent opinion on an entity’s financial statements, this role has

increasingly been expanded to include reviews of internal control.

Worldwide, countries and institutions are recognizing the importance of

providing independent, external assessments on not only financial

Conclusions
Page 29 GAO-02-27 Regional MDBs

reporting, but also on internal control over an entity’s operations and

internal control over compliance with laws and regulations or key policies.

Because MDBs are funded with public resources and are

semigovernmental in nature, member countries that provide the MDBs’

financial support and backing would benefit from assurance provided by

an external auditor over the MDBs’ controls and whether funds are being

used as intended. This reporting could enhance the accountability and

transparency of the MDBs by providing an additional level of assurance

over what was spent, how it was spent, and what resources remain to be

utilized. Such reporting would also provide information about the

effectiveness of the MDBs’ control over lending operations and use of

funds.

External audits of MDBs’ financial statements, along with external

examinations of internal control over financial reporting, lending

operations, and compliance with key bank charters and policies, and the

reporting of the results of those audits to member countries, could help to

provide this accountability and transparency. This type of transparency

and accountability is especially important given the operating risks

inherent in how funds are used in the MDBs’ activities and the fact that the

MDBs rely on member countries’ financial contributions and backing to

obtain funding for their operations. Because each of the MDBs included in

this report has established internal audit functions, an external auditor’s

assessment of internal control could also consider the activities of the

MDBs’ internal auditors.

Regional MDBs’ audit committees are in a prime position to expand the

external reporting for their MDBs and thus strengthen MDB accountability

and enhance member country assurance that funds are spent as intended.

Such assurance would be provided while relying on the MDBs’ own

governance systems and respecting the multilateral nature of the MDBs.

Reaching the above level of assurance will take time. While the MDBs we

looked at should generally be able to obtain an external auditor’s report on

internal control over financial reporting within a short time frame—say

2 to 3 years—their ability to have an external auditor report on internal

control over lending operations and internal control over compliance with

key charter requirements will require a longer-term effort. It will take time

for the MDBs to develop the resources and expertise needed to provide

the accountability and assurance called for in our recommendations.
Page 30 GAO-02-27 Regional MDBs

To (1) provide additional accountability, transparency, and assurance over

the regional MDB groups’ lending operations and (2) ensure that project

funds are spent as intended, we recommend that the Secretary of the

Treasury instruct the U.S. Executive Directors of the four regional MDB

groups included in this report to take the lead in working with the other

Executive Directors to develop a policy requiring these MDBs and their

audit committees to adopt a phased approach to enhance the current

external audits of their financial operations, as follows.

• Engage the external auditors to report on the MDBs’ internal control over

financial reporting in conjunction with their financial statement audits or

in a separate engagement.

• Develop a plan, and report annually on the progress, to engage the

external auditors to report on the MDBs’ internal control over lending

operations and internal control over compliance with key provisions of

bank charters and policies.

• Provide the results of the external auditors’ reports and management’s

progress reports to the MDBs and their member countries annually.

Our recommendations are intended to be implemented in phases.

Reporting on the internal control over financial reliability should be

possible in the near term for the regional banks, because they already

issue annual audited financial statements. We recognize, however, that

more effort and time will be required to identify, implement, and evaluate

the applicable internal control criteria for lending operations and

compliance with key charter provisions prior to engaging the external

auditor to report on management’s assertions in those areas.

In its comments on a draft of this report the Department of the Treasury

acknowledged that establishing and maintaining an effective control

environment is essential for the regional MDBs, especially given the

unique nature of these multilateral institutions. Even though Treasury

stated that it strongly supports oversight mechanisms to help assure

increasingly productive development assistance of the regional MDBs, it

questioned the cost-effectiveness of expanding the existing scope of the

external auditors’ engagements to provide the requisite assurances that

regional MDB internal controls are operating effectively. Treasury officials

also stated their belief that internal entities within the MDB corporate

governance structure are in a better position than an external auditor to

assess the effectiveness of MDB controls.

Recommendations for

Executive Action

Agency Comments

and Our Evaluation
Page 31 GAO-02-27 Regional MDBs

Treasury also stated that, in its opinion, our draft report documents the

sufficiency of the MDBs’ current external audits. However, the major focus

of our report was to emphasize that given the control environment in

borrowing countries, MDBs and member countries would benefit from the

assurance and transparency provided by independent examination and

reporting by external auditors in the area of internal control over lending

operations and internal control over compliance with key provisions of

bank charters and policies. Our report provides information about the

results of the external financial statement audits at the MDBs and makes

clear that by design the objective of a financial statement audit is not to

provide assurance to member countries that project funds are used as

intended. Our report notes that, although the regional MDBs have received

clean opinions on their financial statements, the current financial

statement audits cover only the MDBs’ financial position at a point in time

and the financial results of operations and cash flows for a given fiscal

year. The financial statement audits are not intended to and do not provide

specific assurance about the effectiveness of the MDBs’ internal control

over lending operations and compliance with bank charters and key

policies. MDB project and program funds are used in countries where the

level of perceived corruption is often high.

Treasury also described, for illustrative purposes, the processes used by

IDB for lending oversight and the role of the IDB’s Auditor General and the

board of directors in providing oversight. Treasury also stated its belief

that the internal entities within the MDBs’ own internal governance

structure are better placed than the external auditors to assess internal

control of the institutions and to ensure that programs of the banks are

effective and efficient as called for in their charters. We acknowledge the

importance of the MDB’s own internal processes as a critical aspect of

internal control, and MDB management’s responsibility for establishing

and implementing an effective system of internal control. However, until

the effectiveness of the regional MDBs’ internal control is subject to

review by an independent third party, member countries will not have a

comprehensive independent assessment of the effectiveness of the

controls. The MDBs’ accountability, transparency, and assurance over

internal control could be enhanced through expanded external audit

processes whereby (1) management provides assertions to the external

auditors that the controls are operating effectively, and (2) the external

auditor provides an attestation to the effectiveness of the controls through

its independent testing procedures.

Treasury questioned the cost-effectiveness of expanding the external

auditors’ engagements to include reporting on internal control over
Page 32 GAO-02-27 Regional MDBs

lending operations. We recognize that expanding the scope of the auditors’

work will involve time and effort and, therefore, we recommended a

phased approach. However, the amount of MDB funds at risk is

considerable. The enhanced reporting is designed to provide additional

accountability and transparency over the regional MDB groups’ lending

operations and provide reasonable assurance that project funds are spent

as intended. External auditor attestation and reporting to member

countries on internal control would provide additional assurance and

transparency to member country governments regarding the control over

MDBs’ financial reporting, lending operations, and the use of their funds.

The external audit function brings to management and the boards of

director a unique, independent, and comprehensive view that provides

assurances to offset the risks and perceived corruption in the countries

receiving regional MDB funds. The department’s comments are reprinted

in their entirety in appendix IV.

We are sending copies of this report to the Secretary of the Treasury, the

presidents of the regional MDBs, and other interested parties. Copies will

be made available to others upon request.

Please contact Jeanette Franzel, Acting Director, at (202) 512-9406 or by

email at franzelj@gao.gov if you or your staffs have any questions

concerning this report. Key contributors to this report were Darryl Chang,

Bronwyn Hughes, Meg Mills, Charles Norfleet, Julie Phillips, and John

Treanor.

Jeffrey C. Steinhoff

Managing Director

Financial Management and Assurance
Page 33 GAO-02-27 Regional MDBs

Congressional Committees

The Honorable Joseph R. Biden, Jr.

Chairman

The Honorable Jesse Helms

Ranking Minority Member

Committee on Foreign Relations

United States Senate

The Honorable Robert C. Byrd

Chairman

The Honorable Ted Stevens

Ranking Minority Member

Committee on Appropriations

United States Senate

The Honorable Patrick J. Leahy

Chairman

The Honorable Mitch McConnell

Ranking Minority Member

Subcommittee on Foreign Operations

Committee on Appropriations

United States Senate

The Honorable Michael G. Oxley

Chairman

The Honorable John J. LaFalce

Ranking Minority Member

Committee on Financial Services

House of Representatives

The Honorable Doug Bereuter

Chairman

The Honorable Bernard Sanders

Ranking Minority Member

Subcommittee on International Monetary

 Policy and Trade

Committee on Financial Services

House of Representatives
Page 34 GAO-02-27 Regional MDBs

The Honorable C.W. Bill Young

Chairman

The Honorable David Obey

Ranking Minority Member

Committee on Appropriations

House of Representatives

The Honorable Jim Kolbe

Chairman

The Honorable Nita M. Lowey

Ranking Minority Member

Subcommittee for Foreign Operations, Export

 Financing, and Related Programs

Committee on Appropriations

House of Representatives
Appendix I: Transparency International’s

2001 Corruption Perception Index

Page 35 GAO-02-27 Regional MDBs

Transparency International is an organization dedicated to curbing both

international and national corruption. Transparency International

launched its Corruption Perception Index (CPI) in 1995. The CPI is a

collection of polls, drawing on 14 surveys from 7 independent institutions

for its 2001 results. The surveys reflect the perceptions of business people,

academics, and country analysts. No country has been included in the CPI

without results from a minimum of 3 surveys undertaken over the past

3 years. For this reason, not all countries with high levels of corruption

may have been included.

The CPIs show that the regional MDBs function in environments that are

perceived to have high levels of corruption, underscoring the importance

of internal control over lending operations and compliance within the

MDBs that are providing loans to those countries. According to

Transparency International, the world’s poorest countries are the greatest

victims of corruption. Their survey results also register very high levels of

perceived corruption in the countries in transition, in particular the

countries of central and eastern Europe and the former Soviet Union.

Figure 4 includes all the countries covered by Transparency International.

We have also added countries that were among the MDBs’ five largest

borrowers of all lending arms as of December 31, 2000, that were not

included in the Transparency International CPI and indicate that CPIs for

these countries are not available.

Appendix I: Transparency International’s

2001 Corruption Perception Index
Appendix I: Transparency International’s

2001 Corruption Perception Index

Page 36 GAO-02-27 Regional MDBs

Figure 4: Countries Included in Transparency International’s 2001 CPI

Country CPI Country CPI Country CPI

Nigeria 1.0 Bangladesh 0.4 Turkey 3.6

Uganda 1.9 Indonesia 1.9 Greece 4.2

Kenya 2.0 Pakistan 2.3 Jordan 4.9

Cameroon 2.0 Vietnam 2.6 Italy 5.5

Tanzania 2.2 India 2.7 Taiwan 5.9

Cote d'Ivoire 2.4 Uzbekistan 2.7 Portugal 6.3

Zambia 2.6 Kazakhstan 2.7 Belgium 6.6

Zimbabwe 2.9 Philippines 2.9 France 6.7

Senegal 2.9 Thailand 3.2 Spain 7.0

Malawi 3.2 China 3.5 Japan 7.1

Ghana 3.4 South Korea 4.2 Germany 7.4

Egypt 3.6 Malaysia 5.0 Ireland 7.5

Mauritius 4.5 Sri Lanka N/Av USA 7.6

South Africa 4.8 Nepal N/Av Israel 7.6

Tunisia 5.3 Austria 7.8

Namibia 5.4 Hong Kong 7.9

Botswana 6.0 United Kingdom 8.3

Morocco N/Av Switzerland 8.4

Algeria N/Av Australia 8.5

Ethiopia N/Av Country CPI Norway 8.6

Mali N/Av Azerbaijan 2.0 Luxembourg 8.7

Ukraine 2.1 Netherlands 8.8

Russia 2.3 Canada 8.9

Romania 2.8 Sweden 9.0

Moldova 3.1 Singapore 9.2

Country CPI Latvia 3.4 Iceland 9.2

Bolivia 2.0 Slovak Republic 3.7 New Zealand 9.4

Ecuador 2.3 Czech Republic 3.9 Denmark 9.5

Nicaragua 2.4 Croatia 3.9 Finland 9.9

Honduras 2.7 Bulgaria 3.9

Venezuela 2.8 Poland 4.1

Guatemala 2.9 Lithuania 4.8

Dom.Rep. 3.1 Slovenia 5.2

Argentina 3.5 Hungary 5.3

El Salvador 3.6 Estonia 5.6

Panama 3.7

Mexico 3.7

Colombia 3.8

Brazil 4.0

Peru 4.1 N/Av = Data is not available

Costa Rica 4.5

Uruguay 5.1

Trin. & Tob. 5.3 0 10

Chile 7.5

Corrupt Transparent

Corruption Perception Index

Inter-American

Development

Bank

European Bank for

Reconstruction and

Development

African

Development

Bank Group

Asian Development

Bank

Other Nations Included in

the 2001 CPI
Appendix II: Summary of World Bank’s

Implementation of the COSO Internal Control

Framework as of April 2000

Page 37 GAO-02-27 Regional MDBs

In 1995, the World Bank adopted the Committee of Sponsoring

Organizations of the Treadway Commission (COSO) framework to

establish a common definition of management controls for all Bank units

and a standard against which unit managers and auditors can assess and

measure progress in improving management controls. Audit organizations

around the world use this framework, referred to as Internal Control—

Integrated Framework, as a standard in evaluating management controls.

The COSO framework emphasizes accountability and ownership of

controls at all levels. Under this model, the effectiveness of a management

control system is measured by its capacity to provide reasonable

assurance to the Executive Board of Directors and management regarding

the achievement of their objectives in the following three categories:

• effectiveness and efficiency of operations,

• reliability of financial reporting, and

• compliance with applicable laws and regulations.

Under COSO, management control is defined as consisting of five

interrelated components that form the criteria for effective control. The

five components are used as the criteria to evaluate the strengths and

weaknesses of the controls and to identify what actions can be taken to

improve controls. All five components must be present and effective in

order for management to have the reasonable assurance needed. These

components include the following:

Control Environment. An organization should establish a positive control

environment, that is, one with a structure, discipline, and climate

conducive to sound management controls. Factors that significantly affect

the control environment include the integrity and ethical values of

management and staff, the competence of personnel, the way the agency is

organized, the manner in which management assigns authority and

responsibility, and the attention and direction provided by oversight

groups.

 1

This appendix originally appeared as an appendix in GAO/NSIAD-00-73, issued in April

2000, and has not been updated since that date.

Appendix II: Summary of World Bank’s

Implementation of the COSO Internal Control

Framework as of April 20001

Management Controls

Components
Appendix II: Summary of World Bank’s

Implementation of the COSO Internal Control

Framework as of April 2000

Page 38 GAO-02-27 Regional MDBs

Risk Assessment. An organization should properly identify, analyze and

manage the possible risks involved in meeting organizational objectives.

Control activities. An organization should establish control activities

consisting of policies, procedures, techniques, and mechanisms that

ensure that management directives are being carried out to meet

organization objectives. They include approvals, authorizations,

verifications, and reviews of operating performance.

Monitoring. An organization should continually monitor and evaluate all

aspects of management control to assess the quality of performance over

time. Serious management control deficiencies should be reported to

higher levels, including top management and the Board of Directors.

Information and communication. An organization should identify,

capture, and communicate information in a form and time frame that

enable people to carry out their responsibilities.

In 1995, the Bank established a 5-year timeline to ensure that, by the end of

fiscal year 2000, management will be able to express assurance that

adequate controls are in place, not only for financial reporting purposes,

but also for efficiency and effectiveness of operations. The Office of

Controller made a commitment to

• meet the COSO standards for control effectiveness across the Bank’s

major operational areas;

• extend the COSO standards for prudential controls to nonfinance

organizational units in the Bank in fiscal year 1997;

• assert that both the International Bank for Reconstruction and

Development and the International Development Association have

maintained effective controls over financial reporting as of June 30, 1997,

and obtain the external auditor’s agreement;

• expand the application of the COSO framework so that issues of

organizational efficiency and effectiveness are brought to light; and

• become an institution in which Bank management and staff will have the

ability and process in place to analyze the effectiveness of internal

controls for their areas of responsibility.

In order to meet these goals, the Office of Controller adopted the Control

Self-Assessment methodology for assessing controls based on the COSO

framework. This approach uses the staff from various Bank units to

World Bank

Implementation

Schedule
Appendix II: Summary of World Bank’s

Implementation of the COSO Internal Control

Framework as of April 2000

Page 39 GAO-02-27 Regional MDBs

• review the business unit’s objectives, key processes supporting the stated

objectives, associated risks, and mitigating controls; under normal

circumstances, testing of key controls and documentation of testing is

required;

• hold workshops to (1) analyze obstacles and strengths that affect the

organization’s ability to achieve key business objectives and (2) decide

upon an approach to address issues arising from the process;

• identify reportable conditions requiring control enhancements together

with the results of the control self-assessment workshop in the business

unit’s action plan; and

• obtain representation letters from all the Bank’s senior managers

acknowledging their responsibility for effective controls and confirming

that they have maintained an effective system of management control.

World Bank initiated the control self-assessment methodology during

fiscal year 1996. Bank management has issued a series of reports to the

Audit Committee of the Executive Board on the Bank’s progress made in

implementing the COSO management control framework. The Internal

Audit Division also issued annual reports starting in 1998 providing

independent observations and findings on internal controls in the Bank

based on prior audits and the control self-assessment workshops. In 1999,

the Bank concluded that it met the COSO criteria for effective internal

control over financial reporting for the International Bank for

Reconstruction and Development and the International Development

Association. The Bank’s external auditor examined management’s

assertions and concluded that it was fairly stated, in all material respects.

Bank management has not made an assertion regarding the adequacy of

internal controls over operations.
Appendix III: Sample External Auditor’s

Report on Internal Control Over Financial

Reporting

Page 40 GAO-02-27 Regional MDBs

Audit Committee:

We have examined management’s assertion included in the accompanying

Management’s report that (entity) maintained an effective internal control

over financial reporting as of (date). (Entity’s) management is responsible

for maintaining effective internal control over financial reporting. Our

responsibility is to express an opinion on the effectiveness of internal

control based on our examination.

Our examination was made in accordance with standards established by

the (name of standard setter) and, accordingly, included obtaining an

understanding of the internal control over financial reporting, testing and

evaluating the design and operating effectiveness of internal control, and

such other procedures as we considered necessary in the circumstances.

We believe that our examination provides a reasonable basis for our

opinion.

Because of inherent limitations in any internal control, misstatements due

to errors or irregularities may occur and not be detected. Also, projections

of any evaluation of the internal control over financial reporting to future

periods are subject to the risk that the internal control may become

inadequate because of changes in conditions, or that the degree of

compliance with the policies or procedures may deteriorate.

In our opinion, management’s assertion that (entity) maintained an

effective internal control over financial reporting as of (date) is fairly

stated,1

 in all material respects, based upon criteria established in the

(widely accepted internal control framework selected by the entity as

criteria for its own internal control assessment program).

External Auditor’s signature

Date

 1

The independent auditor should modify the report when management’s assertions are not

fairly stated.

Appendix III: Sample External Auditor’s

Report on Internal Control Over Financial

Reporting

Independent Auditor’s

Report
Appendix IV: Comments From the Department

of the Treasury

Page 41 GAO-02-27 Regional MDBs

Appendix IV: Comments From the

Department of the Treasury
Appendix IV: Comments From the Department

of the Treasury

Page 42 GAO-02-27 Regional MDBs
Appendix IV: Comments From the Department

of the Treasury

Page 43 GAO-02-27 Regional MDBs
Appendix IV: Comments From the Department

of the Treasury

Page 44 GAO-02-27 Regional MDBs
Appendix IV: Comments From the Department

of the Treasury

Page 45 GAO-02-27 Regional MDBs (194033)
The General Accounting Office, the investigative arm of Congress, exists to

support Congress in meeting its constitutional responsibilities and to help

improve the performance and accountability of the federal government for the

American people. GAO examines the use of public funds; evaluates federal

programs and policies; and provides analyses, recommendations, and other

assistance to help Congress make informed oversight, policy, and funding

decisions. GAO’s commitment to good government is reflected in its core values

of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents is through the

Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of

current reports and testimony and an expanding archive of older products. The

Web site features a search engine to help you locate documents using key words

and phrases. You can print these documents in their entirety, including charts and

other graphics.

Each day, GAO issues a list of newly released reports, testimony, and

correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site

daily. The list contains links to the full-text document files. To have GAO E-mail

this list to you every afternoon, go to our home page and complete the easy-to-use

electronic order form found under “To Order GAO Products.”

The first copy of each printed report is free. Additional copies are $2 each. A

check or money order should be made out to the Superintendent of Documents.

GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a

single address are discounted 25 percent. Orders should be sent to:

U.S. General Accounting Office

P.O. Box 37050

Washington, D.C. 20013

To order by phone: Voice: (202) 512-6000

TDD: (202) 512-2537

Fax: (202) 512-6061

GAO Building

Room 1100, 700 4th Street, NW (corner of 4th and G Streets, NW)

Washington, D.C. 20013

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm,

E-mail: fraudnet@gao.gov, or

1-800-424-5454 (automated answering system).

Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800

U.S. General Accounting Office, 441 G. Street NW, Room 7149,

Washington, D.C. 20548

GAO’s Mission

Obtaining Copies of

GAO Reports and

Testimony

Order by Mail or Phone

Visit GAO’s Document

Distribution Center

To Report Fraud,

Waste, and Abuse in

Federal Programs

Public Affairs