We also   reviewed the Bank Group entities’ 2002 and 2001 audited financial  statements and the external auditors’ opinions on the financial  statements and identified the accounting principles and auditing  standards used,   inquired of World Bank management and obtained information on the  audit committee, external audits, and the extent of the external auditor  giving opinions on internal control over financial reporting, operations,  and compliance matters,  analyzed and compiled relevant financial information from the Bank  Group entities’ annual reports and their audited financial statements,  reviewed the banks’ terms of reference to identify the scope of the audit  committee’s oversight and compared them to relevant guidance on  widely accepted internal control frameworks,  reviewed widely accepted internal control frameworks, such as Internal  Control—Integrated Framework issued by the Committee of  Sponsoring Organizations of the Treadway Commission and Guidelines  for Internal Control Standards developed by the International  Organization of Supreme Audit Institutions, and   discussed various options for reporting on internal control with  representatives from the international accounting firm responsible for  the financial statement audits of the Bank Group entities. However, the Bank  Group’s external financial statement audits do not, and are not intended to,  provide specific assurance about the internal control over the Bank  Group’s operations and whether the funds are spent for their intended  purposes. Bank Group Has Taken Important Steps on Internal Control but Reporting Could Be Expanded

Management of the Bank Group entities has acknowledged the importance  of internal control and has (1) implemented a structured internal control  framework, (2) conducted the internal control assessments necessary to  provide its external auditor with a formal assertion on the effectiveness of  the Bank Group’s internal control over external financial reporting, and  (3) contracted with its external auditor to provide an opinion, in  conjunction with the financial statement audits, on whether managements’  assertions on internal control over external financial reporting are fairly  stated. However, Bank  Group management does not include in its assertion internal control over  operations and compliance with key provisions of bank charters and  policies, and it has not asked the external auditor to give opinions on those  internal controls. Given the inherent risks in the banks’ activities, further  assurance on these additional categories of internal control—operations  and compliance—would provide an added level of assurance to the Bank  Group and its member countries that funds were used for their intended  purposes. The Bank Group also  has other options for providing assurance over internal control over  operations and compliance. During our review, we were told that the Bank Group does  not yet have plans to have a comprehensive assessment of these controls. A major function of the Bank Group’s  audit committee is to nominate an external auditor to conduct audits of the  Bank Group’s financial statements and determine the scope of the auditors’  work and the reports to be submitted by the auditors. The Bank Group’s audit committee currently has the external auditor  provide an opinion on management’s assertion on the Bank Group’s  internal control over external financial reporting. The audit committee is well- positioned to assign an internal party or provide an external entity the task  of providing a thorough assessment of such controls.
Why GAO Did This Study

The Congress passed Public Law 106-429 because it was concerned about the sufficiency of external audits of the financial operations of the World Bank Group, a set of multilateral development banks. This law provides that GAO report on the sufficiency of such audits of each Bank Group entity. GAO addressed (1) the extent that the external auditor was providing assurance on internal control over financial reporting, operations, and compliance with key provisions of bank charters and policies in conjunction with financial statement audits and (2) the role the Bank Group's audit committee plays in providing oversight of external financial statement audits and internal control.

What GAO Found

The Bank Group has taken important steps in strengthening its assessment and reporting on internal control, including (1) implementing a structured internal control framework, (2) conducting the internal control assessments necessary to provide its external auditor with an assertion about the effectiveness of the Bank Group's internal control over external financial reporting, and (3) contracting with its external auditor to provide an opinion, in conjunction with the financial statement audit, on whether management's assertion on internal control over external financial reporting is fairly stated. However, Bank Group management does not include an assertion on internal control over operations and compliance matters, and it has not asked the external auditor to give an opinion on those internal controls. During our review, we were told that the Bank Group does not yet have plans to conduct a comprehensive assessment of those controls. The Bank Group's external financial statement audits do not, and are not intended to, provide specific assurance about the internal control over the Bank Group's operations and whether the funds are spent for their intended purposes. Given the inherent risks in the banks' activities, additional assurance on these other categories of internal control--operations and compliance--would provide an added level of assurance to the Bank Group and its member countries that funds were used for their intended purposes. The Bank Group has established an audit committee that provides oversight of external financial statement audits and internal control. A major function of the committee is to nominate an external auditor and determine the scope of the auditor's work and the reports to be submitted by the auditor. The audit committee also has the external auditor give an opinion, in conjunction with the financial statement audit, on management's assertion on the Bank Group's internal control over external financial reporting. The audit committee has the authority to expand the external audits to include the auditor giving opinions on internal control over operations and compliance matters. Alternatively, the audit committee is also well-positioned to assign to an internal party or provide an external party the task of providing a thorough assessment of such controls.