Attachment L SOW Stage 2 - Risk Assessment --revised.pdf

Public Financial Management Risk Assessment Framework (PFMRAF)

Key Elements of a Statement of Work (SOW) for a Stage 2 – Risk Assessment

What is a Statement of Work (SOW)? The SOW is a formal written description of the minimum requirements to be performed by the Contracted Firm to conduct a PFMRAF Stage 2 - Risk

Assessment.

SOWs are important in ensuring a successful PFMRAF Stage 2 Risk Assessment and serves as the basis for an Independent Government Cost Estimates (IGCE), procurement of services and technical expertise, other technical or related assessments, and ongoing reporting, monitoring and evaluation plans.

BACKGROUND:

• A brief description of the country context and the drivers prompting the Stage 2 – Risk

Assessment.

• Conclusions of the Stage 1 - Rapid Appraisal/Stage 1 - Rapid Appraisal Update, and other assessments, if applicable.

• Relationship with PFMRAF and other donor activities and partner government activities.

• Mapping to Country Development Corporation Strategy (CDCS) Results Framework.

• An approved Project check list and Project Design Plan (PDP Plan) and relevant Project

Information which at a minimum should include:

a) a description of the G2G Activity Objective;

b) funding levels;

c) implementing entity(ies) and their responsibilities in management of the proposed G2G activity;

d) proposed implementation mechanism(s) – (Fixed Amount Reimbursement

(FAR) or Cost-Reimbursement);

e) length of the activity.

• The proposed funds flow diagram(s) relative to the envisioned G2G activity.

What to limit/reduce in the Background section:

• Long education on history of country and/or sector

• Buried requirements and results

• Extensive information on enabling legislation--- particularly old legislation

OBJECTIVES/PURPOSE:

• Statement that the Stage 2 Risk Assessment is a fiduciary risk assessment and must focus on risk identification, assessment, scoring/rating, evaluation, and proposal of risk response strategies as they relate to the proposed G2G activity objectives.

• Work conducted in the Stage 2 – Risk Assessment should follow the PFMRAF methodology (both the PFMRAF Manual and ADS 220).

What to limit/reduce in Objectives/ Purpose section:

• Excessive detail not related to the objective of the assessment as related to the envisioned G2G activity.

• Audit terminology - remember this is a risk assessment, not an audit.

SCOPE OF WORK:

• A fiduciary risk assessment of the entity or entities to be involved in administering the

G2G activity from a financial management perspective; the particular PFM function(s) they will undertake (for example, Budget, Procurement, inventory management, etc.);

and the respective geographic location (central, subnational, district, etc.)

• The risk assessment must identify, assess/evaluate risk using probability and impact and score/rate risk using a risk matrix or heat map; and include risk response strategies for all identified risks.

• Utility of the Stage 2 Risk Assessment Questionnaire (Attachment J) provides illustrative questions (by PFM functional area) and format to guide the assessment; it should be adapted (add to, remove questions not applicable) to fit the need;

Customization is key; consideration of the proposed flow of funds and funding mechanism is helpful.

• If a Stage 2 – Risk Assessment is contracted out, the contractor should submit a draft customized questionnaire to the USAID Mission for approval, prior to starting fieldwork.

• Validation/Confirmation (“Testing”): The risk assessment requires validation of key business processes, practices and controls (e.g., management approvals, reconciliations) to confirm understanding of processes USAID will be relying on;

“testing” as a non-statistical sample, based on professional judgment.

• The risk assessment will culminate in a report capturing the results (context, risk identification, analysis, risk response, and mapping).

• The SOW scope should be focused on fiduciary risks and should be delineated from other assessments conducted alongside Stage 2 - Risk Assessment. 1

RESULTS/DELIVERABLES/PLACE OF PERFORMANCE/TIMELINE:

• Final report with logical cross referencing to the risks identified in the questionnaire

• Mapping of risks using a heat map,

• Risk Response Strategies related to the envisioned G2G activity and its objectives.

• Timeline should be clearly stated with specific deliverables, delivery date and method for draft and final reports, questionnaire and work products.

• State language and translation requirements, if appropriate.

SECURITY:

• Outline potential security needs in the country or local environment, as known or applicable.

KEY PERSONNEL / STAFFING:

• Define requirements, expectations, language capabilities and composition of the risk assessment team and/or other donor involvement (specifically when conducting joint-assessments).

• Define inclusion of Mission staff on the risk assessment team. Provide a description of the expected involvement of Mission personnel (i.e., attending meetings, participating in field work, etc.)

CONFLICT OF INTEREST & ACCOUNTABILITY STATEMENT LANGUAGE:

• Include appropriate conflict-of-interest language2 regarding limitations that may apply to future remediation/capacity building work of the entities by the same contractor that conducted the risk assessment.

• Identification and acceptance of risks is ultimately a mission responsibility. Thus, the

USAID Mission is responsible for reviewing Stage 2 Risk Assessment reports (and questionnaires) and modifying as appropriate, to provide input and reflect the mission’s position. The accountability statement3 acknowledges a Mission’s review, understanding, approval and ownership of the Stage 2 Risk Assessment Report(s) and results reflected therein. While this is particularly applicable for Stage 2 Risk Assessment Reports that have been contracted out to a third party, this language is also appropriate for Stage 2 Risk

Assessments conducted in-house, when such ownership language is not evident in the report. The best practice has been to include in both the face of the report and questionnaire regardless of whether the risk assessment was contracted out of conducted in house.

KEY REFERENCE DOCUMENTS (that should be read and referenced by contractor or assessment team):

• ADS 220

• PFMRAF Manual

• Country Development Cooperation Strategy (CDCS), if available

• Stage 2 – Risk Assessment Questionnaire

• Stage 1 – Rapid Appraisal Report and or updates

• DRG or other relevant assessments

• Assessments conducted by other external sources (i.e., other development partners)

The following methodology will be used:

a. Assess the capacity of the ENTITY to properly implement projects in an open and transparent manner and make recommendations to mitigate risks to strengthen the systems of said ENTITY.

b. Assess the ENTITY capacity to manage the execution of the projects, providing appropriate controls over financial management, procurement and project implementation and reporting.

2 Sample Conflict of Interest Language – “Contracted firms conducting the Stage 2 – Risk Assessment work of any particular entity will not be eligible to perform any follow-on risk mediation/capacity building with those entities as a result of that assessment.”

c. Assess the capacity of the ENTITY to manage funds and programs of entities under the authority of the ENTITY.

d. Assess the appropriateness of future project implementation mechanisms and funding flows as set forth in the Background section above.

e. Determine if assessments of other entities within the ENTITY must be performed to be in conformity with the current pertinent regulations.

f. Develop a risk assessment impact of the various risks identified in each area under assessment (listed in the BPA) using rating scale:

Specific areas to focus on during this assessment:

a. Budgetary Systems and Execution

• Review the procedures relating to budget formulation, execution, monitoring and reporting. Obtain an understanding of the budget process at the ENTITY.

• Review application for compliance with timelines and applicable laws relating to the budget process.

• Review budget for comprehensiveness and transparency.

• Review accounting system for adequacy.

b. Procurement

• Map the procurement process at the ENTITY identifying the major steps and approvals for procurement.

• Review the procurement policies and practices for conformity with applicable GoG law and good procurement practices.

• Review controls over the procurement process intended to minimize improper practices and conflicts of interest.

• Analyze the safeguarding of procurement information.

• Analyze the process for selecting bidders through solicitation.

• Review the contract negotiation process for final terms of contracts.

• Review contract administration and procurement planning.

• Document the adequacy of staffing for the procurement function.

• Review contract provisions for compliance with statutory and regulatory constraints.

• Document the ability of the ENTITY to procure commodities and services tax-free when required to do so by donor funding rules, and the extent to which they have done in the past.

c. Human Resources and Payroll

• Review the documentation of personnel files for adequacy and compliance with applicable laws

• Map the process for payroll preparation, payment and controls.

• Document the adequacy of proper controls over the payroll process.

d. Ordering of Goods/Services and Payment of invoices

• Describe the process for ordering of goods/services and payment of invoices.

• Review the control elements for proper segregation of duties and rotating of staff

• Review processes for controls of payments such as cancelling of payments, duplicate payments.

e. Information Technology

• Review adequacy of IT capacity in ENTITY.

• Review the ENTITY IT policies for adequacy and documentation.

• Review adequacy of controls over the IT function; backups, access, virus protection, etc.

• Document the controls over hardware.

f. Control Environment

• Document the existence of a code of conduct.

• Document management’s commitment to integrity, internal controls and problem solving.

• Verify organizations commitment to competence.

• Understand functions and roles of audit committee or other supervisory committees.

o Determine if these committees are functioning as intended.

• Determine if the organizational structure meets the needs of the organization.

• Confirm whether management is engaged in establishing proper policies and practices to the maximum extent possible.

g. Internal and External Audit

• Review reports of external audit and note any items for follow up.

• Review external audits for timeliness.

• Document management response to auditor comments.

• Review role of internal audit function.

• Examine reports of internal auditors and note any items for follow up.

• Understand role of Audit Review and Implementation Committee (ARIC) and whether they are fulfilling their mandate.

h. Donor Relations

• Review relationship with donors and compliance with donor requirements.

• Understand and document the importance of donor aid to accomplishing the goals of the ENTITY.

I.DELIVERABLES

Deliverables Delivery Date

1. Complete PFMRAF Stage 2 questionnaire (document attached). A single, integrated PFMRAF risk assessment questionnaire for the ENTITY Headquarters and any relevant

Regional locations, appropriately adapted as described above. To be submitted with a draft assessment report.

Within 20 working days of the Assessment

Team’s final day of field work

2. Draft assessment report (see report format attached). Include control sheet for reports.

Within 10 working days of the Assessment

3. Risk assessment rating worksheet (see format attached). This is a rating for the probability of an adverse effect for each individual risk.

Within 10 days after receiving comments on the draft assessment report

4. Final assessment report Within 10 days after receiving comments on the draft assessment report

The Report should also provide the following:

• Assessment results to assist USAID/West Africa determine the extent to which the accountability environment and internal controls of the ENTITY to support the effective and efficient use of U.S. Government funds.

• Assessments of the ENTITYs’ ability to plan, execute, report, and deliver on all facets of projects in accordance to USAID agreements.

• Assessment results to assist USAID/West Africa determine the extent of increased risks due to project implementation, or other external constraints that could negatively impact the project.

• A list of recommended corrective actions for all identified risks.

• A copy of supporting documentation used to complete the risk assessment. There will be copies of all documentation and any descriptions of processes and/or procedures.

• If USAID does not accept the report because of deficiencies in the work or noncompliance with the scope of work, the contractor shall perform any additional work necessary as agreed with USAID/West Africa at no additional cost to USAID/West Africa.