Public_Financial_Management_Risk_Assessment_of_the_MCN_-_Attachment__2.pdf

Public Financial Management Risk Assessment of the

Ministry of Counter Narcotics of the Government of the Islamic Republic of

Afghanistan

Report to the Bureau of International Narcotics and Law Enforcement Affairs (INL)

April 2015

Table of Contents A. Executive Summary

Methodology

Findings

B. Background

Afghanistan’s Ministry of Counter Narcotics

C. Methodology

Analysis

D. Summary of Findings and Conclusion

Budgeting System

Finding 1:

Finding 2:

Finding 19:

Finding 20:

Accounting System

Finding 3:

Finding 24:

Financial Management Capacity (Petty Cash)

Finding 4:

Internal Control

Finding 5:

Governance

Finding 6:

Personnel

Payroll

Finding 7:

Finding 8:

Finding 9:

Finding 10:

Finding 21:

Procurement and Purchasing System

Finding 23:

Program Management & Monitoring

Finding11:

Finding 12:

Finding 18:

Compliance with Applicable Laws and Regulations

Finding 22:

Internal Audit

Finding 13:

Finding 14:

Fixed Assets Management

Finding 15:

Cash Management/Petty Cash

Finding 16:

Finding 17:

E. Risk Schedule

Appendix I: Business Process Flow Charts

Appendix II: Risk Matrix Definition of Terms

Appendix III Definition of Key Internal Controls Terms

Appendix IV Risk Assessment Scope Limitation

Appendix V: Walkthrough and Interviews Matrix

REPORT RELEASE INSTRUCTIONS

TRANSMITTAL LETTER

April 22, 2015

Office of Afghanistan and Pakistan International Narcotics and Law Enforcement Affairs Department of State

Dear Ms. Hubbard:

Submitted herewith is the report on the PUBLIC FINANCIAL MANAGEMENT RISK ASSESSMENT (PFMRA) for the Ministry of Counter Narcotics of the Government of the Islamic Republic of Afghanistan.

For additional information, please feel free to contact me via email on ggriffith@gmg-mgt.com or by telephone on 410-461-6539.

Sincerely, Georgia Griffith President, CEO

A. Executive Summary

The Bureau of International Narcotics and Law Enforcement Affairs (INL) contracted GMG Management Consulting, Inc. to conduct a Public Financial Management Risk Assessment (PFMRA) of Afghanistan’s Ministry of Counter Narcotics (MCN). The goal was to determine whether MCN has the capacity to continue to receive and responsibly manage donor funds, including funds from the U.S Government.

The PFMRA is the United States Agency for International Development’s (USAID) risk management methodology used to identify, mitigate and manage the fiduciary risks encountered when considering government-to-government (G2G) assistance. It focuses on fiduciary risks to which United States Government (USG) funds may be exposed when administered directly by the Public Financial Management (PFM) systems of the entities intended to implement G2G-funded activities. PFMRA assessments of individual entities include all PFM systems that may be used in implementing a project. The PFMRA is designed to assess not only the PFM systems of the partner government, but also governance and public accountability factors, including the legal and regulatory environment, as well as the political will for transparent, accountable, and effective governance.

INL currently provides G2G funding to MCN for the programs identified below.

The Good Performers Initiative (GPI), which provides development assistance to provinces that meet the annual counternarcotics goals, such as achieving poppy free status, reducing poppy cultivation by more than ten percent and/or demonstrating other exemplary counternarcotics progress.

The Governor-Led Education (GLE) program, which reimburses Governors who undertake poppy eradication for their eradication expenses.

Portions of the MCN capacity building program.

The PFMRA will help the Government of the Islamic Republic of Afghanistan (GIRoA) make the reforms necessary to strengthen its PFM systems to reduce corruption, improve budget execution and increase revenue collection. These improvements, in turn, will increase the effectiveness of foreign assistance to GIRoA and enhance long-term sustainability.

Methodology

To perform the PFMRA, GMG identified the risks associated with each of MCN’s business processes and its system of controls, based on GMG’s experience and understanding of MCN’s environment. The risk associated with a control is the risk that the control might not be effective and, if not effective, the risk that a significant deficiency or material weakness would result.

GMG evaluated MCN management’s internal controls to determine if there were adequate internal control activities to mitigate these risks. The management internal controls assessed included the development and implementation of adequate policies and procedures to manage MCN’s programs, such as segregation of duties, proper authorization of activities, accurate and complete recording of transactions, data security and integrity, transaction data output, interface controls, master file set up and maintenance, data management, adequate documentation and record keeping to support transactions, physical control of assets and records, and independent checks on performance as related to the PFM system and operations. GMG reviewed the management internal controls for the business processes listed below, including the applications (information technology (IT) software or automated systems) used to support them:

Budget System, Accounting System, Financial Management Capacity, Internal Control, Governance, Personnel and Payroll, Procurement and Purchasing System, Program Management and Monitoring, Compliance with Laws and Regulations, Internal Audit, Fixed Assets Management, and

Petty Cash Management.

The review covered financial activities or transactions associated with MCN programs for the fiscal years 2012 and 2013. GMG developed questionnaires based on USAID’s questionnaire for PFMRA Stage 2 to gather data on MCN’s business processes and its system of controls from MCN’s subject matter experts (SMEs). To verify and validate the data gathered via the questionnaire, GMG conducted walkthroughs of MCN’s business processes and systems, including observation, inquiries and interviews with MCN’s SMEs. GMG also inspected relevant documentation for sample transactions and reviewed MCN’s policies and procedures to determine if they were complete and consistent with international standards. As required by the PFMRA, GMG also tested a sample of transactions of internal control activities to determine whether they were operating effectively.

Findings

Over the course of the evaluation and testing of internal control operating effectiveness, GMG identified control deficiencies, or vulnerabilities. A deficiency identified in internal controls over financial reporting and operations exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements or error or fraudulent activities on a timely basis. A deficiency in design exists when a control necessary to meet the control objective is missing or an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.

GMG evaluated the severity of each control deficiency to determine whether the deficiencies, individually or in combination, were material weaknesses or significant deficiencies. The severity of a deficiency depends on whether there is a reasonable possibility that MCN's controls will fail to prevent or detect an error, fraud, or misstatement of an account balance or disclose any inefficiency and ineffectiveness of operation, or illegal activities or noncompliance with laws and regulations. GMG then analyzed the potential impact of the deficiency or deficiencies, the misstatement, errors, illegal activities, inefficiency and ineffectiveness of operation that could result and the probability of this occurring. GMG used USAID’s PFMRA risk matrix tool to evaluate the risks’ impact and probability and arrive at a risk score.

As a result of the risk assessment, GMG identified twenty-four (24) significant internal control deficiencies that increased the potential for a material misstatement in financial reporting, inefficiency and ineffectiveness of operations and non-compliance with laws and regulations. As a result of the assessment, MCN quantitative risk score is low, but the qualitative risk score is high. Therefore, MCN average risk score is medium.

Quantitative Analysis of Findings

We determined the quantitative risk score to be low based on a numerical calculation. We added the impact (severity of an adverse event associated with a risk or combination of risks scored with an integer), and probability (likelihood of occurrence of an adverse event associated with a risk or a combination of risks) scores to reach the “risk score.” The table below shows the results of this process.

Table: Risk Score Matrix Risk Score Impact Probability Risk Score (Numerical) Critical 4 3 7 High 3 3 6 Medium 2 3 5 Low 1 3 4 Total 10 12 22

We then multiplied the risk score by the number of findings for each business process (area evaluated) to derive the “total risk score” (e.g. budgeting system: 4 x 6=24).

We added the risk scores to arrive at the “grand risk score” for all the business processes (e.g. 6+6+4+…..=71).

Also, we added the total risk scores to arrive at the “grand total risk score” (e.g.24+12+4+…..=145).

Then we divided the grand total risk scores by the grand risk scores to determine the “average risk scores” (e.g.145/71=2.04).

That result is within low risk score range. The table below summarizes theses arithmetic steps.

Table: Average Risk Score Matrix Area Evaluated No. of Findings Risk Score Total Risk Score Budgeting System 4 6 24 Accounting System 2 6 12 Financial Management Capacity 1 4 4 Internal Control 1 7 7 Governance 1 6 6 Personnel and Payroll 5 6 30 Procurement and Purchasing 1 5 5 Program Management and Monitoring 3 7 21 Compliance with Laws and Regulations

1 5 5

Internal Audit 2 6 12 Fixed Assets Management 1 7 7 Petty Cash Management 2 6 12 Grand 24 71 145 Average Risk Score 2.04

Qualitative Analysis of Findings

We considered the risk score for the internal control, program management and monitoring, and fixed asset management processes to be critical. Because the assigned risk score of these business processes is critical, we are required to take into consideration other qualitative factors that affect these business processes. Accordingly, we determined whether there is a reasonable possibility that their deficiencies will result in a misstatement of an account balance or disclosure. We considered the additional qualitative risk factors listed below to determine their effect on the risk score:

The susceptibility of the related asset to loss or fraud. Fixed assets are easily transferred or removed. Therefore, any material weakness in the internal control for fixed assets makes the entity vulnerable to theft.

The subjectivity, complexity, or extent of judgment required to determine the amount involved;

The interaction or relationship of the control with other controls;

The interaction among the deficiencies; and

The possible future consequences of the deficiency.

As result of our consideration of these risk factors in relation to the business processes classified as critical risk, we qualitatively assess MCN risk score as high.

The table below lists the number of findings in each business process (area evaluated) and their overall risk score.

Table: Findings and Risk Score Matrix

Area Evaluated Finding No. Risk Score Budgeting System F1, F2, F19 & F20 HIGH Accounting System F3 & F24 HIGH Financial Management Capacity F4 LOW Internal Control F5 CRITICAL Governance F6 HIGH

Area Evaluated Finding No. Risk Score Personnel and Payroll F7, F8, F9, F10 & E21 HIGH Procurement and Purchasing F23 MEDIUM Program Management and Monitoring F11, F12 & F18 CRITICAL Compliance with Laws and Regulations F22 MEDIUM Internal Audit F13 & F14 HIGH Fixed Assets Management F15 CRITICAL Petty Cash Management F16 & F17 HIGH

As a result of the risks identified, GMG recommends mitigation measures to strengthen MCN’s management internal control activities and reduce the risk of wasting or misusing USG resources. We recommend that these measures include:

Developing and implementing a quality assurance process to verify and validate all deliverables or reports, especially budget reports to MoF and other line ministries, before delivery to other ministries;

Developing and implementing an automated tool (IT software), such as an MS Access database, with a secured environment, larger database capacity, data management, analytical and data warehouse capabilities to support the detail recording, tracking, monitoring, analyzing and reporting (subsidiary ledger process)and business process transactions, including fixed asset management, budget system, accounting system, personnel ad payroll, procurement, etc;

Developing and implementing standard operating procedures (SOP) and desktop manuals for all major business processes;

Strategically developing and implementing an internal control structure or an integrated internal control environment at the entity level that includes:

o Control environment, o Risk assessment, o Control activity, o Information and communication, and o Monitoring.

Periodically evaluating the integrated internal control environment to ensure adequacy and operating effectiveness of the internal control;

Hiring a compliance officer to examine, evaluate, and investigate eligibility for or conformity with laws and regulations governing contract compliance with license and to perform other compliance and enforcement inspection and analysis activities not classified elsewhere; and

Developing and implementing systematic training programs for the SMEs working on major business processes.

B. Background

The Bureau of International Narcotics and Law Enforcement Affairs (INL) contracted GMG Management Consulting, Inc. to conduct a Public Financial Management Risk Assessment (PFMRA) of Afghanistan’s Ministry of Counter Narcotics (MCN) the goal was to determine whether MCN has the capacity to continue to receive and responsibly manage donor funds, including funds from the U.S Government.

The PFMRA is the United States Agency for International Development’s (USAID) risk management methodology used to identify, mitigate and manage the fiduciary risks encountered when considering government-to-government (G2G) assistance. It focuses on fiduciary risks to which United States Government (USG) funds may be exposed when administered directly by the Public Financial Management (PFM) systems of the entities intended to implement G2G-funded activities. PFMRA assessments of individual entities include all PFM systems that may be used in implementing a project. The PFMRA is designed to assess not only the PFM systems of the partner government, but also governance and public accountability factors, including the legal and regulatory environment, as well as the political will for transparent, accountable, and effective governance.

INL currently provides G2G funding to MCN for the programs below.

The Good Performers Initiative (GPI), which provides development assistance to provinces that meet annual counternarcotics goals, such as achieving poppy free status, reducing poppy cultivation by more than 10 percent and/or demonstrating other exemplary counternarcotics progress.

The Governor Led Education (GLE) program, which reimburses Governors who undertake poppy eradication for their eradication expenses.

Portions of the MCN capacity building program.

The PFMRA will help the Government of the Islamic Republic of Afghanistan (GIRoA) make the reforms necessary to strengthen its PFM systems to reduce corruption, improve budget execution and increase revenue collection. These improvements, in turn, will increase the effectiveness of foreign assistance to GIRoA and enhance its long-term sustainability.

The remainder of the background section describes the structure of MCN, its directorates and its major programs, and the relationship between MCN and the Ministry of Finance (MoF). In addition to the background section, the report includes the following sections and appendices:

Methodology (Section C), Findings (Section D), Risk Assessment Schedule(Section E), Business Flow Chart (Appendix I), Risk Matrix Definitions of Terms (Appendix II), Definition of Key Internal Control Terms (Appendix III), Risk Assessment Scope Limitation(Appendix IV) and Walkthrough and Interview Matrix (Appendix V).

Afghanistan’s Ministry of Counter Narcotics

GIRoA’s Constitution, Counter Narcotics and Intoxicants law (the Afghan Drug Law) provides MCN the authority to lead the coordination, policy making, monitoring and evaluation of counternarcotics efforts. This authority includes: coordinating the counter narcotics budget with GIRoA’s Ministry of Finance (MoF); coordinating relevant counter narcotics efforts with GIRoA’s line ministries and organizations; and monitoring and reporting on the implementation of the National Drug Control Strategy.

MCN’s major activities include: law enforcement, international and regional cooperation, eradication, public awareness, alternative livelihoods, criminal justice, and demand reduction.

According to the NDCS, the major objectives of MCN’s work are the following:

Disrupting the drug trade by targeting traffickers and their backers and eliminating the basis for the trade.

Strengthening and diversifying legal rural livelihoods, reducing the demand for illicit drugs and treatment of problem drug users.

MCN accomplishes its mission through the following directorates:

Alternative Livelihood

Drug Demand Reduction

Law Enforcement

Public Awareness

Provincial Relations Coordination

Regional and International Coordination

Survey

Research and Study

Finance and Administration Directorate

Information and Public Relations Directorate

Human Resource Directorate

The four administrative or operational support directorates report their activities to Deputy Minister of Finance and Administration, who then reports to the MCN Minister. The eight (8) major program directorates report their activities to the General Directorate of Policy and Planning. The General Directorate of Policy and Planning then reports to the Deputy Minister of Counter Narcotics, who reports to the MCN Minister. The Provincial Relations Coordination Directorate or the Provincial Affairs Directorate reports its activities directly to the Deputy Minister of Counter Narcotics, who then reports to the MCN Minister. The Procurement Department reports its activities to the Deputy Minister of Finance and Administration, who then reports to the MCN Minister.

Below are descriptions of the major program and procurement directorates.

Alternative Livelihood

The Alternative Livelihood Directorate (ALD) was formed and established based on clauses number 6 and 11 of article number 65 of the Afghan Drug Law. The ALD is primarily responsible and accountable for:

Developing policies for effective implementation of the National Drug Control Strategy and Law against Intoxicants and Narcotics Control.

Planning and procuring resources (financial resources, human resources, physical resources and others) for countering narcotics. Planning for management and implementation of the Counter Narcotics Trust Fund in coordination with the Planning and Research Directorate of the MoF.

Developing and preparing proposals for alternative livelihood programs and submitting those proposals to donors for procuring needed resources.

Collecting data and information from the alternative livelihood programs of the ministries and independent governmental entities and other related stakeholders.

Developing various databases for tracking and reporting information when needed.

Performing any other tasks to achieve the objectives of counter narcotics.

ALD coordinates and carries out its efforts with GIRoA line ministries, including the Ministry of Agriculture, Irrigation and Livestock (MAIL), the Ministry of Commerce and Industries, the Ministry of Rural Rehabilitation and Development (MRRD), the Ministry of Public Works, the Ministry of Energy and Water, and the Ministry of Internal Affairs (MoI).

Drug Demand Reduction

The Drug Demand Reduction Directorate (DDRD) was formed and established based on clauses number 8, 9 and 10 of article number 65 of Afghan Drug Law. The DDRD primarily is responsible and accountable for:

Establishing Curative Centers for Demand Reduction and for recovery of drug addicted people in partnership with Ministry of Public Health.

Monitoring, evaluating and reviewing Drug Demand Reduction Centers across Afghanistan, providing treatment and recovery facility services to drug addicted people.

Designing programs for building and improving the capacity of drug addicted treatment centers in Afghanistan.

Providing professional advice to partner organizations and drug addicted treatment centers in Afghanistan.

Taking necessary steps towards procuring and finding resources for drug addicted treatment centers in Afghanistan.

Developing policies for better implementation of the plans for drug demand reduction, treatment and recovery of drug addicted people.

Public Awareness (Public Information and Communication)

The Public Information and Communication Directorate (also known as the Public Awareness Directorate, or PAD) is primarily responsible and accountable for carrying out and organizing campaigns to increase public awareness of the harm caused by the cultivation of the poppy. Its major activities include promoting national and international days dedicated to countering narcotics campaigns, conducting press conferences, writing press releases, and distributing information on the effect narcotics or hazards of narcotics. PAD coordinates and carries out its efforts with GIRoA’s line ministries, including MoI, the Ministry of Public Health (MoPH), the Ministry of Women Affairs (MoWA), the Ministry of Labor and Social Affairs (MoLSA), the Ministry of Education (MoE), the Ministry of Defense (MoD), the Ministry of Borders and Tribal Affairs (MoBTA) and the Ministry of Hajj. PAD also works closely with international governments, multilateral institutions and non-governmental organizations, including the U.S.

Embassy, UK Embassy, and United Nations Office on Drugs and Crime (UNODC).

Provincial Relations and Coordination

The Provincial Relations and Coordination Directorate (PRCD) is organized by five zones in Afghanistan, the PRCD is primarily responsible and accountable for:

Interacting regularly with Provincial Counter Narcotic Directorates to obtain their performed activities reports, provide guidance for solutions with respect to problems arising in official affairs, segregate duties by on-site visits, formal or official letters, telephonic conversations and internet posts.

Procuring and transferring money to provinces for eradication or destruction of poppy farms.

Raising the capacity for eradication based on the approved plan, and eradication of 5000 acres a year based on the policy of regular reduction of cultivation of poppy.

Contacting and communicating with donor agencies, and national and international stakeholders to find solutions to problems and challenges affecting narcotics counter measures, both at the central and provincial level.

Participating in the management and all other related meetings of Ministers with Ambassadors of other countries and international donors.

Survey

The Survey Directorate has six zonal branches/offices that are managed by the Head of Survey Coordinators, as well as provincial branches, which are headed by Provincial Managers.

Provincial Managers are responsible for managing the operations of provincial offices and for reporting to their zonal Head of Survey Coordinator. Zonal heads report to the central ministry in Kabul. The purpose of this directorate is to carry out surveys related to narcotics, including the annual Opium Survey conducted in conjunction with UNODC. The directorate hires individual contractual surveyors who enter the data collected from the field into the Survey Directorate database on a daily basis. Further, with regard to reporting on the statistical surveys on narcotics including the cultivation, reduction, addictions, etc, the Survey Directorate prepares and publishes reports on monthly basis from the data and reports what the directorates receives from their zonal and provincial offices. After the reports are reviewed and approved by MCN leadership, they are disseminated to relevant departments and directorates of MCN, as well as to other stakeholders, such as UNODC, GIRoA’s line ministries, INL, etc.

Procurement Department

The Procurement Department (PD) was established by the GIRoA procuring entities rule 174 and rule 175. The PD is primarily responsible and accountable for:

Providing and regulating procurement plans;

Preparing, publishing and distributing invitations to pre-qualify, pre-qualification documents and invitations to express interest, tendering announcements, requests, bidding and other documents related to procurement procedures;

Receiving, opening and safeguarding applications to pre-qualify and expressions of interest;

Maintaining any standing lists of bidders or lists of pre-qualified bidders required by the

MCN;

Receiving quotations bids and proposals;

Preparing procurement contracts;

Performing secretariat service for the Procurement Committee;

Facilitating processes in order to implement Article 8 of the Law;

Preparing shortlists and lists of pre-qualified bidders for the Procurement Committee for approval by the Award Authority;

Preparing propositions of the membership of Evaluation of Bids Committee for the Procurement committee to submit to the Award Authority for approval;

Preparing contract award recommendations for the Procurement Committee and award authority, Preparing notices of proposed award and notices of bid acceptance;

Preparing contract documents, in line with the award decision;

Preparing and issuing rejection and debriefing letters;

Preparing and publishing notices of contract award;

Preparing contract variations and modifications;

Assisting with the inspection and acceptance of goods, works and services, including participating in the Inspection and Receipt Committees as required;

Overseeing implementation of procurement contracts not carried out by the end-user;

Assessing the quantity and quality of the procured goods, works and services;

Ensuring that procurement records are maintained, in accordance with these Rules;

Preparing any reports required; and

Providing information, as required, for any petition or investigation to debar a bidder or contractor or any investigation under review procedures.

Research and Study Directorate

The Research and Study Directorate was established in 2011 under the organizational structure of the Deputy Ministry and General Directorate of Policy and Coordination. The objective of the Research and Study Directorate is to monitor and evaluate counter narcotics issues and to lead an effective and coordinated response based on evidence, policy and advocacy. The Research and Study Directorate coordinates CN efforts with other line ministries to deliver informed reports and policy on counter narcotics in Afghanistan.

Figure I- MCN Organizational Chart

MCN Programs

Currently, MCN implements three major programs to achieve its mission:

1. Comprehensive Agriculture and Rural Development Facility (CARD-F);

2. Food Zone program; and

3. Good Performers’ Initiative (GPI).

Comprehensive Agriculture and Rural Development Facility (CARD-F)

CARD-F is a joint venture established under the auspices of Agriculture & Rural Development (ARD) and is managed by an Inter-Ministerial Committee (IMC). The IMC is chaired by the MCN with membership currently drawn from MAIL, MRRD and MoF. The IMC has appointed an Executive Director (ED), who manages the CARD-F program and reports the program activities to the IMC. It aims to promote sustainable growth of licit rural incomes and employment through Economic Development Packages (EDPs), interventions that aim to improve the performance and sustainability of agricultural value chains through investments in rural infrastructure, markets, and farm and off-farm production. CARD-F has offices in Balkh, Badakhshan, Nangarhar and Kabul provinces.

CARD-F’s goals include the following:

Increase legal employment and income opportunities through more efficient agricultural and rural enterprise markets in priority districts;

Reduce risk of a resurgence in poppy cultivation in and around key economic hubs by creating commercially viable and sustainable alternatives for farmers to earn licit income;

Attain greater impact and leverage from existing, district-level programs through improved alignment, coordination and integration of Government and donor support to agriculture and rural development;

Develop key interventions to address bottlenecks to legal livelihoods through additional top-up or gap-filling resources;

Improve government capacity to lead and coordinate donor initiatives to deliver provincial and district-level programs to enhance economic growth and incomes.

CARD-F’s strategic objectives include the following:

Identify, expedite, coordinate and monitor the deployment of ARD Cluster ministries' technical expertise so that EDPs can be implemented;

Develop CARD-F's leadership, management, technical and operational capability so that it becomes a recognized center of excellence within Afghanistan for its infrastructure, agricultural and market development initiatives;

Contribute to Government policy on agricultural, infrastructure and market development;

Improve the quality of development interventions for the rural development.

Food Zone Program

The Food Zone (FZ) Program is designed as an “ink-spot” strategy that aims to enable transition, over the three years of the program, from an opium poppy-based agricultural economy to a licit agricultural economy as defined in the National Alternative Livelihood Policy. The objective of the program is to create poppy-free zones. Currently, the FZ consists of the seven (7) districts and five (5) agricultural research and extension farms that make up the Kandahar Food Zone.

The Food Zone program includes the following components:

A Public Information component that reaches a full spectrum of target audiences through a range of mechanisms including Shuras, radio and television messages, messaging through religious and community leaders, high profile events and posters and promotional material.

An Alternative Livelihood (AL) component that provide a diverse range of agricultural input packages to provide farmers with high-quality, income-generating alternatives. The important elements of the AL campaign are developing expansion of licit crops such as improved wheat varieties, high -value medicinal plants depending on the opportunities in the target province(e.g., saffron, black cumin, Licorice),livestock and improved dairy cattle, high value perennial horticulture (improved orchards, vineyards and greenhouses) and support to research and extension centers. Eradication and Law Enforcement (LE) component of the Food Zone program starting early in the cultivation season and encompassing three areas: self-eradication; Governor Led Eradication (GLE); and measures to disrupt poppy lancing. A priority order of eradication has been established and the program aims to eradicate all drug crops in the seven districts. Interdiction is another key aspect of the LE element of the Food Zone program.

The program structure includes a Program Commission, chaired by the Governor, to monitor and evaluate the working groups that lead the AL, LE, and PI components of the program. Each working group plans, implements, monitors, evaluates and reports on its area. A Planning Secretariat supports the Working Groups with project planning and security arrangements and a Compliance Unit that provides support to the Working Groups. Finally, a Direct Technical Assistance Program Unit provides capacity to the FZ program. The reporting requirements include providing milestones and key performance indicators. Each working group produces a monthly report for the Program Commission with specific elements of information. Specific key performance indicators are established for each working group. Monitoring the program includes community-based monitoring from Community Councils and Cooperatives and Formal Monitoring by agricultural extension workers from MAIL, systematic security monitoring from security patrols, and aerial imagery.

Good Performers Initiative

The Good Performers Initiative (GPI) seeks to incentivize provincial counternarcotics and supply reduction activities through support of sustainable, community-led development projects in provinces that have significantly reduced or eliminated poppy cultivation. INL provides on-budget funding for GPI provincial development projects directly to the Ministry of

Finance. Projects are proposed by Community and Provincial Development Councils, approved by the relevant Afghan ministry, and contracted and overseen by the Ministry of Counter Narcotics. During 2014, INL and MCN worked jointly to improve GPI’s effectiveness. On August 31, 2014, INL and MCN jointly launched GPI II, which transitions the focus of community development projects from mostly infrastructure to support for rural livelihoods and alternative development.

Government of Islamic Republic of Afghanistan Ministry of Finance

GIRoA’s MoF is responsible for the management and execution of the budget, collection of taxes, organization and control of public expenditure, payments to the government, and management of customs. The aim of the MoF is to manage the financial affairs of the country in an accountable and transparent manner and to ensure that international standards are met for procurement and financial management. The vision of MoF is a stable, financially secure and financially self-sufficient Afghanistan with a fiscally disciplined government and a Ministry that is accountable and responsive to the needs of its clients. The broad goals are to mobilize revenue and manage Government finances; support economic management and promote economic growth; manage public wealth; promote good governance and best practice leadership within the Afghan public sector.

C. Methodology

To perform the PFMRA, GMG identified the risks associated with each of MCN’s business processes and its system of controls, based on its experience and understanding of MCN’s environment. The risk associated with a control is the risk that the control might not be effective and, if not effective, the risk that a significant deficiency or material weakness would result. The factors listed below affect the risk associated with a control:

The nature and materiality of misstatements, errors, illegal activities, that the control is intended to prevent or detect;

The inherent risk associated with the related financial management activities and assertions;

Whether there have been changes in the volume or nature of transactions that might adversely affect control design or operating effectiveness;

Whether the financial management activities have a history of errors or prior audit reports that indicate corrective action that needs to be resolved;

The effectiveness of entity-level controls, especially controls that monitor other controls

The nature of the control and the frequency with which it operates;

The degree to which the control relies on the effectiveness of other controls (e.g., control environment or information technology (IT) general and application controls);

The competence of the personnel who perform the control or monitor its performance and whether there have been changes in key personnel who perform the control or monitor its performance;

Whether the control relies on performance by an individual or is automated (an automated control would generally be expected to be lower risk if relevant information technology general controls are effective); and

The complexity of the control and the significance of the judgments that must be made in connection with its operation.

Then, GMG evaluated MCN management’s internal controls to determine if there were adequate internal control activities to mitigate these risks. The management internal controls assessed included the development and implementation of adequate policies and procedures to manage MCN’s programs such as segregation of duties, proper authorization of activities, accurate and complete recording of transactions, data security and integrity, data management, adequate documentation and record keeping to support transactions, physical control of assets and records, independent checks on performance, etc. as related to the public financial management systems and operations. GMG also reviewed the management internal controls for the following business processes, including the applications (IT software or automated system) used to support the business processes for the budget system: the accounting system, financial management capacity, internal control, governance, personnel and payroll, procurement and purchasing system, program management and monitoring, compliance with laws and regulations, internal audit, assets management, and cash management. The review covered financial activities or transactions associated with MCN programs for the fiscal years 2012 and 2013.

GMG developed a questionnaire for MCN subject matter experts (SMEs) based on USAID’s questionnaire for PFMRA Stage 2 to gather data on MCN’s business processes and its system of controls (see attachment # 1 for completed questionnaire). To verify and validate the data gathered via the questionnaire, GMG conducted walkthroughs of MCN’s business processes and systems and interviews with MCN’s SMEs. The walkthroughs and interviews focused on the SMEs’ initiation, authorization, review, analysis, processing, recording, reconciling and reporting of financial management activities or transactions.GMG also observed SMEs performing their routine operations to confirm controls, and inspected relevant documentation for the transactions. In addition, GMG reviewed the policies and procedures for MCN business processes and systems to determine if they were complete and consistent with international standards. Finally, as required by the PFMRA, GMG also selected a sample of transactions for payroll, procurement and purchase, fixed asset, cash management systems to determine whether the internal control activities were operating effectively.

GMG conducted the risk assessment in accordance with USAID’s PFMRA manual ADS 220, General Accepted Government Auditing Standards (GAGAS), OMB Circular A-110 Uniform Administrative Requirements for Grants and Other Agreements with Institutions of Higher Education, Hospitals and Other Non-Profit Organizations, OMB Circular A-123 – Management’s Responsibility for Internal Control, OMB Circular A-133 – Audits of States, Local Governments, and Non-Profit Organizations (Compliance Supplement), and Standard for Internal Control in the Federal Government (Green Book) issued by the Comptroller General of United States (GAO-14-704G). GMG used the Government Accountability Office and President’s Council on Integrity and Efficiency (PCIE) Financial Audit Manual and Public Company Oversight Board Auditing Standard No.12 methodology to perform the risk assessment.

Throughout this report the terms internal control structure, internal control evaluations, and internal audits are used frequently. These concepts are interrelated, but different. To facilitate review and understanding of the report, definitions of these key terms are provided in Appendix III (Definition of Key Internal Control Terms).

Analysis

In the course of its evaluation and testing of internal control operating effectiveness, GMG identified control deficiencies, or vulnerabilities. A deficiency in internal control over financial reporting and operations exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements or error or fraudulent activities on a timely basis. A deficiency in design exists when a control necessary to meet the control objective is missing or an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.

GMG evaluated the severity of each control deficiency to determine whether the deficiencies, individually, or in combination, were material weaknesses or significant deficiencies. The severity of a deficiency depends on whether there is a reasonable possibility that MCN's controls will fail to prevent or detect an error, fraud, or misstatement of an account balance or disclose inefficient and ineffective operations or illegal activities. The factors that affect whether there is a reasonable possibility (probability) that a deficiency, or a combination of deficiencies, will result in adverse events include:

The nature of the financial management activities, disclosures, and assertions involved;

The susceptibility of the related asset or liability to loss or fraud;

The subjectivity, complexity, or extent of judgment required to determine the amount involved;

The interaction or relationship of the control with other controls, including whether they are interdependent or redundant;

The interaction of the deficiencies; and

The possible future consequences of the deficiency (potential impact).

GMG evaluated the control deficiencies as either significant or material weaknesses. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting and operation that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of MCN's financial reporting. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the MCN's financial reports will not be prevented or detected on a timely basis.

GMG also analyzed the impact and probability of the risks identified using the PFMRA risk matrix to arrive at a risk scores. Assessing impact and probability of the risks identified permits the quantifying of qualitative data in order to measure, compare, and prioritize risks and scorings. The results of this assessment were then used to prioritize risks to establish a most-to-least-critical importance ranking. Ranking risks in terms of their criticality or importance provides insights to the MCN's management on where resources may be needed to manage or mitigate the realization of high probability and high consequence risk events.

Impact and probability were measured on a 1-4 scale as explained below.

Impact – The severity of an adverse event associated with a risk or combination of risks is described below. Impact was evaluated on a 1–4 scale.

o Negligible: 1 - PFM broadly reflects good international practice. The development of objective outcome can reasonably be assumed to be attained if conditions do not change. This rating indicates that strong political and management commitment to sound PFM practice is evident. Internal controls overall function as intended with deviation potentially having a financial impact that is less than significant to a program. Accountability institutions are mature, function routinely, and are not under threat.

o Marginal: 2 - PFM broadly reflects good international practice with some gaps or inefficiencies present. Political or management commitment to closing the gaps and eliminating inefficiencies is present. The development objective is reasonably likely to be attained. Expected effects could include minor delays in attainment, minor dissatisfaction by stakeholders, or a nonmaterial financial impact. Noncompliance with the internal control framework is the exception rather than the rule, potentially having a financial impact that is less than material on a program. Weaknesses in accountability may be present, or accountability may be in an early and untested stage of development.

o Serious: 3 - Significant elements of the PFM system do not reflect good international practice. Political or management commitment to attaining a state of compliance with good international practice is inconsistent or questionable.

Attainment of some of the expected outcomes associated with the development objective can reasonably be expected. Expected effects could include a major delay, limited dissatisfaction by stakeholders, and a material financial impact.

Noncompliance with the internal control framework is likely to occur and may result in significant impact to the program. Weakness in accountability is evident.

Opposition to accountability is evident among some elements in the government.

o Catastrophic: 4 - There are obvious and material divergences from good international PFM practice. Political and management commitment to attainment of a state of compliance with good international practice is the exception or entirely absent. Realization of an adverse event associated with this risk factor would lead to less-than-desirable outcomes. Expected effects include failure of the project, widespread and severe dissatisfaction by stakeholders, major financial losses, and extensive loss of reputation. Noncompliance with the internal control framework is expected to occur widely. Accountability institutions have major gaps. Opposition to accountability is organized or widespread and therefore expected.

Probability – The likelihood of occurrence of an adverse event associated with a risk or a combination of risks. Probability was measured on a 1-4 scale.

o Remote: 1 - This number reflects the conclusion that there is less than a 25 percent probability. An adverse event associated with the risk is rare or would only occur in exceptional circumstances. There is little or no experience of a similar failure.

o Occasional: 2 - This number reflects a conclusion that the probability lies between 26 and 50 percent. An adverse event associated with the risk might occur because the conditions for it exist, but controls exist and are effective.

o Probable: 3 - This number reflects a conclusion that the probability lies between 51 and 75 percent. An adverse event associated with the risk likely will occur because the controls are inadequate or are applied inconsistently.

o Frequent: 4 - This number reflects a conclusion that the probability lies between 76 and 99 percent. An adverse event associated with the risk is expected to occur.

There is near certainty of occurrence because the controls do not exist or are ineffective.

Scope Limitation

The scope of the MCN’s risk assessment is narrower than a financial statement or performance audit. A financial statement audit would have required us to perform more detailed internal control, compliance and substantive testing in order to provide an opinion on MCN’s financial reports. More information on the difference between this risk assessment and financial statement/performance audits can be found in Appendix IV (Risk Assessment Scope Limitation).

D. Summary of Findings and Conclusion

As a result of the risk assessment, GMG identified twenty-four (24) significant internal control deficiencies that increased the potential for material misstatement in financial reporting, inefficiency and ineffectiveness of operations and non-compliance with laws and regulations. As a result of the assessment, we quantitatively ranked the overall risk as low, but qualitatively ranked the overall as high, therefore on average the overall risk was ranked medium. Also, we considered the overall risk ranking for the internal control, program management and monitoring, and fixed asset management processes to be critical. The systems and deficiencies found in each business process (evaluated area) examined by the assessment are listed below, including the findings and overall risk ranking.

Area Evaluated Findings No. Risk Rating Budgeting System F1, F2, F19 & F20 HIGH Accounting System F3 & F24 HIGH Financial Management Capacity F4 LOW Internal Control F5 CRITICAL Governance F6 HIGH Personnel and Payroll F7, F8, F9, F10 & E21 HIGH Procurement and Purchasing F23 MEDIUM Program Management and Monitoring F11, F12 & F18 CRITICAL Compliance with Laws and Regulations F22 MEDIUM Internal Audit F13 & F14 HIGH Fixed Assets Management F15 CRITICAL Petty Cash Management F16 & F17 HIGH

In the following pages, GMG outlines the activities performed in each business process, the risks found in their operation (the description of the conditions), why they are determined to be risks (the criteria), the cause of the risks, and their effects. GMG also outlines its recommendations for mitigating these risks, which will strengthen MCN’s control activities and reduce the risk of wasting or misusing U.S. Government resources. Finally, GMG provides MCN’s response to each finding, if provided.

Budgeting System

MCN’s budgeting system consists of major activities such as budget formulation and planning, budget execution and control (tracking, monitoring and reconciling), and reporting. The Afghanistan Financial Management Information System (AFMIS) is used to support the budget execution and control, and reporting activities. Afghanistan’s MoF is primarily responsible for initiating, coordinating, approving and reporting on MCN budgeting activities.