Making a difference: the World Bank Group's Auditor General Carman Lapointe-Young says her team of auditors is playing its part in the organization's fight to end poverty

Internal Auditor, June, 2008 by Neil Baker

INSCRIBED IN STONE AT THE ENTRANCE TO THE World Bank headquarters in Washington, D.C., is its vision: "Our dream is a world free of poverty." Toward that goal, the organization's more than 10,000 professional staff, located around the world, provides technical assistance and lends tens of billions of dollars a year to developing nations. The sheer scope of its mission makes The World Bank a complicated place to audit. Add to that a Byzantine governance structure, and the organization's Auditor General Carman Lapointe-Young has her work cut out for her.

The World Bank Group is actually an amalgam of institutions, four of which have their own executive board of directors. The directors are appointed by member countries or groups of countries, and rotate frequently. In practice, three of the boards usually comprise the same directors--24 in total. Presiding over it all is the president of the World Bank, Robert Zoellick, a former U.S. deputy secretary of state. The previous president, Paul Wolfowitz, a controversial figure, resigned in an ethics scandal in May 2007, after serving only two years in office. The story of his departure captured media attention around the world. Every organization has its politics, but the World Bank is in a class of its own.

[ILLUSTRATION OMITTED]

While the bank has only had II presidents in its 64-year history, Lapointe-Young has worked with three of them since joining the organization in 2004. The World Bank is a tough place to audit, but Lapointe-Young is convinced that her team is playing its part in ending poverty, which she says is motivation enough to overcome the challenges of working in such a politically sensitive organization.

Q. What is your role at The World Bank?

As auditor general, I lead an internal audit function of about 60 auditors, and I report to the president and to the audit committee of the board. The resident board members are called executive directors, but they don't have responsibility for managing bank functions. They provide day-to-day oversight and meet regularly. The audit committee meets frequently--often weekly--so preparing for and attending meetings can be time-consuming. Our audit committee comprises eight of the 24 executive directors. The board of governors who are finance ministers of the shareholding countries' governments only meet twice a year. We don't interact directly with them.

The president is my official supervisor. He has a meeting every morning with his senior management team and all of the vice presidents--I am part of that meeting. We are brought up to date on the issues that are on his mind, and each of the senior executives around the table has an obligation to keep him informed of emerging issues he may need to react to or address.

Q. Do you attend as an independent audit person or as an executive?

It is very much the latter. I think it's important that the audit function does not operate in a vacuum. If we are to really understand the issues that face the organization, we need to be part of that network. It's also a way for me to advise the president on significant issues relating to our audit work and to get his support. He has very little time to sit with anyone around that table on a one-on-one basis; he is very focused on external issues. But what we agreed on when he first arrived, and it seems to be working, is that if he shows support for the audit function at that meeting, it almost guarantees I won't need to appeal for his support on any major issues. He's very effective at that.

Q. How is the internal audit role evolving?

In the past, most of the audits in country operations looked only at financial and administrative activities. If an office in a particular country had a US $2 million budget, internal auditing would look at how it was managed or how the office hired people or secured the premises. The auditors weren't looking at the portfolio of bank projects and trust funds being managed in the field; but that's where the biggest risks lie--is the bank doing what it's supposed to be doing?

Three years ago, we moved to doing full-scope audits of country operations in the field. We still look at the financial and administrative functions, but the real value is in looking at how well business risks are managed. That has been a major change, and there has been something of a price to pay, because we didn't get additional resources to do this type of work. As a result, instead of doing 60 or 70 audits in the field, we can only do 20 or 25. The reduced visibility doesn't have the same deterrent effect, but the results have much greater impact.

Of course, we also carry out a full program of business process, financial, treasury, and IT audits at headquarters. In recent years, we have developed extensive skills in IT auditing and data mining, and we've leveraged these skills to our advantage--our audit results are much more compelling.

Our goal is to provide an annual "positive assurance" opinion to senior management and the board on the overall quality of internal controls, not just on individual audits. This has meant a dramatic change in the way we assess risks and plan our audit work. It means doing enough work to be able to say with a level of confidence that we know all of the soft spots--the control weaknesses that can prevent the bank from achieving its goals.