Risk Management Report and Annual Opinion of the Chief Risk Officer

Author:

Aidspan

Article Type:

Article Number: 5

Alertness to risks and determined action will be needed in the difficult year ahead

This article summarizes the Risk Management Report presented to the Board on the status of the Global Fund’s risk profile, risk management framework, and risk management priorities for 2023, together with the annual opinion of the Chief Risk Officer. The report and opinion are clear that to effectively prioritize and set realistic milestones and objectives will be more important than ever before. Effective risk management is going to be pivotal to ensure risks are promptly identified and either contained or mitigated, and that informed risk trade-off decisions are being made. The fact that risk management is already embedded into the Global Fund’s business processes and operating model ensures a strong foundation. Nonetheless, continuing to strengthen the second line of defence and ensuring tailored and targeted monitoring and oversight supported by the right systems, tools and processes, must be a priority for 2023.

Introduction

For the 49^th Board Meeting, the Board was provided with a Risk Management Report (RMR) – which had been shared with all Standing Committees of the Board – and the Chief Risk Officer’s Annual Opinion.

The RMR identifies volatility and resilience as the two persistent themes throughout 2022. Volatility continues with the looming global recession, a cost-of-living crisis in many countries, disasters linked to climate change, Russia’s ongoing invasion of Ukraine, and conflict, political instability and security threats in a number of countries.

Despite that background, HIV, TB, and malaria (HTM) programs have shown resilience. The 2022 Results Report demonstrates this: HIV testing services for groups in greatest need recovered in 2021; approaches to identify and treat more “missing” people with TB were accelerated; and malaria programs recovered from previous declines, with testing and treatment now registering gains.

Maintaining the success of those programs will not be easy: with the start of the new 2023-2028 Strategy programs, the bar is once again being raised in 2023. The Strategy places an increased focus on resilient and sustainable systems for health (RSSH), as well as pandemic preparedness and response (PPR), which will demand more complex interventions. Furthermore, whilst the recent Seventh Replenishment can be considered a success, particularly given fiscal pressures on donor countries, resources compared to the level of ambition will be constrained during the strategy period.

External risks impacting the Global Fund’s risk profile 

The RMR discusses the four main external risks impacting the Global Fund’s risk profile. The nature of these risks means that the Global Fund has limited ability to mitigate their root causes; but the Secretariat is taking steps, where possible, to mitigate their impact on Global Fund supported programs and its operations.

First, Russia’s ongoing invasion of Ukraine:  In addition to the casualties and the millions of people displaced in Ukraine, the invasion has had far-reaching implications globally. It has impacted energy costs, food security and economies, thereby pushing already vulnerable populations further into poverty, and negatively impacting the ability of implementing governments to maintain investments in health programs and of donor governments to support previous levels of official development assistance.

Second, health finance and macroeconomic risk: Domestic financing is critical to achieving Global Fund strategy targets. As set out in the Investment Case for GC7, domestic financing is projected to be the major source of funding for Global Fund supported programs, with 45% of funding needs across the portfolio anticipated to be met by country resources. However, the high level of public debt in a context of rising global interest rates and slow growth will further complicate the health-financing picture for many countries.

Third, political instability and security risk: Beyond Ukraine, communities in other Global Fund supported countries are also suffering the effects of political instability and security risks. In 2022, the External Risk Index showed a slight upward shift and a worsening risk rating for ten countries, with five now falling into the Very High- or High-risk categories.

Fourth, climate change:  The risks associated with frequent and extreme weather events are increasing, negatively impacting food and water security, health infrastructure and leading to changes in disease transmission patterns.

Overarching risks

The three overarching risks to the implementation of the 2023-2028 Strategy are reported to be:

(1)  RSSH: COVID-19 tested the resilience of countries to respond to and actively mitigate the impact of the pandemic on essential health services. The key factors contributing to effective mitigation of the impact of COVID-19 included: health workforce capacity, especially of community health service delivery; health management information systems and surveillance, laboratory systems, and supply chain functionality and last-mile delivery. However, the pandemic exposed critical gaps including management of acute respiratory care, effective infection prevention control and access to waste management systems to dispose of bio-medical wastes.

(2)  Implementer capacity and bandwidth: 2023 is putting considerable strain on the bandwidth of implementers. The majority of GC6 grants, approximately 180, are moving into their final year of implementation and countries are expected to submit funding requests and negotiate grants for GC7. Over $3.7 billion is anticipated to be disbursed across the portfolio and $9 billion of allocations awarded and signed. In addition, implementers will also need to integrate funds awarded through portfolio optimization for the COVID-19 Response Mechanism (C19RM) and re-profile reinvestments for its extension. The Secretariat is also exploring options to integrate funds awarded through the World Bank’s Financial Intermediary Fund for Pandemic Prevention, Preparedness and Response into selected Global Fund grants, subject to relevant policy approvals. However, the pace and volume of work is considerable and creates a risk that the ability of implementers to deliver on programmatic priorities for the final year of GC6 could be negatively impacted.

(3)  Executing C19RM in a volatile environment: C19RM proved to be agile in responding to the changing nature of the pandemic and to shifting funding needs, issuing updated guidelines to streamline operations, driving reinvestment and launching portfolio optimization to shift investment profiles away from emergency response towards longer term systems strengthening. Despite the successes, thoughtful reprioritization and reinvestment and implementation of funds requires time, particularly when the shift in investment is towards longer term and more complex interventions. A revised C19RM Monitoring and Evaluation Framework has been developed to help support timely and transparent reporting. However, new and adjusted data collection tools will not be in place from the outset and reporting will need to be allowed to evolve over the course of 2023, which will have implications in the short term for the visibility of implementation progress of investments in systems strengthening, and monitoring and oversight.

Impact of global risk events on risk levels relative to risk appetite 

In recognition of the impact of COVID-19 on the risk landscape and risk levels, in November 2021 the Board approved: (i) temporary increases to risk appetite for four out of eleven grant-facing risks (Program Quality – TB, Procurement, Grant Related Fraud & Fiduciary, and Accounting & Financial Reporting by Countries); and (ii) extended timeframes for reaching target risk levels for five out of eleven grant-facing risks (Program Quality – HIV, Program Quality – TB, Program Quality – Malaria, Monitoring and Evaluation, and- In-country Supply Chain).

The HIV Program Quality and In-Country Supply Chain risk levels are High and the In-Country Governance and Quality of Health Product risks remain at Moderate. This is in-line with Board approved risk appetite (see Table A below).

The TB Program Quality risk has reduced to the upper end of High in early 2023, ahead of the December 2023 timeline, and is on track to reach Moderate by June 2025. This reflects ongoing program adaptations supported under C19RM and catch-up plans in place. In view of the progress made to date, the Secretariat is recommending reducing the risk appetite from Very High to High, and maintain the target risk timeframe for reaching Moderate as of June 2025.

The Malaria Program Quality risk is on the cusp of moving to Very High which is driven by factors over which the Global Fund has very limited influence. To ensure the Secretariat has the flexibility to make the difficult trade-off decisions necessary to maintain program continuity, and to help generate the desired level of attention and call to action from all key stakeholders needed to address the emerging threat, the Secretariat recommends increasing the risk appetite to Very High. A recommendation on the target time frame for reducing the risk level back to High and then to Moderate will be presented to the Committees in the coming months and submitted for approval at the November 2023 Board meeting.

*     The target risk level will become the revised risk appetite at the target due date, or when the risk level reduces to the target risk level, whichever is earlier.

**   Recommended revisions to risk appetite and target risk timeframes. 

*** Although the risk trajectory for the In-Country Governance risk is increasing the expectation is that the risk level can be maintained within the Board approved target risk level of Moderate. 

The Monitoring & Evaluation risk has now reached the target risk level of Moderate. As per the November 2021 Board-approved risk appetite statement, the target risk level is to become the revised risk appetite level at the due date. The risk appetite is therefore now revised to Moderate, and a target risk timeframe is no longer applicable since the residual risk is the same as risk appetite.

The target timeframes of December 2022 agreed by the Board for the Procurement and two financial risks, Grant Related Fraud and Fiduciary, and Accounting and Financial Reporting by Countries, have not been met. This reflects the fact that when the Board approved these timeframes, in November 2021, COVID-19 was the only external factor impacting risk levels and the estimated trajectories reflected the likelihood of mitigating the impact of COVID-19 including the availability and roll-out of effective vaccines and novel therapeutics. With the invasion of Ukraine, the situation has changed materially and the root causes driving increased risk levels have been magnified.

Key organizational risks: drivers and mitigations 

Program Quality

TB and HIV Program Quality risks are on track to reach target risk levels within the agreed timeframes but the Malaria Program Quality risk is on the cusp of moving to Very High. This is driven by a combination of factors: political and security threats in several countries impacting programs; changes to epidemiology and transmission trends due to climate change, which are often most severe in countries with larger populations thereby placing further pressure on malaria prevention budgets; the introduction of new vectors in Africa; and evolving drug and insecticide resistance patterns.

Monitoring & Evaluation

Despite variable data quality and data use, as of the end of Q4 2022 the M&E risk had reached the Board approved target risk level of Moderate.

M&E systems will continue to be strengthened as part of the new Strategy, to ensure that program decisions are informed by quality and timely data, disaggregated by age, gender, geography, population groups and strengthened use at national and sub-national levels. There is also a need to strengthen assurance through expansion of uptake of data quality reviews and improve the assessment of controls of various IT platforms in the context of cyber security and data fraud.

In-Country Supply Chain

The In-Country Supply Chain risk remains High with a steady direction of travel. If a Moderate risk level is to be achieved by June 2024, there will need to be a significant step-up in investments to drive greater accountability, transparency and efficiency.

Procurement

The Procurement residual risk remains High, which means that it did not reach Moderate in line with the target risk timeframe of December 2022. A range of evolving external and internal factors are driving the risk level, but it is expected to reach Moderate by June 2024.

Grant-related Fraud & Fiduciary 

The Grant Related Fraud & Fiduciary residual risk remains High, which means that it did not reach Moderate in line with the target risk timeframe of December 2022. The direction of travel is steady and, if the current trajectory is maintained, the risk level should reach Moderate by the end of June 2024.

Accounting & Financial Reporting by Countries 

The Accounting & Financial Reporting by Countries risk remains High, which means that it did not reach Moderate in line with the target risk timeframe of December 2022. The direction of travel is steady and, if the current trajectory is maintained, the risk should reach Moderate within twelve months, by the end of December 2023.

Human Rights and Gender Inequality 

The Human Rights and Gender Inequality risk remains high. However, the direction of travel is steady. The Secretariat is adopting a more ambitious and systematic approach to addressing human rights and gender related barriers in GC7, through new funding request requirements, technical assistance, program essentials, new technical briefs, thematic evaluations, and KPIs measuring engagement and grant performance. Various measures are also currently being implemented by the Secretariat to improve data-driven decision making and improve grant investments in human rights and gender equality.

Sexual Exploitation, Abuse & Harassment (SEAH) and Misconduct 

The SEAH risk remains High with a steady direction of travel. The macro and country specific pressures mentioned throughout the report continue to disrupt services, impact the availability of personnel who support and safeguard vulnerable populations, and contribute to an increased risk of prohibited behaviour.

In-Country Governance 

The In-Country Governance risk remains Moderate but with an increasing direction of travel. In- country governance covers health sector and disease program governance, Principal Recipient (PR) governance and implementation effectiveness, and Country Coordinating Mechanism (CCM) governance. As with other risks, the risk trajectory is being negatively impacted by a highly volatile operating environment, as well as competing and outstretched implementer capacity, and an increased risk of ethical misconduct, including fraud and SEAH, all against the backdrop of an ambitious strategy.

Risk Management Priorities for 2023

In the context of the risks outlined above, there are four risk management priorities for 2023:

1. Focus on emerging threats and risks. Currently, the most significant of these is the risk of reduced domestic health financing and co- financing and the ability of countries to sustain their support to ongoing programs.
2. Continue to strengthen: (a) second line monitoring and oversight by functional teams across the grant life cycle process; and (b) change management initiatives to support capacity building.
3. Enhancement of risk management tools.
4. Strengthening grant monitoring and oversight. Specific initiatives being prioritized for 2023 include more systematic segmentation of the data and analytical needs of different user groups, creating clear linkages with analytical products and decision-making platforms, improving data quality, and improving user interfaces and access.

Chief Risk Officer’s Annual Opinion 

The Global Fund continues to progress along the maturity spectrum in the context of risk management, internal controls and governance from the Embedded level of maturity achieved by the end of 2019.  As a result of the progress made on some of the priorities identified in the Annual Report of 2020 to advance the organizational maturity, the risk management framework is achieving its purpose, as it provides a common language and structure for thinking about and making trade-off decisions, in a more evidence-based and timely manner.

Despite this progress, 2023 will be an extremely challenging year with many competing priorities that need to be delivered against an operating environment that remains volatile and a continually evolving risk landscape. As a consequence, although HTM programmatic results have rebounded and are moving in the right direction, risk trajectories and the organization’s risk profile are not expected to stabilize for at least the next twelve months.

Ensuring a greater focus on emerging risks as well as continuing to strengthen the second line of defence and build-out monitoring and oversight is going to be essential. Collective prioritization is also going to be key. Implementers, the Secretariat and the wider partnership will need to manage a range of competing priorities in the coming twelve months and beyond. There will also need to be a careful and continuous assessment of when activities can be de-prioritized and the risk trade-offs that any de-prioritization will involve. The burden of operational processes and reporting on implementers, and the Secretariat, is a persistent area of concern, but so is the adequacy of monitoring and oversight and the need for greater transparency in our reporting to the Committees, the Board and donors. These tensions can be healthy but, at a time when resources are stretched, they need to be tackled head-on and through cross-organizational and collective problem-solving.

Some stakeholder comments

Given the importance of risk management, many communities had a lot to say.

Some recommended including the LAC Region in the emergency project for the prevention of the emergence of resistant P. falciparum. They highlighted that they have a very effective surveillance network that detects the emergence of resistance to malaria treatment at an early stage. In regard to the ‘Recommendation of Adjustments to Risk Appetite’, they are interested in learning the interventions implemented to reduce the increased risks of malaria. They highlighted that the risk of financial management and accountability is high due to system failures and recommended a way to address these risks by making funds directly available. They also requested more clarity on the proposed mitigation actions for reaching risk to moderate in 12-18 months.

Many African constituencies affirmed the condemnation of financial malfeasance reflected in the report and approved the decision point on risk. They mentioned that gaps in sustaining life-saving interventions, especially for malaria, are expected in 2026. The Global Fund is appreciated for providing health sector resources but they criticized the Secretariat for not engaging with national accountability institutions in most countries, contrary to the principles of aid effectiveness and country ownership. The consequences of ignoring national accountability systems are described in various Global Fund recovery reports and audits. They called on the Global Fund Secretariat to collaborate with national accountability institutions.

Others support proposed changes in risk appetite but expressed concern about the increased risk of achieving programmatic impact on prevention, poor data quality, and capacity of implementers. They suggested more efforts to strengthen consolidated data systems and promote a culture of data use for decision-making, better alignment on risk expectations for challenging environments, and a transparent process for localization by the Global Fund. They also expressed concern about the shifting of the increasing risk burden and cost to implementers, limiting the space for diverse actors to engage.

Some delegates also supported the approval of the decision to pursue the Global Fund’s strategic objectives, with a priority on sustaining the decreasing trend of TB risk. However, they expressed concern about the malaria risk and call for urgent action to address the shortcomings in malaria programs, procurement, and supply chain management, as well as underlying weaknesses in health systems. Stakeholders asked for a target risk timeframe for the malaria program quality to understand the impact of mitigating actions. They are also concerned about the steady direction of travel on the risk related to human rights and gender equality given the increasing criminalization and conflict in many countries, potentially impacting HIV program quality risk. They asked for further clarity on how the direction of travel of this risk is assessed.

Some stakeholders also supported the proposal to increase the Malaria Program Quality Risk Appetite to very high due to rising malaria risks driven by increasing insecticide and drug resistance; and commended the Global Funds’ systematic dual approach to addressing human rights and gender-related barriers.

Others approved the decision point on risk management and emphasized several risks that need to be addressed. These include the risks posed by climate change and the need to increase understanding of its impact on GF programs, the high SEAH risks that require continued implementation of mitigation actions, the risks posed by the deteriorating macroeconomic outlook and its potential impact on domestic financing for health, and the risks to human rights globally. Additionally, they questioned whether the current operating model is reaching its limits in terms of balancing programmatic risk-taking and fiduciary risk, given recent concerns about the effectiveness of local fund agents (LFAs). They suggested exploring other areas for risk mitigation.

Some stakeholders expressed concern about the quality of the country and Fund processes for prioritizing resources to address HTM, and the lack of clarity on co-financing policies. They are seeking a greater understanding of the prioritization process within grant proposals, with a focus on effective data-driven programmatic prioritization and budget optimization. They also want greater transparency on the co-financing process, including specific data on commitments and fulfillment by countries or waivers by the Secretariat. They would like to work together to assist countries in achieving maximum impact with available resources while mobilizing additional ones.

Some acknowledged the challenges faced by the Global Fund in implementing its new Strategy, especially in light of ongoing negotiations and the operationalization of the Pandemic Fund. The Impact KPIs (mortality and incidence rates reduction) are recognized as a steering tool towards achieving SDG3 by 2030 but the statement is clear that achievement of high targets is only possible with enormous efforts from the partnership. Engagement with the Pandemic Fund is encouraged, but risks related to high transaction costs are acknowledged. They emphasized the importance of regular dialogue between the Board and Secretariat to ensure clear definitions of what constitutes an RSSH intervention and improved tracking of progress.

Others felt the driving point was that business as usual will lead to lower-end KPI results, and resource constraints necessitate a prioritized approach to invest in smarter solutions. Taking risks to scale innovative solutions will be necessary to accelerate the end of these epidemics.

Decision

Board papers GF/B49/16, Risk Management Report and Chief Risk Officer’s Annual Opinion, and GF/B49/04, Recommendation on Adjustments to Risk Appetite, will shortly be available on the Global Fund website.