1
Financial Risk Tolerance and Country Based Pooled Funds
E. Rackley, OCHA consultant
Comments to Jock Paul: paul11@un.org
I.
Executive Summary
The practices and protocols of financial risk management and mitigation across UN
operations, and OCHA-managed Country Based Pooled Funds specifically, have evolved
significantly since the 2005 Humanitarian Reform effort for greater aid effectiveness
that led, in part, to this creation of this multi-donor funding instrument. Since then the
number of CBPFs has increased dramatically, and they now serve an unprecedented
number of humanitarian crises. With their consultative decision-making processes and
inclusion of implementing partners (national and international NGOs), donors, and UN
agencies, CBPFs are uniquely positioned to analyze risk and develop mitigation
strategies to ensure the effective delivery of life-saving assistance in extremely volatile,
constantly evolving emergency environments.
The purpose of this study is to foster dialogue among CBPF stakeholders around the
various aspects of financial risk (appetite, tolerance and thresholds) that arise the in the
CBPF context, including those stemming from third party implementing partners
operating in remote areas without direct oversight. Questions pursued by the research
include: To what degree does the existing CBPF architecture and its consultative
management approach allow for enhanced risk sharing among partners—or are
financial risks simply being transferred down the fiduciary chain of actors, with the
highest risks borne by implementing partners on the ground? How do different CBPF
partners perceive risk tolerance (appetite or aversion), and how do these perceptions
change depending on one’s position within the fiduciary chain? Is there a shared
willingness to consider an explicit risk tolerance policy—would partners agree to an
acceptable amount of loss, for instance?
Salient findings include:

Given the consultative decision-making processes of CBPFs (with multistakeholder Advisory Boards and Humanitarian Coordinators), the instrument
offers a strong, even unique degree of collective oversight, which translates into
a qualified form of risk sharing. Yet more effort can be made to identify evolving
risks, improve mitigation measures, and maximize the comparative advantage of
the CBPF consultative dynamic to enhance performance in the face of evolving
risks as emergency needs fluctuate in country. Overall, donors realize that given
the volatility of CBPF contexts, loss and leakage will occur, but are not interested
in an explicit policy that quantifies acceptable loss.
2

While donors appreciate the heightened risks of CBPFs in the world’s most
corrupt and volatile states, they are adamant about ‘zero tolerance’ for weak risk
management among fund managers and program implementers. In other words,
donors are tolerant of risk but intolerant of poor risk management. They expect
the same intolerance and vigilance of all partner institutions, particularly the
custodian of a given CBPF. OCHA’s challenge is to raise the quality of financial
risk management across all CBPFs to an equally high standard.

Discussions of risk tolerance (appetite or aversion) are therefore important only
if the risk management policies and practices in place are robust. Donors and
partners concur that a well-managed, responsive fund can increase risk appetite,
just as a poorly run or slow fund has the adverse effect. While useful to
distinguish risk management from risk tolerance for the purposes of improving
the structure and performance of CBPFs, the two concepts and behaviors are
inextricable and causally linked. Without tested and effective risk management
systems, discussion of risk tolerance is a pointless exercise.

Similarly, a well-designed risk management system does not guarantee its
effective application—both conceptual and operational dimensions must be
robust and visibly effective. The quality of the risk management framework in
place is also distinct from the operational strength of the fund itself, both of
which can influence risk tolerance.

And even where risk management systems are implemented effectively, loss can
still arise--‘residual risk’. CBPF Advisory Boards work to identify risks and
formulate mitigation strategies in a consultative, consensual manner, so that all
partners are apprised of the risks at hand before the funds flow. Standard
Operating Procedures are triggered whenever a case of residual risk arises. Many
partners therefore see ‘risk sharing’ as a distraction from the emphasis on
continued improvement of CBPF risk management systems, as well as the
collective risk assessment work of the Advisory Boards. If all these are solid, risksharing considerations are moot.

Strong local partners are essential to accessing remote populations, yet they are
widely viewed as the greatest financial risk within a CBPF. How to strengthen the
weakest link in a CBPF fiduciary chain? All parties stressed the importance of
capacity building for local partners to improve their internal systems and
reporting. “Not just local partners but equal partners should be a performance
outcome of these funds,” said one. Enabling local partners to be fully
accountable is linked to “our accountability to populations, not just to donors,”
said another.
Recommendations include:
3

For OCHA and donors: A risk tolerance policy is not only not feasible, but
innocuous. Continuing to empower donors and all CBPF stakeholders with the
tools and opportunities to identify and manage context-specific risks will
increase risk appetite in situations of extreme urgency. This should be happening
across all CBPFs when Humanitarian Coordinators issue an allocation strategy,
the result of Advisory Board consultations. All risks should have been discussed
ahead of any fund allocation, with clear knowledge of how risks will be managed.

For OCHA and donors: Should CBPFs contribute to the ‘localization of aid’ and
‘national resilience’ agendas by increasing support for risk management training
for local NGOs by third party service providers? Increased funding for risk
management capacity training for local NGOs will balance out the perception of
‘risk dumping’ and further the localization of aid agenda, the latter an
anticipated theme of the World Humanitarian Summit. OCHA’s stance is that
CBPFs should enable front line responders to deliver assistance (be it national or
international NGOs) and, to do that, there are systems in place to identify and
assess the capacity of viable partners.

For OCHA and donors: Consider early and midway real-time monitoring of CBPFs
to identify RM vulnerabilities and strengths. Proactive monitoring and analysis
that mimics the speed of operations (from proposal to allocation to delivery) as
opposed to end-of-program (forensic) evaluations can improve how risk is being
handled institutionally and collectively, and offer preventive corrections. Such
exercises will correct flaws early, spread best practices and incentivize vigilance,
transparency and communication around risk, fraud, diversion, etc.

For OCHA, donors and implementing partners: Consider funding for capacity
building in financial management for qualifying local partners, so they can meet
eligibility requirements to receive CBPF funds. This is not a short-term solution to
spreading risk, but it helps local partners become, eventually, equal partners.
Currently INGOs may choose to limit their risk by avoiding local NGOs who are
unable to meet their compliance requirements. The result is less delivery of
emergency services. “The UN needs INGOs to reach national NGOs, but their
[fiduciary] limitations make this impossible,” said one INGO representative.
II. Introduction
1. Funding through OCHA-managed CBPFs (i.e. Common Humanitarian Funds and
Emergency Response Funds) in 2014 accounted for 2.6% of the international
humanitarian response for a total of over US$453 million.1 CBPFs routinely operate in
high-risk environments with severe access restrictions due to insecurity. In this regard,
1
OCHA Funding Coordination Section
4
remote management modalities have been increasingly adapted to provide assistance in
areas deemed unsafe for UN staff while shifting responsibilities for programme delivery
to local third-party implementing partners (local and international NGOs, Red Cross and
civil society organizations). CBPFs are targeted towards providing effective, efficient and
supplemental support to the country’s Humanitarian Response Plan and often endeavor
to strike a balance between providing life-saving assistance and putting in place
effective oversight mechanisms on third-party implementing partners.
II. Purpose of Study
2. The study aims to foster dialogue among stakeholders around the various aspects of
financial risk (appetite, tolerance and thresholds) that arise the in the CBPF context,
including those arising from third-party implementing agencies operating in remote
areas without direct oversight. There is a need to create a common understanding of
risk tolerance across all CBPFs to then be shared with all stakeholders. Such a common
understanding would not change existing due diligence standards, but enrich partner
perceptions of sharing risk as distinct from risk transfer between donors, OCHA and
implementing partners.
3. The study also looks at the need for proper messaging aimed at increasing literacy in
risk tolerance, and wider communications around the subject. Study findings and
recommendations will feed into OCHA Funding Coordination Section (FCS) risk
management policy to enhance risk management within Country Based Pooled Funds.
4. Finally, the study aims to collect and represent the diverse views of CBPF stakeholders
on matters specific to risk sharing such as percentage of acceptable loss, fiduciary
capacity of local partners, and how risk tolerance relates to the original objectives of the
aid reform agenda of 2005. In advance of the upcoming World Humanitarian Summit
and its theme of ‘nationalizing response’ (national preparedness, resiliency), these
findings will help OCHA and partners develop a position on increasing national response
capacity, be it self-funded or through international partnerships. Investing in national
capacity is arguably in OCHA’s interest as well, with stronger risk management system
across all CBPFs the desired result.
III. Methods
5. The study findings presented here issue from a comparative desk analysis of existing
risk tolerance policies of relevant UN agencies, donors, Bretton Woods institutions,
NGOs and the private sector. This was followed by a series of in-depth interviews with
relevant donors, UN operational agencies (UNICEF, UNDP), senior OCHA staff in New
York, Geneva and in CBPF countries (South Sudan, Afghanistan, etc.), international NGO
partners, and some national partners. While these latter exist in several CBPF countries,
the study did not have time to consult all.
5
IV. Growth of CBPFs and Risk Management
6. As mentioned above, CBPFs have multiplied in line with the unprecedented number
of large-scale humanitarian crises today. Managing increasing levels of financial risk
associated with this growth and scape of operations has resulted in two major areas of
investment: protocols, procedures and safeguards to prevent financial loss and
diversion (‘ex ante’), and a similarly standard procedures that are engaged once losses
are suspected (‘ex post’), ideally resulting in their recovery. This study does not
investigate the integrity of these risk management systems, but the state of their
performance is a factor in determining the risk appetite of any CBPF.
7. In the field, CBPF management is supported by dedicated Humanitarian Financing
Units (HFU) through the OCHA Country Office. Within these HFUs, Afghanistan and
Somalia have also established Risk Management Units. These RMUs help stakeholders
map and track financial risks, fiduciary vulnerabilities and challenges, establish common
guidelines, and identify lapses in risk management procedures and protocols of
participating institutions. They bring an additional level of independent oversight to help
reduce the risks of such operations. In so doing, they arguably serve to increase risk
awareness among donors and implementing partners.
8. Within CBPFs, remote management of operations and local implementing partners is
an increasingly common, still evolving modality that carries great financial risk but
whose primary dividend is access to otherwise isolated populations in danger. The
fiduciary challenge of remote management is compounded in places like Syria, which
has no history of non-state, third party or community organizations providing
emergency relief under contract to the UN or to international NGOs. Other risk
management studies have highlighted these challenges,2 underscoring the reality that
fraud occurs in high-risk settings and that some loss is to be expected when working in
these environments. Donors actively participate in CBPF Advisory Boards so are wellapprised of all associated risks before funds are allocated to partners.
9. At the same time, risk management is increasingly viewed as a ‘tool for development’,
a bridge towards greater national resilience and stronger local partners, with potential
to increase local agency and autonomy in times of natural and man-made disasters.3 For
this reason, the study refers occasionally to ‘localization of aid’, ‘resilience’ and similar
agendas which may be outside the specific mandate of CBPFs and risk tolerance but
which many partners consider to be relevant, even connected.
V. Terms and challenges around risk literacy and CBPFs
Marc Jacquand and Shelley Ranii. UN Development System Risk Management in Fragile States, a White paper
for the 2014 Spring Meeting of the Utstein Group. 14 April 2014. Center on International Cooperation (CIC) New
York University (NYU)
3 World Development Report 2014
2
6
10. Risk tolerance, appetite and aversion are related areas of interest that comprise the
focus of this study. In their simplest form, risk attitude, appetite and tolerance are often
used interchangeably to describe an organization's attitude towards risk taking—risk
understood as the effect uncertainty on objectives. Risk averse, risk neutral and risk
seeking are variations of these terms also be used to describe one’s risk attitude. Risk
tolerance looks at acceptable/unacceptable deviations from what is expected. Risk
appetite looks at how much risk one is willing to accept, and the variations across that
appetite faced with specific threats or unknowns.
11. The consultative nature of CBPFs results in a qualified mode of risk sharing,
attractive to the stakeholders interviewed for this study because the process mitigates
the risk of bad programming decisions and large sums wasted on ineffective projects.
Group decision-making is no guarantee against failure, but the domestic political
pressures and accountability to which donors are subject prevent this risk pooling from
providing false comfort, as donors and implementing agencies strive individually to
assess the risks, potential for loss, and improve mitigation measures already in place.
12. In the humanitarian sector, where donors and the UN are under political pressure to
show presence and to deliver results, as in Syria today, a higher risk appetite may be
politically driven. This appetite may not be shared by CBPF implementing partners inside
Syria who may be more cautious given the poor fiduciary capacity of their local partners
operating remotely without oversight or strong management and reporting systems.
Who then is best suited to extrapolate from these different perspectives the ‘risk
tolerance level’ for that CBPF at a given time? All interviewed for this study see the
Humanitarian Coordinator as the logical candidate for this role, with OCHA support, as
custodian or steward of the CBPF.
13. As in the financial world, the desire for immediate impact (return on investment)
without a defined appetite for risk can lead to disaster. Previous episodes of risk
management failure (unaccountable losses) in Somalia and DRC were caused in part by
the fiduciary risks of local partners being poorly understood and inadequately
monitored. OCHA, or other contracting authority in its stead, can also make the mistake
of focusing on the appetite of one group of stakeholders (donors, for instance) without
giving sufficient weight to the concerns of partners on the ground. This parallel from the
private sector holds true: the CBPF managing agent should endeavor to define the
overall risk appetite in a way that reflects the different levels of tolerance expressed by
all stakeholders, and to identify the various risks involved at each level in the fiduciary
chain. These may include financial management and reporting, fiduciary capacity of
local partners, impact vs. delivery (process indicators versus measurable change), safety
and security of staff, etc.
VI. Major findings
7
14. Salient findings of the study can be grouped under the following subject headings:
CBPFs and risk sharing; linkages between risk appetite and risk management; pros and
cons of fixing a limit on acceptable losses; concerns around transparency and
communication of financial risk matters; and new initiatives and proposed changes to
the way CBPFs and management agencies handle risk. Within each topic are a short
number of related sub-topics. Findings and analysis are offered here with a minimum of
interpretation: the aim is to capture and reflect the views of CBPF partners in their
original candor and honesty.
(a) CBPFs enable limited risk sharing
15. Among the reasons donors value CBPFs as vital instruments in emergency settings,
shared analysis and collective decision making were cited as significant but not
essential. Most attractive were the improved coordination, efficiency (despite
“cascading administrative costs”) and timeliness of the instruments in disbursing
humanitarian funding in a comprehensive and strategic fashion for maximum quick
impact. Continued and increased support for current and new CBPFs in humanitarian
emergencies around the world shows that donors in particular understand and accept
the financial risks involved. Many donors stressed the fact that if they were truly risk
averse they would be elsewhere.
16. For small donors who are not always present inside an emergency context, CBPFs
are seen as an excellent means of reducing the risk of poor programming decisions.
Larger donors have first-hand information and a direct understanding of the division of
labor between UN agencies, international and local partners, all of which amounts to
improved oversight, and lowers the risk for smaller donors. All donors commended the
instrument for, in DFID’s words, “preventing the fragmentation of strategic oversight,” a
net gain that would be lost if emergency response reverted to a web of bilateral
arrangements.
17. Another attractive feature is that CBPFs contribute directly to a stronger country
coordination team, and this includes the collective decision making aspect of the
instrument. Donors claimed to be “well aware” of the financial risks involved, but that
their engagement is conditional upon the strength of the managing agent’s financial and
risk management systems. Their domestic reputations and institutional culture require
that they acknowledges a trade-off between risk and saving lives in countries that are
among the highest on the World Bank’s global corruption index and lowest on the
Human Development Index.
18. While risk appetite may be higher among donors and fund managers, it was found to
be lower at the field level where local delivery groups (CSOs, national NGOs, etc.) are
contracted by INGOs and UN agencies to deliver assistance to populations in need. Most
local partners do not qualify to receive funding directly from CBPFs due to lack of strong
financial management and reporting systems, and so require direct oversight by CBPF
8
implementing partners. A typical arrangement would be that the national NGO with
better access, knowledge of conflict dynamics and relationships with different armed
groups manages the physical delivery of aid supplies but all financial transactions
(procurement, salaries, hiring, etc.) are run by the CBPF partner, often an INGO. In the
fiduciary chain of any CBPF, then, the highest probability for fraud and waste is where
emergency assistance reaches its final destination—the populations in danger, or endusers of the fund. It is at this critical delivery point where accounting, reporting and risk
management systems are most vulnerable, because CBPF partners are accountable both
for their own actions and transactions as well as those of their sub-contracted local
partners.
19. This dual burden means that the management and reporting systems of CBPF
partners are stretched to the point of vulnerability—a 100% increase in workload,
because covering their own plus another organization’s financial management—and
oversight of weak local agencies on whom they depend for project delivery is a job in
itself. Here the risk is not leakage or fraud per se but of compromised reporting due to
overstretched systems, which can result in insufficiently justified expenses deemed
unallowable by the donor.
20. Risk transfer or risk sharing? Risks that are not shared are passed from donors to
CBPF implementing partners. When asked if they saw the CBPF as a means to share risks
or, conversely, to pass on accountability, donors stated that the mechanism is a means
of transferring or delegating financial risk to UN agencies and implementing partners
and then holding them accountable, an attractive arrangement on many levels. This
does not absolve donors of the need for vigilant risk management and rigorous
accountability to their own constituencies. Humanitarian emergencies are increasing in
number as many donor budgets decline, and a corresponding increase in parliamentary
scrutiny and pressure to show high impact is one offshoot of this trend. When cases of
loss arise and all due diligence and mitigation measures have been respected, donors
stated a willingness to share the loss—but only on a case-by-case basis.
21. Appetite for risk favors the established, well funded INGO and not the smaller,
possibly better connected or specialized group. Further, pending a formal contract
award, large INGOs may choose to advance their own resources to initiate life-saving
programming, then seek reimbursement post-award: such autonomy is itself a form of
risk-taking and risk-transfer that precludes smaller groups without corporate funds. The
implied risk transfer structure and stringent eligibility requirements of CBPFs therefore
appears to disfavor smaller INGOs and local NGOs from participating directly and
assuming or sharing risk themselves. Important to note here however is that CBPF
guidelines do allow coverage of a number of operating costs to encourage participation
by qualifying local partners. While CBPFs are directly accessible to national NGOs, they
typically receive the smallest portion of CBPF funding (i.e., 14% in 2014).
9
22. The result, as reported by study participants, is that risk is concentrated in the hands
of very few CBPF partners on the ground, who must oversee and assume responsibility
for small local actors. Here is where international CBPF partners feel the impact of risk
transfer (‘dumping’) most acutely: the 7% management or overhead fee taken on CBPF
contracts returns to headquarters and is not shared with the field offices that
implement the projects. Because running costs in country must then be assumed, CBPFs
are often only realistic for large INGOs and UN agencies. This results in the
concentration of risk and accountability among the few actors who can afford to be
there. While fewer actors is one way to mitigate risk, in this case it achieves the
opposite because these few risk-taking actors are entirely responsible and accountable
for the financial integrity of all their local partners, few of whom have viable risk
management systems or mitigation measures. Their oversight procedures are made
more vulnerable by the demands of remote management and the impossibility of
independent verification, exposing the CBPF partner to allegations of diversion to
criminal or armed groups, for example.
23. Divergence on risk sharing: While some INGOs felt that because they assume most
of the risk, that donors should share any legitimate losses—the so-called “humanitarian
exception”—although this view was a minority. Most INGOs see this demand as
unrealistic, given that their level of risk tolerance is informed by the risk management
requirements of the donor whose funds the INGOs are seeking. Like other CBPF
stakeholders, donors included, INGOs themselves have strict policies on fraud (zero
tolerance), proactive due diligence and strict practices to identify and mitigate fraud and
misuse. They recognize that this vigilance entails overhead costs and corporate
investment: the cost of doing business, essentially. Donors understandably assess the
policies and practices of CBPF partners as part of their decision to contribute; the abovecited expectation that donors should share unaccountable losses (humanitarian
exception) is therefore unrealistic.
24. ‘Risk dumping’ and managing the risks posed by local partners. INGOs and UN
agencies see themselves at the bottom of the risk transfer chain, responsible for their
own financial activities as well as those of local partners, while struggling to deliver
results in highly volatile situations without rule of law, effective law enforcement or
other reliable institution of recourse should gross malfeasance occur at the hands of
local partners. One consequence of these liability concerns can be risk aversion (e.g.,
avoiding local partners whose independence from Shabab or ISIS cannot be verified,
whose staff consist entirely of family members but that offer the only access to remote
areas, etc.), which can in turn limit the reach and volume of life-saving assistance for the
most needy. Many CBPF partners voiced the need to invest in stronger fiduciary capacity
for local agencies, allowing greater risk sharing with them, although this is clearly a longterm investment and beyond the current emergency response mandate and short-term
horizon of CBPFs.
10
25. While the global CBPF guidelines do not exclude capacity building as an eligible part
of a project, the projects that are submitted are judged according to the priorities in the
allocation document. The strategic direction of the allocation is developed by OCHA on
behalf of the HC, and is based upon the Humanitarian Response Plan, which would
usually not include national capacity building. In order for the CBPFs to support capacity
development, it needs to be included in the standard allocation.
26. Within a CBPF financial risk itself is not formally shared (as in a commercial
investment), but the analysis of threats and vulnerabilities in the operational landscape
is, and this common understanding or analysis informs the overall allocation strategy.
This collective dimension of the enterprise builds mutual confidence among parties to
the fund, and can result in an increased appetite for financial risk. As in the private
sector, group consensus on risk appetite does not guarantee that the fund will perform
as advertised.
(b) Causal Link between Risk Management and Risk Tolerance
27. Risk appetite (risk seeking or risk averse) is directly linked to the quality of risk
management policies and practices in place with every actor inside a given CBPF.
Donors and partners concur that a well-managed and responsive fund can increase risk
appetite, just as a poorly run or slow fund has the adverse effect. For this reason, in the
course of this study, risk management came up in every discussion of risk appetite,
hence the frequency of ‘risk management’ in this report. While useful to distinguish the
two for OCHA’s purposes of improving the structure and performance of CBPFs, the two
concepts and behaviors are inextricably, even causally, linked. Without tested and
effective risk management systems, the determination of risk appetite is a pointless
exercise.
28. UN agency representatives and CBPF stakeholders within the UN understand that
building trust takes time and that risk appetite is a management process, not an
agreement to be signed and implemented. Donors cannot be expected to discuss risk
sharing until risk management systems are updated and harmonized across agencies,
funds and countries of implementation (and newly revised CBPF guidelines introduce a
common risk management model for all CBPFs). There is a widely shared awareness that
UN agencies are still learning how to better manage financial risk and at the same
time—per donor pressure and the humanitarian imperative—take more risks, including
working with local partners in remote areas.
29. Donors were explicit that a well-designed risk management system does not
guarantee its effective application—both conceptual and operational dimensions must
be robust and visibly effective. Similarly, donors highlighted their distinction between
the quality of the risk management framework in place and the operational strength of
the fund itself. Financials systems may be well protected and monitored but if each
grant exceeds the agreed fund allocation speed (50 days) to reach a local partner, this
11
becomes another form of risk. Low confidence in the fund and in OCHA’s ability to
produce timely allocations could deter future contributions from donors.
30. And while donors may appreciate the heightened risks due to CBPF presence in the
world’s most corrupt and volatile states, they are adamant on their ‘zero tolerance’ for
weak risk management among fund managers and program implementers. In other
words, donors are tolerant of risk but intolerant of poor risk management. They expect
the same intolerance and vigilance of all partner institutions, particularly the custodian
of a given fund, be it OCHA or UNDP. Loss itself carries the risk that donor confidence
will be negatively affected, with the potential consequence of decreased funding levels.
At present, these expectations are not explicit in any common policy, operating
agreement or MOU between donors, managing agents and implementing agencies.
31. For this reason and others explained in this report, the prospect of sharing losses
traced to poor risk management systems is a non-starter. Formal acknowledgment of
the high risk of loss given the volatility of fund working environments is not a problem in
itself, but “what would it solve?” asked one donor. Advisory Boards enable donors to be
fully apprised of the risk management measures in place and the risks facing a fund.
Without perhaps a formal consensus, the consultative work of Advisory Boards serves to
ensure that these measures are adequate to the risks at hand.
32. And yet, all risk management systems being effectively implemented, there are still
things that can go wrong. Instances of residual risk need not result in accusations or
finger pointing, because all parties are apprised of the risks, mitigation measures in
place, and the Standard Operating Procedures that go into effect when a loss is
reported. OCHA reported that guidelines for final decisions on whether unaccountable
losses are allowable or not are still vague. Donors too preferred a case-by-case
approach.
33. Because trust and risk appetite are not automatic but built through proven risk
management policies and performance, questions of risk tolerance (appetite or
aversion) depend on the state of this foundation, and cannot be addressed abstractly.
CBPF partners were unanimous that risk appetite is directly proportionate to the
strength of risk management systems and the performance of all actors in the CBPF
system. Timeliness and proactive communication is also key, but strong local partners
are an equally essential ingredient to maximal returns on donor investments.
34. For this reason, all parties interviewed stressed the importance of capacity building
for local partners to improve their internal systems and reporting. “Not just local
partners but equal partners should be a performance outcome of these funds,” said
one. Empowering local partners to be fully accountable will strengthen the fiduciary
chain and is linked to “our accountability to populations, not just to donors,” another
party explained. Who should be tasked with this is another question, but local third
12
party services were a common preference over international management consulting
firms.
35. A contrarian view captured in this study is worth sharing: the perception that donors
will always resist a harmonized set of policy and practices on risk management
(allowable costs vs. fraud, eligibility requirements for local NGOs etc.), because concerns
about risk may buy them time or permit an exit from negotiations over CBPF support.
Some donors see risk as a bargaining chip with utilitarian value, and therefore reaching
a definite conclusion on questions of risk management standards, risk sharing
modalities, etc., is not in their interest. Political expediency can increase risk appetite for
donors much more than proven risk management systems in place. As mentioned
above, domestic political or media pressure to be visible in Syria or Yemen today, for
instance, can serve as a powerful incentive for higher risk appetites, despite the fact
that local partners may have to liaise with known militias or even terrorist groups to
reach affected populations.
(c) Quantifying Acceptable Loss
36. Overall, donors realize that loss and leakage will occur in the country contexts where
CBPFs operate, but they are not interested in an explicit policy that quantifies
acceptable loss, for reasons presented in this section. INGO perspectives on the subject
were diverse, from seeing no benefit to a fixed loss figure to the view that ‘sharing risks
means sharing losses’.
37. Study findings indicate that identifying a specific level of risk tolerance is
problematic for donors except in the case of concrete scenarios, and even here
reactions vary significantly. For example, subcontracting a local organization with little
fiduciary capacity may be an acceptable risk where needs are great, while implementing
the project directly and paying local militias for access to populations is unacceptable
(source: UN and NGO representatives). Both however are daily realities and must be
assumed.
38. This is connected to the fact that effective emergency programming, often inside
conflict, inevitably involves trade-offs, yet not everyone agrees on where acceptable
leakage becomes misuse. All agree however that information sharing based on strict
protocols, rapid reporting of suspicious actors or practices, and robust risk management
systems built on common understandings are the essential foundations for maintaining
operational confidence and a healthy appetite for risk among all stakeholders.
39. Arguments for and against quantifying acceptable loss. Leakage versus fraud or
diversion is seen as impossible to define categorically or in the abstract. Even consensus
on whether payments to militias for access to populations are allowable was deemed
“context dependent.” CBPF contexts vary too drastically, even within a single country, to
permit standardization. This does not preclude the possibility of consensus in the case of
13
an established access point requiring payment to, for instance, Al Shabab. Making the
case in advance and providing evidence that alternatives are lacking can suffice as
justification in such a case. Again, these are purely contextual and fluid within a
changing operational context such as Somalia.
40. After the Somalia fraud cases, donors were explicit that they expect to be informed
of these grey areas and questionable practices so that an understanding can be reached
and a crisis avoided. CBPF Advisory Boards can serve as a forum for proactive
communication around evolving risks analysis. When alerted to an alleged fraud or
misappropriation, donors expect partners to demonstrate exhaustive efforts to recover
unaccountable funds before considering a write-off. Besides the Advisory Board, no
formal instrument exists to inform and educate donors of all forms of risk (local partner
capacity, armed groups among beneficiaries, etc.) and how managing agents and CBPF
partners are mitigating these risks. For some, this is inadequate. UNDP specifically
identified this as a gap in the risk management landscape, without which agreements
around loss and risk at the country level will remain an ad hoc affair.
41. Political necessity dictates that donors declare a zero tolerance policy on fraud,
making the proposal of a quantified risk threshold or percentage of acceptable loss
moot. However, one of CBPF’s largest donors (SIDA) is distancing itself from zero
tolerance given the fact that CBPFs operate in the world’s most corrupt and dangerous
countries, where the high risk of loss is a reality. Still a specific loss threshold, even
where this might simplify budgetary planning in a volatile emergency context, remains
unattractive: “What happens when it’s exceeded?” said one donor. Donors insist
however that where risk management policies and their application—an important
distinction—are both manifestly solid, they will be more accommodating when issues of
loss come up.
42. Paradoxical pairing: risk appetite and ‘zero tolerance’. While no CBPF partner
agreed to specify a risk tolerance threshold, either quantitatively or as policy, the
existence and popularity of CBPFs today underscore a high appetite for financial risk
among CBPF stakeholders. Donors, fund management agencies and implementing
partners stressed their institution’s ‘zero tolerance’ for fraud, diversion, misuse or other
form of unaccountable loss. Anything less would cast doubt on their fiduciary credibility,
with immediate reputational and political consequences. Even raising the possibility of
sharing loss could be (mis)-perceived by some stakeholders as condoning lax vigilance.
Some donors expressed the concern that any explicit agreement to share loss could
inadvertently encourage diversion (up to the point of loss agreed).
43. Further, any formal agreement to share financial risk (i.e., share losses) could
potentially be used against them, donors said, by political enemies seeking to malign
their fiduciary capacity and custodianship of public funds. In this light, CBPFs do transfer
risk along a fiduciary chain but no one is thereby absolved of financial, reputational and
14
political risk. CBPF stakeholders are accountable not only to each other but to multiple
other interests and constituencies as well, few of which overlap.
44. Given the diversity of interests among stakeholders to a given CBPF, this study also
found that it may be unrealistic to expect perfect consensus around risk despite
continued dialog and ever-improving risk management systems. Partner institutions will
always have their own internal regulations, standards of accountability and
constituencies to appease. Identifying the “realm of the possible” in each operational
context is the most realistic approach given the diversity of institutions, interests and
operational modalities, not to mention the vastly different conditions under which
CBPFs function.
(d) Transparency and Messaging
45. Honesty about risk and necessary trade-offs. Managing expectations is part of
today’s transparency and communications ethos, and has a role in debates around risk
tolerance and appetite. Donors appreciate the risks involved and the higher returns that
CBPFs yield. But to stipulate in writing that by working in high-risk environments where
financial management systems are vulnerable and that a specific budget percentage will
therefore go missing—this is not a viable position for any CBPF stakeholder. Such
reasoning assumes a dubious transactional logic (“we take security risks for you, so help
cover our losses”) that is more likely to breed resentment than trust. The desired
response to any suspect situation is proactive communications so that high-level, donorinstigated investigations are avoided. This will build trust and can prevent reputational
damage.
46. OCHA to propose new ways of communicating financial risk and risk tolerance to
donors and partners. Various donors and partners suggested that OCHA propose an
estimation of risks associated with a given CBPF and seek harmonization in advance of
alleged fraud or unaccountable loss and then seeking a write-off from donors. This is an
option, but risk analysis is a core activity CBPF advisory boards, who are asked to
develop risks analysis and risk management papers, update them regularly and use
them to make decisions when formulating, for instance, an allocation paper. Risk
mapping is thus already part of CBPF guidelines; the challenge is implement it with
quality. It is true that “holistic approaches can be counter-productive,” and that only by
breaking financial risks down into their most likely forms will practical solutions emerge,
ones that should not require additional administrative/bureaucratic protocols and
MOUs. Risk Management Units in Somalia and Afghanistan presumably play this role to
a degree, but are not fund custodians like OCHA, and are not accountable to donors in
the same manner.
47. Transparency, shared understanding, and ‘risk literacy’. CBPF managers, country
advisory teams and humanitarian coordinators are encouraged to continue seeking
ways to incentivize collective risk management locally by identifying common interests,
15
known threats and vulnerabilities and hammering out protocols that reward or enable
regular and responsive information sharing as problems arise.
48. Many stakeholders were optimistic about recent years of progress in CBPF
management and efficiency but felt room for improvement remained: institutional selfpreservation still trumps public commitments to transparency, communication and
collective accountability. As a result, appetite for risk can only mirror the strength of risk
management systems in place, the quality of real-time information sharing and the
proven ability to handle crises as they emerge.
49. Allowable costs. Inconsistent or absent guidelines that distinguish allowable from
disallowable costs is frustrating for partner agencies, and can increase risk aversion. This
is an unintended and undesirable consequence of the risk transfer structure of CBPFs.
Although covered in detail in Chapter 5 of the CBPF guidelines, many partners reported
very different experiences when trying to justify and recover costs from donors that fall
in a grey area. Is the $200 paid at a checkpoint disallowed as diversion or considered an
acceptable cost of doing business? As described above, a general standard is unrealistic
but within a country context certain cases may be justified as allowable, many donors
stated. They acknowledged the non-specificity of their policies, which are global and not
country-specific, hence their preference for case-by-case assessments of allowable vs.
unallowable cost. Prior mapping or inventory of potentially ineligible costs during the
early allocation strategy phase could help manage expectations in this area.
(e) Initiatives and changes
50. The prospect of common standards. All parties interviewed, particularly INGOs and
donors, were emphatic that UN agencies need to harmonize their due diligence
processes, risk management policies and practices, and compliance requirements—a
“one stop shop” model that puts into practice the “One UN” slogan. This includes the
need for a common understanding of risk tolerance across all CBPFs to be developed
and shared with all stakeholders. The resulting common minimum due diligence
standards and eligibility requirements could then be adopted and reflected among CBPF
implementing partners on the ground, minimize and streamline administrative burdens
and thereby liberate human and material resources for emergency service delivery,
their proper objective. This finding is echoed throughout all best practice guidelines for
humanitarian donors and is highlighted in the Good Humanitarian Donorship Principles.
51. Evidence of positive change includes OCHA’s donor portal, which serves as a
repository for confidential communications on ongoing investigations in Somalia. Such
transparency increases confidence that solid risk management systems are in place and
thus prevent risk adversity from taking root.
52. Trade offs between needs and risk. In every emergency operation, the
‘humanitarian imperative’ will clash with risk management on the ground, particularly in
16
cases of remote management. OCHA can play a role in helping donors understand and
trust that all possible due diligence was applied, given security constraints, before vital
aid delivery got underway. Saving lives should take precedence when the demands of
risk management obstruct or delay operations, and OCHA should be ready to defend IPs
with solid financial management systems. Similarly, OCHA should show equal vigilance
toward reducing its own onerous eligibility processes and promoting ease-of-use
protocols, such as the one-time due diligence capacity assessment.
53. Invest in capacity building to reduce risks and increase local resiliency. In countries
like Afghanistan, national NGOs have been receiving management training in multiple
forms from many international partners for decades, and many NNGOs are now equal
partners receiving direct funding from donors and UN agencies. In other FCAS countries
with long-term emergency assistance programs, such as DR Congo, this development is
less common. Finally, national NGOs in Afghanistan and South Sudan were emphatic
that the rigor and practicality of the OCHA/UNDP capacity assessment process was an
important learning experience for them because it exposed them to international
standards—not just in word but in practice—that they would not otherwise be held to
locally. This also serves as an example of well-targeted capacity building around specific,
mutually agreed objectives to which recipient agencies can be held accountable.
54. Donors recognize that the weakest link in the fiduciary chain lies with national
delivery partners. For this reason, they appreciate and encourage capacity building for
local NGOs, entities that many donors are unable to work with given their weak systems
and inability to meet compliance requirements. CBPFs are attractive because of this
localization of responsibility and delivery by NNGOs, with the oversight and risk
management assumed by OCHA and INGOs to whom local groups report.
55. Other INGOs see their relations with local partners as a series of trade-offs, and after
exhaustive capacity assessments will collaborate on, for example, food delivery or
health care, but retain control over all procurement or finances relating to the local
partner. They will strengthen weak financial systems with training, sometimes over
many years, and gradually allow the partner greater accountability and autonomy. One
INGO reported seeing several of its long-term partners now able to contract directly
with WFP, for example. CBPFs should support these approaches where possible, and
allow budget lines in proposals to reinforce financial management systems.
56. The fact that most national NGOs and potential partners lack compliant financial
systems and risk management tools is arguably one of the CBPF’s greatest obstacles to
deeper access, wider coverage and higher volumes of aid delivered. Groups like the
Humanitarian Leadership Academy and other initiatives work to identify and map the
range of barriers for national NGOs and CSOs to being eligible to receiving direct
assistance from INGOs, CBPFs and donors. Increasing the number of eligible local
partners could exponentially increase the modalities and quantities of assistance
delivered. Remote management is a related barrier to which there is no easy solution.
17
There is no current consensus on best practice for INGOs to manage risk remotely and
prevent aid diversion to blacklisted individuals or terrorist activities; it is a work in
progress.
57. OCHA and CBPF donors may wish to consider outsourcing the creation of an incountry platform to publicize funding opportunities and national NGO eligibility
requirements, coupled with a project to identify common management weaknesses and
offer training targeting these capacity gaps. Training in standardized risk management
policies and practices could be offered. National NGOs may then more quickly be able to
meet eligibility requirements of CBPF partners.
58. Ultimately, the ‘humanitarian imperative’ to save lives should not preclude capacity
building and investments in local partners. Indeed, the concept should include capacity
building and openly acknowledge a kinship with the ‘nationalization’ and resilience
agendas. Without this expanded capacity, dependency on outsiders will remain the
norm. Nor can risk be shared equally between CBPF partners; it will be ‘dumped’ on
implementing partners to assume all risks of local agencies, if they choose to have any
at all. Refusing local partners because of the high risks involved would be a perverse
inversion of this expanded sense of humanitarian imperative, one that includes local
capacity building for increased national resiliency.
59. National NGOs who are eligible for direct grants from CBPFs stated that most local
partners are very far from having internal management systems that would meet donor
requirements and make them equal partners. While many can transfer and track their
finances, few have financial risk management tools in place. Besides trainings, a
guideline for national NGOs would be useful, they said.
60. Competitive market for risk? If individual UN agencies identified their risk
thresholds—emergency responders with higher risk of loss and long-term development
agencies with less—donors could make funding decisions based on return on
investment and degree of financial risk. This would mimic the private sector by forcing
UN agencies to provide options for funding in a market environment that might appeal
to donors. The potential impact on national NGOs and ability to reach people in need is
unclear.
IV. Conclusions and Recommendations
61. Quantifying appetite for risk and allowable loss is not advised or recommended,
per the majority of stakeholders interviewed for this study. Continuing to invest in
strong risk management systems and harmonizing reporting standards, protocols and
procedures across fund partners is seen as vital. This will increase mutual trust and
increase risk appetite correspondingly. The pressures of institutional self-preservation
will remain, but as long as operational guidelines around proactive communication and
18
transparency regarding alleged fraud or ambiguous costs (e.g. paying militias for access)
are shared and respected, CBPF partners will have less to hide.
62. Consider marrying the localization of aid and risk sharing agendas by increasing
support for risk management capacity training for local NGOs. A commonly cited
positive dividend of CBPFs for national partners is the experience and capacity building
from INGOs enables them to seek funding independently—a benefit indeed, but
infrequent for various reasons. Increased funding for risk management capacity training
for local NGOs will balance out the ‘risk dumping’ problem, and further the localization
of aid agenda. INGOs interviewed for this study complained that capacity building costs
for local NGOs are absorbed as overhead and not accommodated by CBPF grants.
Allowing such costs as detailed in CBPF partner proposals to train and monitor local
agencies’ financial and reporting systems is also a step towards ‘nationalization’ and
resilience, anticipated themes of the World Humanitarian Summit and of great interest
to CBPF donors. In parallel, CBPF partners should seek to increase funding for risk and
financial management for local NGOs. This too is an investment in local sustainability
and national resilience.
63. Consider early and midway real-time monitoring of CBPFs to identify RM
vulnerabilities and strengths. Proactive monitoring and analysis that mimics the speed
of operations (from proposal to allocation to delivery) as opposed to end-of-program
(forensic) evaluations can improve how risk is being handled institutionally and
collectively, and offer preventive corrections. Such exercises will correct flaws early,
spread best practices and incentivize vigilance, transparency and communication around
risk, fraud, diversion, etc. Stakeholders making this recommendation framed it as
“making CBPFs accountable to populations,” instead of exclusively to donors, which is
currently the case.
64. To strengthen risk appetite and stakeholder confidence in RM systems, forego
agreements on sharing risk/loss and develop an impact assessment tool for RM
systems. Important for many reasons beyond the scope of this study, but if OCHA and
its partners can demonstrate annually, for instance, the number and type of fraud
allegations investigated and successfully handled, then discussions around sharing
losses—case by case—are likely to be more fruitful. Donors were unanimous on this
point: higher risk appetite and loss sharing is a privilege to be earned by implementers;
it will never take the form of an MOU, legal obligation or public commitment.
Developing a dedicated tool to track allegations and demonstrate the effectiveness of
OCHA risk management will increase donor confidence and appetite for risk.
65. Include funding for capacity building in financial management for qualifying local
partners, so they can meet eligibility requirements to receive funds from INGOs or
OCHA. This is not a short-term solution to spreading risk, but it furthers the localization
of aid agenda by helping local partners become, eventually, equal partners. Currently
INGOs limit their risk by avoiding local NGOs who are unable to meet their compliance
19
requirements. The result is less delivery of emergency services. “The UN needs INGOs to
reach national NGOs, but their [fiduciary] limitations make this impossible,” said one
INGO representative.
66. Messaging around risk literacy. CBPF stakeholders have much to be proud of today:
apart from high transaction costs (a pervasive frustration), all parties agreed that the
funds were a vital addition to the emergency response toolbox. Communication around
the realities of life saving in conflict and the financial risks involved should stress the
mutual accountability of all CBPF partners, the high standards of their respective risk
management systems, and their collective achievements all in the face of great odds.
The whole is presumably greater than the sum of its parts, and OCHA should be able to
demonstrate why CBPFs allow partners to achieve much more together than alone.
67. OCHA to accompany M&E and risk management activities of CBPF partners. Risk
thresholds and donor confidence would arguably be higher if M&E and risk
management oversight involve OCHA as a “second pair of eyes” to verify sound
movement of monies, reporting and verification of delivery on the ground. OCHA would
not substitute for partners’ own M&E and risk management policies and practices, but
merely add value as an independent corroborator—ideally in real time instead of asking
questions after quarterly reporting is received. Donor agreement would be needed, as
additional resources would be required. Where OCHA does not have access, vetting and
training local organizations (NGO, state agency, neutral CSO) to conduct this kind of
independent verification is a feasible option.