The Grant Risk Assessment and Management (GRAM ) Tool

Transcription

1 The Grant Risk Assessment and Management (GRAM ) Tool Guidance note for in-country implementers August 2015

2 List of Abbreviations CCM CT GRAM GF LFA M&E NFM NGO PR QUART SR SSR Country Coordinating Mechanism Country Team Grant Risk Assessment Management The Global Fund Local Funding Agent Monitoring and Evaluation New Funding Model Non-Governmental Organization Principle Recipient Qualitative Risk Assessment Tool Sub-Recipient Sub-Sub Recipient

3 The purpose of this document is to: Introduce Global Fund Principal Recipients/Implementers to the Grant Risk Assessment Management tool known as GRAM. Provide guidance on the GRAM tool and to assist in strengthening implementer s risk management capacities. 1. Introduction The Global Fund s mission is to fight AIDS, Tuberculosis, and Malaria in those countries where there is the greatest need. The Global Fund s operations involve multiple partnerships, challenging humanitarian and development contexts and extensive geographic scope. Risk is an everyday part of programs that are supported by the Global Fund. Managing those risks improves the probability of the grants achieving its objectives. 1 Managing risks is one of the key priorities of The Global Fund and its partners. A consistent roll out of risk assessments and discussions on risk will help to manage grants more effectively. In-country implementers may have a number of tools at their disposal to assess and monitor risks. If implementers have their own tools for highlighting risks and risk ratings and these are working effectively, they are encouraged to continue using existing risk assessment tools. The Global Fund has developed one such qualitative risk assessment tool for its in-country implementers. The following document explains the rationale and processes for developing in-country risk management plans using the Global Fund s qualitative risk assessment tool known as GRAM. 2. GRAM: The PR (implementer) risk management tool: GRAM (Grant Risk Assessment and Management) is a tool designed specifically for incountry implementers to assess the risks they face in their programs funded by the Global Fund. The GRAM examines 4 broad categories of risk and provides a concise risk overview based on the determination of the likelihood and severity of each risk. GRAM generates a risk heat map, providing an overview of all rated risk levels, and an action tracker, allowing risk mitigation actions to be prioritized and tracked. This qualitative tool can be an effective way of capturing risks, proposing prevention and mitigation actions, and implementing action planning for implementers conducted by implementers. This risk assessment tool can also bridge informational gaps between the Global Fund and in-country actors. At the Global Fund Secretariat level, Country Teams (CTs) are expected to complete a Qualitative Risk Assessment Tool known as QUART. QUART identifies, prioritises, and integrates risk in the management of a grant using the CTs knowledge as well as gathered perspectives from the Country Coordinating Mechanism (CCM), PRs, and SRs. 1 According to the Global Fund s definition, a risk is the effect of uncertainty on the achievement of the organization or program objectives. 6 P a g e

4 2.1 Key objectives of GRAM include: Increased consistency and proactiveness in risk management activities including: risk identification and assessment, risk prevention & mitigation, reporting and monitoring, risk response and corrective action. Increased capacity for effective grant management Greater openness, transparency and accountability in decision-making between all actors in the grant management process. Actions by Secretari at & LFA Actions by Partners Actions by CCM and PRs Graph 1.1: Level of influence on actions for achieving objectives of a grant Stronger communication channels between CTs, LFAs, partners, and incountry PRs in dealing with and prioritising risks. This will significantly impact and improve programming. More effective strategic planning as a result of increased knowledge and understanding of these risks Better prioritization and focus on the most material risks 3. GRAM and its Structure: The GRAM provides a comprehensive, structured framework to identify and assess operational risks faced in grant management and program implementation. The tool s structure details several main elements: Risk Types and Risks Likelihood and Severity Ratings Time Horizon Risk Levels While the GRAM tool provides a structured analysis it also allows for the necessary flexibility to account for any risks specific to an implementer or country context. Considering risk management is a dynamic process, implementers can update the assessment during various milestones of the grant (i.e. signing, disbursements and renewals). Ultimately, the aim of GRAM is to allow operational risks to be more systematically and holistically assessed, and better linked to risk prevention and mitigation measures and decision-making more generally. This should allow better prioritization and differentiation of risk management activities and strengthen implementer s risk management capacities. 3.1 Implementing GRAM into the Grant Cycle: In order to understand the implications of the GRAM, it is important to understand how this risk assessment can be carried out during the Global Fund grant cycle. The GRAM can be completed as part of the grant making (country dialogue) for new grants or during 6 P a g e

5 implementation (for ongoing grants). Deciding on a timeline regarding the implementation of the GRAM should be determined jointly between implementers, CCM, and CTs. New grants (NFM) Ongoing grants The CCM and implementers are expected to identify key risks and mitigations to be included as a part of the concept note. Conducting a risk assessment using GRAM or a similar tool is recommended. This is an opportunity for the CCM and implementers to reflect on the key risks identified in the concept note against the portfolio analysis and risks identified by the Country Teams. The information in a risk assessment tool should be updated as a part of the discussions during grant making. It is important to review the residual risks in the grants as a part of the grant signature. GRAM or other similar tools can also be introduced anytime during the implementation. 3.2 Context Information and Analysis: Before analysing risk types and risk, users of the GRAM tool will provide a country overview and contextual information relating to the grant. This contextual information and analysis is featured on the second sheet of the tool, after the instructions page. The objective of the contextual information and analysis section is to provide a sound background to the specific risk analyses. This is similar to the Implementation Map Analysis that the implementers would have submitted as a part of the concept note. The big picture: Before the assessment, the team is expected to summarize various contextual elements briefly. This should help in focusing the discussions and should link subsequently to the detailed assessments. Risk Analysis of the Activities and Stakeholders - these two analyses are very qualitative and expected to contribute to providing a comprehensive context and facilitate triangulation, when individual risks are discussed later in the tool. 3.3 Risk Types and Risks: The GRAM tool features 23 standard risks associated with GF grants. These standard risks grouped into four main Risk Type categories, derived from the Global Fund's mission and objectives in grant-making. In this framework a risk is defined as a future adverse outcome which the Global Fund seeks to avoid in a given Grant. GRAM is not expected to comprehensively cover all the risk in all grants, but provides a list of maximum plausible risks, which needs to be addressed. The implementer and CCM can add any new risks which they find applicable to the particular context of grant implementation Additionally, the GRAM allows implementers to include 2 additional, customized risks per risk category or to rename some of the 23 standard risks should they wish. Customizing additional risks can be useful in explaining grant, country, or implementer-specific risks but should generally be avoided for 2 reasons: Adding further risks can amount to up to 31 risks. Increasing the number of risks displayed may make it difficult to focus and prioritize. Renaming the 23 standard risks to accommodate grant, country, or PR specific risks can result in a dilution of the strategic level risks in the GRAM. This dilution could 3 P a g e

6 lead to the risk heat map becoming dominated by low level risks, diminishing the importance of high level, strategic risks. The 4 Risk Types and 23 Standard Risks are detailed below: Risk Type Description 1. Programmatic & Performance Risks Risks related to programs having limited relevance, not achieving shorter-term performance or longer-term impact, being unsustainable, or being assessed with inadequate M&E or data quality 2. Financial & Fiduciary Risks Risks related to Global Fund investments and other resources not being used for the intended purposes, according to policies, or efficiently, or not being properly recorded and accounted for 3. Health Services & Health Products Risks related to timeliness, safety, quality, and Quality Risks accessibility of health services, including pharmaceuticals and health products and equipment, negatively impacting beneficiaries and key populations 4. Governance, Oversight & Management Risks Risks related to poor governance, inadequate oversight and monitoring, or poor program and grant management in terms of quality, timeliness, efficiency and compliance Risk Type 1. Programmatic & Performance Risks 2. Financial & Fiduciary Risks 3.Health Services & Health Products Quality Risks 4. Governance, Oversight & Management Risks Risks 1.1 Limited Program Relevance 1.2 Inadequate M&E & Poor Data Quality 1.3 Not Achieving Grant Output Target 1.4 Not Achieving Grant Outcome & Impact Targets 1.5 Poor Sustainability 1.6 Other (please specify) 2.1 Low Absorptive Capacity or Over-commitment 2.2 Poor Financial Efficiency 2.3 Fraud, Corruption, or Theft of Global Fund Funds 2.4 Theft or Diversion of Non-financial Assets 2.5 Financial Non-compliance 2.6 Market and Macro-economic Losses 2.7 Poor Financial Reporting 2.8 Other (please specify) 3.1. Treatment Disruptions 3.2 Substandard Quality of Health Products 3.3 Poor Quality of Health Services & Use of Health Products 3.4 Human Rights barriers in accessing Health Services 3.5 Other (please specify) 4.1 Inadequate Security and Stability at the national/subnational level 4.2 Limited PR Governance & Oversight 4.3 Limited PR Reporting & Compliance 4.4 Limited Secretariat oversight and LFA verification 4.5 Inadequate SR Governance & Oversight 4.6 Inadequate SR Reporting & Compliance 4.7 Ineffective CCM Oversight 4 P a g e

7 3.4 Contributing Factors: In addition to the risk types and the standard risks, the contributing factors describe the key drivers of each of the 23 standard risks. The success of the GRAM depends on the ability of the implementer to take into consideration the key contributing factors for each risk mentioned in the tool and to complete the risk assessment with candour and honesty. Keep in mind, this list is not comprehensive but rather a set of indicative factors used to help guide implementers which can be found in Annex 2 of this document. Implementers are advised to think through the contributing factors thoroughly by using the indicated list as a checklist when completing the GRAM. 3.5 Risk Heat Map: The tool has been developed using MS excel which consolidates inputs and presents these in several formats to allow validation and prioritization. It then summarizes the results of the assessment in the form of a heat map as well as a tracking sheet for any actions proposed from the assessment. The various output sheets from the MS Excel Tool should be seen as dynamic products. As such, they will be regularly updated to support discussions between implementers, CCM, and CTs on risk and grant management on an ongoing basis. The table below is an example of a generated risk heat map created once all inputs are tracked in the GRAM: 3.6 Likelihood, Severity and Time Horizon In order to generate the risk heat map above, GRAM users must assess the 23 standard risks in terms of their Likelihood and Severity. Likelihood refers to the chance that the future negative outcome occurs, while Severity refers to the estimated impact of the negative outcome assuming it does occur. The purpose of introducing these two dimensions in assessing risks is to: 5 P a g e

8 improve consistency and granularity of risk assessment take into account materiality of risks for more effective prioritization encourage and facilitate robust discussion The Time Horizon over which Likelihood and Severity should be assessed for each risk is the following one year (twelve months) from the date of the assessment. In other words, the user should be assessing how likely the risk may occur in the coming 12 months, and estimating how severe it would be if it the relevant risks were to occur. Likelihood Ratings What is the chance of the risk occurring within the time horizon, based on the contributing factors? Highly Unlikely Unlikely Likely Highly likely less than 10% chance of happening between 10-40% chance of happening between 40-70% chance of happening +70% chance of happening Severity Ratings Assuming the risk occurs, how severe is its impact expected to be, based on the contributing factors? In rating the severity of the risks, consider the impact on the following 4 areas: Wastage of grant funds Poor program performance, data quality, impact or sustainability Negative health outcomes from program activities Reputational issues and threats to future funding Minor Moderate Major Critical No or only minor impact expected in all areas At most moderate impact expected in all areas At most major impact expected all areas Critical impact expected in at least one area Both the likelihood and the severity should be assessed based on consideration of the contributing factors which have been identified as the main drivers or indicators for each of the 23 standard risks. The user is also expected to provide a written description to justify the likelihood rating, severity ratings and the key contributing factors they have selected. If the lowest possible likelihood and/or severity ratings are chosen, no contributing factors need to be listed (to justify the low ratings). Keep in mind that the tool has a very generic view of likelihood and severity definition. A written description explaining each determined rating will add more value and detail to the assessment. 6 P a g e

9 The following color-coded heat chart signifies the determined risk rating based on the combination of the likelihood rating and the severity rating. Likelihood and severity combine to signify the level of risk for each standard risk which is then added the overall heat map. Severity Minor Moderate Major Critical Highly Unlikely Low Low Medium Medium Likelihood Unlikely Severity Major Unlikely Low Medium High High Likely Medium High High Very High Risk Level Medium Highly Likely Medium High Very High Very High Example of a combined likelihood & security rating which determines a risk level Likelihood 4. GRAM Rollout Process For effective use of the GRAM, the following broad steps are recommended. Please note that these steps are general guidelines and at the discretion of implementers. Implementers can adapt this process depending on their preparedness and capacity to effectively integrate risk management into their respective programs. In order to understand the tool fully and come to an agreement on a realistic baseline, implementers will receive training support by CTs or an experienced facilitator who can answer any questions and concerns. 4.1 Appreciating the objective of risk assessment: There is usually a sense of apprehension when it comes to detailing risks affecting the roll out and success of a grant, such as risk ratings related to CCM and GF Secretariat effectiveness, for example. Some implementers may feel as though providing such information can negatively impact the CT s perception of their work. On the contrary however, for the Global Fund, knowing and agreeing on the key risks is a constructive and collective effort that should involve many stakeholders (e.g.: partners/ccm/ others) who support in finding solutions and mitigating risks. Therefore, providing as much honest information as possible will strengthen risk mitigation measures for all actors involved in the grant management and risk management process. 4.2 PR preparedness to undertake a risk assessment. The use of the GRAM itself will be a self-assessment. However, some prior review of contributing factors or risk will prepare implementers for the GRAM workshop. 7 P a g e

10 4.3 Risk Self-Assessment In preparation for the workshop, implementers are encouraged to conduct their own risk self-assessments. The objective of the selfassessment is to have better alignment within an implementer on the key risks and should facilitate better focus during the GRAM workshop discussions. A risk selfassessment template is attached in Annex Workshop: The GF CTs or an experienced consultant will facilitate an incountry workshop on how to use the GRAM tool. This brief, two-day workshop will allow in-country implementers, PRs and CCM to familiarise themselves with the tool and a chance for initial stakeholder dialogue on how to appropriately administer risk assessments. During a scheduled in-country workshop, implementers will be introduced to the GRAM tool. There are four main steps to completing the GRAM which will be described and enacted during the proposed workshop. 1. Fill in the specific contextual information in the General Info sheet Assess risks and propose actions in the four risk and action input sheets - (i) Programmatic & Performance, (ii) Fiduciary & Financial, (iii) Health Services & Products, (iv) Governance, Oversight & Management 2. Rate Likelihood and Severity for each risk 3. Explain the Likelihood and Severity ratings and the most significant causes for each risk 4. Where appropriate, propose actions to prevent and/or mitigate risks Use the Risk Heat Map to validate the risk assessment across the different areas and to prioritize risks to address through action planning. Use the Action Tracker sheet to decide which actions to pursue to address key risks, and input the relevant tracking information next to these: existing actions, cost, source of resources, responsible person After becoming familiar with the GRAM tool, participants of the workshop will complete the tool and share their completed GRAM including the risk heat map and proposed action plan to the group for further understanding and discussion. It is possible that the workshop will identify risks and possible mitigating strategies which require further information or consultation before the strategy can be confirmed. For instance, a proposed strategy may require consultation with external agencies or ministries to develop a coordinated approach to reducing a specific risk. Therefore, some follow-up may be required prior to the GRAM tool being finalized. Additionally, it may be critical that senior management collate and review the recommended actions for consistency, calibration and to identify linkages with other activity underway in the country. This may lead to 8 P a g e KEEP IN MIND: The workshop is generally a one-time activity to introduce the tool and train implementers on its use. A key objective of the workshop is to plan to update the tool regularly and use the information from it for decision making purposes.

11 identification of priority actions. Accordingly, at the end of the workshop, it may be appropriate to schedule a follow-up meeting, possibly in one or two week s time, when the final GRAM action plan is confirmed. During the workshop, implementers will be provided contact information and follow-up guidance so as to ensure that the GRAM tool can be an effective and sustainable tool for GF implementers. NOTE: Careful consideration needs to be given to how many grants should be covered in a single workshop. This will vary considerably dependent upon the grant and country context. While grants may have common risks, obviously programmatic risks may vary considerably and including all grants in a single workshop may result in nuances between grants being lost. On the other hand, there can be valuable insights gained by sharing ideas between grants 4.5 Follow up: During the workshop, stakeholders will discuss and come to an agreement concerning a number of points. After the workshop, implementers should be in agreement and aware of: 1. Time frames for completing the assessment of the full portfolio 2. Ways of ensuring quality check and validation 3. Identification of point persons in each implementer who can support on-going implementation of this. 4. Overall frequency of updates of GRAM (recommended every 6 months along with the disbursement request) 5. Next grant milestone which will provide an update on the implementation of the risk mitigation and prevention actions. Refer to the chart below that describes the risk assessment follow up process: REMEMBER: Joint prioritization of a shortlist of actions and follow up points is a key for effective risk management In country workshop / discussions Done by implementer Grant Risk Self- Assessment Sharing GF perspectives Sharing of Grant risk self- assessment outcome Partners experience Introduction to tools Group work - use of tools (facilitated by the Country Team) Sharing of Group work outcome Alignment of Risk Prevention mitigation mechanisms between CT, LFA and implementer Instituting a mechanism to support the implementers in follow ups and integration of risk assessment in grant management Implementer owned follow up mechanism 9 P a g e

12 REMEMBER: The GRAM is a simple tool for implementers who wish to introduce a mechanism for prioritizing action for risk management and for detailing risk mitigation measures for their grants. All implementers are expected to have comprehensive risk management plans as part of effective grant governance. 5. Annexures Annex 1: Self-Assessment Template Annex 2: Risk and indicative list of major contributing factors Annex 1: Self-assessment Template Grant Risk self-assessment (This template captures discussions within the implementer on various risks as perceived by them at a grant level). Name of the PR Grant No:. Definition: Operational risk is the possibility of reduced program impact, not achieving targets, and/or wastage or misuse of resources due to specific processes or actors in our Performance- Based Funding model not operating as intended. In this framework a risk is a future adverse outcome which the PR is seeking to avoid in a given Grant Programmatic & Performance Risks This is a broad area encompassing programmatic, monitoring and evaluation and performance related risks. Typically, this includes risks related to grants and the broader programs having limited relevance in relation to epidemiological and programmatic context, not being aligned to the national context, systems and other donors, and other aspects which may impede relevance or sustainability. In addition, issues related to inadequate monitoring and valuation and data quality should also be considered in this section. Finally, key drivers of the risk that the grant does not achieve targets agreed in the Performance Framework or longer-term impact should be explored. 10 P a g e

13 Brainstorming: Where are the risks in this area that you foresee for a period of next 12 months? Please provide specific details of the risk that you identified by listing the contributing factors. Guidance: Please try to elicit the contributing factors and consequences i.e. risks. Please find some examples of two 2 risks identified (e.g.: (i) misalignment between proposal objectives and program strategies leading to the risk of not achieving the impact, (ii)malfunctioning HMIS (Health Management Information System), unfilled vacancies, inadequate training of existing data entry operators contributing to inaccurate data collection from ARV centres etc.) Priority: From the above, please select three most important risks (i.e. have a high likelihood or a high negative impact or both)? Management: What can you do to avoid these risks or mitigate their impact? (Please specify the action, timeframe, person(s) responsible) Risk 1 : Action 1 Action 3 Risk 2 Action 1 Action 3 Risk 3 Action 1 Action 3 11 P a g e

14 Fiduciary & Financial Risks Fiduciary and financial risks address the possibility of funds and other resources not being used for the intended purposes, according to policies, or efficiently, or not being properly recorded, accounted for or reported. This area therefore includes financial management and fiduciary control risks such as: low or ineffective absorption of funds; weak internal controls and the risk of fraud, corruption, theft or diversion of funds or non-financial assets including pharmaceuticals and health products and equipment; and wastage of funds or non-financial assets due to poor management by implementing entities, foreign exchange or market price changes. Risks related to financial misreporting should also be explored here. Brainstorming: Where are the risks in this area in the next 12 months? Please provide specific details of the risk that you identified by listing the contributing factors. (E.g. Insufficient understanding of Global Fund reporting requirements, inadequate financial accounting software, lack of management supervision over financial system leading to the inadequate Financial Reporting) Guidance: Please try to elicit the contributing factors and consequences i.e. risks. Priority: From the above, please select three most important risks (i.e. have a high likelihood or a high negative impact or both)? Management: What can you do to avoid these risks or mitigate their impact? (Please specify the action, timeframe, person(s) responsible) Risk 1 Action 1 Action 3 Risk 2 Action 1 Action 3 Risk 3 Action 1 Action 3 12 P a g e

15 Health Services & Health Products Quality Risks Broadly, this risk area is defined as risks related to quality and accessibility of health services provided to beneficiaries. This includes risks related to timeliness, safety, quality, and accessibility of health services, including pharmaceuticals and health products and equipment, negatively impacting beneficiaries and key populations. Risks of diagnostic or treatment disruptions including supply chain management issues should be considered here. Additionally, human rights barriers may impede access to health services. Human rights risks arising from the operating context as well as risks of rights violations affecting grant recipients should be considered. Brainstorming: Where are the risks in this area in the next 12 months? Please provide specific details of the risk that you identified by listing the contributing factors. (E.g. Lack of reliable consumption data, inadequate MIS and lack of coordination and reconciliation between inventory and patient information to leading to inadequate forecasting and quantification for 2013 ) Guidance: Please try to elicit the contributing factors and consequences i.e. risks Priority: From the above, please select three most important risks (i.e. have a high likelihood or a high negative impact or both)? Management: What can you do to avoid these risks or mitigate their impact? (Please specify the action, timeframe, person(s) responsible) Risk 1 Action 1 Action 3 Risk 2 Action 1 Action 3 Risk 3 Action 1 13 P a g e

16 Action 3 Governance, Oversight & Management Risks These risks relate to inadequate governance, oversight and monitoring, or program and grant management including complying with Global Fund policies and reporting requirements. Governance encompasses effective institutional structures and leadership, management of competing interests and stakeholders, and sufficient management controls and information of the organization's activities and staff as well as key partners to ensure satisfaction of the organization's objectives. Oversight relates to the ability of the overseeing body or actor to proactively identify and rectify issues that can materially impact attainment of these objectives, and can range from audit, inspection and investigation, to evaluation and Brainstorming: monitoring, to Where risk management are the risks activities. in this area Program in the and next grant 12 months? management Please risks provide should specific consider details the quality, of the risk timeliness, that you efficiency identified and by listing compliance the contributing by CCM, PR, factors. SR, LFA (e.g.: and the Ineffective Global Fund functioning Secretariat, of the with CCM Global oversight Fund policies committee, and poorly reporting defined requirements. oversight plans and lack of proactive upwards reporting by PR to CCM leading to inadequate CCM governance and oversight ) Guidance: Please try to elicit the contributing factors and consequences i.e. risks. Inadequate CCM Governance & Oversight Priority: From the above, please select three most important risks (i.e. have a high likelihood or a high negative impact or both)? Management: What can you do to avoid these risks or mitigate their impact? Risk 1 Action 1 Action 3 Risk 2 Action 1 Action 3 Risk 3 14 P a g e

17 Action 1 Action 3 Annex 2: Major Contributing Factors by Risk REMEMBER: The following list is NOT comprehensive but rather a set of indicative factors used to help guide implementers in completing the GRAM tool. 1. Programmatic & Performance Risks Risk Limited Program Relevance Inadequate M&E and Poor Data Quality. Not Achieving Grant Output Targets Main contributing factors 1.1 Program goals and objectives are not aligned with agreed and most current national / international strategies, policies and guidelines 1.2 Insufficient attention by CCM to ensuring programs are designed based on sound analysis of key population needs and remain needsbased 1.3 Overall proposal has not been well translated into the grant 1.4 Grant targets are inconsistent with the proposal, other grants, national targets or GF strategic objectives 1.5 Indicators are not appropriate or effective for measuring output, outcome, or impact consistently with the goals and objectives of the program 1.6 Evidence that program SDAs, coverage, reach and intensity are not effective to achieve the proposed goals and objectives 1.7 Epidemiological or program context situation in country has significantly evolved since the TRP reviewed the proposal 1.8 Significant delays in grant implementation from approval of the proposal 2.1 Inadequate indicator measurement framework 2.2 Inadequate routine/programmatic data collection 2.3 Inadequate data management 2.4 Inadequate data quality assurance mechanisms in place 2.5 Inadequate program reviews and evaluations regularly conducted 2.6 Inadequate M&E Human Resources capacity 2.7 Inadequate M&E budget allocation or spending for the national health sector, disease program or PR M&E system 2.8 Inadequate data analysis, dissemination and use 2.9 Inadequate progress made on the implementation of M&E system strengthening activities 3.1 Number and materiality of conditions precedent and management actions assigned during the grant negotiation and signing processes, or during implementation, and progress against these to date. 3.2 Insufficient budget to support implementation 3.3 High complexity of grant implementation arrangements 3.4 Previous, current, or expected delays in procurement and supply chain management activities (PHPM & non-phpm) 3.5 Previous and current delays in disbursements 3.6 Shortages in global drug supplies 3.7 Poor performance against Output Targets in current and previous periods for the grant, as well as other grants to PR and in this country, or other indications that current targets may be set unrealistically high. 3.8 Insufficient capacity of the PR Program Management Unit (PMU) for effective program and grant implementation 3.9 Overall stability of country, enabling environment, and health sector 3.10 PR and/or major SRs were not involved in development of the proposal, program implementation plan, or budget 4.1 Poor performance against Outcome and/or Impact Targets in current and previous periods for the grant, as well as other grants to PR and in this country, or other indications that current targets may be set unrealistically high. 15 P a g e

18 Not Achieving Grant Outcome & Impact Targets Poor Sustainability 4.2 Overall capacity of health systems, strength of national health strategy, and government spending on health sector 4.3 Overall stability of country, enabling environment, and health sector 4.4 Lack of effective coordination by parties involved in grant implementation including national health bodies, national and subnational governments, donors, and partners 4.5 Lack of effective coordination between grants and disease programs 4.6 SDAs or Outputs are not sufficiently well-linked to Outcomes and Impact, or Output targets are not sufficiently well-linked to Outcome and Impact Targets 4.7 Quality of training, systems strengthening activities, and other nonhealth service related Outputs 5.1 Alignment with national systems - GF supported programs do not use public financial management systems 5.2 Alignment with national systems -GF supported programs do not use public procurement systems 5.3 Alignment with national systems - GF supported programs do not use national M&E systems 5.4 Alignment with national systems - GF-financed remuneration is not aligned to national or interagency frameworks 5.5 Alignment with national systems - Lack of capacity building and systems strengthening to support sustainable impact 5.6 Harmonization and Coordination - Lack of CCM and PR coordination with other health bodies, donors, and partners. 5.7 Harmonization and Coordination GF financing is implemented through a Project management Unit (PMU) parallel to existing government structures 5.8 Transparency-Predicted GF financing is not accurately reported in the country budget, aid information management system or other such aid tracking tools 5.9 Sustainability - Inadequate counterpart financing 2. Fiduciary & Financial Risks Low Absorptive Capacity or Over-commitment Poor Financial Efficiency 6.1 Inadequately defined implementation arrangements 6.2 Poor budgeting, including especially budget assumptions 6.3 Inadequate budget monitoring and forecasting 6.4 Delays in SR reporting and implementation 6.5 History of low absorptive capacity and over commitment 6.6 Delays in procurement (PHPM specific) 6.7 Delays in procurement (other than PHPM) 6.8 Undisclosed counterpart funding or partner contributions 7.1 Lack of comprehensiveness and appropriateness of budget 7.2 Inadequate control framework 7.3 Undisclosed counterpart funding or partner contributions 7.4 Inefficient procurement practices (PHPM specific) 7.5 Inefficient procurement practices (other than PHPM) 7.6 Inadequate implementation arrangements 7.7 Inadequate SR management (SR selection and/or inadequate oversight of SR management) 7.8 High materiality of previous losses due to inefficiencies 7.9 Budget contains a high proportion of budget lines susceptible to inefficiency Fraud, Corruption, or Theft of Global Fund Funds 8.1 Inadequate bank and cash management 8.2 Low rating of PR financial management and SR oversight and management 8.3 Indications of collusion, fraud or corruption (from past experience or other) 8.4 Inadequate SRs/ SSR oversight by PRs 8.5 Poor PR and SR staff capacity 8.6 Inadequate control framework 16 P a g e

19 Theft or Diversion of Nonfinancial Assets Financial Non-compliance Market and Macroeconomic Losses Poor Financial Reporting 8.7 Non-transparent or non-competitive PHPM procurement practices 8.8 Lack of internal controls in the PHPM procurement process 8.9 Socio political unrest and pressure 8.10 High value of previous single fraud events identified 8.11 Budget contains a high proportion of budget lines which are fraud prone so called yellow-flag budget items 9.1 Incomprehensive and inadequate fixed assets management 9.2 Inadequate health products stock management 9.3 Inadequate SR/ SSR oversight by PRs 9.4 High value of previous theft or diversion of non-cash assets identified 9.5 Poor PR and SR staff capacity 9.6 Socio political unrest and pressure 9.7 History or indications of theft, diversion or unexplained losses 10.1 Inadequate budget monitoring and forecasting 10.2 History of reduced or delayed disbursements 10.3 History of unauthorized inter-grant borrowing 10.4 History of unauthorized reprogramming 10.5 History of other ineligible expenditures 11.1 Recent or expected significant change in exchange rates 11.2 Percentage of budget subject to exchange rate fluctuations 11.3 Inadequate management and monitoring of exchange rate fluctuations 11.4 Anticipated price increases for health products 11.5 History of unexpected significant price increases or high inflation (excl. PHP) 11.6 History of financial and macroeconomic losses 12.1 Inadequate financial information systems (PR and SR) 12.2 Inadequate financial records process and controls 12.3 Inadequate financial staff capacities and/or poor understanding of Global Fund reporting requirements 12.4 Insufficient planning of PR & SR financial reporting and weak PR control over SR financial reporting 12.5 Lack of budget variance analysis (SR) 12.6 History of delayed PR or SR reporting 12.7 Non-fulfillment of audit requirements 3. Health Services & Health Products Quality Risks 13.1 Previous stock-outs Treatment Disruptions Substandard Quality of Health Products 13.2 Unpredictable or limited sources of supply 13.3 Inefficient or ineffective procurement processes 13.4 Lack of SOPs for procurement process or poor adherence to SOPs 13.5 Inadequate forecasting and quantification 13.6 Lack of coordination of pharmaceutical and health products management activities 13.7 Inadequate storage and distribution practices/ capacity at central (and/or peripheral) level 13.8 Inadequate inventory management practices 13.9 Inefficient Global Fund processes 14.1 Record of past non- compliance with the Global Fund QA policies 14.2 Inadequate capacity for quality monitoring of products 14.3 Selection of a non-compliant QC laboratory with QA Policy 14.4 Inadequate temperature control and storage conditions 14.5 Presence of expired products in the supply chain 14.6 Lack of SOPs for storage and distribution or poor adherence to SOPs 14.7 Lack of capacity of national regulatory authorities (NRA) to implement and oversee quality monitoring activities 14.8 Lack of coordinated approach in QA requirements 14.9 Insufficient resources dedicated to QA implementation at the Secretariat 15.1 Gap in guidelines /policy framework related to prevention, diagnosis and treatment 17 P a g e

20 Poor Quality of Health Services & Use of Health Products Human Rights barriers in accessing Health Services 15.2 Non- adherence to approved national or WHO guidelines when selecting products for procurement 15.3 Non-adherence of health professionals to approved prevention, treatment and care guidelines/protocols at facility level 15.4 Guidelines and protocols are not available at the facility level 15.5 Lack of mechanisms to support retention in treatment and adherence to prescribed regimens 15.6 Insufficient monitoring/supervision of prescriber and provider practices 15.7 Lack of capacity building/ta in rational use of medicines and health products 15.8 Absence of functional national pharmacovigilance system 15.9 Inadequate number of qualified staff in health services 16.1 Evidence of access issues at health facilities for securing health services 16.2 Lack of representation of key population groups on CCM or ineffective engagement of key population groups with CCM 16.3 Lack of equity assessment, poor reporting on equity-related indicators, and difficulty to assess and rely on in-country partners information or other sources to assess equity or human rights issues Evidence of inequity in service coverage (Outputs) or Outcomes and Impact 16.5 Gaps or weaknesses in programming and implementation for key population groups 16.6 Evidence of human rights violations in grant or program activities, or in country more generally from publicly available indices and reports 16.7 Conduciveness of country political, social, and legal environment to protection and promotion of Human Rights and Equity 4. Government Oversight and Management 17.1 Upcoming country elections or potential significant changes in national leadership Inadequate Security and Stability at the national/subnational level 17.2 Security issues constraining capacity of PR to engage partners for local implementation and to ensure populations can access services 17.3 Inadequate ability to accurately monitor programme activities in conflict areas 17.4 PR constrained in addressing specific security threats which target program providers and recipients 17.5 Significant changes in national leadership and strategies compromise continuity of health system support for grant programs 18.1 Ineffective PR & Program Management Unit (PMU) governance Limited PR Governance & Oversight 18.2 Upcoming country elections or potential significant changes in national leadership 18.3 Conflicts of interest within the PR senior leadership and management 18.4 Inadequate PR internal control procedures, and internal and external audit requirements, practices, and follow-up on issues identified 18.5 Lack of clear risk management responsibilities and activities within PR management 18.6 Inappropriate or ineffective SR selection by PR 18.7 Limited authority or ability of PR to respond appropriately to identified and follow-up on SR management issues 18.8 Inadequate management information systems at PR level, or inadequate reporting infrastructure for SRs to report to PRs, to support effective governance and oversight 18.9 Insufficient frequency and quality of communications, site visits, and verification of program activities by PRs 18 P a g e

21 Limited PR Reporting & Compliance Limited Secretariat oversight and LFA verification Inadequate SR Governance & Oversight Inadequate SR Reporting & Compliance Ineffective CCM Oversight Complexity of grant implementation arrangements Poor PR engagement and coordination with partners, program stakeholders and other relevant actors in the health sector, including across grants and programs Limited Partner capacity for providing Technical Assistance related to PR Governance & Oversight 19.1 Insufficient PR and PMU staff capacity for satisfying with Global Fund reporting requirements including submitting high-quality grant deliverables in a timely manner 19.2 Poor Quality, completeness and timeliness of deliverables and reporting by PR 19.3 Non-compliance with grant terms & conditions, and progress against CPs and other conditions and management actions by PRs and SRs 19.4 Non-fulfillment of audit requirements 19.5 Inadequate Management Information Systems at PR level and for reporting from SRs to PRs, to support Global Fund reporting requirements 19.6 Complexity of grant implementation arrangements 19.7 Limited partner capacity for providing Technical Assistance related to Global Fund reporting and other requirements 20.1 Country Team members inadequate engagement including missions to familiarize themselves with local context, impacting on quality of oversight 20.2 Frequent changes in the County Team members, which affects team s ability to provide consistent quality oversight and support to the incountry stakeholders 20.3 Delays in and clarity of communication and guidance by Country Team to in-country partners (CCM and PRs) compromise the ability of PR to address grant management issues effectively Infrequent in-country LFA verifications results in limited LFA communication with CCM, PR, partners, external auditors, and relevant national bodies 20.5 Frequent changes in LFA team result in limited contextual knowledge and lack of established communication practices with PR and CCM 20.6 Lack of regular debriefing by LFA at the end of each mission resulting in delay in feedback to PR to address grant management issues 21.1 Inadequate SR internal control procedures, and internal and external audit requirements, practices, and follow-up on issues identified 21.2 Ineffective SR & Management Unit governance 21.3 Inappropriate or ineffective SSR selection by SR 21.4 Inadequate management information systems at SR level, or inadequate reporting infrastructure for SSRs to report to SRs, to support effective governance and oversight 21.5 Insufficient frequency and quality of communications, site visits, and verification of program activities by SRs 22.1 Insufficient SR staff capacity for submitting high-quality grant deliverables in a timely manner 22.2 Non-fulfilment of audit requirements 22.3 Inadequate Management Information Systems at SR level and for reporting from SSRs to SR 23.1 Poor access by PRs and other stakeholders to CCM information and decision-making raising concerns regarding transparency 23.2 CCM oversight processes irregular and not systematic leading to PR being unclear of oversight support available and of schedule of oversight activities 23.3 Lack of standardized reporting format and schedule for PRs to report to CCM 23.4 Frequent changes in CCM oversight membership results in limited contextual knowledge of grant implementation challenges 23.5 Delays in and lack of clarity of CCM decision-making and communication on issues raised by PRs to strengthen grant performance compromise grant implementation 19 P a g e

22 20 P a g e