Transcription
OFFICE OF INSPECTOR GENERALU.S. Agency for International DevelopmentUSAID’S Global HealthSupply Chain Would BenefitFrom More Rigorous RiskManagement and Actions ToEnhance Local OwnershipAUDIT REPORT 4-936-20-002-PJULY 10, 20201300 Pennsylvania Avenue NW Washington, DC 20523https://oig.usaid.gov 202-712-1150Office of Inspector General, U.S. Agency for International Development
The Office of Inspector General provides independent oversight that promotes theefficiency, effectiveness, and integrity of foreign assistance provided through the entitiesunder OIG’s jurisdiction: the U.S. Agency for International Development, MillenniumChallenge Corporation, U.S. African Development Foundation, and Inter-AmericanFoundation.Report waste, fraud, and abuseUSAID OIG HotlineEmail: ig.hotline@usaid.govComplaint form: https://oig.usaid.gov/complainant-selectPhone: 202-712-1023 or 800-230-6539Mail: USAID OIG Hotline, P.O. Box 657, Washington, DC 20044-0657Office of Inspector General, U.S. Agency for International Development
MEMORANDUMDATE:July 10, 2020TO:USAID/Bureau for Global Health, Assistant Administrator, Dr. AlmaGoldenFROM:USAID OIG Africa Regional Office, Audit Director, Robert Mason /s/SUBJECT:USAID’S Global Health Supply Chain Would Benefit From More RigorousRisk Management and Actions To Enhance Local Ownership (4-936-20002-P)This memorandum transmits the final report on our audit of USAID’s in-countrymanagement of its Global Health Supply Chain Program. Our audit objectives were to(1) examine how USAID assessed risks for in-country supply chains and (2) determinethe extent to which selected missions in Africa undertook activities that aligned withgood practices for addressing the root causes of in-country supply chain weaknesses. Infinalizing the report, we considered your comments on the draft and included them intheir entirety in appendix D.The report contains two recommendations related to the Bureau for Global Health’smanagement of its supply chain program. After reviewing information you provided inresponse to the draft report, we consider both recommendations resolved but open,pending completion of planned actions. For each recommendation, please provideevidence of final action to the Audit Performance and Compliance Division.We appreciate the assistance you and your staff extended to us during this audit.Office of Inspector General, U.S. Agency for International DevelopmentPretoria, South Africahttps://oig.usaid.gov
CONTENTSINTRODUCTION .1SUMMARY .2BACKGROUND .3MISSIONS TOOK SOME STEPS TO IDENTIFY COUNTRY-LEVEL SUPPLY CHAINRISKS, BUT USAID DOES NOT HAVE A COMPREHENSIVE AND CENTRALIZEDRISK ASSESSMENT PROCESS FOR ITS GLOBAL HEALTH SUPPLY CHAINPROGRAM .7Missions Took Some Steps To Identify Supply Chain Risks at the Country Level .8Lack of Comprehensive Risk Management for the Global Health Supply ChainHindered USAID’s Ability To Identify and Mitigate Risks .9SELECTED MISSION ACTIVITIES MOSTLY ALIGNED WITH GOOD PRACTICESFOR ADDRESSING ROOT CAUSES OF SUPPLY CHAIN WEAKNESSES, BUT USE OFPARALLEL OPERATIONS COULD IMPEDE COUNTRIES’ EFFORTS TO BECOMESELF-RELIANT . 12Reviewed Activities at Selected Missions Mostly Aligned With Good Practices forAddressing Root Causes of In-Country Supply Chain Weaknesses . 12Efforts To Mitigate Risks by Completing Work on Behalf of Government Officials orUsing Parallel Supply Chains Can Have Unintended Consequences for Countries’Progress Toward Self-Reliance . 15CONCLUSION . 16RECOMMENDATIONS . 16OIG RESPONSE TO AGENCY COMMENTS . 17APPENDIX A. SCOPE AND METHODOLOGY . 18APPENDIX B. SOURCES REVIEWED TO IDENTIFY GOOD PRACTICES FORADDRESSING THE FOUR ROOT CAUSES OF SUPPLY CHAIN WEAKNESSES . 21APPENDIX C. GOOD PRACTICES REVIEWED FOR ACTIVITY EXAMPLES. 23APPENDIX D. AGENCY COMMENTS . 25APPENDIX E. MAJOR CONTRIBUTORS TO THIS REPORT . 32Office of Inspector General, U.S. Agency for International Development
INTRODUCTIONPublic health challenges such as treating HIV and AIDS, preventing infectious diseases,and averting child and maternal deaths continue to burden national health systems.Some countries do not have the systems in place to appropriately safeguard and deliverthe lifesaving medicines and other items, such as basic medical supplies and equipment,needed to combat these threats. 1 For more than a decade, USAID has deliveredmedicines and other healthcare commodities to help save lives around the world. In2017, USAID’s Global Health Supply Chain (GHSC) Program had five awards totalingnearly 10.5 billion to provide healthcare commodities and technical assistance.This large and multifaceted effort presents many risks for USAID. Commodities areoften prone to theft, waste, and loss or can be unavailable due to stockouts or expiredproducts when they are most needed. To effectively address these risks, supply chainactivities should address systemic, underlying causes of in-country supply chainweaknesses to achieve the program’s goals.USAID’s GHSC program has been under scrutiny both in the oversight community andin the media. In 2017, investigators in USAID’s Office of Inspector General raisedconcerns that the Agency’s inadequate oversight of USAID-funded commodities leftthem vulnerable to theft. Around the same time, a few media articles highlighted thepoor performance of USAID’s newest supply chain contractor implementing the 9.5 billion Global Health Supply Chain – Procurement and Supply Management (GHSCPSM) award—the Agency’s largest single award to date.These concerns garnered congressional attention, culminating in a request from theSenate Foreign Relations Committee for OIG to initiate work on the supply chains ofUSAID-funded health commodities. In response, we conducted this audit to examineUSAID’s management of in-country supply chain activities. 2 Our objectives were to(1) examine how USAID assessed risks for in-country supply chains and (2) determinethe extent to which selected missions in Africa undertook activities that aligned withgood practices for addressing the root causes of in-country supply chain weaknesses.To address these objectives, we reviewed USAID processes for assessing in-countrysupply chain risks and interventions to mitigate root causes of in-country supply chainweaknesses at four selected USAID missions: Malawi, Mozambique, Nigeria, andTanzania. The scope was limited to fiscal years 2017 and 2018, and two awards withinUSAID’s GHSC program: GHSC-PSM and Global Health Supply Chain – TechnicalAssistance (GHSC-TA). 3 We conducted this audit in accordance with generally accepted1Source: Global Fund Inspector General, “The Global Fund’s In-Country Supply Chain Processes,” April28, 2017.2OIG concurrently conducted an audit of USAID’s procurement and management of its GHSC-PSMaward, which was ongoing at the time of this report.3The GHSC-PSM award was implemented by Chemonics, Inc. The GHSC-TA award was implemented byPricewaterhouse Coopers Public Sector, whose name was later changed to Guidehouse after it wasacquired by Veritas Capital.Office of Inspector General, U.S. Agency for International Development1
government auditing standards. Appendix A contains additional information about theaudit’s scope and methodology.SUMMARYRisk identification for the in-country components of USAID’s GHSC program isprimarily done by overseas missions. USAID missions we reviewed used country-specifictools to identify some risks, including those related to the supply chain. Missions furtheridentified weaknesses within supply chain systems through various external assessmentsconducted by implementers, oversight organizations, and other donors, and some usedthe original version of the optional National Supply Chain Assessment tool developed bythe Bureau for Global Health. However, while the Agency’s enterprise risk managementframework calls for consideration of significant risks as an interrelated portfolio,USAID’s risk identification efforts related to its supply chain investments were siloed bycountry without a coordinated or systematic effort to look across missions for broaderrisk patterns. Within the existing Agency structure for enterprise risk management,supply chain risks identified at the mission level were not reported up to Global Health,which manages USAID’s worldwide supply chain activities. Instead, regional bureausassessed the aggregate supply chain risks identified by missions. Global Health’s 2018risk profile did not include any risks related to its supply chain program. The absence ofa robust, centrally managed risk identification process for supply chain activities limitsthe Agency’s ability to proactively address patterns across missions, such as brokenagreements between host governments and USAID and local infrastructure constraints,which we observed.To address risks and achieve the program’s goals, supply chain activities should addresssystemic, underlying causes of in-country supply chain weaknesses. We determined that50 out of 58 selected activities at the missions we reviewed fully aligned with goodpractices we identified from industry standards for addressing the four root causes ofsupply chain weaknesses. For example, implementers in Mozambique adhered to goodpractices for providing technical assistance to the host country government to quantifycommodity requirements and costs—which included working with the host countrygovernment, considering underlying assumptions, consumption data, and gap analyses,and conducting the exercise on an annual and quarterly basis. The remaining eightactivities were partially aligned. For example, for an activity in Malawi where GHSC-PSMsubcontracts firms to receive, store, and distribute commodities, the implementersadhered to warehousing, distribution, and inventory control good practices, but thehost country government did not participate. While the selected mission activitiesmostly aligned with good practices for addressing root causes of supply chainweaknesses, in three of the four missions we visited, USAID undertook risk mitigationmeasures that can delay countries’ transition to self-reliance. More specifically, in threemissions USAID either (1) had project-funded consultants do the work of governmentofficials instead of training and advising them or (2) operated a parallel supply chain.While often necessary to minimize the risks that U.S. taxpayer-funded property couldbe lost or that commodities might not be delivered, such workarounds also impede aOffice of Inspector General, U.S. Agency for International Development2
host country’s ability to ultimately manage its own supply chain and do not directlycontribute to USAID’s goal of fostering self-reliance.We are making two recommendations to the Bureau for Global Health. The first is tostrengthen USAID’s management of supply chain risks worldwide, and the second is toincrease the capability of host governments to manage health commodity supply chainswith reduced donor support in the missions we reviewed. USAID agreed with ourrecommendations.BACKGROUNDUSAID makes significant investments in global health supply chains to ensure healthcarecommodities get to those in need while strengthening systems to foster self-reliance.GHSC program activities include providing lifesaving healthcare commodities, such asHIV/AIDS antiretroviral therapy medicines and malaria bed nets, and transferringknowledge on managing healthcare commodities.The Bureau for Global Health provides oversight of USAID’s worldwide supply chainmanagement activities through an established management structure consisting ofofficials from five offices within the bureau: the Offices of HIV/AIDS; Infectious Disease;Population and Reproductive Health; Maternal/Child Health and Nutrition; and HealthSystems. These five offices provide technical expertise and take the lead in overseeingthe supply chain program.Managing the GHSC program involves working with stakeholders at headquarters inWashington, DC, and in the field at missions worldwide across all elements of thesupply chain. The six commonly adopted supply chain elements are: 41. Product selection - Selecting drugs based on national treatment guidelines andapproval.2. Forecasting and supply planning - Estimating the quantity of commodities needed toensure an uninterrupted supply.3. Procurement - Contracting with suppliers to obtain drugs within agreed-uponproduction and delivery time frames and costs.4. Warehousing - Maintaining appropriate security and environmental conditions.5. Inventory management - Monitoring for shortages and waste due to expiredproducts, keeping accurate records of available and anticipated stock, and preparingfor distribution.6. Distribution - Managing the flow of commodities from the point of production tothe end user.4Source: U.S. Government Accountability Office (GAO), “PEPFAR: Drug Supply Chains Are Stronger, ButMore Steps Are Needed to Reduce Risk,” April 26, 2013.Office of Inspector General, U.S. Agency for International Development3
For USAID-funded commodities, depending on each country’s context, some of theseelements are carried out by staff in Agency headquarters while some are managed incountry.Once commodities arrive in country, they are either delivered to host countrygovernments for distribution through the national supply chain, or distributed through aparallel supply chain that the Bureau for Global Health uses to mitigate risks in countrieswhere they believe it is prudent to do so. While the exact pathways for commoditiesvary depending on multiple factors, including country requirements and commoditytype, figure 1 shows the typical flow of commodities through an in-country supply chain.Figure 1. Commodity Flow in National Supply ChainsCentral MedicalWarehouseRegional or DistrictWarehousesHospitals and HealthFacilitiesBeneficiariesHealth CommoditiesNote: In parallel supply chains, USAID bypasses one or more elements in the national supply chain.Source: OIG-generated based on analysis of in-country supply chains for selected missions.USAID’s Global Health Supply Chain ProgramFor many years, USAID has undertaken supply chain activities to help meet its threestrategic priorities for global health: 1) preventing maternal and child deaths, 2)controlling the HIV/AIDS epidemic, and 3) combating infectious diseases. Like all USAIDprogramming, the Agency’s supply chain efforts must also support the Agency’soverarching objective to help countries become self-reliant, thus ending the need forforeign assistance altogether.In 2015, the Bureau for Global Health revamped its supply chain portfolio. This includedawarding the GHSC-PSM contract — 9.5 billion for a maximum of 8 years—to procureand provide health commodities and improve supply chain activities in partner countries.By June 2017, the GHSC program had five awards totaling nearly 10.5 billion to deliverhealth commodities and provide systems strengthening technical assistance around theworld. Of the five awards USAID used to operate its GHSC program, the GHSC-PSMand GHSC-TA contracts comprised 96 percent, or 10 billion. 5 GHSC-PSM wasUSAID’s primary award for procuring and providing health commodities. It alsoprovided technical assistance in improving in-country supply chains. The GHSC-TAaward also offered supply chain technical assistance, but it did not provide commodities.5As of June 2017, the Global Health Supply Chain Program also included the GHSC – Rapid Test Kits,GHSC – Quality Assurance, and GHSC – Business Intelligence and Analytics award mechanisms.Office of Inspector General, U.S. Agency for International Development4
All four missions we reviewed used GHSC-PSM for commodity procurement andshipping. USAID missions could choose to receive technical assistance for supply chainmanagement from either GHSC-PSM or GHSC-TA. USAID/Tanzania chose GHSC-TAwhile the three other selected missions chose GHSC-PSM. Table 1 shows the allocationof expenditures for fiscal years (FY) 2017 and 2018 across the four missions wereviewed.Table 1. Expenditures (in Millions) for Procured Commodities andTechnical Assistance in Selected ceMozambiqueNigeriaTanzaniaFY 17FY 18FY 17FY 18FY 17FY 18FY 17FY 18Total 10 14 28 85 89 165 72 71 534 7 9 12 17 21 37 4 5 112Source: OIG analysis of expenditures received from Global Health and missions.Supply Chain Risk ManagementUSAID’s operations, centered in the world’s poorest and most vulnerable countries, areinherently risky. In general, the level of risk increases as operations increase incomplexity, and the GHSC program, given its large size, broad geographical scope, anddiverse array of commodities, is complex. The Office of Management and Budget’s(OMB) 2016 directive that Federal agencies adopt comprehensive enterprise riskmanagement (ERM) programs to identify, assess, and respond to risks is vitally importantfor USAID in general and the GHSC program in particular. 6 In the context of ERM,enterprise risks can be seen as those that could significantly affect an agency’s ability toachieve its objectives. These risks can be either organization-wide or centered on oneunit that carries out a key program or function.To identify significant risks across the Agency, USAID has established an ERMframework. According to USAID’s governance charter for ERM and internal control,USAID’s missions, bureaus, and independent offices are required to “identify key risksand internal control deficiencies using a structured and systematic approach.” The ERMprocess is meant to be a holistic approach to risk management and consider all risks,internal and external, as an interrelated portfolio, rather than in isolation. Usedproperly, ERM helps organizations continuously, proactively, and comprehensively assessrisks to optimize risk management efforts and make better decisions.USAID’s governance structure for implementing ERM consists of management andoversight bodies responsible for reviewing, managing, and approving identified risks anddeficiencies of various Agency units: bureaus, independent offices, divisions, andmissions. Each of these units has a Management Council on Risk and Internal Control6OMB Circular A-123, “Management's Responsibility for Enterprise Risk Management and InternalControl,” July 15, 2016.Office of Inspector General, U.S. Agency for International Development5
(MCRIC) that manages ERM and prepares its unit’s risk profile. 7 Risk profiles developedat different levels of the organization are reported up to the next management level.The Risk Management Council assesses the collective risk profiles prepared by eachMCRIC to develop the overall Agency risk profile, which is reviewed at leastsemiannually and updated as needed. The Agency’s risk profile is then endorsed by theExecutive Management Council on Risk and Internal Control (EMCRIC), chaired by theDeputy Administrator. 8In the case of Agency units that are part of the GHSC program, the risk profilesdeveloped by USAID’s overseas missions are reported to their respective regionalbureaus, like Africa Bureau, which then develop a risk profile for their region. In aseparate reporting chain, USAID’s functional bureaus, like Global Health, developseparate risk profiles for their respective areas of responsibility. The risk profiles fromall bureaus and independent offices are then used to collectively develop the Agency’srisk profile (see figure 2).Figure 2. Risk Reporting Structures Under USAID’s Enterprise RiskManagement ProcessUSAID Agency Risk ProfileRegional BureauRisk ProfilesFunctional BureauRisk ProfilesIndependent OfficeRisk ProfilesMission RiskProfilesNote: This figure is not intended to depict all parts of the ERM process, such as the consideration offinancial internal controls.Source: OIG analysis of USAID’s ERM process described in ADS 596mab, “Governance Charter forEnterprise Risk Management and Internal Control.”7In 2017, the Agency adopted Automated Directives System (ADS) 596mab, USAID’s governance charterfor ERM, as a mandatory reference for ADS 596. ADS 596mab required each organizational unit to submita risk profile to the next management level.8The Inspector General sits as a non-voting observer on the EMCRIC.Office of Inspector General, U.S. Agency for International Development6
Some supply chain risks are already well established. In an April 2017 report, the GlobalFund OIG identified four root causes of persistent supply chain problems at the incountry level that also pose risks for USAID: (1) inadequate or ineffective countryownership and governance, (2) lack of accurate and reliable data, (3) inadequate humanresources, and (4) insufficient host government funding (see table 2). 9Table 2. Root Causes of In-Country Supply Chain WeaknessesRoot CauseDescriptionCountry Ownership andGovernanceChallenges with country ownership and governancestructures have affected prioritization, coordination, andaccountability within supply chain activities.Data ReliabilityChallenges in obtaining accurate and reliable data tosupport informed decision making.Human ResourcesInadequate human resources for service delivery andsupply chain management.FundingInadequate financial resources for supply chaintransformation.Source: Global Fund Inspector General, “The Global Fund’s In-Country Supply Chain Processes,” April2017.These four root causes adversely affect all six key elements of supply chain managementand are important considerations for oversight of USAID-funded technical assistanceand healthcare commodities.MISSIONS TOOK SOME STEPS TO IDENTIFYCOUNTRY-LEVEL SUPPLY CHAIN RISKS, BUT USAIDDOES NOT HAVE A COMPREHENSIVE ANDCENTRALIZED RISK ASSESSMENT PROCESS FOR ITSGLOBAL HEALTH SUPPLY CHAIN PROGRAMWhile an organization cannot respond to all potential risks related to achieving its goalsand objectives, Federal managers are required to identify, analyze, and assess majorrisks. These Federal requirements emphasize the importance of understanding thecombined impact of internal and external risks as an interrelated portfolio. 10 As part ofUSAID’s broader framework for assessing and managing significant, enterprise-level risksfacing the Agency, missions identify supply chain risks at the country level. However, the9These four root causes were identified in a Global Fund OIG capping report published in April 2017.That capping report was a review of prior Global Fund audits that identified supply chain weaknesses in 15countries. Global Fund’s analysis of those prior audits led them to identify these four systemic root causesand report on them in its capping report.10OMB Circular A-123, “Management's Responsibility for Enterprise Risk Management and InternalControl,” July 15, 2016.Office of Inspector General, U.S. Agency for International Development7
lack of a comprehensive risk assessment process dedicated to the supply chain programmay hinder Global Health’s ability to identify and mitigate risks across the entireprogram.Missions Took Some Steps To Identify Supply Chain Risks at theCountry LevelUSAID missions use country-specific tools to identify risk, including those related to thesupply chain, at the country level. Three of the four missions we reviewed reportedusing some country-specific tools to consider risk in USAID programs, includingCountry Development Cooperation Strategies (CDCSs) and Project AppraisalDocuments (PADs). CDCSs describe USAID’s strategic approach in a given country andlay the groundwork for subsequent decision making; the strategies are not designed toprovide in-depth details about USAID projects and thus have limited use in developingrisk assessment strategies for supply chain activities. Similarly, the PAD describedcountry health systems in general terms and did not incorporate a detailed or ongoingassessment of supply chain challenges. 11To further identify weaknesses within supply chain systems, missions we reviewed reliedon various external assessments conducted by implementers, oversight organizationssuch as the Global Fund OIG, and other donors. These assessments included end-userverification reports, warehouse capacity assessments, logistics management informationsystems assessments, and commodity leakage studies. 12 These assessments allowedmissions to be aware of persistent challenges in each country. While missions usedthese assessments to gain further understanding of supply chain risks, they were notused by the Agency to yield broader insight into whether similar problems existed inother countries and were not intended to provide detailed, ongoing assessment ofsupply chain challenges.To obtain consistent information on the state of in-country supply chains, the Bureaufor Global Health created the National Supply Chain Assessment tool. By examining 11technical areas of a public health supply chain in developing countries, such as humanresources, forecasting and supply planning, and distribution, this tool provides asnapshot of the capacity and performance of the national system. According to GlobalHealth, the assessment is resource intensive and is optional for missions. Theassessment was revamped in 2018, and at the time of our audit, none of the fourcountries we visited had used the updated version. Mozambique and Nigeria missionslast used this tool in 2014 and 2015, respectively, and Malawi and Tanzania had not usedthe tool.11USAID policy requires missions to prepare a PAD that codifies how each project will contribute to themission’s development strategy.12End-user verification reports examined health facilities to assess the availability of commodities forbeneficiaries. Warehouse capacity assessments determined the status of warehouse conditions and maderecommendations for improvements. Logistics management information systems assessments examinedthe network of in-country systems used to track logistics data related to demand, inventory, and pipelineinformation of health commodities. Commodity leakage studies examined what factors contributed to lossand theft of health commodities.Office of Inspector General, U.S. Agency for International Development8
Lack of Comprehensive Risk Management for the Global HealthSupply Chain Hindered USAID’s Ability To Identify and MitigateRisksWhile the missions we reviewed took some steps to identify supply chain risks at thecountry level, USAID lacked a structured process for comprehensively managing risksfor the GHSC program. Within USAID’s ERM structure, the risks identified at themission level, including supply chain risks, are not reported up to the Bureau for GlobalHealth. Instead, supply chain risks are reported up to regional bureaus (see figure 3).Bureau officials explained that while mission risk profiles are managed by theirrespective regional bureaus, feedback from the missions could be considered by GlobalHealth but this is not required.Figure 3. Management of and Risk Reporting for USAID’s GlobalHealth Supply Chain ProgramBureau for Global HealthTechnical directionand oversightRegional BureausLimited ad-hoc reporting ofcountry-level supply chainrisksFormal reportingof country-levelrisks through ERMUSAID missions withGHSC program activitiesSource: OIG analysis of flow of reported in-country supply chain risks and USAID’s ERM processdescribed in ADS 596mab, “Governance Charter for Enterprise Risk Management and Internal Control.”Given its technical expertise and leadership role in overseeing the supply chain program,the Bureau for Global Health is best positioned to assess the aggregate supply chainrisks identified by the missions. A structured framework would allow Global Health torequest information it would need in order to inform its technical guidance to themissions with GHSC activities and manage supply chain risks.Global Health’s FY 2018 risk profile included five risks affecting its programs. 13 Forexample, the bureau identified risks related to providing substantial funding in countries13The first round of risk profiles was completed in FY 2018.Office of Inspector General, U.S. Agency for International Development9
where USAID has no staff presence or non-permissive environments and the risk ofmaintaining proper oversight of USAID health programs in these areas. However, thebureau’s FY 2018 risk profile did not include any risks specifically related to its supplychain program. Bureau officials explained that since media attention and poorperformance of the implementer led USAID to include the risk of late delivery ofcommodities in the overall Agency’s risk profile, it would have been redundant andconfusing to also include supply chain-related risks in Global Health’s risk
The scope was limited to fiscal years 2017 and 2018, and two awards within USAID's GHSC program: GHSC-PSM and Global Health Supply Chain - Technical . strengthen USAID's management of supply chain risks worldwide, and the second is to increase the capability of host governments to manage health commodity supply chains
