01 Reserve speed is still a signature
A reserve allocation exists so a fund can move when a standard call for proposals cannot. Speed does not retire the file. Someone still has to be able to show why these partners were invited, why a project was single-sourced, and where the selection record sits in OneGMS before the funding recommendation.
This note is for people who run or oversee Country-based Pooled Funds — the Pooled Fund Management Branch, humanitarian financing units, and the colleagues who sign allocation strategies. It reads three public OIOS audits. The current one is global oversight of the funds, issued 30 December 2025. The second is Iraq in 2020, where suspected fraud sat in a forensic queue. The third is Ethiopia in 2017, labelled as vintage on purpose: a pass-through to a consortium, and an implementing partner whose donor had already suspended funding. The control language is the CBPF Global Guidelines, December 2022, and four of their annexes. Trace-li does not invent those rules.
02 Method & claim hygiene
pdftotext.
OIOS 2017/014’s public file URL returned HTTP 404 to a direct download the same day; the report text was retrieved through document fetch and the figures below were checked against that text (REPORT 2017/014, 17 March 2017). Locators are in the sources appendix.
What we did not claim. That any fund or partner is a Trace-li client. That Trace-li would have prevented an allocation. That an OIOS audit is a criminal finding. That a missing scorecard means the project was wrongly chosen. That “no evidence of fraud” on two completed Iraq audits cleans the other thirty-three. That an accepted recommendation is implemented. That OCHA’s estimate of exposure in Ethiopia is an OIOS loss figure. That Annex 8 is a fraud-sanctions regime — the annex says it is not.
Cases locked after verification: OIOS 2025/098 (CBPF management and oversight, period 1 January 2023–31 December 2024); OIOS 2020/005 (OCHA Iraq and the Iraq Humanitarian Fund, 8 April 2020); OIOS 2017/014 (OCHA Ethiopia and the Ethiopia Humanitarian Fund, 17 March 2017, vintage). A companion note on Global Fund files is The award was signed. The proof was not ready. The UNFPA note is The workplan was signed. The competition file was not. The published case card for OIOS 2025/098 is founder Freeze #2, a thin rehearsal with no pack fields mapped from the packet. OIOS 2020/005 remains a fixture awaiting a founder freeze. The index is /cases.
Fletcher’s reporting priority: one record the next reviewer can use
In his 24 August 2026 Security Council briefing on Ukraine, Tom Fletcher called for unified donor tracking to replace parallel reporting. That gives this historical audit a current decision-maker’s question: can the selection record serve the next review without being assembled again?
The connection is Trace-li’s proposal, not a conclusion of the audit or an endorsement by Fletcher. Start with one reserve allocation: retain the partner-selection basis, supporting documents and the reviewer’s explanation of any departure from committee scores, then test whether later reviewers can retrieve and reuse that record with fewer repeated evidence requests. Reporting time saved is a pilot measure to establish, not a result already demonstrated. CBPF grant selection and supplier procurement have different rules; this case concerns the former.
03 The pattern across three audits
The funds are not failing a single test. OIOS’s 2025 opinion is that management and oversight were effective, and that documentation of partner pre-selection and project selection still needed to be complete. Iraq’s problem, in the paragraphs that matter here, is time: suspected cases referred for forensic audit, almost none of them finished. Ethiopia’s problem, in 2017, is design: money passed through a lead NGO to partners OCHA had itself selected, without a legal line back to those partners, and a large book of projects stayed with a partner a donor had suspended. The matrix is a synthesis. Ethiopia is not evidence of how a fund operates now.
04 Value chain: the Guidelines are the control surface
The product sentence is the same one used on the Global Fund note, narrowed again. What must be visible and dispositioned before the funding recommendation — modality, the allocation strategy, the basis for each invited or single-sourced partner, the scorecard where the Guidelines call for one, and a human note where a score and a recommendation do not match. Humans dispose. Trace-li freezes the record. OIOS still audits.
Annex 4 of the Global Guidelines is a scorecard for standard allocations, developed from the allocation strategy before strategic review starts. The four categories and weights are fixed across funds: strategic relevance 30 per cent, quality programming 30 per cent, monitoring 15 per cent, cost-effectiveness 25 per cent. The scorecard informs selection and does not exclusively decide it. A footnote says the scorecard may also be used under reserve allocations that involve a limited competitive process. That is not a sentence that every reserve project must carry a scorecard. OIOS records OCHA’s own position in the 2025 audit: scorecards were not mandatory for reserve, because partners are pre-selected on the strategy. OCHA’s accepted response to recommendation 3 then speaks of a OneGMS feature for consistent upload of mandatory project scorecards before a project is recommended for funding. Accepted wording is not the same thing as a rule already in force for every reserve file.
Annex 7 is eligibility: preliminary screening, registration in the UN Partner Portal and the Grants Management System, due diligence, and capacity assessment. The declarations in that guidance note cover accurate information, United Nations compliance activities, conflict of interest, non-support to United Nations designated entities, previous or pending legal processes, and protection from sexual exploitation and abuse. Annex 8 is non-compliance other than fraud and sexual exploitation or abuse, which go through their own standard operating procedures. Its measures are suggested, not mandatory. Annex 9 states a partner duty to notify OCHA immediately, within 48 hours, of a breach or possible breach of a Grant Agreement obligation, by the partner or a subcontractor. None of those annexes is a Trace-li rule pack. The wireframes below are a Global Fund-shaped desk, labelled as such.
05 Case 1 — The pre-selection that was not in the file
Standard allocations, as OIOS describes the Guidelines, support the response when time allows a competitive call against a humanitarian response plan or an equivalent plan. Reserve allocations are for rapid-onset and unforeseen circumstances when a standard allocation is considered infeasible. Applications come from a limited number of pre-selected eligible partners, by invitation, identified according to explicit criteria.
Globally, reserve was how most of the money moved: 58 per cent, US$661 million, in 2023 and 56 per cent, US$521 million, in 2024. In the same years the funds approved 1,287 projects (US$1.14 billion) and 1,103 projects (US$938 million). Those are approval volumes. They are not losses.
OIOS reviewed 15 reserve allocations. Five used a limited competitive selection among pre-selected partners. Ten used a single-sourced partner for each project. Of those ten, the basis for the single-source choice was justified for five, using project scorecards or other tools. It was not documented for the other five. For three of those five, the reserve strategy itself included some partner selection criteria. Criteria in a strategy are not a documented justification for the partner that was actually invited. Since 2025, the Pooled Fund Management Branch has reviewed allocation-strategy quality before finalization, including reserve selection criteria. OIOS says it did not review whether financing units consistently documented the partner-level justification, especially for single-source. Allocation strategies were not always saved to the CBPF Data Hub, which the audit says is required.
The project file has a parallel gap. Of 60 projects reviewed in OneGMS, 35 were standard allocations and 25 were reserve. Project scorecards or alternative project selection documents were missing for 2 standard projects and 11 reserve projects. OCHA told OIOS that scorecards were not mandatory for reserve. There were also mismatches between review-committee scores and the partners recommended, without a documented justification. OIOS does not count those mismatches. This note does not invent a count.
Recommendation 2 asks PFMB to monitor reserve pre-selection and to keep allocation strategies stored centrally. Recommendation 3 asks for monitoring of project selection and for selection decisions to be recorded or uploaded in OneGMS. OCHA accepted both. The response on recommendation 3 describes a future OneGMS feature so that mandatory project scorecards are uploaded before a project is recommended for funding. That is an accepted action. The audit does not say the feature was already operating across the 2023–2024 sample.
Two adjacent facts belong in the same reading, with their limits. Projects are supposed to close within 270 days of completion, assuming the partner and the audit firm are not late, once final reports, the project audit, and any refund are clear. As of November 2025, 3,938 projects launched between 2016 and 2023 were still somewhere in closure in OneGMS — 35 per cent of projects launched in that period. And the Secretariat, including OCHA, had no formal procedure for sanctioning partners, and no procedure for sharing information on non-performing partners with other United Nations organizations. The Board of Auditors recommended stronger information-sharing in 2024. OCHA was working on arrangements with other Secretariat entities. PFMB does keep a database of suspected and confirmed fraud cases for the Board, donors, and the Pooled Fund Working Group. A database is not a sanctions list. This note does not invent one.
Where the assurance path bites
Pre-selection basis and the selection upload
OIOS gap (verified): of 10 single-sourced reserve allocations in a sample of 15, the basis was not documented for 5. Of 25 reserve projects in a sample of 60, 11 lacked a scorecard or alternative selection document. OCHA: scorecards were not mandatory for reserve.
What must be visible before the funding recommendation: the allocation strategy, the reason each invited or single-sourced partner is in the set, and the selection record OneGMS is supposed to hold. Where the Guidelines make a scorecard obligatory — standard allocations — it is developed before strategic review. Where they do not, the absence still needs a disposition, not a silent file.
Illustrative product UI. Public case is not a client. Does not claim Trace-li would have prevented the finding.
06 Case 2 — Iraq: proof that arrived in hundreds of days
The CBPF standard operating procedures, as OIOS states them, give three ways to address reported fraud. The partner investigates, mostly when it self-reports. An independent firm does a forensic review. Or OIOS investigates. OIOS may also open its own investigation and does not have to notify OCHA first.
Only 2 of 35 suspected fraudulent cases under forensic audit from 2015 to 2019 had been completed. Those two took 382 days and 586 days from the partner notification date to completion. Both concluded there was no evidence of fraud or wrongdoing. External-audit terms of reference expect an ideal of six months. Forensic audits had no timeframe. OIOS’s point was that red flags needed a harder look before a case was commissioned, and that a standard time should exist even if the clock is not entirely OCHA’s to control.
Recommendation 3 — review the commissioning procedure and estimate standard timeframes — was accepted and remained open, pending evidence that the procedures had been updated. This note does not carry that recommendation forward to a later year. A 2020 “open” is a 2020 status.
The lesson for a pre-signature desk is not that forensic audit is unnecessary. It is that a suspicion which surfaces only after payment, and then waits a year or more for a file, is a poor substitute for the eligibility, conflict-of-interest, and selection record that Annexes 7 and 4 describe at the front of the award. “No evidence” on two finished audits is not a clean bill for the thirty-three that had not finished.
Where the assurance path bites
The question you can still ask before renewal
OIOS gap (verified): 2 of 35 suspected fraudulent cases under forensic audit, 2015–2019, completed; 382 and 586 days; both “no evidence of fraud/wrongdoing.” No forensic timeframe in the procedures OIOS reviewed.
What must be visible before the next award or renewal: whether a partner in that queue is still eligible, and a disposition a human owns — not a hope that the forensic file will arrive in time to explain a signature already made. The two completed conclusions stay attached to those two files.
Illustrative product UI. Public case is not a client. Does not claim Trace-li would have prevented the backlog.
07 Case 3 — Ethiopia, 2017: pass-through, then a suspension
In that period the Ethiopia Humanitarian Fund received US$121.4 million and allocated US$108 million to 159 projects. Reserve was already the main modality inside this one fund: 65 per cent, about US$76.4 million, against about US$41 million (35 per cent) on the standard modality. Those percentages are not the 2023–2024 global figures in Case 1. They are not on that chart.
OCHA had adopted a pass-through. It signed an agreement and disbursed to a lead NGO. The lead NGO signed and disbursed to participating NGOs. Three projects, about US$7 million, two lead NGOs, seven participating NGOs. The modality was not stated in the fund’s operational manual. OIOS found no evidence it had been cleared by the fund’s governing bodies, the Funding Coordination Section, and the Executive Officer. The process before signature was not adequately documented. Because OCHA, through the clusters, selected the participating NGOs, OIOS concluded OCHA had no legal recourse over the funds those NGOs received, and that selecting them potentially diluted recourse against the lead. Recommendation 1 — legal advice from the Office of Legal Affairs, and policies for consortium projects — was accepted and remained open. The annex target was 31 December 2018. This note does not update it.
Separately, a major donor audited the head office and global operations of an organization the report calls Implementing Partner A. The donor suspended funding to that partner globally. OCHA Ethiopia assessed the risk, reviewed the partner’s procurement controls, and with the Administrative Service Branch suspended further grants until further notice. Partner A was implementing five EHF projects totalling US$11.2 million, of which about US$9 million (80 per cent) had been disbursed. OCHA Ethiopia estimated financial exposure at about US$3.7 million. OIOS’s sentence is that exposure could be much higher, because the projects were still going or had finished but had not yet been audited for whether the expenditures were proper. US$3.7 million is OCHA’s estimate of exposure. It is not an OIOS loss figure, and it is not drawn as one.
Recommendation 2 — prioritize audits of Partner A’s completed projects and monitor those still running — was accepted and remained open pending the audit and monitoring reports. The partner is not named. This note does not name them.
Where the assurance path bites
Who the grant actually binds, after a donor has already stopped
OIOS gap (verified, 2017): pass-through of about US$7 million without a manual provision or documented clearance; no legal recourse over participating NGOs. Partner A: five projects, US$11.2 million, about US$9 million disbursed, further grants suspended, exposure estimated by OCHA at about US$3.7 million and described by OIOS as possibly higher and unaudited.
What must be visible before the next disbursement: the legal line to every partner who will spend the money, and a disposition when a donor suspension is already on the record. Vintage does not make the design question obsolete. It does forbid reading 2017 as the 2025 control state.
Illustrative product UI. Public case is not a client. Does not claim Trace-li would have prevented the finding.
08 What this means for PFMB, financing units, and humanitarian coordinators
These audits are public. They are not Trace-li clients. They are useful because reserve allocations accounted for the majority of CBPF funds awarded in 2023 and 2024, and the selection record is still the thing a later audit samples.
Practical questions before the funding recommendation
- Modality. Is this reserve because a standard call is infeasible, and is that judgment in the allocation strategy that will actually be stored?
- Pre-selection. For each invited partner, and especially for a single-sourced one, is the basis documented — not only a criterion somewhere in the strategy?
- Scorecard. For a standard allocation, was the scorecard built from the strategy before strategic review, on the four weighted categories? For a reserve file, if a scorecard is not required, what selection document is in OneGMS instead?
- Mismatch. If the review-committee score and the recommended partner diverge, is the reason written down? OIOS saw mismatches and did not count them. Do not treat silence as a zero.
- Eligibility. Are Annex 7’s declarations — including conflict of interest and designated entities — on the partner file before invitation, not after a forensic referral?
- Notification. Annex 9’s 48-hour duty is a partner obligation in the guidance note. It is not evidence that any of the sampled funds received such a notice.
- Sanctions honesty. There was, in this 2025 audit, no formal Secretariat procedure for sanctioning partners or for sharing non-performance with other United Nations organizations. Do not brief a list that does not exist. Annex 8’s measures are for non-compliance other than fraud, and they are suggested.
- Status honesty. Accepted, initiated, and open are the words the reports use. They are not “done.” Ethiopia remains 2017.
09 Soft close
One allocation strategy. One frozen pre-selection.
Bring one reserve allocation that is about to be recommended. The question is whether the invited partners, the single-source basis, and the selection record can be cited before the humanitarian coordinator signs — not whether a forensic audit will explain the file a year later.
Disclaimer
- Public OIOS reports, Guidelines and OCHA statements only. These cases are not Trace-li clients.
- Audit ≠ criminal. None of these three reports is presented as a criminal verdict.
- Missing document ≠ improper award. Undocumented pre-selection and a missing scorecard are file gaps. Incomplete file is not diversion.
- “No evidence” is narrow. It is what OIOS reports for two completed Iraq forensic audits. It is not a conclusion about the other 33 cases.
- US$3.7 million is OCHA Ethiopia’s 2017 exposure estimate. OIOS says exposure could be much higher because the projects were not yet audited. It is not a loss figure.
- Accepted ≠ implemented. Recommendations are reported as accepted, initiated, or open at the date of each report.
- 2017 is vintage. Ethiopia is not the control state described in the 2025 CBPF audit.
- No prevention claim. Trace-li freezes a pre-signature record. It does not rewrite these audits.
- Screens are illustrative Trace-li desk UI in a Global Fund pack shape. They are not a live OCHA or CBPF desk run, not OneGMS, and not OIOS exhibits.
Sources appendix
Full claim → locator table: sources appendix. 2025/098, 2020/005, and the Guidelines annexes were read as PDFs on 24 Sep 2026. 2017/014 text was retrieved the same day after the file URL returned HTTP 404 to a direct download.
- OIOS, Audit of the management and oversight of country-based pooled funds, 2025/098, 30 December 2025 — ¶23–25, ¶29, ¶31–34, ¶37. PDF
- OIOS, Audit of the operations of OCHA in Iraq, 2020/005, 8 April 2020 — ¶33–36. PDF
- OIOS, Audit of the operations of OCHA in Ethiopia, 2017/014, 17 March 2017 — ¶5, ¶22, ¶30, ¶34–35, recommendations 1 and 2. Vintage. PDF link (404 on direct download, 24 Sep 2026)
- OCHA, CBPF Global Guidelines (updated December 2022) and Annexes 4, 7, 8 and 9. Guidelines page
- OCHA, Tom Fletcher’s as-delivered Security Council briefing on Ukraine, 24 August 2026 — paragraph calling for unified donor tracking. Statement. Read on 11 Oct 2026; used as current reporting context.
- Companion notes: Global Fund, UNFPA. Published case card: OIOS 2025/098. Fixture case card: OIOS 2020/005.
© Trace-li Research Desk · OCHA CBPF research · 24 Sep 2026 · Updated 11 Oct 2026 Africa/Cairo.