Earlier policy library. This page belongs to an earlier library of ASF policies. The current, approved governance set is the ASF Standards Package 2026 (GOV, OPS, QMS and EV documents). Where this page and the 2026 package differ, the 2026 package applies.
ASF Institutional Policy Manual · Aligned with PHIG, September 2026
Part of the ASF policy framework, aligned with the equivalent PHIG policy. To raise a concern: see the ASF Complaints and Reporting Channel.
ASF checks that its controls work in practice, not only on paper, through a yearly risk-based internal review reported to the Board. Owner: Board Audit and Risk lead, with the Ethics Focal Point.
- Annual internal review plan: approved by the Board, covering the highest risks in the register (Policy 34) — for example procurement, payroll, sub-awards and safeguarding.
- Independence: reviews are done by someone not responsible for the area reviewed; for larger grants, ASF may engage an external reviewer.
- Scope: sample testing of transactions, procurement files, timesheets, asset checks and partner files against this manual and donor rules.
- Findings: rated high, medium or low, with an agreed action, owner and deadline; high findings are reported to the Board within 30 days.
- Follow-up: the Ethics and Compliance Officer tracks every action to closure and reports progress to each Board meeting.
- External audit: the annual statutory audit and any donor project audits follow Policy 22; auditors’ management letters are answered in writing within 60 days.