ASF Institutional Policy Manual · Aligned with PHIG, September 2026
Part of the ASF policy framework, aligned with the equivalent PHIG policy. To raise a concern: see the ASF Complaints and Reporting Channel.
ASF checks that its controls work in practice, not only on paper, through a yearly risk-based internal review reported to the Board. Owner: Board Audit and Risk lead, with the Ethics Focal Point.
- Annual internal review plan: approved by the Board, covering the highest risks in the register (Policy 34) — for example procurement, payroll, sub-awards and safeguarding.
- Independence: reviews are done by someone not responsible for the area reviewed; for larger grants, ASF may engage an external reviewer.
- Scope: sample testing of transactions, procurement files, timesheets, asset checks and partner files against this manual and donor rules.
- Findings: rated high, medium or low, with an agreed action, owner and deadline; high findings are reported to the Board within 30 days.
- Follow-up: the Ethics and Compliance Officer tracks every action to closure and reports progress to each Board meeting.
- External audit: the annual statutory audit and any donor project audits follow Policy 22; auditors’ management letters are answered in writing within 60 days.