The evaluation concluded that the policy provides a firm foundation for risk management within WFP, constituting marked improvement from previous iterations. WFP’s risk culture has matured, with better integration of risk management functions and sustained corporate attention to risk. These changes accelerated following high-profile incidents. There is clear evidence that WFP is moving from risk being managed by specialists to becoming "everyone's business". However, this positive shift is not yet fully reflected across all employee roles and responsibilities. Risk escalation and risk mitigation processes require further clarification. Shortcomings remain in the trust and positive incentives required to foster open and transparent risk management practices.
The evaluation highlights critical areas for continued focus and puts forward five recommendations: revise, update and consolidate the enterprise risk management policy document and accompanying guidelines while ensuring coherence with other policies and corporate documents; take steps to further strengthen WFP’s risk management culture; strengthen enterprise risk management tools to enhance their contribution to decision-making and performance – including around cross-cutting issues; enhance the clarity of risk management resourcing and capacity; and enhance mutual transparency and accountability in relation to risk management with external stakeholders.