Terrorist Diversion

A Guide to Prevention and Detection for NGOs

Oliver May, Paul Curwell

• Publisher: Routledge
• Year: 2020
• ISBN:
  9780429807503
• Edition: 1
• Topic: Business
• Subtopic: Organizzazioni non profit e di beneficenza
• Index: Business

Many of the world's 40, 000 International NGOs (INGOs) work in places where terrorist financing, sanctions breaches, and diversion are key risks. Almost all of the top ten recipient countries of humanitarian aid alone in 2015 were high-risk jurisdictions, for example, receiving more than £7bn between them. When they feel safe to speak, sector workers share sobering stories about what might have happened to some of this money.

As INGOs struggle to keep up with worsening humanitarian needs, diversion risks and their complexity remain daunting. The demands of internal stakeholders, donors, banks, and regulators are diverse and even contradictory. Public scrutiny has magnified, but is not always well-informed. Institutional donors transfer ever more risk to implementing partners, while some banks seek to avoid this business altogether, pushing some NGOs outside the global banking system. Looming over all of these converging pressures is a latticework of austere international sanctions and counter-terror regimes.

It is no surprise that INGOs find themselves struggling to reconcile this complex set of expectations with their charitable missions. Yet the consequences of failing to do so can be severe; future funding is contingent on reputation, and serious offences litter the regulatory landscape. The implications of breaches can be existential for organisations and criminal for individuals.

Terrorist Diversion: A Guide to Prevention and Detection for NGOs is an accessible, pragmatic guide for international NGOs of all shapes and sizes. Clearly explaining the nature of the challenge, and setting out a programme to meet it, it explores how it is possible for INGOs to manage these risks more effectively through their missions – not in spite of them.

Part I

1 The challenge

Terrorist diversion and INGOs

Oliver May

This chapter explores the likelihood of diversion for INGOs operating in certain contexts, and the vulnerability of these unique organisations. In broad strokes, it describes some of the key reasons why managing diversion risk is such a complex undertaking for an INGO. These factors, of course, are those of which any Anti-Diversion Programme (ADP) must take account. It also considers the consequences of failing to prevent diversion incidents – whether they are detected or not.

The likelihood of diversion

Determining the likelihood of diversion requires nuance. Other integrity-related risks, such as sexual abuse or fraud, may carry a relatively consistent level of opportunity across most INGOs; they all work with people, they all have funds that can be abused. But diversion is not the same – not all INGOs share exposure to the core risk factors. Determining a general risk level for the sector may fail to appreciate its diversity, nor necessarily be constructive.

That said, there are common factors shared by some organisations within the sector. Indeed, in 2017, three sectoral assessments in the UK (HM Treasury), Australia (AUSTRAC/ACNC), and the Asia region (AUSTRAC) all revised the charity sector’s general risk level downwards – but identified a higher risk subset of internationally operating organisations.

INGOs at an elevated likelihood of diversion might be those that can see their situation in three factors identified by FATF (2014): The value of an INGO’s resources or activities to a diversionary, the INGO’s proximity to that diversionary, and that diversionary’s capability and intent to abuse them.

Figure 1.1 Factors elevating diversionary likelihood.

The value of an INGO’s resources or activities to a diversionary

In 2016, the top five recipient countries of humanitarian assistance – Syria, Yemen, Iraq, Palestine, and South Sudan – received $7.7bn (£6bn) between them (Development Initiatives, 2018) and were, at the time, all high-risk jurisdictions with active and organised diversionary threats. As significant proportions of these funding streams are delivered through INGOs, their operations represent a major channel of resources into fragile states and conflict zones. To put it another way, as an INGO security advisor told Benelli et al. (2012), “NGOs are walking dollars.”

Funds do not have to be liquid to be of use to diversionaries, either. While both food and Non-Food Items (NFIs) alike can serve diversionaries directly, they can also serve a diversionary’s purposes; these items can be liquidated or can be distributed to others to gain legitimacy with local populations. Even non-distributional forms of intervention can be of use to a diversionary, such as the construction of amenities and infrastructure, or training in critical skills.

Indeed, the very nature of humanitarian and development assistance means that, to a diversionary, many of its outputs are likely to be valuable. In fact, Belliveau (2015) found that the perceived value of the service provided by Médicins Sans Frontières (MSF) in Somalia was a critical factor in the agency gaining access in the first place.

Proximity

INGOs do not have to be operating in the base countries of diversionaries to be at risk – merely adjacently. In one matter of which I am aware, Al-Shabaab allegedly levied fees from INGOs in Kenya, across the border from Somalia. And adjacency does not have to be geographic either; risk can rise for INGOs working with particular populations known to be targeted by diversionaries for recruitment purposes.

In fact, of the top ten recipient countries of humanitarian assistance in 2016, nine were either high-risk conflict zones or were adjacent to one (Development Initiatives, 2018). Between them, they received more than 60 per cent of global humanitarian funding that year at over $11bn (£8.6bn). There was known, organised diversionary activity in at least eight.

Diversionary capability and intent

FATF (2014) notes that both capability and intent must be present for a diversionary to pose a threat. A group, for example, may have the capability to divert resources from an INGO but may not wish to do so. Similarly, a group may wish to divert resources, but may not have the ability to do so.

The geographic, social, and political power of diversionaries can be easy to underestimate. Given that many such groups see themselves as governments-in-waiting (in some cases, de-facto governments), it should be expected that they could exact a sophisticated approach to diversion where their value chains and those of INGOs intersect. Al-Shabaab appointed local humanitarian officers to co-ordinate with aid groups and ensure the collection of fees ( Jackson and Aynte, 2013), while the Taliban in Afghanistan had a ‘minister’ for the management of aid agencies (Jackson and Giustozzi, 2012).

The vulnerability of INGOs to diversion

Although every INGO is unique, a number of common enablers of vulnerability may exist for those that work in proximity to diversionaries. Themes INGOs should watch out for include a low risk maturity but a high risk appetite, an over-sensitivity to cost that impedes proportionate investment, the phenomenon of risk transfer, and shared factors with wider fraud and corruption vulnerabilities.

Low risk maturity versus high risk appetite

In East Africa, I once delivered AML/CTF workshops to nearly 50 national and international NGOs. When I asked participants whether any had conducted an AML/CTF risk assessment, none had. Then I asked if anyone had conducted any kind of risk assessment at all, and only one hand went up.

In recent years, there has been significant development in the application of risk management across the aid sector. This includes the adoption of Enterprise Risk Management (ERM) (Modirzadeh, 2013), for example, activity by sector collectives and peak bodies, and even the use of compliance software (Harvard Law School, 2014). Even so, the capacity and capability of many INGOs to manage diversion risk remains questionable. The CHE project found that most respondents in a survey of about 500 humanitarian and development workers (mostly from senior or project management, or legal departments) declared only a ‘slight’ or ‘moderate’ familiarity with counter-terror laws (Burniske and Modirzadeh, 2017). Debarre (2019) described a lack of understanding amongst humanitarian stakeholders of sanctions regimes.

Meanwhile, many organisations swing between overly simplistic and paralysingly complex approaches to risk. Without meaningful risk assessment, managers cannot be confident that controls are proportionate or effective. The absence of good risk management sits behind not just the absence of controls, but over-control in which bureaucratic procedures hinder delivery and do not actually modify the real risks the organisation faces.

And so, a core enabler of vulnerability to diversion is what we might call the ‘jaws of trouble’ – where low organisational risk maturity meets high risk appetite. Put simply, ‘risk maturity’ is the extent to which an INGO has implemented effective risk management. The poorest maturity is naivety; no concept of risk nor real management of it. The greatest maturity would see an organisation not just managing hazards well, but managing risk so effectively that it was able to embrace risky opportunities. Meanwhile, ‘risk appetite’ represents the total volume of residual risk that an organisation is prepared to bear.

There are a range of drivers pushing INGOs towards the jaws of trouble, but four might be particularly common. Firstly, that for INGOs, risk appetite decisions are often powered by a moral imperative. This differentiates them from companies, answerable for their bottom lines and luxuriously selecting operating theatres on the basis of a nuanced analysis of profit, risk, and opportunity. For humanitarian agencies in particular, that ‘life and limb’ principle – part of the humanitarian imperative – is a heavy weight on the scales and, if it is not treated carefully, can obliterate balanced risk analysis.

The second driver is how the operational ambitions of many INGOs outstrip their resources. This often derives from a fundamental tension: The push to help ever more beneficiaries versus the failure to adequately invest in the business support functions necessary to do so safely. This stretch rapidly becomes untenable, and holes appear.

The third might be the limited extent to which informed self-reflection around risk exists in many INGOs. While the Charity Finance Group’s (CFG) 2018 survey of British charities operating overseas found that most respondents thought that they were at a low, or very low, risk of money-laundering or terrorist-financing, this was also the view of that group in Nairobi at the start of my workshop. At the end, the modal response was that they were at a medium risk.

Perhaps this is, in part, a consequence of fourth driver – that diversion often suffers from poor risk visibility. Challenges to incident detection can make it difficult to develop an informed risk picture, while diversion risks can span multiple functions, and change rapidly and unpredictably (Modirzadeh, 2013).

Over-sensitivity to cost

A key enabler for the misalignment of ambition and resource is chronic underinvestment in business support functions. Sensitivity to such costs is hard-wired into global development. This is even expressed in the language of some of the key research into diversion. For example, Pantuliano et al. (2011), Mackintosh and Duplat (2013), Harvard Law School (2014), Metcalfe-Hough et al. (2015), and CFG (2018) all use the term ‘burden’ – sometimes paired with ‘administrative’ – to describe aspects of the INGO response to counter-terrorism. This tells us something important about how diversion risk management might be unconsciously seen by many in the sector – as a set of secondary activities, rather than integral to the safe delivery of operations. Certainly, NGOs are known to underinvest in business support ( Jones, 2018) and local and national NGOs do not often enjoy substantial funding for ‘overheads’ in their contracts (Stoddard et al., 2019).

The challenge for us is that the sensitivity to their cost which leads to underinvestment is not necessarily driven by a sober risk management equation, but by powerful outside levers. These might include, for example, the unreasonable expectations of uninformed public commentators (such as Gina Miller’s 2015 attack on charity cost ratios – see Ricketts, 2015), ideologically-driven political pressures, and sectoral norms at the intersection of fundraising and accounting that create a ‘race to the bottom’ on ‘administrative’ cost reporting.

Risk transfer: A systemic flaw

Risk transfer, usually through contractual means, involves shifting a risk onto another party. Generally speaking, this is a sensible way to alleviate the likelihood or consequences of a risk (particularly its financial liabilities). Perhaps the most commonly-used allegory is home insurance. One pays a small, regular fee so that if one’s possessions are stolen or damaged by fire, the insurer will take care of the matter.

Aid operations make extensive use of risk transfer. One of the most common operating modalities in the sector features a long funding chain, in which big government or multilateral donors engage INGOs, who in turn engage local partners, to execute project aims. In a matter I examined in Africa, there were more than a dozen organisations in one such chain.

The rationale for risk transfer seems relatively sound at face value. Other organisations enjoy greater access and local knowledge, and are therefore in a better position to deliver the project’s aims and control its risks. While this might sound attractive, there are ways that it might actually elevate vulnerability to diversion.

Firstly, risk transfer is rarely complete. In the home insurance example, the risk has only been transferred in certain circumstances, and only a particular consequence is covered by the transfer. One is still required to reduce the likelihood of theft, for example, by locking doors, or the insurer may not pay out. Donors do not fully transfer the risk of diversion – they are not fully protected from all the consequences, such as reputational damage. Similarly, Metcalfe et al. (2011) also found that INGO staff would still feel a moral responsibility for the partners to whom the risk had apparently been transferred.

Secondly, the concept relies on the ability of the transferee to reduce the likelihood or absorb the consequences. But in this sector, capacity and capability to manage the risks often decline with each step down the funding chain; a phenomenon exacerbated by the increased focus on ‘localisation’ and the masking of ‘partnership’ in flowery terms that bely that this is often no more than a subcontracting arrangement. Indeed, Stoddard et al. (2019) found that the use of local partnerships as a cost-effective means to scale up in Nigeria and South Sudan, for example, had the effect of incentivising competition amongst local NGOs to take on more risk. Abild (2009) meanwhile argued that some actually profit from risk transfer and what he called the ‘Nairobi field divide’. If that were so, then the opacity inherent in much risk transfer potentially becomes an enabler for payments to diversionaries.

Shared factors with wider fraud and corruption

Diversion shares characteristics with the...

Table of contents

• Cover
• Title
• Copyright
• Contents
• List of Figures
• List of Tables
• List of acronyms
• Acknowledgments
• Foreword
• Introduction
• Part I
• Part II
• Appendix
• Index