Policies and processes

Risk, internal control, and audit

Improving the effectiveness of organizational risk management, control, and governance processes remained one of the top priorities for the IIASA Council and Executive in 2019. IIASA maintains a comprehensive risk register, which is continuously reviewed and updated. Appropriate actions aimed at mitigating or removing organizational risks are undertaken to prevent potential negative impacts for IIASA.

Committed to bringing in a systematic approach to evaluating and mitigating risks, the IIASA Council and Executive decided to establish an internal audit function. The purpose of this function will be to introduce a professional auditing of the governance, risk management, and internal controls at IIASA, to ensure compliance with the regulatory framework and to enhance performance, organizational learning, and efficiency and effectiveness of IIASA operations.

Delegation of authority and conflict of interest

The IIASA Council adopted a Delegation of Authority Framework in 2019, with the aim of improving transparency and the effectiveness of its decision-making processes. The new framework assigns appropriate levels of involvement in the decision-making process to the IIASA Council, the council committees, and IIASA management. This ensures efficient decision-making while retaining an apt segregation of duties, thus minimizing potential conflict of interest. Further actions taken included a decision that Council members and National Member Organization secretaries need to step down from their roles when applying for IIASA executive positions.

Social and ethical responsibility

Committed to strengthening the engagement and wellbeing of IIASA staff, and in response to recommendations from the 2017 Institutional Review, IIASA embarked on an institute-wide campaign to collectively define IIASA’s core values. The established values will serve as the backbone of the IIASA Strategy 2021-2030 and the new IIASA People Strategy. In addition they will be embedded into the daily working environment to help create an inclusive and respectful working culture for staff members at all levels. In 2019 a Works Council constituted according to Austrian labor law was established at IIASA to represent the interests of staff.

Financial policies

The Finance Committee of the Council supervises the institute’s accounting and auditing activities, the annual payments of National Member Organization contributions, the realization of royalties and other revenues, and the annual financial reports. IIASA is also legally obliged under the Austrian Association Act and Austrian Commercial Law to have its accounts externally audited on an annual basis. IIASA’s statutory financial statements are presently audited by BDO Austria.

In addition, some external funders require that the projects they contribute to are individually audited, with around 25 project audits being carried out in 2019. The European Commission (EC), a major contributor to the institute’s external funding, also sometimes performs second-level audits on already externally audited EC projects. To date, four major second-level audits on twelve projects were carried out in 2009, 2011, 2015, and 2017 respectively. All of these were successfully concluded.

At IIASA, financial policies and procedures are in place for:

• Sponsored research and budgeting for proposals (sections 4.4.7 and 4.4.8 of the IIASA Operating Procedures and Policies)
• Procurement, business travel, organizing conferences, and visits from external collaborators and stakeholders (section 4.4 of the IIASA Operating Procedures and Policies)
• A budget planning and oversight process (section 4.4.2 in IIASA Operating Procedures and Policies)

The procedures and approval processes are facilitated and documented through the IIASA Management Information System.

Data protection and privacy

In 2019 IIASA continued to develop a register of data processing activities. The register, which is required under the EU General Data Protection Regulation (GDPR), lists all the institute’s activities which process personal data. In addition to the legal requirement, it gives IIASA a comprehensive, centrally located overview of all personal data it processes, the legality of the processing, and the location of said data, making it easier to respond to data subject requests in a timely and correct manner. Also in 2019, IIASA investigated the security of its data processing activities. In close co-operation with the relevant departments, several measures have been taken to improve these processes and the related infrastructure to make the data holdings of the institute more resilient to cyber threats.

Intellectual property and copyright

IIASA follows the rules and procedures laid out in the institute’s patent and software policies. The Patent Policy ensures that any invention made in the course of research activities at IIASA is used to bring about the widest possible benefits. This includes that the institute gains financially from any commercial exploitation of patents resulting from the use of its resources, and that favorable terms are applied in granting licenses to organizations and citizens of National Member Organization countries. The Software Policy defines and protects the intellectual property rights for software developed by IIASA staff, and outlines the processes for commercialization, licensing, and distribution.

The IIASA Copyright Policy takes the practices of international journals and publishers into consideration and aims to facilitate the widest possible dissemination of IIASA results. In 2019, a new Scientific Publications and Copyright Policy was updated in order to take into account the latest developments in academic publishing, open access publishing, and the use of creative commons licenses to expand the sharing and uptake of IIASA research. The new policy is expected to be introduced in 2020.

Data management and archive policies

The IIASA rules laid out in its policies on Good Scientific Practice and Conflict of Interest, constitute the institute’s current data archiving standard. To comply with the requirements of research funders and other collaborators, IIASA policy stipulates that all primary research data must be retained for a minimum of 10 years, thus ensuring the reproducibility of findings and results. In addition, model-based work, model specifications, and methods of analysis have to be sufficiently documented, ideally in a peer-reviewed publication or its official supplement.