---
title: "No defined exit strategy: the audit line that concerns you"
description: "An internal WFP audit, seen by FRANCE 24 and PassBlue, reveals no exit strategy from its software supplier: the question that concerns every critical supplier."
url: https://csidia.com/en/notes/audit-wfp-nessuna-strategia-di-uscita/
lang: en
date: 2026-08-10
label: "Observatory"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/audit-wfp-nessuna-strategia-di-uscita/
---

# No defined exit strategy: the audit line that concerns you

If the supplier holding your organisation’s data together closed the relationship — or if you were the one to end it — could you say how long it would take, in what format, and at what cost? If the answer is “we’ve never actually tested it”, you are not the exception: it is the ordinary condition of anyone entrusting critical data to a supplier without ever verifying the exit. On 7 August 2026 an investigation made that question concrete, inside the internal audit of one of the largest organisations in the world.

## A “high priority” audit, a renewal all the same

FRANCE 24 and PassBlue published **in coordination** — one investigation with two bylines, not two independent confirmations — an internal audit of the United Nations **World Food Programme**, drawn up by the agency’s Office of the Inspector General and dated August 2025, on the WFP’s five-year relationship with a US data-analytics software company. The audit is not public: the outlets say they have seen it, while the WFP finalises the renewal of the 2019 contract — **pro bono**, five-year, declared value **$45 million** — for **DOTS** (Digital Operations and Transformation System), built to track the agency’s aid deliveries. “The general scope and terms of the contract remain the same,” a WFP spokesperson said.

The audit rates the problem “high priority”: “inadequate risk management”, no “proper guidelines and policy” on data, “key privacy concerns” never addressed “since the inception of the partnership”; the WFP “lacks a unified and trusted system” to manage them, while “reputational considerations” tied to the partnership “have led to institutional uncertainty”. Then the line that gives this piece its title: “At present, there is no clearly defined exit strategy for DOTS, nor clarity on the potential costs that may arise should the partnership be terminated”. The technology division “has assessed opportunities to export and save data from DOTS”, but the plan was never presented to the key parties, not even to the company, while “substantial” investment continues.

## The software works. That’s the problem.

The news is not that the company’s software performs badly. It’s the opposite, and it’s more uncomfortable. A former employee who used it extensively calls DOTS “the best tool in the sector. Nothing comes close to it”: roughly **98% of WFP operations** run through DOTS, and removing it would make the supply chain “collapse”. Another employee judges it “mediocre” instead — “it doesn’t bring anything new that wasn’t already available on the open internet”. We report both: the thesis doesn’t change. **A mediocre supplier gets replaced.** One that 98% of an organisation uses daily, with an exit plan never tested, no longer gets replaced: it holds you, not through a clause against you but through the absence of one in your favour. What counts is who holds the key, not who is right about the product — the same dependency as [who retains ownership of the operating model in a deal with a major supplier](https://csidia.com/en/notes/palantir-mercury-ontologia-di-chi-e).

DOTS is not **SCOPE**, the WFP’s biometric system, among the largest biometric databases in the world: the company reportedly pushed hard for access to SCOPE, but some internal officials kept biometric data outside its perimeter. A cyberattack on the WFP in May 2026 exposed the data of thousands of aid beneficiaries in Gaza: the WFP says it involved the Self-Registration Application for Palestine, with “no direct connection” to the company’s software.

## The other voices: Skau, the company, Europe

Acting director **Carl Skau** reportedly acknowledged the relationship is problematic, but said leaving would be costly with systems now intertwined; he did not respond to FRANCE 24. The company declined an interview, calling itself “proud to partner with the World Food Programme”: it “does not use, retain or sell customer data for its own purposes”, “we do not use customer data to train models”. The WFP says it is not locked into any single supplier: “WFP processes and controls all its own data”. The pro bono contract still requires paying for cloud and support: the UN records over **$10.5 million** paid to the company from 2017 to 2024, while — according to a staff member who spoke to the two outlets — an internal assessment put building an equivalent in-house at **$20 million**. The same employee calls the pro bono contract “a vendor lock-in contract”: that is their reading, not a word the audit uses.

The European context helps make sense of the story. In June, France’s **DGSI** ended its partnership with the same company for a domestic competitor: the decision, said France’s ambassador for digital affairs and AI **Clara Chappaz**, came “in part, over concerns about data sovereignty and digital resilience”. Germany’s domestic security service did the same. Britain’s **NHS** admitted in May that some of the company’s staff could access identifiable patient data, contrary to earlier statements.

[See the service](https://csidia.com/en/solutions/document-compliance) · [Talk to an engineer](https://csidia.com/en/contact)

## The clause nobody reads to the end

There is also a contractual reason to write an exit strategy before signing. Privacy International, in its report “All Roads Lead to [the company]” (November 2021), analysed a 2019 licence between the company and the US Department of Defense, obtained via FOIA: the company may collect usage data on the Products “to monitor, analyze, maintain and improve the Products”. The same document defines “Products” as “the Client Software, Cloud Solutions and Software specified in the Order”, and “Software” as “the [company’s] proprietary commercial software, models, and algorithms [...] in any format”. A chain of definitions, not an opinion: if Products include Software, and Software includes “models, and algorithms”, improving the Products includes, by contract, improving models and algorithms. Privacy International finds an almost identical clause — 18.9 — in Gotham and Foundry’s terms on the UK government’s Digital Marketplace.

The company exercised its right of reply in the same report, and on the WFP wrote: “[The company] deploys our commercially available data integration platform, Foundry, in an environment where access and use are controlled by the WFP.” Lawyer **Chris Wlach**: suppliers have always wanted usage data to improve performance, “but today, data can also help train algorithms and AI models” — and whoever hands it over needs to know that.

## Sources

- [FRANCE 24 — exclusive: the WFP renews its contract with the company despite concerns raised in a leaked audit (7 August 2026, updated 9 August)](https://www.france24.com/en/americas/20260807-never-speak-about-palantir-leaked-audit-reveals-the-un-s-palantir-problem-united-nations-ai-tech-wfp-iaea-ethics)
- [PassBlue — Never Speak About It: investigation into the WFP’s leaked audit (7 August 2026)](https://passblue.com/2026/08/07/never-speak-about-it-leaked-audit-reveals-the-uns-palantir-problem/)
- [Privacy International — report on the company, with its reply (November 2021, PDF)](https://privacyinternational.org/sites/default/files/2021-11/All%20roads%20lead%20to%20Palantir%20with%20Palantir%20response%20v3.pdf)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/audit-wfp-nessuna-strategia-di-uscita/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com