# EUR-Lex - 52012SC0283 - EN

*|*

# 52012SC0283

**COMMISSION STAFF WORKING DOCUMENT Implementation of recommendations and audit executive summaries /* SWD/2012/0283 final */**

			*

			*

COMMISSION STAFF WORKING DOCUMENT

Implementation of recommendations and
audit executive summaries

Accompanying the document

Report from the Commission to the
European Parliament and the Council

Annual Report to the Discharge
Authority
on internal audits carried out in 2011
(Article 86(4) of the Financial Regulation)

TABLE OF CONTENTS

1........... Implementation of
Recommendations.............................................................................. 9

2........... Executive summaries..................................................................................................... 10

2.1........ Governance.................................................................................................................. 10

2.1.1..... Fraud........................................................................................................................... 10

2.1.1.1.. AGRI Fraud Prevention and Detection.......................................................................... 10

2.1.2..... Ethics........................................................................................................................... 11

2.1.2.1.. COMP: Follow up on Handling of
sensitive information and Ethics................................. 11

2.1.3..... Business Continuity management................................................................................... 11

2.1.3.1.. Consolidated: Follow up on Business
Continuity Management........................................ 11

2.2........ Assessing the Commission's
Performance...................................................................... 12

2.2.1..... ENTR & EACI: Performance Audit
of the Entrepreneurship and Innovation Programme (EIP) managed by DG ENTR and
the EACI.................................................................................................... 12

2.2.2..... ECHO: Performance of ECHO's
operational activities................................................... 13

2.2.3..... MARKT: Monitoring by DG MARKT of
the Application of Public Procurement Rules in the Member States   15

2.3........ Control strategies.......................................................................................................... 16

2.3.1..... Research Area.............................................................................................................. 16

2.3.1.1.. INFSO: DG INFSO's Control Strategy
for on-the-spot control and fraud prevention and detection     16

2.3.1.2.. RTD: DG RTD's Control Strategy for
on-the-spot control and fraud prevention and detection  17

2.3.2..... External Aid................................................................................................................. 19

2.3.2.1.. DEVCO: EDF Grants................................................................................................... 19

2.3.3..... Rural Development....................................................................................................... 20

2.3.3.1.. AGRI: Audit on the Internal Control
System for managing the Instrument for Pre-Accession Assistance for Rural
Development in DG AGRI............................................................................................ 20

2.3.4..... TEN-T EA................................................................................................................... 21

2.3.4.1.. TEN-T EA: Control strategy in the
Trans-European Transport Network Executive Agency (TEN-T EA)         21

2.4........ Global Navigation Satellite
System Programs (GNSS)................................................... 22

2.4.1..... ENTR: Global Navigation Satellite
System Programs (part: Governance, Risk management and Project Management)............................................................................................................... 22

2.4.2..... ENTR : Global Navigation Satellite System Programs
(part: Actions, Grant & Procurement Management)        23

2.4.3..... ENTR: Global Navigation Satellite
System Programs (part: Financial Circuits, Financial Management and Accounting
for Fixed Assets)........................................................................................ 25

2.5........ Financial Management Process..................................................................................... 26

2.5.1..... Guarantees................................................................................................................... 26

2.5.1.1.. Consolidated: Management of
Guarantees (BUDG, ELARG, DIGIT, EACI)................. 26

2.5.1.2.. BUDG: Management of Guarantees
(BUDG, ELARG, DIGIT, EACI).......................... 27

2.5.1.3.. ELARG: Management of Guarantees
(BUDG, ELARG, DIGIT, EACI)........................ 27

2.5.1.4.. DIGIT: Management of Guarantees
(BUDG, ELARG, DIGIT, EACI)........................... 28

2.5.1.5.. EACI: Management of Guarantees
(BUDG, ELARG, DIGIT, EACI)............................ 28

2.5.2..... Procurement................................................................................................................. 28

2.5.2.1.. OIB: Management of Procurement in
OIB..................................................................... 28

2.5.2.2.. HR: Management of Procurement by DG
HR................................................................ 29

2.5.2.3.. OIB: 2nd Follow-up Audit of the
management of Procurement Contracts in OIB........... 29

2.5.2.4.. JRC: Follow-up audit on Procurement
in JRC............................................................... 29

2.5.3..... Recoveries................................................................................................................... 30

2.5.3.1.. EAC: Follow-up audit on Recoveries............................................................................ 30

2.5.3.2.. BUDG: Follow-up audit on Recoveries......................................................................... 30

2.5.3.3.. LS: Follow-up audit on Recoveries............................................................................... 30

2.5.3.4.. INFSO: Follow-up audit on
Recoveries........................................................................ 30

2.5.3.5.. DEVCO: Follow-up audit on
Recoveries...................................................................... 30

2.5.3.6.. EACEA: Follow-up audit on
Recoveries....................................................................... 31

2.6........ Information Technologies.............................................................................................. 31

2.6.1..... Local IT....................................................................................................................... 31

2.6.1.1.. DG EMPL: Audit on Management of
Local IT in DG EMPL......................................... 31

2.6.2..... Security of IT environment in
subcontracted projects IT................................................. 32

2.6.2.1.. REGIO: Audit on Security of IT
environment in subcontracted projects IT in DG REGIO 32

2.6.3..... Management of the
telecommunication infrastructure and services sTESTA.................... 33

2.6.3.1.. DIGIT: Audit on the Management
telecommunication infrastructure and services sTESTA in DG DIGIT           33

2.6.4..... Enterprise Europe Network IT tools............................................................................. 34

2.6.4.1.. EACI: Audit on Enterprise Europe
Network IT tools in EACI....................................... 34

2.6.5..... Follow-ups on IT audits................................................................................................ 35

2.6.5.1.. TAXUD: Follow-up audit on the large
IT Systems in DG TAXUD................................ 35

2.6.5.2.. TAXUD: Follow-up audit on New IT
Organisation and Contractual Framework............ 35

2.6.5.3.. PMO: Follow-up audit on Management
of Local IT...................................................... 35

2.6.5.4.. LS: Follow-up audit on Management
of Local IT........................................................... 36

2.6.5.5.. OLAF: Follow-up audit on the
Anti-fraud Information System (AFIS)........................... 36

2.6.5.6.. INFSO: Follow-up Audit on the
Management of Research Information Systems in DG INFSO           36

2.6.5.7.. RTD: Follow-up Audit on the
Management of Research Information Systems in DG RTD 36

2.7........ Other audits.................................................................................................................. 36

2.7.1..... JRC: Audit on Competitive
Activities............................................................................. 36

2.7.2..... BUDG: Implementation of the
Internal Control standard 13 on Accounting and Financial reporting       38

2.8........ Follow-up audits (if not in the
above categories)............................................................ 39

2.8.1..... RTD: Follow-up audit on DG RTD's
Internal Control System for managing FP7 – Design 39

2.8.2..... REA: Follow-up audit on the set up
of Internal Controls and Financial Management Systems – Design in REA 39

2.8.3..... HR-DS: Follow-up audit on
Monitoring of Security as managed by HR-DS................... 39

2.8.4..... AGRI: Follow-up audit on Rural
Development.............................................................. 39

2.8.5..... INFSO: Follow-up audit on DG
INFSO's Internal Control System for managing FP7 – Design           40

2.8.6..... ERCEA: Follow-up audit on ERCEA on
the set up of internal controls/financial management system – Design  40

2.8.7..... EMPL: Follow-up of the audit on
the internal control systems for managing the new Structural Funds programming
period – Phase II.......................................................................................................... 40

2.8.8..... REGIO: Follow-up of the audit on
the internal control systems for managing the new Structural Funds programming
period – Phase II.......................................................................................................... 40

2.8.9..... HOME: 2nd Follow-up audit on
Grants under Shared management of the European Refugee Fund in DG HOME.................................................................................................................................... 40

2.8.10... TEN-T EA: Joint IAS/TEN-T EA IAC
Follow-up audit on Audit of the Management of the Operational Budget in TEN-T
EA................................................................................................................... 40

2.8.11... ECHO: 2nd Follow-up audit of NGOs
funding in DG ECHO........................................ 41

2.8.12... ELARG: 2nd Follow-up audit on
"Ex-post control activities in DG ELARG".................. 41

2.8.13... FPI: Follow-up audit on the
financial management of the Common Foreign and Security Policy Budget 41

2.8.14... OIL: Second follow-up audit on the
Evaluation of targeted internal control standards in OIL     41

2.8.15... HR & OIB: 2nd Follow-up Audit
of the Management of Building Procurement Contracts by DG HR and OIB 41

2.8.16... EACI: Follow-up audit on the
management of the Operational Budget of the EACI........ 42

2.8.17... MARKT: Follow-up audit on
Monitoring the Implementation of EU law........................ 42

2.8.18... ENV: Follow-up audit on Monitoring
the Implementation of EU law.............................. 42

2.8.19... SG: Follow-up audit of the
Consolidated report on Monitoring the Implementation of EU law  42

2.8.20... MARE: Follow-up audit on the European
Fisheries Fund as managed by DG MARE..... 42

2.8.21... OIB: Follow-up audit on the
Inventory Process as managed by OIB.............................. 42

2.8.22... OIL: Follow-up audit on the
Inventory Process as managed by OIL.............................. 43

2.8.23... EPSO: Follow-up of the Limited
Review on the selection process as managed by EPSO 43

2.8.24... SANCO: Second Follow-up on Grant
management (Food & Feed) in DG SANCO..... 43

2.8.25... PMO: Follow-up audit on the
activities of PMO/6 ISPRA............................................. 43

2.8.26... DEVCO: Follow-up audit of remaining
recommendations on 2003 IAS In-depth Audit of DG AIDCO            43

2.8.27... EAC: Follow-up audit of remaining
recommendations on 2004 IAS In-depth Audit of DG EAC          44

2.8.28... ELARG: Follow-up audit of remaining
recommendations on 2003 IAS In-depth Audit of DG ELARG 44

2.8.29... ESTAT: Follow-up audit of remaining
recommendations on 2003 IAS In-depth Audit of DG ESTAT  44

1.           Implementation
of Recommendations

Table 1 sums
up the level of implementation of accepted recommendations, based on the
auditees’ assessments, for IAS recommendations made during the period 2007-2011[1].
The recommendations not yet implemented are broken down by period overdue on
the right-hand side of the table.

Year || Priority || Total || Implemented || In progress (by number of months overdue)

|| || || No || % || No || % || No delay || 0-6 || 6-12 || 12+

2007 || Critical || 4 || 4 || || || || || || ||

Very important || 123 || 121 || || 2 || || || || || 2

Important || 159 || 158 || || 1 || || || || || 1

Desirable || 33 || 32 || || 1 || || || || || 1

|| 319 || 315 || 99% || 4 || 1% || || || || 4

2008 || Critical || 0 || 0 || || || || || || ||

Very important || 138 || 130 || || 8 || || 1 || || || 7

Important || 164 || 154 || || 10 || || 1 || || || 9

Desirable || 13 || 12 || || 1 || || || || || 1

|| 315 || 296 || 94% || 19 || 6% || 2 || || || 17

2009 || Critical || 2 || 2 || || || || || || ||

Very important || 138 || 127 || || 11 || || || || || 11

Important || 144 || 132 || || 12 || || || || || 12

Desirable || 5 || 5 || || || || || || ||

|| 289 || 266 || 92% || 23 || 8% || || || || 23

2010 || Critical || 2 || 2 || || || || || || ||

Very important || 126 || 79 || || 47 || || 18 || 25 || 4 ||

Important || 149 || 104 || || 45 || || 14 || 24 || 5 || 2

Desirable || 4 || 3 || || 1 || || || || 1 ||

|| 281 || 188 || 67% || 93 || 33% || 32 || 49 || 10 || 2

2011 || Critical || 0 || 0 || || || || || || ||

Very important || 56 || 6 || || 50 || || 44 || 6 || ||

Important || 101 || 13 || || 88 || || 83 || 5 || ||

Desirable || 1 || 1 || || || || || || ||

|| 158 || 20 || 13% || 138 || 87% || 127 || 11 || ||

|| || || || || || || || || ||

TOTAL 2007-2011 || 1362 || 1085 || 80% || 277 || 20% || 161 || 60 || 10 || 46

Table 1. Level of implementation of recommendations based on auditees’ assessments

2.           Executive
summaries

This working document also contains the
original executive summaries (reflecting the state of play at the time when
the audits were finalised) of audit engagements finalised by the IAS in
2011[2].
Each summary underwent the applicable standard professional validation and
contradictory procedures between auditor and auditee at the time of
finalisation. It also contains statistical information for the acceptance of
the recommendations

2.1.        Governance

2.1.1.     Fraud

2.1.1.1.  AGRI
Fraud Prevention and Detection

a. Background

DG AGRI budget finances
the Common Agricultural Policy expenditure mainly through two shared management
Funds, the European Agricultural Guarantee Fund (EAGF) which fully finances EU
direct aid and market measures (43,7 billion € in 2011) and the European
Agricultural Fund for Rural development (EAFRD) which co-finances rural
development programmes (14,4 billion €). Expenditure under both funds is
managed through some 81 national or regional paying agencies (sometimes through
delegated bodies as well) in the 27 Member States (MSs). The Commission
performs a supervisory role over national systems to obtain reasonable
assurance on the effective functioning of national systems and assumes final
responsibility for the implementation of the budget.

b. Audit Objectives

The main objective of
the audit was to assess the adequacy and effective application of the
governance, risk management and internal control process for fraud prevention,
detection and follow-up of fraud cases by DG AGRI in accordance with the
competences established by the Commission.

c. Audit Scope

The scope of the audit has covered:

· 
DG AGRI internal control system for combating
fraud; in particular, prevention, detection and corrective measures, including
its supervisory role with respect to MSs in the framework of shared management;

· 
The division of competencies and the
coordination between OLAF and DG AGRI.

DG AGRI's
Annual Activity Report 2010 included one reservation concerning serious deficiencies in the Integrated Administration and Control
Systems (IACS) in Bulgaria, Romania and Portugal.

The fieldwork was finalised at the end of
June 2011. All observations and recommendations relate to the situation as of
that date. The audit was finalised on 28 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 4 || 4 || 100 || 0 || 0%

Important || 0 || 0 || 0% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.1.2.     Ethics

2.1.2.1.  COMP:
Follow up on Handling of sensitive information and Ethics

The objective
of this engagement was to assess the progress made in implementing the
remaining accepted recommendations addressed to DG COMP following the final
audit report on handling of sensitive information and ethics in DG COMP issued
in 2009.

Based on the results of its follow-up
audit, finalized on 27 June, the IAS assessed that they have all been
adequately and effectively implemented, except for one important
recommendation.

2.1.3.     Business Continuity
management

2.1.3.1.  Follow
up on Business Continuity Management

In 2009 the IAS finalised the audit on
Business Continuity Management (BCM). The overall objective of the audit,
conducted in the Secretariat-General (in its central
role) and in three operational DGs (DG HR, DG JLS and DG TAXUD), was to
assess the adequacy and the effectiveness of the BCM process in the Commission.
At that time, the IAS considered the process of implementing
and adapting BCM to be still evolving. Consequently providing an audit opinion
was deemed more appropriate at the moment of following up the original audit,
when the BCM process was expected to be more mature and the accepted
recommendations addressed to the different DGs implemented.

The in-depth follow-up evaluated the progress made by each of the Services in
implementing the respective action plans (the results of which are described in
individual notes, one per DG) and re-assessed the adequacy of controls as a
whole, to provide an opinion on the BCM process in the Commission. The IAS
assessed that all the recommendations addressed to individual DGs had been
adequately and effectively implemented (except for one recommendation addressed
to the SG) and that the
control system in place provides
reasonable assurance regarding the achievement of the business objectives set
up for the BCM process, except for the issue relating to BCM supervision. The re-assessment of the control system in place did not identify
any additional significant (Critical or Very Important) weaknesses. The
follow-up audit was finalised on 31 January 2012.

2.2.        Assessing
the Commission's Performance

2.2.1.     ENTR
& EACI: Performance Audit of the Entrepreneurship and Innovation Programme
(EIP) managed by DG ENTR and the EACI

a.  Background

In order to meet the objectives of the
renewed Lisbon strategy, and thus stimulate growth and employment in Europe, a
Competitiveness and Innovation Framework Programme (CIP) has been adopted for
the period 2007-2013. It entered into force on the 9 November 2006 with a
budget of € 3.6 billion. The Entrepreneurship and Innovation Programme (EIP) is
the largest expenditure component within the CIP with €2.17 billion. Its aim is
to improve the competitiveness and innovativeness of European enterprises and
particularly small and medium sized enterprises. The EIP comprises a wide
variety of actions. It is managed by DG Enterprise and Industry (ENTR), DG
Economic and Financial Affairs (ECFIN) (Financial Instruments), DG Environment
(ENV) (Eco-Innovation) and the Secretariat-General. DG Information Society and
Media (INFSO) and DG Energy (ENER), which participate in CIP, are not involved
in EIP. The implementation of certain parts
of the EIP has been delegated to the European Investment Fund (EIF)
(Financial Instruments) and Executive Agency for Competitiveness and Innovation
(EACI) (Eco-Innovation market replication projects, Enterprise Europe Network
and Intellectual Property Rights [IPR] projects).

The IAS audit
took place in a context of growing interest in programme performance. The current Multiannual Financial Framework (MFF) 2007-2013 will soon
come to an end and intensive discussions are currently ongoing about the next
Multiannual Financial Framework 2014-2020, the new legal base and the future of
the EIP. Furthermore, attention in the ongoing revision of the Financial
Regulation and the discussions on the new legal bases will be put on
simplification and efficiency gains. The Commission reiterated its commitment
to simplification in its June 2011 Communication on the next Multiannual
Financial Framework. The Secretary-General and the Director General of DG BUDG
also recently issued guidance on simplification and performance measure­ment
for post-2013 spending programmes.

b. Audit Objectives

The
objective of the audit was to assess:

· 
the adequacy of the policies
and procedures put in place by management for promoting, monitoring and
evaluating performance;

· 
the adequate and effective
application of the internal control system (ICS) supporting this process, and

· 
the risk management and governance processes
related to the EIP managed by DG ENTR, DG ENV and the EACI. In particular, the
audit assessed whether the ICS provides reasonable assurance regarding:

– 
compliance with
the main rules and guidelines in use in the Commission;

– 
economy, effectiveness and efficiency of the processes mentioned in the scope. In this respect, the need
for simplifying internal administrative rules and procedures was taken into
account; and

– 
reporting of
information on performance. The audit will focus on the internal control
systems related to the reporting processes between DGs as well as with EACI and
the usefulness of the milestones and indicators in place for an effective and
efficient monitoring of the programme.

c.  Audit Scope

The scope of the audit included the
Entrepreneurship and Innovation Programme (EIP) since it is the largest component
of the Competitiveness and Innovation Programme (CIP) and because the successor of the current CIP under the new
Multiannual Financial Framework will probably not include the two other
programmes of the CIP. Only the parts of the EIP managed by DG ENTR and the
EACI were included in the scope. The parts of the EIP managed by DG ECFIN
(financial instruments) were excluded from the scope, because they are managed under a different mode (joint
management) and because the European Court of Auditors has recently audited
them. DG ENV, which outsourced almost the whole management of
Eco-innovation to EACI, was consulted but not subjected to this audit.

There are no observations/reservations in
the respective DGs' and Agency's AARs that relate to the area/process audited.

The fieldwork was finalised on 7 June 2011.
All observations and recommendations relate to the situation as of that date.
The audit was finalised on 19 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.2.2.     ECHO:
Performance of ECHO's operational activities

a. Background

The Directorate General
for Humanitarian Aid and Civil Protection (ECHO) aims at saving and preserving
life, preventing and alleviating human suffering and safeguarding the integrity
and human dignity of populations affected by natural or man-made disasters. It
provides humanitarian aid to the most vulnerable victims of disasters in their
immediate aftermath and also in cases of complex and protracted crises,
whenever needs arise that overwhelm capacities of authorities of the countries
concerned. Beyond disaster response, ECHO strives to enhance disaster
prevention and preparedness, both within the EU and beyond.

In 2010, the Commission's
commitments to new or protracted crises and disaster preparedness totalled
€1.115 million. An important share of the funding was devoted to protracted
crises in Africa. Substantial assistance was also provided in South West Asia
(Afghanistan and Pakistan) and the Caribbean Region (Haiti).

ECHO does not implement
assistance programmes itself. It fulfils its mission by funding actions through
partners that have been screened in terms of financial and operational capacity
and with which it has signed a Framework Partnership Agreement. In 2010, ECHO's
budget for humanitarian actions was implemented through a wide range of
implementing partners, i.e. 50% by NGOs, 39% by UN Agencies and 11% by
International Organisations.

b. Audit Objectives

One of the objectives
of the IAS is to carry out performance audits focussing on the effectiveness,
efficiency and economy of the use of resources. The IAS examines performance in
the context of the "proper implementation of budgetary procedures",
(Article 85 FR) that include the concept of "sound financial
management" (Article 27 and 28a FR), and the assessment of "the
performance of departments in implementing policies, programmes and
actions", (Article 86 FR).

Taking into account
ECHO's mission and objectives mentioned above, the general IAS audit objective
was to reply to the following question: Is ECHO spending on humanitarian crises
used to best effect for preventing and alleviating the consequences of
disasters?

Detailed audit
objectives included ECHO's:

· 
Preparedness to meet the needs of populations
affected by disasters.

· 
Investment in DRR and disaster preparedness to
increase the resilience of regions recurrently affected by disasters.

· 
Rapidity and flexibility of procedures to ensure
that the delivery of aid can be executed within a reasonable period of time.

· 
Quality of the aid delivered.

· 
Visibility and communication policies.

· 
Sustainability of the aid through the
implementation of strategies to ensure a smooth transition between relief,
rehabilitation and development.

c. Audit Scope

The scope of this audit included the
performance of ECHO's activities linked to emergency, protracted and forgotten
crises. Disaster preparedness and Disaster Risk Reduction (DRR) strategies and
Information and Communication activities have also been assessed.

The fieldwork was finalised in October
2011. All observations and recommendations relate to the situation as of that
date. The audit was finalised on 8 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.2.3.     MARKT:
Monitoring by DG MARKT of the Application of Public Procurement Rules in the
Member States

a. Objectives and Scope

The objective of the audit was to assess
the effectiveness and efficiency of the monitoring by DG MARKT of the
application of public procurement rules in the Member States (MS), with a
particular attention for Directives 2004/17/EC and 2004/18/EC3.

This audit was notably intended to
contribute to the Commission's objective of achieving an increasingly positive
DAS from the European Court of Auditors (EGA). Problems found by the EC A in
the application of public procurement rules in MS have an important impact on
the level of the error rate detected in the framework of its Declaration of
Assurance (DAS), in particular as regards Cohesion Policy. There are a large
number of national, regional and local authorities involved, which may explain
the difficulties in transposing, implementing and monitoring the EU regulatory framework.

In defining the scope of the present audit,
the IAS took into account previous relevant audit work by the IAS and the EGA,
and in particular the IAS audit on "Monitoring the Implementation of EU
Laws" and its follow-up audit.

There are no observations/reservations in
DG MARKT 2010 Annual Activity Report (AAR) that relate to the area/process
audited.

The fieldwork was finalised on 30 March
2011. All observations and recommendations relate to the situation as of that
date. The audit was finalised on 16 May.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 1 || 1 || 100% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.3.        Control
strategies

2.3.1.     Research
Area

2.3.1.1.  INFSO:
DG INFSO's Control Strategy for on-the-spot control and fraud prevention and
detection

a. Background

Together with the other Research Commission
Services (RCS), DG INFSQ implements EU research policy and supports the
development of the European Research Area mainly through the Research Framework
Programmes. Under the Seventh Framework Programme (FP7) for 2007-2013, which is
currently being implemented, DG INFSO's share is some EUR 10 billion in total.
In 2010, DG INFSO's payments were EUR 1.23 billion for FP7 and EUR 150 million
for non-research programmes. Although the programming period for the Sixth
Framework Programme (FP6) for 2003-2006 has finished, DG INFSO made payments
amounting to EUR 160 million against cost claims during 2010 for on-going
projects financed under FP6.

In recent years there have been a range of
initiatives aimed at addressing the difficulties which have characterised the
previous programming periods, in particular the development of common control
and audit strategies amongst the RCS and in particular a common FP7 audit, or
on-the-spot control, strategy designed to test the veracity of cost claims
submitted by beneficiaries at different stages of the project cycle.

In line with the increased focus on fraud
prevention and detection in the Commission, and following a recommendation made
by the IAS3, DG INFSO has developed an Anti-Fraud Control Strategy.
This document outlines its anti-fraud strategy and sets out existing anti-fraud
controls, those being presently developed and outlines future developments.

b. Audit Objectives

The objective of the audit was to assess
the internal controls underpinning DG INFSO's on-the-spot controls processes
and the adequacy and effective application of the fraud governance, risk
management and internal control processes for fraud
prevention and detection.

c. Audit Scope

The audit of the on-the-spot control
processes focused particularly on:

– 
the on-the-spot audit strategy and planning
processes for ex-ante, interim and ex-post audits;

– 
the methodology, guidelines and procedures and
the coordination with the other research DGs and executive agencies;

– 
the implementation/execution of the audit plan
by the ex-post audit unit directly and by the external audit firms (outsourced
audits);

– 
the monitoring and reporting arrangements;

– 
the measures to ensure the quality of the work
undertaken;

– 
the follow-up given to audit results including
the monitoring and implementation of corrective actions.

The scope of the audit encompassed both fraud
prevention and detection controls. Prevention encompasses controls to reduce opportunity
and decrease motive. Detection encompasses controls, which indicate possibility
of fraud. The audit covered the different internal control system components as
defined by the COSO model: control environment, risk assessment, control
activities, information and communication, monitoring. The scope included the
control systems to the extent they cover FP6, FP7 and other programmes managed
by DG INFSO (Non-research programmes).

DG INFSO has made reservations in recent
years on the rate of residual errors on the accuracy of cost claims in FP6.
Nevertheless in its 2010 AAR there is no reservation that relates to the
process audited on the grounds that the cumulative residual error rate for FP6
(2.2%) is close to the materiality level and expected to fall below 2% in the
course of 2011 (once all ongoing audits are closed and all initiated
extrapolation exercises have been completed). Therefore, the reservation
regarding the accuracy of FP6 claims made in previous AARs was lifted.

The fieldwork was finalised on 3 June 2011.
All observations and recommendations relate to the situation as of that date.
The audit was finalised on 6 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 6 || 6 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.3.1.2.  RTD:
DG RTD's Control Strategy for on-the-spot control and fraud prevention and
detection

a. Background

Together with other Research Commission
Services (RCS), DG RTD implements EU research policy and supports the
development of the European Research Area mainly through the Research Framework
Programmes. Under the Seventh Framework Programme (FP7) for 2007-2013, which is
currently being implemented, DG RTD’s share is some EUR 25.2 billion in total.
Although the programming period for the Sixth Framework Programme (FP6) for
2003-2006 has finished, DG RTD made payments amounting to EUR 753 million
against cost claims during 2010 for on-going projects financed by FP6.

In recent years there have been a range of
initiatives aimed at addressing the difficulties which have characterised the
previous programming periods, in particular the development of common control
and audit strategies amongst the RCS and in particular a common FP7 audit, or
on-the-spot control, strategy designed to test the veracity of cost claims
submitted by beneficiaries at different stages of the project cycle.

In addition, in line with the increased
focus on fraud prevention and detection in the Commission, and following a
recommendation made by the IAS, DG RTD has developed an Anti-Fraud Control
Strategy. This strategy has resulted in an action plan which the DG is
currently in the process of implementing. With such a key share of the overall
research area spending budget, it is essential that DG RTD has a sound and credible
control strategy and robust approach to dealing with the possibility of
beneficiary fraud.

b. Audit Objectives

The objective of the audit was to assess
the internal controls underpinning DG RTD’s on-the-spot controls processes and
the adequacy and effective application of the fraud governance, risk management
and internal control processes for fraud prevention and detection.

c. Audit Scope

The audit of the on-the-spot control
processes focussed particularly on:

· 
the on-the-spot audit strategy and planning
processes;

· 
the methodology, guidelines and procedures and
coordination with the other research DGs and executive agencies;

· 
implementation of the audit plan by the ex-post
audit units either directly or by the external audit firms (EAFs);

· 
monitoring and reporting arrangements;

· 
monitoring the effectiveness of the system of
audit certification;

· 
measures to ensure the quality of the work
undertaken;

· 
the follow-up given to audit results including
the monitoring and implementation of corrective actions.

The scope of the audit encompassed fraud
prevention controls aimed at reducing the opportunity and motivation to commit
fraud and detection measures to indicate the possibility of fraud. The audit
covered the different internal control system components as defined by the COSO
model: control environment, risk assessment, control activities, information
and communication, monitoring.

The scope included the control systems to
the extent they cover FP6, FP7 and other programmes managed by DG RTD (Research
Fund for Coal and Steel). The control systems for the REA, ERCEA and the Joint
Undertakings were not included. 
It should be noted that as part of its 2010 AAR the DG made a reservation
concerning the rate of the residual errors with regard to the accuracy of cost
claims in the FP6. 
The fieldwork was finalised on 21 June 2011. All observations and
recommendations relate to the situation as of that date. The audit was
finalised on 29 September.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.3.2.     External
Aid

2.3.2.1.  DEVCO:
EDF Grants

a. Background

The European Development Fund (EDF) is the
main instrument for providing EU development and cooperation aid to the
African, Caribbean and Pacific (ACP) States and Overseas Countries and
Territories (OCT). It is funded by Member States and governed by its own
financial regulation. The European Commission is responsible for the financial
implementation of operations funded by EDF resources, with DG DEVCO managing
most of the programmes either from its Headquarters (HQ) in Brussels or through
the EU Delegations (EUDs) in ACP countries.

b. Audit Objectives

The objective of this audit was to asses DG
DEVCO's compliance with procedures and the effectiveness and efficiency of its
controls on grants financed by the EDF in order to ensure that they support a
control strategy that is able to provide assurance to the Director-General when
signing off the Annual Activity Report.

c. Audit Scope

The audit focused on activities carried out
during the period 2008-2010 and covered the following main processes:

· 
grants awarding,

· 
grants contracting,

· 
ex-post evaluation.

In reviewing these processes, the audit
also assessed the reliability and accuracy of financial and operational data in
CRIS and the effectiveness of HQ supervision for the assurance process.

Other aspects of the grant management
process (e.g. project implementation and monitoring, ex-post controls), as well
as regional programmes, grants managed under decentralised management within
the imprest component of Programme Estimates, and grants and contribution
agreements with the United Nations, the World Bank and the African Union, were
excluded from the scope of this audit. These have been covered in other audits
already completed or are planned by the IAS and/or the Internal Audit
Capability (IAC) of DEVCO.

There are no observations/reservations in
the 2010 Annual Activity Report that relate to the processes audited.

The fieldwork was finalised on 8 July 2011.
All observations and recommendations relate to the situation as at that date.
The audit was finalised on 14 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 7 || 7 || 100% || 0 || 0%

Total || 10 || 10 || 100% || 0 || 0%

2.3.3.     Rural
Development

2.3.3.1.  AGRI:
Audit on the Internal Control System for managing the Instrument for
Pre-Accession Assistance for Rural Development in DG AGRI

a. Background

Council Regulation (EC) 1085/2006
established the Instrument for the Pre-Accession (IPA) providing the basis for
the co-ordination, management and implementation of the Commission's
pre-accession strategy.

IPARD, one of the five IPA components,
assists the Candidate Countries(CCs) (Croatia, Turkey and the Former Yugoslav
Republic of Macedonia) in preparing for the implementation of the "acquis
communautaire" of the Common Agricultural Policy (CAP) and alignment to EU
structures, through the provision of financial assistance under multi-annual
rural development programmes. These programmes' financial envelope is 1.145,8 €
millions for the 2007-2013 period.

The Commission implements IPARD through
fully decentralised management mode according to the provisions laid down in
the Framework, Sectoral and Multi-Annual Agreements between the Commission and
the Candidate Country.

b. Audit Objectives

The main objective of the audit was to
assess the adequacy and effective application of the governance, risk
assessment and internal control process for managing the Instrument for
Pre-Accession Assistance for Rural development (IPARD).

c. Audit Scope

The scope of the audit covered the
preparation and implementation of IPARD programmes for the period 2007-2013 and
the roles and responsibilities of DG AGRI's units involved.

There are no observations/reservations in
the AAR that relate to the process audited.

The fieldwork was finalised on 25 November
2011. All observations and recommendations relate to the situation as of that
date. The audit was finalised on 20 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 1 || 1 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.3.4.     TEN-T
EA

2.3.4.1.  TEN-T
EA: Control strategy in the Trans-European Transport Network Executive Agency
(TEN-T EA)

a. Background

The Trans-European Transport Network
Executive Agency (TEN-TEA) was created by the European Commission in 2006 and
is responsible for managing the technical and financial implementation of the Trans-European
Transport Network Programme (TEN-Т). The projects funded under the
TEN-Т Programme cover all transport modes plus logistics and intelligent
transport systems, and involve all EU Member States. More than 300 projects
amounting to more than 7 billion EUR (out of a budget of more than 8 billion EUR) have already been launched under the
2007-2013 financial perspective. The Agency also manages more than 60
ongoing projects set up under the previous financial perspectives, which
represents 290 million EUR.

The IAS-IAC joint-audit on The Control
Strategy in the Trans-European Transport Network Executive Agency (TEN-TEA) was
included in the IAS/TEN-TEA coordinated 2011 Audit Work Programme because of
the relative importance of the operational budget of the Agency and the audit
will therefore contribute to the IAS Overall Opinion.

b. Audit Objectives

The objective of the audit was to assess
the adequacy and effective application of the internal control system (ICS),
risk management and governance processes related to the Control Strategy of the
operational budget in TEN-Т E A

In
particular, the audit assessed whether the ICS provided reasonable assurance
regarding compliance with
the relevant legislation, the reliability of financial and management
information and the effectiveness and efficiency of the processes
mentioned in the scope below.

c. Audit Scope

As a result of the desk review and the
interviews carried out during the Preliminary Survey, the scope of
this audit focussed on the following processes:

· 
Ex-ante financial controls in the Agency regarding commitments, payments (prefinancing -
interim payments - final payments), recoveries and decommitments of the
operational budget.

· 
Ex-post controls (external
audit) and on-the-spot audit strategy regarding the operational budget.

There were no observations/reservations
made in the 2010 AAR of DG MOVE and TEN-T EA concerning the processes under the
scope of this audit:

During the
audit, no scope limitations were identified.

The fieldwork
was finalised on 20 October 2011. All observations and recommendations relate to the situation as at that date and do not consider
improvements introduced since then. The audit was finalised on 3 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Important || 7 || 7 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.4.        Global
Navigation Satellite System Programs (GNSS)

2.4.1.     ENTR:
Global Navigation Satellite System Programs (part: Governance, Risk management
and Project Management)

a. Objectives and Scope

The objective of the audit was to assess
the adequacy and effective application of the internal control system (ICS),
risk management and governance processes related to the Global Navigation
Satellite System (GNSS), managed by DG ENTR. In particular, the audit assessed whether the ICS provided
reasonable assurance regarding compliance with the relevant legislation,
and the effectiveness and efficiency of the processes mentioned in the
scope below.

As a result of the desk review and the
interviews carried out during the Preliminary Survey, three sub-engagements were
decided, covering:

· 
Governance, Risk Management and Project
Management

· 
Financial circuits, financial management and
accounting for Fixed Assets

· 
Grants (under indirect centralised management)
and Procurement

This part deals with the conclusions of the
first sub-engagement "Governance, Risk Management and Project
Management". The scope of the audit focussed on the governance
structure of GNSS, including the compliance with legal bases, roles and responsibilities of each Institution and body and
the oversight and supervision function of the Commission, the risk
management, including the methodology, monitoring and reporting, and the
project management, including change management, monitoring and reporting.

There were
no observations/reservations made in the 2009 AAR of DG TREN concerning the processes under the scope of this audit.

During the
audit, no scope limitations were identified.

The fieldwork was finalised on 21 December
2010. All observations and recommendations relate to the situation as at that
date and do not consider several improvements
introduced since then (e.g. the appointment of a Deputy Director
General). The audit was finalised on 13 April.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 6 || 6 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 11 || 11 || 100% || 0 || 0%

2.4.2.     ENTR
: Global Navigation Satellite System Programs (part: Actions, Grant &
Procurement Management)

a.  Background

EGNOS' and Galileo's aim is to provide a state-of-the-art global and high-accuracy positioning system upon which European Union can rely
independent from the Russian GLONASS and US GPS systems, whose full services
are limited to military applications and which can be disabled for public
applications in times of conflict. The
fully deployed system will consist of 30 satellites and the associated ground
infrastructure. In 2007-2008, the Galileo programme was
reorganised with a new planning, a new funding scheme, and a new governance
model involving notably the Commission as Programme Manager, the European Space
Agency (ESA) as Project Manager and the Member States through different bodies.
The current total budget amounts to EUR 7,5 billion.

The audit on The Global Navigation
Satellite System (GNSS) was included in the IAS coordinated Audit Work
Programmes for 2010 and 2011 because it was assessed as a high risk area.

This part deals with the conclusions of the
third sub-engagement "Grant and Procurement Management",
mentioned under point IV.1.

b. Audit Objectives

The objective of the audit was to assess
the adequacy and effective application of the internal control system (ICS)
relating to Grant (under indirect centralised management) and Procurement
Management for GNSS.

In particular, the audit assessed whether
the ICS provided reasonable assurance regarding compliance with the
relevant legislation, the reliability of financial and management
information and the effectiveness and efficiency of the processes
mentioned in the scope below.

c. Audit Scope

As a result of the desk review and the
interviews carried out during the Preliminary Survey, the scope of this
audit focussed on the following processes:

– 
Actions (Grants under indirect centralised
management): the payments from the Commission to
the European Space Administration (ESA) following the Delegation Agreement.

– 
Procurement management: needs analysis and planning – preparation of the contract (call for
tenders, evaluation of tenders, award of contract, and budgetary and legal
commitment) – payments (prefinancing, deliveries, intermediate payments, and
final payment) and ex-post controls.

The following
reservation was made in the 2010 AAR of DG ENTR concerning the processes under
the scope of this audit:

"Reservation
concerning the reliability of the financial reporting by the European Space
Agency (ESA) for its own costs(*) about the joint implementation of
the space component of the Global Monitoring for Environment and Security
(GMES) and about the implementation of the EU satellite navigation (EGNOS and
Galileo) programme."

(*) It should be noted that the above reservation relates
to ESA entitlement to be reimbursed for its own costs incurred in the
implementation of the delegated tasks and not the industrial procurement
expenditure.

During the audit, no scope limitations were
identified.

The fieldwork was finalised on 9 May 2011.
All observations and recommendations relate to the situation as at that date
and do not consider improvements introduced since then. The audit was finalised on 14 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 6 || 6 || 100% || 0 || 0%

Total || 9 || 9 || 100% || 0 || 0%

2.4.3.     ENTR:
Global Navigation Satellite System Programs (part: Financial Circuits,
Financial Management and Accounting for
Fixed Assets)

a. Background

The EGNOS', and Galileo (projects, which
form together The Global Navigation Satellite System (GNSS) aim to
provide a state-of-the-art global and high-accuracy positioning system upon which European Union can rely
independently from the Russian GLONASS and US GPS systems. The fully deployed system will consist of 30 satellites and the
associated ground infrastructure. In 2007-2008,
following a key reform to address serious project cost overrun and delay
issues, the Galileo programme was reorganised with a new planning and funding
scheme, as well as a governance model involving the Commission as Programme
Manager, the European Space Agency (ESA) as Project Manager, and the Member
States through different bodies. The governance reform accordingly entrusted
the ownership of the infrastructure from the Galileo and EGNOS programmes to
the Commission and made it owner of the assets and responsible for managing
these programmes. The current total budget amounts to EUR 7 billion.

This part deals with the conclusions of the
second sub-engagement “Financial Circuits, Financial Management and
Accounting for Fixed Assets, mentioned under point IV.1.

b. Audit Objectives

The audit was conducted in two parts:

· 
the DG’s accounting for fixed assets,

· 
the financial circuits and financial management.

The IAS audit objectives for the accounting
for fixed assets were:

· 
to assess the adequacy and effective application
of the Internal Control System (ICS) in respect of the management of the
transfer of EGNOS fixed assets from ESA to the Commission as of 1st
April 2009; and

· 
to ensure the existence, completeness, security,
and correct valuation and disclosure of the EGNOS and all the GNSS Fixed Assets
(including those to be replaced or transferred in future financial periods
under EGNOS and the IOC (Initial Operational Capability) and FOC (Full
Operational Capability)) in the financial statements of the Commission.

The objective of the audit in relation to
financial circuits and financial management was to assess the adequacy and
effective application of the DG’s internal control system (ICS) and financial
circuits relating to the GNSS funds managed by DG ENTR (together with the
European Space Agency (ESA)).

c. Audit Scope

The scope of this audit focused on the
implementation of the provisions of Regulation 683/2008 and the detailed
requirements of the two Delegation Agreements agreed between the EC and ESA on
the further implementation of these two programmes. In respect of fixed assets,
the audit scope was extended to cover the assets acquired under standard
(centralised procurement) Commission contracts for EGNOS, and those to be
transferred from ESA.

The audit did not cover expenditures funded
under the Research Programme budget of the Commission or expenditures on the
GMES programme.

In respect of the audit on both financial
circuits and financial management and accounting for fixed assets, the
following reservation was made in the 2010 AAR of DG ENTR concerning the
processes under the scope of this audit:

"Reservation concerning the
reliability of the financial reporting by the European Space Agency (ESA) for
its own costs about the joint implementation of the space component of the
Global Monitoring for Environment and Security (GMES) and about the
implementation of the EU satellite navigation (EGNOS and Galileo) programme."

During the audit, no scope limitations were
identified.

The fieldwork was finalised on 27 June
2011. All observations and recommendations relate to the situation as at that
date and do not take account of any improvements introduced since then. The audit
was finalised on 17 November.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 5 || 5 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 10 || 10 || 100% || 0 || 0%

2.5.        Financial
Management Process

2.5.1.     Guarantees

2.5.1.1.  Consolidated:
Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

a. Background

Commission Services are required to ask for
guarantees to protect the financial interests of the EU. According to the
Financial Regulation (FR) and its Implementing Rules (IR), the contracting
authority can ask tenderers and contractors to lodge a guarantee to avoid that
bids will not be withdrawn (tender guarantee), to ensure full performance of
the contract (performance guarantee) or to
limit the financial risks connected with payment of pre-financing
(pre-financing guarantee). Pre-financing guarantees can also be asked in case
of grant agreements.

DG BUDG, in its central role, provides
instructions, interpretative notes and model contracts for guarantees to
support the Commission Services in the correct implementation of the FR and its
IR. In addition, it organises training courses and is responsible for the IT
application for recording and managing guarantees in ABAC. Financial
guarantees, as part of the annual accounts of the Commission, are recorded
off-balance sheet.

b. Audit objectives and audit scope

The overall objective of this audit was
to assess the compliance of the management of guarantees with the FR and other
applicable rules and regulations and its effectiveness and efficiency. In particular,
the audit assessed the support and guidance provided by DG BUDG to operational
Services, the internal control systems implemented in the Commission Services
for managing guarantees and the adequacy of the related monitoring and
reporting systems in place.

The scope of the audit,
conducted in DG BUDG (in its central role) and in a sample of operational DGs
and Executive Agencies (DG ELARG, DG DIGIT and the Executive Agency for
Competitiveness and Innovation - EACI), covered the management of performance
guarantees for procurement contracts and pre-financing guarantees for
procurement contracts and grant agreements. The audits were finalised on 19 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 6 || 5 || 83% || 1 || 17%

Important || 16 || 15 || 94% || 1 || 6%

Total || 22 || 20 || 91% || 2 || 9%

2.5.1.2.  BUDG:
Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 7 || 7 || 100% || 0 || 0%

Total || 10 || 10 || 100% || 0 || 0%

2.5.1.3.  ELARG:
Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 0 || 0% || 1 || 100%

Important || 5 || 4 || 80% || 1 || 20%

Total || 6 || 4 || 67% || 2 || 33%

2.5.1.4.  DIGIT:
Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.5.1.5.  EACI:
Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.5.2.     Procurement

2.5.2.1.  OIB:
Management of Procurement in OIB

a. Background

Procurement is vital to
OIB's core business, as most operational activities are made possible via a
large number of procurement procedures and the signature of numerous contracts.

b. Audit Objectives

The objective of the
audit was to assess the control measures implemented in order to ensure the
legality and regularity of the public procurement process managed by OIB. In
addition, efficiency and effectiveness of internal procedures have also been
addressed in this context.

c. Audit Scope

For the purpose of this
audit, the procurement process was considered in the broad sense, i.e. including
both the pre-award activities (from the needs analysis and planning to the
signing of the contract) as well as the post-award activities (from the
execution of the contract to its monitoring, ex-post controls and the feedback
on the procurement process).

The specific area of Buildings Procurement
was excluded from the scope of this audit, since the relevant framework is
currently being revised.

The fieldwork was finalised on 5 December
2011. All observations and recommendations relate to the situation as of that
date. The audit was finalised
on 17 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.5.2.2.  HR:
Management of Procurement by DG HR

a. Objectives and Scope

The objective of the audit was to assess the
legality and regularity of the public procurement process managed by DG HR.
Aspects of efficiency and effectiveness of internal procedures were also
considered in this context.

For the purpose of this
audit, the procurement process was considered in the broad sense, i.e. including both the pre-award activities (from
the needs analysis and planning to the signing of the contract) and the
post-award activities (from the execution of the contract to its monitoring, ex-post controls and the feedback on
the procurement process).

The fieldwork was finalised on 20 May
2011. All observations and recommendations relate to the situation as of that
date. The audit was finalised on 28 July.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Important || 5 || 5 || 100% || 0 || 0%

Total || 5 || 5 || 100% || 0 || 0%

2.5.2.3.  OIB:
2nd Follow-up Audit of the management of Procurement Contracts in OIB

Based on the
results of its follow-up engagement, finalised on 11 November, the IAS assessed
that all the relevant recommendations addressed to OIB had been implemented,
except for one recommendation, of which the effective implementation was
further assessed as part of the wider on-going audit on procurement in OIB.

2.5.2.4.  JRC: Follow-up audit on
Procurement in JRC

Based on the results of a follow-up audit, finalised
on 23 September, the IAS concluded that all the recommendations addressed to DG
JRC that resulted from the audit on Procurement have been adequately and
effectively implemented, except for the recommendation no 3, which remains
open. However, the priority of recommendation 3 was downgraded from Very
Important to Important as parts of the actions have been already implemented
and the residual risk has been reduced. As the procurement planning tool is not
yet fully operational, the risk of difficult retrieval of information in the
units where procurement files are kept only on paper remains. The table below
summarises the remaining actions to be implemented.

2.5.3.     Recoveries

The IAS performed in 2008 an audit on the
Recovery process in the Commission. The audit was conducted in DG BUDG and LS
(it their central role) and in four operational DGs/Agencies (DG AIDCO, EAC,
INFSO and EACEA). The follow-up audits were finalised on 25 March 2011.

2.5.3.1.  EAC:
Follow-up audit on Recoveries

According to Issue Track, the EAC
considered all recommendations as implemented ("Ready for review").
Based on the results of its follow-up audit, the IAS assessed that they had all
been adequately and effectively implemented, except for four recommendations.

2.5.3.2.  BUDG:
Follow-up audit on Recoveries

According to Issue Track, DG BUDG
considered all recommendations as implemented ("Ready for review").
Based on the results of its follow-up audit, the IAS assessed that all accepted
recommendations had been adequately and effectively implemented.

2.5.3.3.  LS:
Follow-up audit on Recoveries

According to Issue Track, the LS considered
five out of the ten recommendations as implemented ("Ready for
review"). Based on the results of its follow-up audit, the IAS assessed
that all five recommendations had been adequately and effectively implemented.
Furthermore, one recommendation, which had an "open" status in Issue
Track, was assessed as being adequately implemented and could therefore be
closed in the system.

At the end of the follow-up engagement, the
IAS considered the remaining four recommendations still open. These will be the
subject of a second follow-up audit in line with the IAS methodology.

2.5.3.4.  INFSO:
Follow-up audit on Recoveries

Based on the results of its follow-up
audit, the IAS assessed that all the recommendations from the original audit
have been adequately implemented and risks mitigated.

2.5.3.5.  DEVCO:
Follow-up audit on Recoveries

According to Issue Track, DEVCO considered
all recommendations as implemented ("Ready for review"). Based on the
results of its follow-up audit, the IAS assessed that they had all been
adequately and effectively implemented, except for one recommendation.

Furthermore, the IAS considered one
recommendation (Important) as implemented, but nevertheless wanted to raise the
DG's attention to the need to properly monitor its consistent implementation.

2.5.3.6.  EACEA:
Follow-up audit on Recoveries

Based on the results of its follow-up
audit, the IAS assessed that all the recommendations from the original audit
had been adequately implemented and risks mitigated.

2.6.        Information
Technologies

2.6.1.     Local
IT

2.6.1.1.  DG
EMPL: Audit on Management of Local IT in DG EMPL

a. Background

The activities of DG
EMPL depend heavily on IT systems. Some of them support the operational and
financial management of the projects financed by DG EMPL and other DGs, while
others permit to interconnect Member States and other stakeholders to exchange
information, which makes the reputational risk especially relevant.

The DG EMPL IT unit's
mission is to provide all users with a modem, secure and efficient informatics
system to sustain and extend the strategies and objectives of DG EMPL.

b. Audit Objectives and scope

The overall objective
of the audit was to assess the internal control system put in place by DG EMPL
to ensure an adequate and effective management of its local IT activities, with
a particular focus on the following areas:

· 
IT Governance;

· 
Organization and management of the IT activities
and projects;

· 
Physical and logical security arrangements

The audit focused in
particular on the activities performed by unit EMPL G4 (Information Technologies). Other units and key staff (G2 -
Financial Resources, adviser of Directorate G) were also consulted regarding
their respective responsibilities. The audit was
finalised on 20 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 4 || 4 || 100% || 0 || 0%

Important || 9 || 9 || 100% || 0 || 0%

Total || 13 || 13 || 100% || 0 || 0%

2.6.2.     Security
of IT environment in subcontracted projects IT

2.6.2.1.  REGIO:
Audit on Security of IT environment in subcontracted projects IT in DG REGIO

a. Background

DG REGIO's activities
are supported by, among other IT systems, WFS (for decisional and financial
procedures related to the programming and financial execution activity phases
of Structural Funds programmes management) and SYS AUDIT (for monitoring audit
activities in the context of the control of structural funds).

The DG outsourced their
evolutive maintenance to an external IT Consortium, which performs its
development activities mainly abroad. The servers are hosted by DG DIGIT, who
is also responsible for their administration and for the provision of a secure
connection between the Commission network and the contractor's Data Centre.

Because WFS and
SYSAUDIT manage and store sensitive and personal data and development
activities are performed "extra-muros", an increased inherent risk of
breaches in security and unauthorised access to sensitive and personal data
exists.

b. Audit Objectives

The overall objective
of the audit was to assess the internal control systems put in place by DG REGIO to provide adequate physical and
logical security arrangements, as well as proper management of the
subcontracted IT development activities related to the outsourced evolutive
maintenance of WFS and SYSAUDIT.

c. Audit Scope

The engagement focused
on the following priority areas and processes related to the evolutive maintenance
of WFS and SYSAUDIT3:

· 
Planning and organisation: quality management,
risk assessment and project management

· 
Acquisition and implementation: maintenance of
application software, change management and testing and deployment in
production of new developments

· 
Operations: management of service levels,
management of third party services and systems (logical) security

The audit covered DG REGIO's IT Unit (A4) in its
capacity of defining security requirements and monitoring the correct
implementation of the contract with SEII , and the contractor (SEII), in its
capacity of delivering software development, project management, operational
and technical support, user guidance and training services.

DG REGIO did not include any reservations in its
AAR that relate to the area/process audited.

The fieldwork was finalised in March 2011. All
observations and recommendations relate to the situation as of that date. The audit was finalised on 22 July.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 6 || 6 || 100% || 0 || 0%

Important || 7 || 7 || 100% || 0 || 0%

Desirable || 1 || 1 || 100% || 0 || 0%

Total || 14 || 14 || 100% || 0 || 0%

2.6.3.     Management
of the telecommunication infrastructure and services sTESTA

2.6.3.1.  DIGIT:
Audit on the Management telecommunication infrastructure and services sTESTA in
DG DIGIT

a. Background

The secured Trans-European
Services for Telematics between Administrations (sTESTA) is the largest project
funded by the ISA programme, the objective of which is to improve electronic
cooperation among public administrations in EU Member States.

This network, which is the
successor of the previous TESTA I and TESTA II , is provided by the Commission
to European Institutions, European Agencies and National Administrations across
Europe in sectors such as justice and home affairs, health, consumer protection
and statistics.

sTESTA is based on a
dedicated and private infrastructure operated by a consortium which provides
the network infrastructure and supporting services. The outsourced activities
are monitored through regular quality and security audits conducted by
specialised external service providers.

DG DIGIT is the system
owner of sTESTA. Its main responsibility is to ensure the provision of high
quality and secure networking services through the management of outsourcing
contracts. This includes defining the security requirements and providing
technological directions to the project, controlling the providers'
performances, following up the corrective actions and tracking incidents.
Relations with the stakeholders and dissemination of information among them are
also part of DG DIGIT responsibilities.

The main inherent risks
related to the management and operation of the sTESTA network relate to
possible breaches in the security (unauthorised disclosure, modification or destruction
of information while being transported over the sTESTA network) and
interruption of activity (due to failure of the equipment/software, external
attack or of lack of diligence in implementing and operating the sTESTA network
systems). If not adequately mitigated, they might ultimately affect the
provision of high quality and secure networking services and have a negative
impact on the Commission's reputation.

b. Audit Objectives

The overall objective of
the audit was to assess the internal control systems put in place by DIGIT to
ensure that sTESTA is adequately managed and monitored. The audit focused in
particular on the definition of the service requirements and on the definition
and implementation of a quality review and monitoring programme.

c. Audit Scope

The engagement covered the
following priority areas (COBIT processes):

· 
DS1 : Define and manage service levels;

· 
DS2: Manage third-party services;

· 
MEI : Monitor and
evaluate IT performance;

· 
ME3: Ensure compliance with external
requirements.

The audit covered the
activities of Sector DIGIT.C2.002 (N1 - Network Infrastructure) in its capacity
of defining sTESTA security and operational requirements and monitoring the
correct implementation of the different related contracts. The audit was finalised on 6 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Important || 4 || 4 || 100% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.6.4.     Enterprise
Europe Network IT tools

2.6.4.1.  EACI:
Audit on Enterprise Europe Network IT tools in EACI

a. Objectives and Scope

The Enterprise Europe Network
(EEN) is a network of contact points providing information and advice to EU
companies on EU matters regarding developing business in new markets,
facilitating technology transfers and accessing EU funding. Initially developed
by DG ENTR, it is now operated and further developed by the Executive Agency
for Competitiveness and Innovation (EACI). The EEN has close to 600 member
organisations from 48 countries using the system.

EACI provides IT tools to
support EEN activities. These IT tools are the bridge between EEN partners and
form the basis of their collaboration. Using Europe's largest database,
containing more than 13,000 profiles of cutting-edge technologies, the EEN
brings together research and commercial applications. EACI decided to update
EEN IT tools and launched the development project "Enterprise Europe
Network 2.0 - Merlin".

The IT audit of the Audit on
Enterprise Europe Network IT tools is included in the 2010 Work Programme
of the IAS. This follows the audit risk assessment as part of the lAS's
Strategic Audit Plan for 2010-2012.

The audit was planned because
of the visibility of the Enterprise Europe Network IT tools, which are used by
a number of users outside the Commission and because one might wonder whether an
executive agency can manage a system of this size developed by another
organisational entity.

The objective of the EEN IT
tools audit was to assess the adequacy and effective application of the
internal control systems, IT governance, IT Project Management and IT
Development related to the EEN IT tools in EACI. It also complements previous
audits performed in the area of IT Project Management and will help the audited
agency to identify the areas for improvement to focus on.

The scope of this audit was limited
to the Merlin development project and related IT processes and
procedures. During the audit, no scope limitations have been identified.

The fieldwork was finalised on 15 April
2011. All observations and recommendations relate to the situation as of that
date. The audit was finalised on 22 June.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 4 || 4 || 100% || 0 || 0%

Important || 4 || 4 || 100% || 0 || 0%

Total || 8 || 8 || 100% || 0 || 0%

2.6.5.     Follow-ups
on IT audits

2.6.5.1.  TAXUD:
Follow-up audit on the large IT Systems in DG TAXUD

Based on the results of its follow-up
audit, the IAS assessed that all three remaining recommendations addressed to
DG TAXUD that resulted from the audit "IAS Audit of the large IT
Systems in DG TAXUD" had been adequately and effectively addressed and
could be closed. The follow-up audit was finalised on 23 June.

2.6.5.2.  TAXUD:
Follow-up audit on New IT Organisation and Contractual Framework

Based on the results of its follow-up
audit, the IAS assessed that all the recommendations addressed to DG TAXUD that
resulted from the audit on New IT Organisation and Contractual Framework had
been adequately and effectively implemented. The follow-up audit was finalised
on 21 November.

2.6.5.3.  PMO:
Follow-up audit on Management of Local IT

According to Issue Track, 19 out of 20
recommendations were considered as implemented by the PMO, while for one
recommendation some improvements were still needed and consequently remained
open.

Based on the
results of its follow-up audit, the IAS assessed that all the recommendations
considered by the PMO as "Ready for review" had been adequately and
effectively implemented, except for four recommendations. The follow-up audit
was finalised on 8 February.

2.6.5.4.  LS:
Follow-up audit on Management of Local IT

According to Issue Track, 16 out of 25
recommendations were considered as implemented by the LS. Based on the results
of its follow-up audit, the IAS assessed that all of them had been adequately
and effectively implemented, except for three recommendations. The follow-up audit was finalised on 27 May.

2.6.5.5.  OLAF:
Follow-up audit on the Anti-fraud Information System (AFIS)

Based on the results of its follow-up
audit, the IAS assessed that all the recommendations addressed to OLAF that
resulted from the audit on the Anti-Fraud Information System (AFIS) had been
adequately and effectively implemented, except for one recommendation. The follow-up
audit was finalised on 23 September.

2.6.5.6.  INFSO:
Follow-up Audit on the Management of Research Information Systems in DG INFSO

Based on the results of its follow-up
audit, the IAS assessed that all the recommendations addressed to DG INFSO that
resulted from the audit "IAS Audit on the Management of Research
Information Systems at DG INFSO" had been adequately and effectively
implemented and could be closed.

DG INFSO made progress in their controls
over management of information systems and had reached the maturity level that
IAS considered as sufficient for closing the recommendations. However, the IAS
considered that improving further these controls would benefit DG INFSO. The follow-up
audit was finalised on 7 July.

2.6.5.7.  RTD:
Follow-up Audit on the Management of Research Information Systems in DG RTD

Based on the results of its follow-up
audit, the IAS assessed that all the recommendations addressed to DG RTD that
resulted from the audit "IAS Audit on the Management of Research
Information Systems at DG RTD" had been adequately and effectively
implemented and could be closed. The follow-up audit was finalised on 23 June.

2.7.        Other
audits

2.7.1.     JRC:
Audit on Competitive Activities

The mission of the Joint Research Centre
(JRC) is to provide customer-driven scientific and technical support for the
conception, development, implementation and monitoring of European Union
policies. As a service of the European Commission, the JRC functions as a
reference centre of science and technology for the Union. Close to the
policy-making process, it serves the common interest of the Member States,
while being independent of special interests, whether private or national. In
2010, JRC's total budget for expenditure amounted to some EUR 389 million and
mainly covered the implementation of direct actions under the Framework
Programme 7 (FP7) EC and Euratom research programmes, together with
decommissioning activities.

Its revenue budget in 2010 was EUR 72
million, mainly from Competitive Activities which is made up of work undertaken
on behalf of third parties or providing assistance to Commission DGs. Under a
decision from Council, JRC is required to earn part of its income from
additional sources through Competitive Activities to demonstrate its scientific
competitiveness. The target is currently 15% of the overall JRC budget and
split between the various Institutes. In 2010, competitive cashed income
amounted to EUR 62,5 million and the target for 2011 is set at EUR 65,1 million.

The main
objective is the development of added value to its institutional programme next
to the acquisition/development of knowledge, increasing networks, benchmarking
and ensuring scientific excellence. Under the Financial Regulation, any revenue
of competitive activities will be used to provide additional expenditure
appropriations. Expenditure relates to the resources needed, such as goods and
services and the major component, staff costs.

a. Audit Objectives

The overall
objective of this engagement was to assess the internal controls underpinning
the Competitive Activities processes. Specifically, the audit has assessed:

· 
governance arrangements;

· 
internal controls and procedures exercised at
the different stages of the process (from planning up to closure, monitoring
and reporting);

· 
reliability of reporting on competitive
activities;

· 
compliance with Financial Regulations and other
applicable rules /regulations;

· 
effectiveness and efficiency of certain aspect
of the procurement process when carried out exclusively in the frame of
competitive activities. More specifically, whether the services/goods purchased
were justified and adequately 'invoiced' (such as verification of needs
identification, timely planning, cost aspects).

b. Audit Scope

The audit focussed in particular on key
controls of the three types of competitive activities, for the following
components of the internal control system:

· 
Overall governance, strategic framework and
overall planning:

– 
Systems, policies, procedures and tools required
for an effective governance and organizational framework for competitive
activities.

– 
Planning of the overall competitive activities
at corporate/institute level.

· 
From initial request up to the closure of the
competitive project: The complete cycle of activities, including identification
of potential customers, selection and preparation of proposals or participation
in calls for proposals for indirect actions, contracting and project
implementation.

· 
Debt and treasury management: Budgeting and
cashing of competitive income responsibilities performed by JRC.

· 
Overall monitoring and reporting: Specific
procedures and monitoring arrangements, management scoreboards (or equivalent
tools), KPI's and loop back to priorities and targets fixed, ex post controls,
supporting tools.

Excluded from the scope was the Management
and Cost Reporting process for the Indirect Actions element of Competitive
Activities and the measures for hedging third party liability (e.g. safety and legal
aspects, insurance policies), as these are subject of recently
conducted/ongoing audits of JRC Internal audit Capability (IAC). There were no
observations/reservations made by JRC in its 2010 Annual activity Report (AAR)
which related to the processes audited. The fieldwork was finalised in November
2011. All observations and recommendations relate to the situation as of that
date. The audit was finalised on 22 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 8 || 8 || 100% || 0 || 0%

2.7.2.     BUDG:
Implementation of the Internal Control standard 13 on Accounting and Financial
reporting

An audit on the Implementation of Internal
Control Standard 13 was launched in January 2011. The objective of the audit
was to assess the internal control systems and the related monitoring
activities in place in the Commission to ensure reliability (accuracy,
completeness and timeliness) of the accounting information provided by the DGs,
and used by DG BUDG as a basis for the preparation of the Commission annual
accounts.

As a result of the preliminary review, the
IAS identified that the main risks that may affect the reliability of the accounting
data and the key controls in place (centrally and locally) are regularly
audited by the Court of Auditors[3] (in the context of the
Annual Report on budget execution) and by the IACs (when reviewing the closure
and/or cut-off procedures in their DGs).

On the basis of a close review of other
auditors work programmes and results, the IAS concluded that the main areas are
adequately covered and decided to close the present audit without performing
any detailed testing on the internal control and monitoring systems implemented.
The audit was finalised on 11 May.

2.8.        Follow-up
audits (if not in the above categories)

In addition to the follow-up audits carried
out by the IAS, the latter also regularly reports to the APC on the state of
play regarding implementation of IAS audit recommendations. Overall, 80% of the
recommendations made over the period 2007-2011 are considered by auditees as
implemented as of 31 January 2012.

2.8.1.     RTD:
Follow-up audit on DG RTD's Internal Control System for managing FP7 – Design

Based on the results of its follow-up
audit, finalised on 20 January 2012, the IAS assessed that the recommendations
addressed to DG RTD that resulted from the original audit had been implemented
with the exception of two important recommendations.

2.8.2.     REA:
Follow-up audit on the set up of Internal Controls and Financial Management
Systems – Design in REA

The IAS made ten recommendations in total,
eight of which were reported as implemented at the date of the follow-up audit
finalised on 19 January 2012. Based on the results of its follow-up work, the
IAS assessed that six out of these had been implemented. The two remaining
recommendations, for which a certain limited number of actions still needed to
be finalised, were assessed as partially implemented.

2.8.3.     HR-DS:
Follow-up audit on Monitoring of Security as managed by HR-DS

Based on the results of its follow-up
audit, finalised on 19 January 2012, the IAS assessed that globally all the
recommendations resulting from the original audit which were reported as
"ready for review" by DG HR had been implemented

2.8.4.     AGRI:
Follow-up audit on Rural Development

Based on the results of its follow-up audit
finalised on 13 January 2012, the IAS assessed that all the recommendations
addressed to DG AGRI that resulted from the original audit had been adequately
and effectively implemented, except for one
recommendation which was assessed partially implemented.

2.8.5.     INFSO:
Follow-up audit on DG INFSO's Internal Control System for managing FP7 – Design

Based on the results of its follow-up audit
finalised on 13 January 2012, the IAS assessed that all the recommendations
addressed to DG INFSO that resulted from the original audit had been
implemented, with the exception of one important recommendation, which was
assessed partially implemented.

2.8.6.     ERCEA:
Follow-up audit on ERCEA on the set up of internal controls/financial
management system – Design

Based on the results of its follow-up audit
finalised on 3 January 2012, the IAS assessed that seven out of eight
recommendations addressed to ERCEA that resulted from the original audit had
been adequately and effectively implemented.

2.8.7.     EMPL:
Follow-up of the audit on the internal control systems for managing the new
Structural Funds programming period – Phase II

Based on the results of its follow-up audit
finalised on 22 December, the IAS assessed that all the recommendations
addressed to DG EMPL that resulted from the audit on DG EMPL's internal control
systems for managing the new Structural Funds programming period - Phase II had
been adequately and effectively implemented.

2.8.8.     REGIO:
Follow-up of the audit on the internal control systems for managing the new
Structural Funds programming period – Phase II

Based on the results of its follow-up audit
finalised on 22 December, the IAS assessed that all the recommendations
addressed to DG REGIO that resulted from the audit on DG REGIO's internal
control systems for managing the new Structural Funds programming period -
Phase II had been adequately and effectively implemented.

2.8.9.     HOME:
2nd Follow-up audit on Grants under Shared management of the European Refugee
Fund in DG HOME

Based on the results of its second
follow-up audit finalised on 16 December, the IAS assessed that all the
recommendations addressed to DG HOME that resulted from the audit on Grants
under Shared Management of the European Refugee Fund and that remained open
after its first follow-up had been adequately and effectively implemented.

2.8.10.   TEN-T
EA: Joint IAS/TEN-T EA IAC Follow-up audit on Audit of the Management of the
Operational Budget in TEN-T EA

The objective of this engagement was to
assess the progress made in implementing the remaining accepted recommendations
addressed to DG MOVE and to TEN-T EA following the first follow-up of the "Audit
of the Management of the Operational Budget in TEN-TEA” carried out in
2009.

Based on the results of its follow-up audit
finalised on 15 December, the IAS assessed that all the recommendations
addressed to DG MOVE and TEN-T EA that resulted from the Audit of the
Management of the Operational Budget in TEN-TEA had been adequately and
effectively implemented, except for two recommendations addressed to DG MOVE
and two recommendations addressed to TEN-T EA.

2.8.11.   ECHO:
2nd Follow-up audit of NGOs funding in DG ECHO

The objective of this engagement was to
assess the progress made in implementing the remaining accepted recommendations
addressed to DG ECHO following the first follow-up of the audit carried out in
2007 (final report dated 6 June 2007).

Based on the results of its follow-up audit
finalised on 12 December, the IAS assessed that all the recommendations
addressed to DG ECHO that resulted from the audit had been adequately and
effectively implemented.

2.8.12.   ELARG:
2nd Follow-up audit on "Ex-post control activities in DG ELARG"

The objective of this engagement was to
assess the progress made in implementing the remaining accepted recommendations
addressed to DG ELARG following the first follow-up carried out in 2008 (final
report dated 18 July 2008).

Based on the results of its follow-up audit
finalised on 7 December, the IAS assessed that all the recommendations
addressed to DG ELARG that resulted from the audit "Ex-post control
activities" and from the first follow-up audit had been adequately and
effectively implemented.

2.8.13.   FPI:
Follow-up audit on the financial management of the Common Foreign and Security
Policy Budget

According to Issue Track, 10 out of 11
recommendations were reported as implemented by the auditee. One recommendation
was not included in the scope of the follow-up as it was not ready for review
at the time of the follow-up.

Based on the results of its follow-up audit
finalised on 6 December, the IAS assessed that all the recommendations
addressed to the former DG RELEX and now transferred to FPI that resulted from
the audit on the financial management of the Common Foreign and Security Policy
Budget had been adequately and effectively implemented, except for four
recommendations.

2.8.14.   OIL:
Second follow-up audit on the Evaluation of targeted internal control standards
in OIL

Based on
the results of its follow-up audit finalised on 29
November, the IAS
assessed that globally all the recommendations addressed to OIL that resulted
from the audit on the Evaluation of targeted
Internal Control Standards in OIL had been implemented.

2.8.15.   HR
& OIB: 2nd Follow-up Audit of the Management of Building Procurement
Contracts by DG HR and OIB

Based on the results of its follow-up
engagement finalised on 22 November, the IAS assessed that all the relevant
recommendations addressed to DG HR and OIB which were reported as ready for
review had been implemented.

2.8.16.   EACI:
Follow-up audit on the management of the Operational Budget of the EACI

Based on the results of its follow-up audit finalised on 30
September , the IAS assessed that all the recommendations addressed to EACI, DG
MOVE, DG ENER, DG ENTR and DG ENV that resulted from the audit on 'Management
of the Operational Budget of the Executive Agency for Competitiveness and
Innovation' in 2009 had been adequately and effectively implemented.

2.8.17.   MARKT:
Follow-up audit on Monitoring the Implementation of EU law

Based on the results of its follow-up audit finalised on 6 September,
the IAS assessed that all the recommendations addressed to DG MARKT that
resulted from the audit on "Monitoring the Implementation of EU
law" had been adequately and effectively implemented.

2.8.18.   ENV:
Follow-up audit on Monitoring the Implementation of EU law

Based on the results of its follow-up audit finalised on 6 September,
the IAS assessed that all the recommendations addressed to DG ENV that resulted
from the audit "Monitoring the implementation of EU law" had
been adequately and effectively implemented.

2.8.19.   SG:
Follow-up audit of the Consolidated report on Monitoring the Implementation of
EU law

Based on the results of its follow-up audit finalised on 6 September,
the IAS assessed that all the recommendations addressed to SG that resulted
from the audit "Consolidated report on Monitoring the implementation of
EU law" had been adequately and effectively implemented.

2.8.20.   MARE:
Follow-up audit on the European Fisheries Fund as managed by DG MARE

Based on the results of its follow-up audit finalised on 15 July,
the IAS assessed that all the recommendations addressed to DG MARE that
resulted from the audit on the European Fisheries Fund as managed by DG MARE
had been adequately and effectively implemented.

2.8.21.   OIB:
Follow-up audit on the Inventory Process as managed by OIB

This follow-up audit does not result in a
re-assessment of the adequacy of controls as a whole, but focuses on the
specific recommendations in the original audit. It was carried out in
accordance with the IAS methodological guidelines.

The assessment of the state of
implementation was based on a desk review of evidence provided by OIB in Issue
Track.

Based on the results of the follow-up audit
finalised on 12 July, the IAS assessed that all the recommendations addressed
to OIB that resulted from the audit have been adequately and effectively
implemented, although in some cases there is still
room for improvement. The IAS would specifically like to invite OIB to consider
the following points for attention:

· 
due to IT-related issues, the finalisation of
the tracking exercise analysis has been postponed by three months, and will not
be completed before the end of September 2011. While acknowledging OIB's
efforts to perform this analysis, the IAS considers, based on the information
received, that significant attention is still required in order to complete it
in the best conditions (Recommendation 2);

· 
the report function from ABAC SAM (DG BUDG
owner) has some weaknesses and is still in the process of being tested
(Recommendation 2);

· 
OIB is invited to send a note and/or instruction
for newly appointed GBIs, in order to raise their awareness on their
responsibility to verify the items (tracking) on a timely and regular basis
(Recommendation 4);

· 
back-up arrangements have not yet been established to ensure business continuity for the warehouse management. OIB is invited to
include them in its Business Continuity Plan
(Recommendation 7Based on the results of its follow-up
audit, the IAS assessed that all the recommendations addressed to OIB that
resulted from the audit had been implemented.

2.8.22.   OIL:
Follow-up audit on the Inventory Process as managed by OIL

Based on the results of its follow-up audit
finalised on 12 July, the IAS assessed that all the recommendations addressed
to OIL that resulted from the audit on the Inventory process as managed by
OIL, had been adequately and effectively implemented.

2.8.23.   EPSO:
Follow-up of the Limited Review on the selection process as managed by EPSO

Based on the results of its follow-up
engagement finalised on 12 July, the IAS assessed that all the relevant
recommendations addressed to EPSO had been implemented.

2.8.24.   SANCO:
Second Follow-up on Grant management (Food & Feed) in DG SANCO

This follow-up audit focused on the four
outstanding recommendations of the first follow-up of the audit on Grant
Management (Food & Feed) in DG SANCO in 2010.

Based on the results of its second follow-up audit finalised on 12
July, the IAS assessed that all the recommendations addressed to DG SANCO that
resulted from the above mentioned audit had been adequately and effectively
implemented.

2.8.25.   PMO:
Follow-up audit on the activities of PMO/6 ISPRA

Based on the results of its follow-up audit finalised on 5 July, the
IAS assessed that all the recommendations addressed to PMO that resulted from
the audit on the activities of PMO/6 ISPRA had been adequately and effectively
implemented.

2.8.26.   DEVCO:
Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG
AIDCO

Based on the results of its third follow-up, finalised
on 28 June, to assess the implementation of the seven recommendations from the 2003
in-depth audit in ex-DG AIDCO that remained open after the two follow-ups
carried out in 2006 and 2008, the IAS assessed that the recommendations had
been implemented, except for one recommendation which will be followed up as
part of the implementation of DG DEVCO's action plan in response to the 2007
and 2008 IAS audits on Financial Management of Directorates D and B
respectively.

2.8.27.   EAC:
Follow-up audit of remaining recommendations on 2004 IAS In-depth Audit of DG
EAC

Based on the results of its third follow-up,
finalised on 7 June, to assess the implementation of the ten recommendations
from the 2004 in-depth audit in DG EAC that remained open after the two
follow-ups carried out in 2005 and 2008, the IAS assessed that all the
recommendations had been implemented, except for six recommendations which will
be followed-up as part of the implementation of DG EAC's action plan in
response to the 2010 IAS audit on Monitoring and Supervision of National
Agencies by DG EAC.

2.8.28.   ELARG:
Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG
ELARG

Based on the results of its follow-up review finalised on 7 June,
the IAS assessed that the recommendation had been implemented.

2.8.29.   ESTAT:
Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG
ESTAT

Based on the results of its follow-up
review finalised on7 June, the IAS assessed that the recommendations had been
implemented.

[1]               The duplication of recommendations resulting from
DGs' split and cut-off consideration to classify recommendations by year
explains the changes of figures compared to Table 1 in the 2010 report.

[2]               The reports finalised by 1 February 2011 and the ML
on the split of the DGs finalised in March 2011, are included in the 2010
report and are, therefore, not included in the 2011 report. Likewise, the
reports issued in 2011 but finalised by 31 January 2012 are included in the
2011 report.

[3]               Concerning the ECA, their audits in the context of
annual report on budget execution includes focus on "the control
systems put in place by the Commission to ensure that accounting data is not
affected by errors". In particular, the ECA assessment
"is mainly based on the evaluation of the results of the [accounting
quality] project’s implementation by the examined DGs in the different areas of
controls by which it is made up." The Court assessed in particular the
accounting control environment, the closing process and cut-off procedures.