# IMMC.SWD%282022%29160%20final.ENG.xhtml.2_EN_autre_document_travail_service_part1_v5.docx

european flagEUROPEAN COMMISSION

Brussels, 7.6.2022

SWD(2022) 160 final

COMMISSION STAFF WORKING DOCUMENT

Accompanying the document

REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS

Annual report to the Discharge Authority on internal audits carried out in 2021

{COM(2022) 292 final}

Table of contents

Table of contents

Content of the staff working document

Part 1 Final reports

1.
     Horizontal audits

2.
     Agriculture, natural resources and health

3.
     Cohesion

4.
     Research, energy and transport

5.
     External actions

6.
     Education and citizenship

7.
     Economic and financial affairs

8.
     General services

9.
     Information technology audits

Part 2 - FOLLOW-UP ENGAGEMENTS (SUMMARISED)

List of audits for which all recommendations have been closed in 2021 after a follow-up audit

Part 3: summary of long-outstanding recommendations – state of play as at 31 January 2022

List of abbreviations

CHAFEA: Consumers, Health; Agriculture and Food Executive Agency

CINEA: European Climate, Infrastructure and Environment Executive Agency (former INEA – Innovation and Networks Executive Agency)

DG AGRI: Directorate-General for Agriculture and Rural Development

DG BUDG: Directorate-General for Budget

DG CLIMA: Directorate-General for Climate Action

DG CNECT: Directorate-General for Communications Networks, Content and Technology

DG COMM: Directorate-General for Communication

DG COMP: Directorate-General for Competition

DG DEFIS: Directorate-General for Defence Industry and Space

  DG DEVCO: Directorate-General for International Cooperation and Development
  1

DG DIGIT: Directorate-General for Informatics

DG EAC: Directorate-General for Education, Youth, Sport and Culture

DG ECFIN: Directorate-General for Economic and Financial Affairs

DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations

DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion

DG ENER: Directorate-General for Energy

DG ENV: Directorate-General for Environment

DG ESTAT: Eurostat

DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union

DG GROW: Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs

DG HOME: Directorate-General for Migration and Home Affairs

DG HR: Directorate-General for Human Resources and Security

DG INTPA: Directorate-General for International Partnerships (former DG DEVCO)

DG JUST: Directorate-General for Justice and Consumers

DG MARE: Directorate-General for Maritime Affairs and Fisheries

DG MOVE: Directorate-General for Mobility and Transport

DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations

DG REFORM: Directorate-General for Reform (former SRSS

DG REGIO: Directorate-General for Regional and Urban Policy

DG RTD: Directorate-General for Research and Innovation

DG SANTE: Directorate-General for Health and Food Safety

DG SCIC: Directorate-General for Interpretation

DGT: Directorate-General for Translation

DG TAXUD: Directorate-General for Taxation and Customs Union

DG TRADE: Directorate-General for Trade

EACEA: European Education and Culture Executive Agency (former Education, Audiovisual and Culture Executive Agency)

ECHA: European Chemicals Agency

EEA: European Environment Agency

EISMEA: European Innovation Council and small and medium-sized enterprises (SMEs) Executive Agency

EPPO: European Public Prosecution Office

EPSO: European Personnel Selection Office

ERCEA: European Research Council Executive Agency

F4E: Joint Undertaking for ITER and the Development of Fusion for Energy (F4E)

FPI: Service for Foreign Policy Instruments

FRONTEX: European Border and Coast Guard Agency

IAS: Internal Audit Service

IDEA: Inspire, Debate, Engage, and Accelerate Action

JRC: Joint Research Centre

OIB: Office for Infrastructure and Logistics in Brussels

OIL: Office for Infrastructure and Logistics in Luxembourg

OLAF: European Anti-Fraud Office

OP: Publications Office of the European Union

PMO: Office for the Administration and Payment of Individual Entitlements

REA: European Research Executive Agency

SG: Secretariat-General

SG.RECOVER: Secretariat-General Recovery

SJ: Legal Service

Content of the staff working document

Part 1 of this document contains:

a summary of the internal audit engagements performed as part of the 2021 Internal Audit Service (IAS) audit plan (reports issued between 1 February 2021 and 31 January 2022); and

the principal recommendations (critical and very important
  2
  ) made.

The information contained in this document reflects the state of play when the audit engagements were finalised. Each audit followed the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation of the engagement. The enclosed summary of each engagement aims to provide an overview of the audits and their main results. Additional, up-to-date information is provided in specific sections by the auditees on measures drawn up and already implemented after the internal audit engagements were finalised.

Part 2 of this document contains a summary of the results of the IAS follow-up engagements performed between 1 February 2021 and 31 January 2022
  3
  .

Part 3 provides a summarised overview of the eight long overdue very important recommendations as at 31 January 2022.

Part 1 Final reports

1.Horizontal audits

2.Audit on the implementation of audit results in Horizon 2020 (CINEA, DG CNECT, EISMEA, ERCEA, REA, DG RTD)

The objective of the audit was to assess if the internal control system set up for the process for implementing H2020 Common Audit Service and European Court of Auditors audit results, H2020 audit results extensions and financial recommendations from OLAF investigations in the research family is adequately designed and effectively implemented in compliance with the applicable rules.

There are no observations/reservations in the 2020 Annual Activity Reports of the Directorates-General and Executive Agencies involved that relate to the processes audited. .

The fieldwork was finalised on 24 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the following strengths/good practices in relation to the implementation of Common Audit Service audit results:

·The process for the implementation of the Common Audit Service audit results and extensions is overall well designed.

·The roles and responsibilities related to the implementation of the Common Audit Service H2020 audits results and extensions in the H2020 implementing entities are clearly defined.

·The project officers and the financial officers are provided with the necessary tools to implement the Common Audit Service audit results effectively. In particular:

–central guidance (eGrants Vademecum) has been developed by the Common Implementation Centre which details the checks to be made for the implementation of the Common Audit Service audits results, i.e. clear description of the checks and steps that need to be performed, centrally developed templates to be used by the project officers and financial officers;

–the implementation of Common Audit Service audit results (including extensions) is supported by a specifically developed electronic workflow (‘AURI’) in the COMPASS IT system.

The IAS identified three very important issues at corporate family level (Common Implementation Centre - DG RTD) concerning: (1) monitoring of the implementation of Common Audit Service audit results and extensions; (2) reporting on the implementation of Common Audit Service and European Court of Auditors audit results and extensions; (3) implementation of the results of the non-joint European Court of Auditors audits; and one very important issue at the level of the implementing bodies (CINEA): implementation of Common Audit Service audit results and extensions and formulated four very important recommendations:

Monitoring of the implementation of Common Audit Service audit results and extensions (One very important recommendation addressed to the Common Implementation Centre - DG RTD)

The Common Implementation Centre should define the guidance and methodology for the monitoring of the implementation of audit results including adopting a set of common targets and indicators. It should also improve the content and the quality of the COMPASS AURI report, in order to provide a reliable supporting tool/monitoring instrument for Directorates-General/Executive Agencies.

Reporting on the implementation of Common Audit Service and European Court of Auditors audit results and extensions (One very important recommendation addressed to the Common Implementation Centre - DG RTD)

The Common Implementation Centre should develop a common approach on how the implementing bodies should report on the implementation of H2020 audit results and audit extensions in their Annual Activity Report, to ensure consistency and comparability/consolidating of data in the Research family.

Implementation of the results of non-joint European Court of Auditors audits (One very important recommendation addressed to the Common Implementation Centre - DG RTD)

The Common Implementation Centre should develop a central guidance for the implementation of the European Court of Auditors non-joint audit results and define a common approach for the use of the information technology system for European Court of Auditors non-joint audits

Implementation of Common Audit Service audit results and extensions of audit results (One very important recommendation addressed to CINEA)

CINEA should implement measures (such as participation of staff in trainings or workshops, organised by the Common Implementation Centre) to raise the financial officer’s awareness of the applicable H2020 guidance (e-grants Vademecum) on the process of completion of the calculation sheets, the implementation of recovery orders, and the process related to deviations.

Additional information provided by CINEA and DG RTD on the measures defined and/or implemented following the Internal Audit Service audit

The action plan addressing the recommendations of the implementation of audit results was sent to the IAS on 24 February 2022. According to DG RTD’s corporate action plan the implementation of the following actions will be completed until the end of 2022.

For recommendation n°2, the actions are: (1) to consult the members of the Research & Innovation Network of Ex ante Control practitioners (RINEC) and research and innovation audit network (RIAN) groups to analyse the targets and indicators used by the different implementing services to monitor the implementation of audit results; (2) to agree with the stakeholders on the best targets and indicators to monitor the implementation of audit results; and finally (3) to draft guidance setting common targets and indicators for the monitoring of implementation of audit results. The Common Implementation Centre will assess if and how the COMPASS AURI report can be improved to serve as a reliable supporting/monitoring instrument for the implementing services.

For recommendation n°3, the Common Implementation Centre will coordinate with the different implementing services and define a common approach to be endorsed by the Common Implementation Centre Governance on what data should be reported on the implementation of H2020 audit results/audit extensions in their annual activity report.

For recommendation n°4, a new feature in the corporate database for the external audit data (AUDEX) allowing the encoding of results on these non-joint ECA audits is currently under development. This new feature was presented in the RIAN meeting in October 2021 and the group unanimously welcomed it. Once the new feature is available in AUDEX, the AURI workflow will be used to implement the results of non-joint ECA audits the same way as that of any other audits.

CINEA developed an action plan, which outlines two main actions to be implemented by the end of 2022 to ensure that all financial officers have the adequate knowledge. The actions are related to the tutoring of newcomers and the participation to relevant trainings.

3.Audit on relations with decentralised agencies: European Environment Agency (EEA) and European Chemicals Agency (ECHA) (DG CLIMA, DG ENV)

3.

Audit on relations with decentralised agencies:

European Environment Agency (

EEA

)

and

European Chemicals Agency

(

ECHA

)

(DG

CLIMA, DG ENV)

The objective of the audit was to assess whether DG ENV and DG CLIMA have put in place adequate internal control systems to ensure that relations with their main decentralised agencies (EEA and ECHA) are managed effectively and efficiently and in accordance with the applicable legislation and corporate guidance.

The objective of the audit was to assess whether DG ENV and DG CLIMA have put in place adequate internal control systems to ensure that relations with their main decentralised agencies (EEA and ECHA) are managed effectively and efficiently and in accordance with the applicable legislation and corporate guidance.

There are no observations/reservations in the 2020 Annual Activity Report of DG ENV and DG CLIMA that relate to the area/process audited.

There are no observations/reservations in the 2020 Annual Activity Report of DG ENV and DG CLIMA that relate to the area/process audited.

The fieldwork was finalised on 30 June 2021. All observations and recommendations relate to the situation as of that date.

The fieldwork was finalised on 30 June 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the in-depth knowledge, experience and strong commitment of staff of DG ENV and DG CLIMA in their day-to-day relations with the EEA and the ECHA and the (longstanding and) good working relationships that have been established over time.

The IAS identified two very important issues concerning: (1) DG ENV supervision and coordination mechanisms with the EEA; and (2) the oversight role of both DGs CLIMA and ENV on the EEA’s resources, and formulated three very important recommendations:

DG ENV supervision and coordination mechanisms with the EEA (One very important recommendation addressed to DG ENV)

DG ENV should establish a process including a written description to monitor the progress of activities that DG ENV requests to the EEA, establish a supervision strategy vis-à-vis the EEA with key elements and initiate discussion with Central services to find ways to strengthen the coordination with other DGs requesting activities to the EEA.

Oversight role of both DGs CLIMA and ENV on the EEA’s resources (Two very important recommendations addressed to DG CLIMA and DG ENV)

DG ENV and DG CLIMA should enhance controls and guidance for the preparation of the financial fiches, strengthen the coordination with other Commission services and clarify roles and responsibilities for shared projects at the planning stage, including to the extent possible the financing sources to ensure optimal financing practices.

Additional information provided by DG CLIMA and DG ENV on the measures defined and/or implemented following the Internal Audit Service audit

DG CLIMA and DG ENV have coordinated an action plan, to be implemented by the end of 2022. It notably aims at enhancing controls on the ‘financial fiches’ requesting resources for the EEA, strengthening the structured dialogues between DG ENV, DG CLIMA and the EEA, better coordinating EEA activities with other Commission services, and preparing guidance on the financing of non-core activities.

Work on the implementation of these recommendations has started. In particular, a ‘structured dialogue’ has been established between DG ENV, DG CLIMA and the EEA with Senior Management meetings twice a year to discuss strategic priorities in terms of the EEA support, in a context of increasing demands and limited resources. An ‘Intergroup’ (DG ENV – CLIMA – EEA) has been created for implementing such a strategy.

In addition, a permanent Inter-Service Group (ISG) has been established to strengthen the coordination with other DGs regarding EEA activities. In the context of the European Green Deal, more and more DGs request support and have agreements with the EEA (in total, 12 ongoing or foreseen agreements between EEA and other Commission services have been identified). The ISG will also be consulted for the evaluation of the EEA and for drafting the Commission Opinion on the agency Programming Documents.

In addition, a permanent Inter-Service Group (ISG) has been established to strengthen the coordination with other DGs regarding EEA activities. In the context of the European Green Deal, more and more DGs request support and have agreements with the EEA (in total, 12 ongoing or foreseen agreements between EEA and other Commission services have been identified). The ISG will also be consulted for the evaluation of the EEA and for drafting the Commission Opinion on the agency Programming Documents.

4.Limited review on the error rate calculation (DG DEFIS, DG GROW)

4.

Limited review on the error rate calculation (DG DEFIS, DG GROW)

The objective of the limited review was to check the correctness of the calculation of the error rates by DG DEFIS and DG GROW and of the disclosure in their Annual Activity Reports.

The objective of the limited review was to check the correctness of the calculation of the error rates by DG DEFIS and DG GROW and of the disclosure in their Annual Activity Reports.

The IAS did not formulate any critical or very important recommendations.

The IAS did not formulate any critical or very important recommendations.

5.Audit on crisis communication (DG COMM, DG ECHO, DG SANTE, SG)

5.

Audit on crisis communication (DG COMM, DG ECHO, DG SANTE, SG)

The objective of the audit was to assess whether the Commission has put in place an adequate internal control system that is effective and efficient for communication during a crisis.

The objective of the audit was to assess whether the Commission has put in place an adequate internal control system that is effective and efficient for communication during a crisis.

There was no observation/reservation in the 2020 Annual Activity Reports of DG COMM, DG ECHO, DG SANTE and SG on crisis communication that relate to the area/process audited.

There was no observation/reservation in the 2020 Annual Activity Reports of DG COMM, DG ECHO, DG SANTE and SG on crisis communication that relate to the area/process audited.

The fieldwork was finalised on 22 July 2021. All observations and recommendations relate to the situation as of that date.

The fieldwork was finalised on 22 July 2021. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the commitment of the Commission’s communication community at large, which was visible during the multi-sectoral COVID-19 pandemic crisis when they managed extra tasks under high workload and tight deadlines, while at the same time adapting to novel working conditions.

The IAS acknowledged the commitment of the Commission’s communication community at large, which was visible during the multi-sectoral COVID-19 pandemic crisis when they managed extra tasks under high workload and tight deadlines, while at the same time adapting to novel working conditions.

The IAS did not formulate any critical or very important recommendations.

The IAS did not formulate any critical or very important recommendations.

6.Audit on delegations and efficiency of decision making in the European Joint Undertaking for ITER and the Development of Fusion for Energy and cooperation mechanisms with DG ENER (DG ENER)

6.

Audit on delegations and efficiency of decision making in the European Joint Undertaking for ITER and the Development of Fusion for Energy and cooperation mechanisms with DG ENER (DG

ENER)

The objective of the audit was to assess the adequacy of the design and the effective implementation of F4E’s internal control processes for financial circuits and financial delegations and deputising arrangements for its key operational processes. Furthermore, the audit assessed DG ENER’s and F4E’s cooperation and supervision mechanisms.

The fieldwork was finalised on 30 September 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the DG ENER’s efforts to supervise Fusion for Energy (F4E). In particular:

·The supervision of F4E is carried out at the highest management level. Regular meetings are held between the Deputy Director-General and the Director of F4E.

·The current supervision strategy for F4E provides a division of tasks between responsible units and a timeline for the main annual supervision activities (thus going beyond the guidance template provided by the Secretariat-General of the Commission).

The IAS did not address any critical or very important recommendations to DG ENER.

7.Audit on interruptions, suspensions and financial corrections for the European Structural and Investment Funds 2014-2020 (DG EMPL, DG MARE, DG REGIO)

The objective of the audit was to assess the adequacy of the design and the effective implementation of: (1) preventive measures: interruptions and suspensions mechanisms; and (2) corrective measures: financial correction processes applied by DG REGIO, DG EMPL and DG MARE to protect the EU budget.

As regards reporting in the Annual Activity Reports, reservations were made by DG REGIO, DG EMPL and DG MARE for deficiencies in the management and control systems of a number of operational programmes which affect the legality and regularity of the payments concerned.

The fieldwork was finalised on 31 October 2021. All observations and recommendations relate to the situation as of that date.

The IAS identified a number of good practices that the Directorates-General apply in their management of the interruptions, suspensions and financial corrections processes:

·The dedicated SharePoint site for the Interruptions, suspensions and financial corrections committee in DG REGIO, the presentation of the committee’s proceedings, the library of the supporting documents and the monitoring tables available for both preventive and corrective measures facilitate an easy access to all relevant information on the decisions made and the status of specific cases.

·The DG REGIO Wiki tool, an online library of the procedures, guidelines and explanatory materials available for all users, is a best practice.

·During our testing we noted cases of very good cooperation and coordination of actions between desk officers and auditors, both inside and across Directorates-General, especially in the context of strict legal deadlines that are applicable to preventive measures.

·The creation of the joint audit directorate is a catalyst for harmonising and streamlining the internal procedures for applying preventive and corrective measures and the role of the audit units.

The IAS identified three very important issues concerning: (1) preventive measures - key criteria for preventive measures; (2) preventive measures - warning letters and (3) corrective measures - financial corrections, and formulated eight very important recommendations:

Preventive measures - key criteria for preventive measures (Two very important recommendations addressed to DG EMPL, DG REGIO)

For the 2014-2020 programming period, DG REGIO and DG EMPL should ensure that the use of the 10% threshold to interrupt payments is clearly explained in the related guidance, as well as how this links to the acceptance of accounts process and subsequent financial corrections, both in terms of the underlying rationale and the choice of this particular threshold level. In this context, the Directorates-General should assess the need to revise the criteria for deciding on interruptions as part of a proactive response from the Commission to protect the budget and include an analysis in their Annual Activity Reports of the resulting impact on persistently high error rates.

For the 2021-2027 programming period, DG REGIO and DG EMPL should re-assess and explain clearly in the related guidance the underlying rationale for interrupting payments taking into account different thresholds for retention of interim payments (5% instead of 10%) under the 2021-2027 period and include an analysis in their Annual Activity Reports on the possible impact on persistently high error rates.

Preventive measures - warning letters (Three very important recommendations addressed to DG EMPL, DG REGIO)

DG REGIO and DG EMPL should evaluate the effectiveness of warning letters sent in case a payment request was received (i.e. warning letters for corrective measures), manage more rigorously the process of issuing and following-up on warning letters and include an analysis in their Annual Activity Reports of the resulting impact on persistently high error rates.

DG EMPL should set deadlines for initiating the internal process by geographical units for deciding on warning letters.

Corrective measures - financial corrections (Three very important recommendations addressed to DG EMPL, DG MARE, DG REGIO)

DG REGIO, DG EMPL and DG MARE should update their guidance and operational procedures on financial corrections to set internal deadlines for the key steps of the financial corrections process. The guidance should be updated to take into account all relevant Legal Service opinions, including on net financial corrections. The Directorates-General should use a simple document (e.g. a checklist, flow chart) listing all requirements for pursuing net financial corrections and thereby document whether these conditions were met for each potential case. Finally, the Directorates-General should provide a clearer explanation in their respective Annual Activity Reports as regards the legal constraints in applying net financial corrections, link this clearly to the fact that no such corrections have been applied in practice for the 2014-2020 programming period, and analyse the impact on the Commission’s corrective capacity.

Additional information provided by DG REGIO, DG EMPL and DG MARE on the measures defined and/or implemented following the Internal Audit Service audit

DG REGIO and DG EMPL will update the guidance note on interruptions and clearly explain in a guidance note the use and impact of the 10% threshold to interrupt payments, its link with the acceptance of accounts exercise and with the subsequent potential financial correction procedure. The criteria for deciding on interruptions will also be reviewed in the light of persisting material levels of error reported by the ECA for the cohesion area. An evaluation of the effectiveness of warning letters for corrective measures will be made. The financial corrections manual will be updated. In the AAR 2021 a more comprehensive explanation on the net financial corrections instrument is presented highlighting legal constraints and challenges in the application and the impact on the Commission’s corrective capacity.

DG MARE will update its financial corrections manual, and ensure consistency with those issued by DG REGIO and DG EMPL.

8.Audit on the preparation for the 2021-2027 programming period (DG EMPL, DG MARE, DG REGIO)

The objective of the audit was to assess whether DG REGIO, DG EMPL and DG MARE had designed and implemented effective processes to support the start of the 2021-2027 programming period.

As the legislation for the 2021-2027 period was formally adopted in 2021, in their 2020 Annual Activity Reports, DG REGIO, DG EMPL and DG MARE did not issue a reservation specifically on the 2021-2027 programming period.

The fieldwork was finalised on 24 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG REGIO, DG EMPL and DG MARE to effectively prepare for the 2021-2027 programming period. The IAS identified the following strengths and good practices in this area:

·DG REGIO’s 2021-2027 Programming Negotiations Progress Reports: regular reports are prepared for the attention of the Board of Directors outlining the overall progress in the negotiations and the main issues arising during the latter to be flagged. The content of the report has evolved over time and is now very comprehensive covering different areas and topics relevant during the programming process. Launch of the 2021-2027 programming period: based on the experience of the previous programming period, the 2021-2027 negotiations’ process was launched on time in 2019 and subsequent coordination arrangements were decided and put in place by DG REGIO.

·Coordination arrangements: the IAS welcomed the initiative of DG REGIO: (1) to engage the Common Provisions Regulation Directorates-General (and the SG country team leaders) in the discussions with Member States on partnership agreement level information; (2) to organise coordination arrangements between Directorates-General timely and early in the process of the programming period; (3) to seek cooperation with other Directorates-General and services not part of the Common Provision Regulation family, e.g. DG AGRI, DG ENV.

·Stock Taking Group: the Stock Taking Group is an important tool for cooperation between the Commission services for the phases of informal and formal dialogue with Member States. This includes discussion on common issues, deciding on the most appropriate solutions for the participating Directorates-General, information sharing as regards on-going initiatives on joint planning. All Common Provisions Regulation Directorates-General (DG REGIO, DG EMPL, DG MARE and DG HOME) participate actively and regularly in the Group’s meetings and the Directorates-General have made efforts to incorporate DG HOME, which became part of the Common Provisions Regulation family only as from the 2021-2027 programming period.

The IAS identified two very important issues concerning: (1) support to Member States in the preparation of the 2021-2027 programming period (deficiencies in procedures to provide guidance for Member States); and (2) timing of the preparation and operational start of the 2021-2027 programming period (delays in launching IT system and frequency of internal reporting) and formulated seven very important recommendations:

Support to Member States in the preparation of the 2021-2027 programming period (Two very important recommendation addressed to DG REGIO)

DG REGIO should:

·Establish a clear procedure for issuing ‘non-guidance documents’ (including the identification of the process owner, the purpose and scope of these documents, the procedure for preparation, consultation and adoption of such documents) and implement this procedure consistently.

·Make all guidance and non-guidance documents addressed to Member State authorities responsible for programming, implementation and audit available in a common repository.

DG REGIO should make all internal guidance and non-guidance documents related to the Common Provision Regulation accessible to all Common Provision Regulation Directorates-General desk officers in a common repository (i.e. REGIO Wiki).

Timing of the preparation and operational start of the 2021-2027 programming period (Five very important recommendations addressed to DG EMPL, DG MARE, DG REGIO)

DG REGIO, DG EMPL and DG MARE should:

·Improve the communication and coordination between the structural funds common database team (SFC) and the Common Provisions Regulation Directorates-General to identify elements where a common approach is needed in SFC 2021 (in particular for future development of SFC 2021 modules, such as payments to programmes or the reporting obligations).

·Ensure the participation of all Common Provisions Regulation Directorates-General in the development and finalisation of the checklist for the assessment of the horizontal enabling condition on the Charter of Fundamental Rights.

·Improve their internal reporting system to senior management.

DG REGIO should finalise and upload the Interreg checklist for programmes assessment and upload in Wiki (and later on, when filled in, in MyWorkplace).

DG EMPL should develop a financial checklist to support the relevant units in their checks while the validations rules in SFC 2021 are not yet fully operative.

Additional information provided by DG REGIO, DG EMPL and DG MARE on the measures defined and/or implemented following the Internal Audit Service audit

DG EMPL agreed on an action plan with the IAS. All important recommendations have been implemented, including improvement of communication and coordination between the SFC Team and the Common Provision Regulation DGs as well as of the internal reporting system to the senior management, and the production of financial checklists. The important recommendation concerning clear procedures for “non guidance documents” will be implemented in accordance with the time limits (end June 2022) as indicated in the action plan.

DG MARE has implemented the actions related to the most important recommendations, notably the improvement of communication and coordination between the SFC Team and the Common Provisions Regulation DGs as well as the internal reporting system to the senior management, and the production of financial checklists.

DG REGIO is preparing a clear procedure for issuing (non-) guidance documents and creating a common repository of documents on the REGIO Wiki extranet accessible for the national authorities implementing the policy. In addition, REGIO further improved the communication and coordination between SFC Team and Common Provisions Regulation DGs and increased reporting frequency to senior management, including on country specific issues.

9.Audit on governance, stakeholder management and external communication in the European Border and Coast Guard Agency comprising where relevant DG HOME

9.

Audit on governance, stakeholder management and external communication in the European Border and Coast Guard Agency comprising where relevant DG

HOME

The objective of the audit was to assess the adequacy of the design and the effective implementation of the governance structure and arrangements in Frontex, and DG HOME’s oversight role and responsibilities as concerns Frontex.

The objective of the audit was to assess the adequacy of the design and the effective implementation of the governance structure and arrangements in Frontex, and DG HOME’s oversight role and responsibilities as concerns Frontex.

The 2020 Annual Activity Report of DG HOME (2.1.5 Declaration of Assurance and reservations) comprises the following reservation, which relates to the areas and processes audited:

The 2020 Annual Activity Report of DG HOME (2.1.5 Declaration of Assurance and reservations) comprises the following reservation, which relates to the areas and processes audited:

‘Reservation on reputational grounds related to weaknesses identified in the effective implementation of Frontex’s new mandate in accordance with good governance and the requirements of the European Border and Coast Guard Regulation.’

‘Reservation on reputational grounds related to weaknesses identified in the effective implementation of Frontex’s new mandate in accordance with good governance and the requirements of the European Border and Coast Guard Regulation.’

The fieldwork was finalised on 16 November 2021. All observations and recommendations relate to the situation as of that date.

The fieldwork was finalised on 16 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts of DG HOME to improve its oversight controls in Frontex. In particular, the IAS noted the following strengths:

The IAS recognised the ongoing efforts of DG HOME to improve its oversight controls in Frontex. In particular, the IAS noted the following strengths:

Frontex Support Group Meetings – In May 2021, DG HOME put in place a new process aimed at ensuring internal coordination between the different units dealing with Frontex-related topics. Held every two weeks, the Frontex Support Group Meetings enable DG HOME staff to discuss those topics in an efficient manner by, for example: (1) providing updates on the state of play, with Directorate B briefing other directorates about relevant information, e.g. following Frontex’s management board meetings; (2) discussing current priorities with regard to the Agency; and (3) proving inputs to letters received from Frontex and discussing the corresponding replies.

The IAS did not formulate any critical or very important recommendations.

10.Agriculture, natural resources and health

11.Audit on support, monitoring and checks of the work of Certification Bodies (DG AGRI)

The objective of the audit was to assess whether the measures taken by DG AGRI to support, monitor and check the work of Certification Bodies are adequately designed and effectively implemented to allow it to draw the necessary assurances from their work.

There were no observations/reservations in the 2019 Annual Activity Report of DG AGRI that relate to the area/process audited.

The fieldwork was finalised on 26 February 2021. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the ongoing efforts made by DG AGRI to improve the implementation of the measures taken to support, monitor and check the work of Certification Bodies. In particular, the audit identified the following strengths:

·Enhanced coordination within Directorate H vis-à-vis Certification Body audit activities. DG AGRI.H has enhanced coordination between audit units as regards audit activities on Certification Bodies (e.g. through the creation of the peer review group or specific trainings provided by AGRI.H.5 to other Directorate H audit units).

·DG AGRI has incorporated the Certification Body risk in its central risk analysis. In 2019, DG AGRI reviewed its central risk analysis to include an additional risk factor linked to the risk of ‘insufficient or inadequate audit work by the Certification Body’. This new risk factor was used for the first time in the 2020-2023 multi-annual work programme and reflects the extended role given to the Certification Bodies by the 2013 horizontal regulation.

The IAS did not formulate any critical or very important recommendations.

12.Audit on monitoring and supervision arrangements regarding land parcel identification system in Member States (DG AGRI)

The objective of the audit was to assess the adequate design and effective implementation of the controls put in place by DG AGRI to support the management of Member States land parcel identification systems and to monitor their quality.

There are no reservations in the 2020 Annual Activity Report of DG AGRI that relate to the land parcel identification system (LPIS) quality assessment (QA) process audited.

The fieldwork was finalised on 3 August 2021. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged a number of strengths:

·The commitment, dedication and highly technical expertise of the staff within AGRI.D3 (unit AGRI.C1 since 16 January 2022) involved in the land parcel identification system quality assessment exercise.

·The efforts made by AGRI.D3 (unit AGRI.C1 since 16 January 2022), in cooperation with the JRC, to provide highly detailed and technical guidance to the Member States via the WikiCAP website.

The IAS identified one very important issue concerning the monitoring and follow-up of the land parcel identification system quality assurance exercise and formulated one very important recommendation:

Regular analyses of the land parcel identification system quality assurance exercise

DG AGRI should, on an annual basis, perform a global analysis of the outcome of the land parcel identification system quality assurance exercise and report on it to internal and external stakeholders. Moreover, in order to improve the monitoring of the land parcel identification system quality assurance, DG AGRI should perform a regular qualitative in-depth analysis of the assessment reports (in cooperation with other relevant services), an annual assessment of the remedial action plans based on agreed criteria and put in place working arrangements to systematically follow up identified remedial actions. Finally, DG AGRI should set up regular dedicated internal meetings and reporting arrangements regarding the land parcel identification system quality assurance exercise. DG AGRI should also improve communication and coordination between AGRI.D3 (unit AGRI.C1 since 16 January 2022) and AGRI.H3 to increase efficiency and synergies, whilst respecting the specific roles and mission of the two units.

Additional information provided by DG AGRI on the measures defined and/or implemented following the Internal Audit Service audit

DG AGRI accepted the recommendation and submitted an action plan that was assessed as satisfactory to mitigate the risks identified by the IAS. The recommendation is due for 30 June 2022.

DG AGRI committed to implement the following actions for the very important recommendation:

13.Develop a template for an “annual state of play note of the land parcel identification system (LPIS) quality assessment (QA)” for AGRI hierarchy and relevant units. A summary of this note will be shared with Member States at the nearest Committee meeting.

14.a) In cooperation with other relevant services, e.g. the JRC, DG AGRI will develop and describe the methodology of a more in-depth analysis of LPIS QA reports. This analysis will be done every 3 years. The most recent results of this exercise will feed in and be summarised in the “annual state of play note of LPIS QA”. b) perform regular in-depth qualitative analyses of the assessment reports (ARs) in cooperation with other relevant services (e.g. JRC), an annual assessment of the remedial action plans (RAPs) based on agreed criteria and put in place working arrangements to systematically follow up identified remedial actions.

DG AGRI has already implemented two actions, still to be confirmed by the IAS:

15.DG AGRI developed a template for the annual state of play of LPIS QA.

16.b) DG AGRI prepared three documents: a documentation on the criteria used for the evaluation of the remedial action plans and criteria for follow-up; a template for the evaluation of the remedial action plans and a template for reporting on the status of the remedial action that will serve for the annual state of play of LPIS QA reports.

17.Cohesion

18.Audit on processes put in place for the delivery of technical support to Member States (DG REFORM)

The objective of the audit was to assess the adequacy of the design and effective implementation of DG REFORM’s processes and controls for delivering technical support projects carried out under the Structural Reform Support Programme.

Reservations were raised in the 2017-2020 Annual Activity Reports on the rate of the residual error that was calculated under direct grant management – in the 2020 Annual Activity Reports, the reservations concerned grant agreements signed with non-pillar assessed beneficiaries under the technical support funds (European Structural and Investment Funds and Structural Reform Support Programme) for which the legality and regularity-related criterion of 2% was breached. It is to be noted that the reservation was lifted in the 2021 Annual Activity Report in application of the “de minimis” rule.

The fieldwork was finalised on 21 October 2021. All observations and recommendations relate to the situation as at that date.

The IAS recognised the ongoing efforts made by DG REFORM to improve the design of individual projects under the SRSP programme and to strengthen the monitoring of their implementation. The IAS identified the following strengths and good practices in these areas:

·Policy officers are very knowledgeable about the available delivery means for implementing technical support projects and the established processes enable the selection of appropriate delivery means/sub-tasks in each case.

·Existing controls ensure that the reprogramming of the projects (i.e. the change of key aspects of projects) and amendments of the underlying individual contracts/grant agreements comply with the applicable rules.

·The recently reinstated JIRA (a project monitoring tool) correspondents’ network provides a platform for structured discussions on JIRA user needs and developments between operational units and the horizontal unit A2 which is responsible for JIRA.

The IAS identified one very important issue concerning the project preparation and monitoring: tools, guidance and practices and formulated one very important recommendation:

Project preparation and monitoring: tools, guidance and practices

DG REFORM should:

·Finalise the e-manual of procedures and the revised JIRA workflows.

·Provide a common information technology solution for monitoring the project implementation that will assist the responsible officers in their daily tasks.

·Persist in current efforts to improve the completeness and reliability of project data encoded in JIRA (e.g. through providing training courses and communication activities to the responsible officers).

·Put in place a robust tool for performing effective plagiarism checks on project deliverables.

Additional information provided by DG REFORM on the measures defined and/or implemented following the Internal Audit Service audit

DG REFORM accepted all the recommendations received and submitted an action plan that was assessed as satisfactory to mitigate the risks identified by the IAS. The action plan has started with implementation at the latest by 30 June 2023.

19.Research, energy and transport

20.Audit on support, monitoring and enforcement of the existing energy ‘acquis’ (DG ENER)

The objective of the audit was to assess whether DG ENER has put in place an internal control system that ensures an effective and efficient support, monitoring and enforcement of EU energy law application.

There are no observations/reservations in the 2020 Annual Activity Report of DG ENER that relate to the area/process audited.

The fieldwork was finalised on 11 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG ENER regarding the support, monitoring and enforcement of the energy acquis and identified the following strengths:

·As regards the organisation, DG ENER staff responsible for the support, monitoring and enforcement of the energy acquis are knowledgeable and motivated, and have accumulated valuable experience in the legal energy field. In line with best practices highlighted in the coherence exercise, the same staff responsible for policy development are also responsible for the monitoring and enforcement of its implementation.

·There is good cooperation internally between the sectorial units and the Planning and Legal Affairs unit, as well as externally with key stakeholders in policy implementation (Member States, national regulators, supervisory agencies, etc.). Additionally, the Directorate-General has established effective cooperation with its Cabinet, which is systematically consulted on any key decision regarding new EU-Pilot dialogues and infringement cases, and for the final approval of proposals for infringement cases to be submitted for a decision at the College’s infringement cycle .

·Before the entry into force of the energy legislative initiatives, there is proactive support to Member States, as well as regular dialogue and effective communication with Member States and key stakeholders regarding challenges, conflicts of interpretation and other issues identified in the implementation of the policy. This is used as lessons learnt for policy development.

The IAS identified one very important issue concerning the management supervision for the reporting and verification of compliance assessment results for the transposition of Directives and formulated one very important recommendation:

Management supervision for the reporting and verification of compliance assessment results

DG ENER should develop guidance on the compliance assessment process and define the requirements for formal documentation of the compliance checks, including the verification of the assessment reports prepared by external contractors and the basis for recommending specific enforcement actions on detected issues. Also, it should ensure and document adequate management supervision of the compliance assessment process.

Additional information provided by DG ENER on the measures defined and/or implemented following the Internal Audit Service audit

For implementation of the recommendation DG ENER has committed to:

·Establish additional guidance on the compliance assessment process.

·Define the requirements for formal documentation of the compliance checks.

·Develop a more effective and documented management supervision of the compliance assessment process.

21.Consulting on supervision of the Energy Community Secretariat (DG ENER)

21.

Consulting on

supervision of the Energy Community Secretariat (DG ENER)

The objective of the consulting engagement was to propose improvements in DG ENER’s processes for supervising the Secretariat, including through modifications in the financial and staff rules of the Energy Community Secretariat.

The objective of the consulting engagement was to propose improvements in DG ENER’s processes for supervising the Secretariat, including through modifications in the financial and staff rules of the Energy Community Secretariat.

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

22.Audit on H2020 grant management - phase III, including scientific management for longer duration projects (ERCEA)

22.

Audit on H2020 grant management - phase III, including scientific management for longer duration projects (ERCEA)

The objective of the audit was to assess the effectiveness of the ex ante controls on the H2020 grant payments in ERCEA, and their contribution to the assurance on the legality, regularity and sound financial management of the related expenditure.

The objective of the audit was to assess the effectiveness of the

ex ante

controls on the H2020 grant payments in ERCEA, and their contribution to the assurance on the legality, regularity and sound financial management of the related expenditure.

There are no observations/reservations in the 2020 annual activity report of ERCEA relating to the area/process audited. The fieldwork was finalised on 15 May 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the efforts made by ERCEA in ensuring effective implementation of ex ante controls on H2020 grant payments in the context of an increasing workload. In particular, ERCEA has a strong control environment and has applied the following good practices:

There are no observations/reservations in the 2020 annual activity report of ERCEA relating to the area/process audited. The fieldwork was finalised on 15 May 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the efforts made by ERCEA in ensuring effective implementation of

ex ante

controls on H2020 grant payments in the context of an increasing workload. In particular, ERCEA has a strong control environment and has applied the following good practices:

·The project officers produce a note to the file for every interim/final payment. This note summarises all information related to reviews of audits, amendments, outcome of the mid-term/final scientific reports, outcomes of previous interim periods and principal investigator’s time commitment reports. This note allows ERCEA to monitor the progress of a project during its lifetime;

·

The project officers produce a note to the file for every interim/final payment. This note summarises all information related to reviews of audits, amendments, outcome of the mid-term/final scientific reports, outcomes of previous interim periods and principal investigator’s time commitment reports. This note allows ERCEA to monitor the progress of a project during its lifetime;

·ERCEA has proactively reacted in response to the COVID-19 pandemic. In particular, by establishing a COVID-19 task force comprising representatives of each unit and providing an analysis of the impact of COVID-19 on ERCEA’s activities.

·

ERCEA has proactively reacted in response to the COVID-19 pandemic. In particular, by establishing a COVID-19 task force comprising representatives of each unit and providing an analysis of the impact of COVID-19 on ERCEA’s activities.

·Unlike the other bodies implementing H2020, ERCEA carries out the scientific reviews mostly with its own staff and does not often use external experts. This allows flexibility to adapt the planning and cope with the workload, as the scientific review is not depending on the availability of expert management.

·

Unlike the other bodies implementing H2020, ERCEA carries out the scientific reviews mostly with its own staff and does not often use external experts. This allows flexibility to adapt the planning and cope with the workload, as the scientific review is not depending on the availability of expert management.

The IAS did not formulate any critical or very important recommendations.

The IAS did not formulate any critical or very important recommendations.

23.Audit on support, monitoring and enforcement of the transport ‘acquis' (DG MOVE)

23.

Audit on support, monitoring and enforcement of the transport ‘acquis' (DG MOVE)

The objective of the audit was to assess whether DG MOVE has put in place an internal control system that ensures effective support, monitoring and enforcement of EU transport law application.

The objective of the audit was to assess whether DG MOVE has put in place an internal control system that ensures effective support, monitoring and enforcement of EU transport law application.

There are no observations/reservations in the 2020 Annual Activity Report of DG MOVE that relate to the area/process audited.

There are no observations/reservations in the 2020 Annual Activity Report of DG MOVE that relate to the area/process audited.

The fieldwork was finalised on 10 November 2021. All observations and recommendations relate to the situation as of that date.

The fieldwork was finalised on 10 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG MOVE regarding the support, monitoring and enforcement of the transport acquis, and identified the following strengths:

The IAS recognised the ongoing efforts made by DG MOVE regarding the support, monitoring and enforcement of the transport acquis, and identified the following strengths:

·Since its establishment, DG MOVE has deployed an infringement cell in the coordination Unit A.4 ‘Legal issues & enforcement’ to support the line units on all procedural aspects related to the processing of complaints, EU-Pilot cases and infringements, including the monitoring of the state of play. This cell participates in the Secretariat-General-led discussions on the definition of the Commission’s enforcement and monitoring policy. Unit A.4 also has a legal cell that provides substantive legal advice to case handlers on all enforcement cases (i.e. CHAP
  4
  , EU-Pilot and infringements). Both cells communicate continuously and cooperate constructively on monitoring and enforcement of EU transport legislation with the line units.

·DG MOVE set up a CHAP coordinator in October 2019 to supervise the registration and assignment of complaints to the relevant line unit, and to regularly remind the line units to respect the obligation to notify the complainant. The CHAP coordinator is one of the members of the infringement cell and also provides substantive advice on the drafting of letters to complainants.

·In 2016, DG MOVE put in place a comprehensive Vade Mecum on infringements, aiming at bringing together all the key elements relevant to the Directorate-General’s compliance assessment of directives and management of complaints, EU-Pilot cases and infringements. The document describes the internal controls performed during the different phases of the process of monitoring and enforcing EU transport legislation, as well as the actors involved. The Vade Mecum is regularly updated to take into account specific needs identified at Directorate-General level and any changes in the procedures decided at central level.

The IAS did not formulate any critical or very important recommendations.

24.Audit on SEDIA implementation (REA)

The objective of the audit was to assess whether the Single Electronic Data Interchange Area (SEDIA)-related services by REA are provided in an effective and efficient manner, in compliance with the applicable regulations, and as agreed between the parties.

There are no observations/reservations in the 2020 Annual Activity Report of REA that relate to the area/process audited.

The fieldwork was finalised on 27 September 2021. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the following strengths:

·The results of the Central Validation Service clients’ survey conducted by the IAS in the context of this audit show a high satisfaction rate (92%) of REA’s clients.

·SEDIA is implemented by knowledgeable and committed staff in the Central Validation Service. Furthermore, a good collaboration between REA and DG BUDG and the effectiveness of the controls performed by REA has enabled DG BUDG to reduce its controls on legal validations, moving from a systematic verification to a sampled-based one.

·REA implements effective controls on legal and financial validation and verification services despite recurrent and significant delays in the delivery of information technology components for the upgrade of the participant data management (PDM) information technology system.

The IAS identified two very important issues concerning: (1) personal data protection and access to personal data and; (2) delivery of information technology components and formulated two very important recommendations:

Personal data protection and access to personal data

REA should review the information provided to the participants in order to clarify that identity documents can only be uploaded in the folder ‘identity documents’. In addition, it should assess with the service provider the feasibility of implementing automated controls on the documents uploaded by the participants, review the existing documents uploaded in PDM and remove those that include personal data. Finally, REA should finalise and endorse the internal implementing rules for personal data management and access to PDM for the Central Validation Service.

Delivery of IT components

REA should, in the short term, prepare a plan for the remaining information technology developments, including detailed milestones and deliverables and a narrative of the expected improvements, and submit it to the Grant and Procurement Steering Board for endorsement. In the mid-term, REA should perform a high-level analysis, together with DG Budget, the Common Implementation Centre and DG DIGIT on either: (1) the potential integration/interface of PDM by/with SUMMA
  5
  ; or (2) developing a new PDM tool as part of the new generation of eGrants/eProcurement suite, and submit it to the Grant and Procurement Steering Board for decision.

Additional information provided by REA on the measures defined and/or implemented following the Internal Audit Service audit

REA accepted all the IAS recommendations.

According to the action plan accepted by the IAS, the following actions will be taken. In respect to improving the protection of personal data in SEDIA:

- REA will provide to DG DIGIT the updated information to be visible to the participants in the Participant Register, in the form of a pop-up window.

- REA will request from DG DIGIT to perform a common assessment on the technical possibilities of the PDM tool to determine the feasibility: to implement automated controls on the documents uploaded by the participants that detect in particular identity documents; and to review the existing documents uploaded in PDM and remove those that include personal data, where not required. The results of these assessments will be discussed with DIGIT in order to reach a common position on the technical possibilities of implementing these control features.

- REA’s Central Validation Service will finalise and endorse a) the internal implementing rules for personal data management and b) the document on access to PDM for the Central Validation Service.

In respect to improve the timely delivery of IT components by DG DIGIT, REA will:

- Prepare together with DG DIGIT a plan for the remaining IT developments. The Business Process Owner (BPO) for Participant Register will then submit it to the Grant and Procurement Steering Board (GPSB) for endorsement.

- Perform a high-level analysis recommended by the IAS, together with DG BUDG, the Common Implementation Centre (DG RTD) and DG DIGIT, to be submitted by the BPO for Participant Register to the GPSB for decision.

The prospective implementation time for the recommendation is mid 2022 for the recommendation regarding the delivery of IT components, and end 2022 for those relating to personal data protection.

25.Audit on ‘Article 185 bodies’ (DG RTD)

The objective of the audit was to assess whether the supervision of article 185 bodies by DG RTD is effective and provides the necessary assurance that the financial contribution of the European Union is compliant with the applicable rules.

The audit engagement was launched in December 2020 and the preliminary survey phase, carried out in the first quarter of 2021, covered the five article 185 bodies under the responsibility of DG RTD.

The evidence gathered by the IAS during the preliminary survey, during which no major weaknesses related to the key supervisory tools used by DG RTD (in particular the project officers’ checks for the assessment of the annual reports) were identified, complemented by the fact that only two out of the five article 185 bodies under DG RTD responsibility will continue in the present form under Horizon Europe, enabled the IAS to re-assess the inherent risks related to the design and implementation of the supervision of article 185 bodies by DG RTD as medium to low.

As a result, the IAS decided to close the audit after the preliminary survey.

The IAS did not formulate any critical or very important recommendations.

26.Limited review on the Horizon 2020 error rate calculation by the Common Audit Service (DG RTD)

The objective of the limited review was to assess if the Common Audit Service effectively implemented the revised methodology for the calculation of the detected and residual error rates for H2020 and its disclosure in the 2020 Annual Activity Reports in the research and innovation family.

There are no observations/reservations in the 2020 Annual Activity Report of Directorate-General in Research and Innovation (DG RTD) that relate to the area/process audited.

The fieldwork was finalised on 5 March 2021. All observations and recommendations relate to the situation as of that date.

The IAS identified the following strengths and good practices:

·The use of information technology tools to encode audit data and in the calculation of the detected error rate (Microsoft Access currently used for the old methodology) makes these procedures more efficient (less resources spent on performing the same tasks) and effective (less error prone).

·The experience and knowledge of the staff involved in the calculation of the error rates at the different stages of the process (calculation of the top-up, of the detected error rate through the Microsoft Access database and of the residual error rate).

The IAS did not formulate any critical or very important recommendations.

27.External actions

28.Limited review on the measures implemented to address the error rate for indirect management with beneficiary countries (DG INTPA)

The objective of the limited review was to assess the adequacy and effectiveness of the actions taken by DG INTPA to analyse the root causes of errors detected by the Residual Error Rate study in indirect management with beneficiary countries contracts; the design of the measures to address them; and the implementation of these measures.

There are no observations/reservations in the 2020 Annual Activity Report of DG INTPA that relate to the area/process audited.

The fieldwork was finalised on 21 June 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG INTPA to prepare and implement annually an action plan to address the root causes of the errors and other high risk areas, and to assess its implementation regularly.

The IAS did not formulate any critical or very important recommendations.

29.Audit on the closure process of previous programmes - IPA I and ENPI (DG NEAR)

The audit assessed the adequacy of the design and the efficient and effective implementation of the controls put in place by DG NEAR for managing the closure of contracts and programmes for the European Neighbourhood and Partnership Instrument and the Instrument for Pre Accession I.

There are no observations/reservations in the 2020 Annual Activity Report DG NEAR that relate to the area/process audited.

The fieldwork was finalised on 22 September 2021. All observations and recommendations relate to the situation as of that date.

The IAS identified the following strengths:

·The closure checklists are clear, complete and suitable for the different management modes and, in our sample, they were correctly filled-in by staff responsible for closing contracts and financing decisions.

·The high level of digitalisation of the closure file (checklists, routing slip, explanatory notes, etc.) provides an easily accessible audit trail.

·Staff in both DG NEAR headquarters and EU Delegations are fully aware of the monitoring tools at their disposal.

·The key performance indicators related to closure (such as expired contracts, reduction of old ‘Reste à Liquider’, and the annual ‘potentially abnormal Reste à Liquider’ exercise) provide the Directorate-General with an aggregate view on its contract portfolio on aspects relating to closure.

The IAS did not formulate any critical or very important recommendations.

30.Audit on IPA II grants in direct management (DG NEAR)

The audit objective was to assess whether internal controls on the Instrument for Pre Accession (IPA) II grants in direct management are adequately designed and efficiently and effectively implemented to ensure legality and regularity of the underlying transactions.

DG NEAR made the following reservation in the 2020 Annual Activity Report concerning the area/process under the scope of this audit engagement: reservation concerning the errors in expenditure in direct management grants, due to a residual error rate (3.17%) above 2%. The actual exposure for 2020 was estimated at EUR 20.8 million.

The fieldwork was finalised on 25 November 2021. All observations and recommendations relate to the situation as of that date.

The auditors recognised the ongoing efforts made by DG NEAR to maintain and continuously update its internal control framework underpinning the legality and regularity of IPA II grants in direct management. In particular, the following strengths/good practices were observed:

·Since 2001, the grant selection and award process has been governed by the ‘Practical guide on contract procedures for European Union external action’, which is a complete and regularly updated body of guidance used by DG INTPA, DG NEAR and FPI. Overall, the grants in our sample conformed to key requirements of the guide applicable to the processes under audit.

·DG NEAR’s manual of procedures which details the ex ante checks to be performed when processing the payments. Overall, the grants in our sample conformed to key manual of procedures requirements.

·The IPA Contracts and Finance unit (NEAR.R.5) regularly organises meetings with staff dealing with finance and contracts in IPA Delegations and Headquarters, serving as a platform for awareness raising on financial and control procedures and for the exchange of best practices.

·Headquarters supervision missions to IPA Delegations have appropriate frequency and geographical coverage. They represent a good monitoring control on the application of the internal control framework in the Delegations.

·The EU Delegation to Serbia and the EU Office to Kosovo established the good practice of performing on the spot project visits, which are carried out at least once in the lifetime of each grant by teams composted of both financial and operational staff. The cooperation between the Finance & Contracts and Operation sections may contribute to more effectively detecting ineligible costs and taking timely corrective measures.

·DG NEAR measures the time from informing applicants that they have been successful to signing grant agreement via key performance indicator 5 ‘Time to grant’ and reports on it in the Annual Activity Report. On this key performance indicator, DG NEAR was significantly below the maximum of 90 days stipulated in the Financial Regulation (38.4 days in 2019 and 50.2 days in 2020).

The IAS did not formulate any critical or very important recommendations.

31.Education and citizenship

32.Audit on the preparation for the 2021-2027 programming period of DG HOME funds (DG HOME)

The objective of the audit was to assess whether DG HOME has designed and put in place an effective internal control system in support of its preparation for the start of the 2021-2027 programming period.

As the legislation for the 2021-2027 period was formally adopted in 2021, in its 2020 Annual Activity Report, DG HOME did not issue a reservation specifically on the 2021-2027 programming period.

The fieldwork was finalised on 30 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS identified the following strengths in the practices followed by DG HOME:

·In the programming period 2021-2027, DG HOME is for the first time part of the Common Provisions Regulation family. The IAS acknowledges the involvement of DG HOME into the coordination arrangements of the other Common Provision Regulation DGs (DG EMPL, DG MARE, and DG REGIO). The Stock Taking Group is a long-standing well-established coordinating mechanism and remains an important tool for the preparation and the programming of the 2021-2027 Multi-annual Financial Framework between the Commission services during the informal dialogue and the formal negotiations with Member States. Compared to previous programming periods where DG HOME was not part of the Common Provision Regulation family, DG HOME now regularly attends the steering group meetings and actively participates in them. Not only does DG HOME play an active role in contributing to the discussions by sharing views with other DGs via this platform, but it also adopts good practices already developed and implemented by the other Common Provision Regulation DGs in previous programming periods.

·DG HOME has developed its own tool in order to monitor the internal progress in programming. Its so-called dashboard is an Excel spreadsheet, published on the 2021-2027 programming period intranet site and available to all DG HOME staff. Its Desk Officers update it for each country on an ongoing basis. It aggregates information on the negotiation process for partnership agreements and operational programmes (for DG HOME funds and other than DG HOME funds) for each Member State. The dashboard also includes information on submission dates, registration, leading Directorates-General, ongoing internal and inter-service consultations and the latest state of play on the respective Member State negotiation. Thus, the dashboard provides a comprehensive overview of the latest status of the negotiation progress for horizontal units and desk officers from DG HOME’s perspective.

The IAS identified two very important issues concerning: (1) delays in work programmes of the thematic facility; and (2) monitoring of progress in the programming of the 2021-2027 period and reporting to senior management and formulated two very important recommendations:

Delays in work programmes of the thematic facility

DG HOME should: (1) as a matter of urgency finalise the adoption of the outstanding work programmes and financing decisions for the thematic facility 2021-2022; (2) prepare guidance on the management of the thematic facility to all parties involved, e.g. desk officers, members of the evaluation committees, future applicants/beneficiaries.

Monitoring of progress in the programming of the 2021-2027 period and reporting to senior management

DG HOME should: (1) establish an effective monitoring of the programming process in the Member State to ensure correct estimates about the state of play and reliable forecasts of expected submission dates of programmes by Member State; (2) prepare regular written reporting to senior management on the progress on the programming process.

Additional information provided by DG HOME on the measures defined and/or implemented following the Internal Audit Service audit

For one very important recommendation (delays in work programmes of the Thematic Facility) DG HOME implemented already the actions related to the adoption of work programmes and financing decisions for the Thematic Facility 2021-2022, and will fully implement the remaining action to provide guidance by June 2022.

In relation to the second recommendation (monitoring of progress in the programming 2021-27 period and reporting to senior management) DG HOME already took actions in relation to the effective monitoring of the programming process in the Member States by developing a dashboard and also by reporting weekly to senior management. The full implementation of this recommendation is foreseen by June 2022.

33.Economic and financial affairs

34.Audit on preparedness of the Competition programme (DG COMP)

The objective of the audit was to assess whether DG COMP has put in place an adequate framework to prepare for the Competition programme under the 2021-2027 multi-annual financial framework and has adequately designed the elements necessary for its implementation.

There are no observations/reservations in the 2020 Annual Activity Report of DG COMP that relate to the area/process audited.

The fieldwork was finalised on 18 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the efforts made by DG COMP to establish and improve its internal processes in order to prepare for the adoption and implementation of the Competition programme. In this respect, DG COMP developed a monitoring system for the procurement of studies called the ‘traffic lights system’ which enables the tracking of the progress of planned actions and their compliance with the estimated timetable, thus helping to ensure a timely implementation of the actions. The ‘traffic lights system’ is coordinated by Unit R2; and each Directorate is responsible for monitoring and reporting on the progress made.

The IAS identified one very important issue concerning the elements for the implementation of the Competition programme and formulated three very important recommendations:

Elements for the implementation of the Competition programme (Three very important recommendations addressed to DG COMP)

DG COMP should formally define the internal process for the implementation of the Competition programme covering the main steps (planning, monitoring and reporting) and should finalise the design of internal arrangements and tools which support the implementation of the programme.

In addition, DG COMP should update the design of the specific planning and programming process to include: (1) clear steps for the prioritisation of activities; and (2) a clear methodology for the approval of budget adjustments and subsequent budget reallocations at the programme level.

Finally, DG COMP should define the internal Competition programme monitoring and reporting arrangements.

Additional information provided by DG COMP on the measures defined and/or implemented following the Internal Audit Service audit

An action plan to address the recommendations was submitted and agreed with the IAS in January 2022, for implementation by September 2022.

35.Audit on the performance of the treatment of stakeholders' complaints concerning the Internal Market (DG GROW)

The objective of the audit was to assess the design and effective implementation of DG GROW’s processes for treating stakeholder complaints, including compliance with existing rules and procedures and monitoring arrangements.

There are no observations/reservations in the 2020 Annual Activity Report of DG GROW that relate to the area/process audited.

The fieldwork was finalised on 15 November 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG GROW to handle the increasing number of stakeholders' complaints concerning the Internal Market on a timely basis, while at the same time streamlining and adjusting the relevant processes following the reorganisation which took place in the first quarter of the year.

DG GROW has put in place procedures that address the necessary steps of the complaint handling cycle and which are aligned with the relevant corporate guidance. The staff members involved in the handling of complaints are experienced and showed commitment.

The internal communication channels enable management and staff to fulfil their responsibilities related to case handling effectively. DG GROW uses standard communication channels with other actors involved (SG, Legal Service, associated Directorates-General, Cabinet) in line with corporate standards.

The IAS did not formulate any critical or very important recommendations.

36.Audit on effectiveness of cooperation with external stakeholders (DG TAXUD)

The objective of the audit was to assess whether DG TAXUD has set up and implemented appropriate management and control systems to effectively organise, monitor and improve the cooperation with its external stakeholders.

There are no observations/reservations in the 2020 Annual Activity Report of DG TAXUD that relate to the area/process audited.

The audit covered the period 2020-2021. The fieldwork was finalised on 23 November 2021 and all observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by DG TAXUD to cooperate effectively with its wide range of external stakeholders and observed the following strengths in relation to the audited process:

·Over the years, DG TAXUD has established an effective cooperation within its expert groups that contributes to achieving their mandate. The external members of such groups meet DG TAXUD’s expectations in terms of effectively contributing to discussions to support the Directorate-General’s policy work and the achievement of the related objectives.

·DG TAXUD is striving to continuously improve cooperation with its external stakeholders within its expert groups. For instance, the Directorate-General made efforts to foster a more pro-active role of the external members in the discussions held within certain groups, and to embrace the new challenges related to its policy work (e.g. by including members from civil society in certain expert groups).

·DG TAXUD has taken actions towards a better oversight over the activities in the audited area to improve their efficiency and effectiveness. These actions include setting up the list of its recurrent meetings, and the ongoing exercise aiming at streamlining the numerous groups the Directorate-General interacts with.

The IAS did not formulate any critical or very important recommendations.

37.General services

38.Consulting on synergies and efficiencies in procurement (DG COMM)

The objective of the consulting engagement was to provide advice to DG COMM’s management in further achieving synergies and efficiencies in procurement and the related financial management.

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

39.Audit on preparedness for the new European Statistical Programme under the 2021-2027 Multiannual Financial Framework’ (DG ESTAT)

The objective of the engagement was to assess whether DG ESTAT:

·has put in place an adequate framework (i.e. governance, definition of roles and responsibilities, internal coordination, planning of resources, etc.) to prepare the Directorate-General for the implementation of the European Statistical Programme of the 2021-2027 Multi-annual Financial Framework;

·has adequately designed the elements necessary for successfully implementing the European Statistical programme (planning and programming, monitoring and reporting systems, financial management procedures).

The IAS did not formulate any critical or very important recommendations.

40.Consulting on ‘Globalisation risk’ (DG ESTAT)

The objective of the consulting engagement was to provide advice to DG ESTAT on how to further improve the ‘Early Warning System’, created to mitigate the impact of major restructuring of multinational enterprise groups on the quality of European business statistics, national accounts and balance of payments statistics.

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

41.Audit on preparedness to implement the European Public Prosecutor’s Office Regulation (OLAF)

The objective of the audit was to assess the adequacy and effectiveness of the internal control systems put in place by OLAF to prepare for the future cooperation with the European Public Prosecutor’s Office (EPPO).

There are no reservations in the 2020 Annual Activity Report of OLAF that relate to the area/process audited.

The fieldwork was finalised on 20 September 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts made by OLAF to prepare for the cooperation with EPPO and in particular found that:

·OLAF has implemented a number of organisational changes to align its structure to the new environment. In particular, in 2018, OLAF set up a specific task force to support the set-up of EPPO which was operational until mid-2020 while in 2021, it established an ‘EPPO Team’ responsible for discussing and coordinating with EPPO staff on the key operational aspects of the cooperation arrangements, and finally created a new Unit 03 responsible for all operational matters related to the cooperation with EPPO.

·In September 2020, OLAF reinforced its internal workgroup on ‘Investigation Instructions and Workforms’ (INWOG) to work on the proposal for the new OLAF Regulation and revision of OLAF’s internal guidelines and instructions.

·OLAF reported regularly to its Supervisory Committee on key aspects of the internal preparations for cooperation with EPPO.

·During EPPO’s set up phase (2019-2020), OLAF delivered awareness-raising sessions to all its staff focusing on the state of play of the establishment of EPPO and the revision of the OLAF regulation. Moreover, in March 2021, OLAF organised a Questions and answers debate for its staff with two representatives from EPPO on the topic of ‘Everything that you always wanted to know about, and dare to ask to EPPO’.

·In the period June – mid-July 2021, OLAF transferred to EPPO 155 cases which OLAF’s operational units previously identified as falling under EPPO’s responsibility. OLAF explained that as result of the transfer, EPPO initiated around 80 criminal investigations contributing to the overall protection of the EU budget.

·On 5 July 2021, OLAF signed with EPPO the ‘Working arrangement between the European Anti-fraud office and the European Public Prosecutor’s Office’ to establish and formalise the areas of cooperation between the two organisations in the exercise of their respective mandates.

The IAS identified three very important issues concerning: (1) planning and monitoring of the internal preparatory process, (2) investigation and data protection guidelines, (3) information technology related aspects and formulated three very important recommendations:

Planning and monitoring of the internal preparatory process

OLAF should reassess the risks related to the cooperation with EPPO, identify and implement the relevant mitigating measures, as well as monitor and update its risk register accordingly. Regarding the 2021 ‘Preparedness plan for the Arrival of EPPO’, OLAF should ensure that it is formally adopted by senior management and communicated to all relevant staff. The plan should indicate all responsible actors. The status of implementation of the actions in the plan should be monitored regularly by senior management.

Investigation and data protection guidelines

OLAF should plan and implement the update of all its investigation and data protection guidelines and templates. It should adopt the updated guidelines and publish them as relevant. It should prepare a list of new templates needed for the cooperation with EPPO, define the timeline for their creation, adoption and regular update.

Information technology related aspects

OLAF should implement the changes to its case management system related to the cooperation with EPPO as soon as possible. It should develop and agree with EPPO technical annexes to their working arrangement on the hit/no-hit system and secure communication line. Furthermore, it should adopt a methodology for the implementation of the current manual hit/no-hit system and subsequent information exchange process. Finally, it should perform an analysis of the key elements necessary to take informed decisions on the future of the hit/no-hit system.

Additional information provided by OLAF on the measures defined and/or implemented following the Internal Audit Service audit

OLAF has prepared an action plan to address the recommendations from the ‘audit on preparedness of OLAF to implement the EPPO regulation’. In this action plan, OLAF will implement several specific measures, to be carried out until December 2022, approximately. These measures include identifying and monitoring risks related to the cooperation with EPPO, as well as keeping the OLAF "Preparedness plan for the Arrival of EPPO" continuously updated and adapted to the cooperation between both offices. This plan will be approved by OLAF’s senior management and will be implemented by the end of 2022.

Regarding the update of OLAF investigation and data protection guidelines and templates, OLAF has started a new revision of the Guidelines on investigation procedures, as well as necessary updates of standard templates. Those that have already been developed are being continuously updated, especially the ones related to the cooperation with EPPO. The Guidelines for Data Protection, on the other hand, have already been approved and developed.

Lastly, all the recommended changes related to OLAF's case management system are currently under development and will be implemented before the end of the year. The technical annexes included in the OLAF-EPPO working arrangements are being discussed with the EPPO on a continuous basis and will also be finalised by December 2022.

42.Consulting on risk management (OLAF)

The objective of the consulting engagement was to provide advice to OLAF’s Director-General on how to improve the risk management process in his service.

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

43.Audit on establishment of statutory rights and calculation of individual entitlements (PMO)

The objective of the audit was to assess whether PMO has an effective and efficient control system in place to ensure the correct establishment of rights and calculation of entitlements for active and post-active staff.

There were no observations/reservations in the 2020 Annual Activity Report of PMO that relate to the processes audited.

The fieldwork was finalised on 23 July 2021. All observations and recommendations relate to the situation as of that date.

The IAS identified the following strengths:

·Since February 2021, significant changes in the management process have been made, supported by a ‘change management strategy’, with a clear roadmap and objectives. The changes involve consulting staff to identify PMO’s main challenges and collecting suggestions for improvement. Furthermore, a ‘collaboration forum’ and ‘communities of practice’ have been established. Finally, a number of focused workshops have been organised and improvements made to communication channels.

·The IAS welcomed these changes, in particular, the establishment of the ‘community of practice’ on internal control and on knowledge management, which aims at improving coherence and collaboration, the exchange of good practices and training on cross-cutting issues in the Office. Expected outcomes from the knowledge management community of practice include more harmonised, streamlined and efficient procedures and working methods, commonly developed guidelines for staff, and an improved knowledge management system overall.

·The IAS also welcomed the continuous information technology developments aimed at supporting the activities of the Office. In relation to the audited processes, new online declarations on the place of origin and installation allowance are now in a test phase, and a new module to manage the entry into service rights and mobility is being developed. These developments are expected to increase efficiency, lower the cost of control and reduce the risk of error.

The IAS identified one very important issue concerning the control strategy and formulated one very important recommendation:

Control strategy

PMO should strengthen its general control system, in particular by developing a single and coherent control strategy (aligned with the applicable provisions of the legal base in relation to effective control systems) for the establishment of rights and calculation of individual entitlements at Office level. It should establish a process to identify and assess operational risks at process level and match the intensity and frequency of controls with the level of risks. PMO should also strengthen the ex ante controls related to the category ‘allowances from other sources’ and clearly distinguish between ex ante and ex post controls to ensure that they are performed in compliance with the provisions of the Financial Regulation. Furthermore, PMO should centralise the ex post control function to ensure segregation of duties and independence of actors involved in those controls. Finally, it should substantially revise its ex post control methodology and the method for the calculation of the error rate, by applying a statistically representative sampling approach.

Additional information provided by the PMO on the measures defined and/or implemented following the Internal Audit Service audit

An action plan has been recently adopted and is currently being implemented. Following the reorganisation of PMO, the ex post control function is already centralised in unit PMO.7 as of 1 January 2022.

44.Information technology audits

45.Consulting on SUMMA programme (DG BUDG)

The objective of this consulting engagement was to review and advise DG BUDG on improvements required, if any, in the design of the governance setup for the SUMMA programme and in the DG’s process for identifying business requirements and defining the target solutions, which aim to simplify and harmonise business processes and stay as close as possible to standard SAP functionalities.

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

46.Audit on the management and monitoring of compliance with the Commission’s information technology security framework (DG DIGIT)

The objective of the audit was to assess the adequacy of DG DIGIT’s processes for managing and monitoring compliance with the Commission’s information technology security framework.

The IAS noted a number of good practices regarding the processes for managing and monitoring information technology security compliance:

·As regards the information technology security framework itself, although a limited number of areas remain to be completed (i.e. creating or updating standards on ‘Network Security’, ‘Identity Management’ and ‘Secure Software Development’ planned for inter-service consultation at the end of 2021), the framework is largely in place in terms of implementing rules and standards.

·DG DIGIT has made significant progress in the rollout of the information technology security governance, risk and compliance tool, which is designed to facilitate the Directorates-General actual implementation of the information technology security requirements and provide for its monitoring. This constitutes a key part of the compliance management and monitoring process and has been a major challenge for DG DIGIT to provide a comprehensive and workable tool.

The IAS identified two very important issues concerning: (1) information technology security compliance management and reporting practices, and (2) information technology security compliance management process and formulated two very important recommendations:

Information technology security compliance management and reporting practices

DG DIGIT should launch a Commission-wide campaign to raise awareness on the information technology security framework compliance monitoring activities and to report in a comprehensive and reliable way on the current status of implementation of information technology security framework controls. In particular, the requirements needed to be compliant with the Commission’s information technology security framework need to be clarified more precisely. Based on the information and practical experience collected from the Directorates-General, DG DIGIT should propose to the Information Technology and Cybersecurity Board additional and effective methods for enforcing information technology security compliance.

Information technology security compliance management process

DG DIGIT should create standard compliance assessment, management and monitoring procedures, guidelines and training materials to help make the overall process as operational and as streamlined as possible and thus to promote commitment and take-up. To facilitate the process and help the Directorates-General to use their resources most effectively, DG DIGIT should also define the relative priorities of the information technology security controls so stakeholders can focus the compliance efforts on the most critical information technology security controls and risks. These should be made clear to the process stakeholders as part of a concerted communication effort.

DG DIGIT should also examine the possibilities for improving synergies and coherence between the information technology risk assessment and information technology security compliance processes to ensure maximum possible alignment of the underlying information technology security framework and effective use of resources.

Additional information provided by DG DIGIT on the measures defined and/or implemented following the Internal Audit Service audit

DG DIGIT prepared and submitted an action plan end October 2021, which was accepted by IAS early November 2021. DIGIT is currently implementing the action plan according to the agreed target dates, therefore mitigating the related risks.

As part of the audit action plan to improve overall monitoring and reporting on the compliance levels, DG DIGIT is working closely with the other DGs to collect a first set of priority compliance attestations and to report compliance key performance indicators to the Information Technology and Cybersecurity Board. To further improve the execution efficiency of the DGs in their overall IT security management activities, DG DIGIT is also providing a compliance support tool and is working on an integrated risk and compliance process and workflow.

47.Audit on information technology security management in the HR family (DG DIGIT, EPSO, DG HR, PMO)

The objective of the audit was to assess the adequacy of the design and the effectiveness of the implementation of the governance, management and control processes put in place by HR family members for their systems.

There are no observations/reservations in the 2019-2020 Annual Activity Report of the audited Directorates-General that relate to the area/process audited. The fieldwork was finalised on 30 April 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the ongoing efforts by EPSO to continuously further improve information security and identified the following strengths:

·There is a solid knowledge of technical and non-technical information security issues amongst key personnel.

·There is effective and close cooperation between the business and information technology sides defining and enforcing the business needs on the information technology security domain.

There is effective communication between EPSO and DG DIGIT as in respect of the development and management of the communication and information systems.

The IAS recognised the ongoing efforts by PMO to improve information security and identified the following strengths:

·A Systems Security Officer has been appointed.

·Systems risk exercises are performed using the ITSRM2 methodology.

·There are first or draft versions of security plans for all systems (as at the completion of the audit fieldwork stage).

The IAS identified three very important issues concerning: (1) logical system-related controls (2) information technology service provider management (3) information technology security governance (and risk management) and formulated seven very important recommendations:

Logical system-related controls (Two very important recommendations addressed to DG DIGIT and DG HR)

DG DIGIT should strengthen user access management processes on database level and ensure, together with HR family members, that obsolete database interfaces are timely deleted. Moreover, DG DIGIT should reduce the use of production data in non-production environments to a minimum. Furthermore, DG DIGIT should provide the system owners with a regular security health check report on technical level. In addition, DG DIGIT should strengthen oversight of manual interventions by sample cross checks of activities performed on database level.

DG HR should assess whether the secure hosting solution offered by DG DIGIT would be feasible or, as a minimum, some individual controls from this solution could be applied in the current basic hosting solution to strengthen the security level. Based on the results, DG HR should (in cooperation with the other HR family members) complete a service level agreement with DG DIGIT and clearly identify roles and responsibilities as regards the implementation, monitoring and reporting of information technology security controls.

Information technology service provider management (Two very important recommendations addressed to DG DIGIT and DG HR)

DG DIGIT should inform the system owners about substantial changes having an impact on production data, such as the creation of environments storing production data or the establishment of system interfaces in a production environment.

DG DIGIT should launch an exercise together with HR family members to assess the gaps between the basic hosting and the secure hosting solution. Based on this process, DG DIGIT should update the service level agreements with the family members. In these service level agreements, roles and responsibilities should be clearly defined.

DG HR should define and implement basic security processes, including user account management, logging and monitoring, vulnerability management as well as reviewing system interfaces. It should strengthen oversight on manual interventions in Sysper, assess the feasibility to improve protection of data in motion and reduce the use of production data in non-production environments to a minimum.

Information technology security governance (One very important recommendation addressed to DG HR)

DG HR should improve its information technology security management by keeping an up-to-date system inventory and endorsing information technology security plans as a key tool for steering information technology security. Moreover, DG HR should strengthen its process for ensuring a continuous improvement of its information technology security arrangements, including roles and responsibilities related to information technology security.

Information technology security governance (One very important recommendation addressed to EPSO)

EPSO should restart the information technology steering committee meetings, ensuring information technology security issues are discussed in these meetings. It should also develop/improve its information technology security standards and procedures ensuring all staff involved are aware of the framework and their roles and responsibilities. Moreover, EPSO should implement the security controls identified on the information technology security plan and yet to be implemented, and formally appoint the relevant information technology security roles and ensure the objectives of each role are properly fulfilled.

Information technology security governance and risk management (One very important recommendation addressed to PMO)

PMO should:

·Strengthen its internal oversight on technical security controls implemented by DG DIGIT.

·Strengthen the LISO function by enhancing his/her involvement in information technology security issues across the service.

·Strengthen the process of continuous improvement of information technology security by executing risk-based assessments on all PMO systems, and implementing compensating measures.

·Assess the risk landscape for all PMO systems, and review alignment of these risks with the technical and organisational controls in place.

·Update all PMO security plans and for the missing controls, prepare a roadmap on how to implement these controls.

Additional information provided by DG DIGIT, DG HR, PMO and EPSO on the measures defined and/or implemented following the Internal Audit Service audit

DG DIGIT prepared and submitted an action plan early December 2021, which was accepted by IAS mid-December 2021. DIGIT is currently implementing the action plan according to the agreed target dates, therefore mitigating the related risks.

Relevant actions are in progress in the following areas:

·User access management (developing procedures on user access management on database level; defining, in collaboration with the HR family, a process for review of user accounts on database level).

·System interfaces and separation of production from non-production (producing inventory of database links in the HR family systems).

·Manual interventions (reviewing the current available tools for reconciliation activities).

·Use of production data (reviewing current situation of environments).

·Assessment of appropriate hosting solutions (gathering inputs from the hosting provider).

Following the IAS’ acceptance of DG HR’s action plan in December 2021, implementation progresses are according to plan. Actions requiring major technical investments are being assessed for timely and cost efficient ‘solutioning’.

An action plan has been recently adopted and is currently being implemented. Since the end of the audit, risk management for PMO systems is carried out by PMO (instead of DIGIT), additional mitigating measures are planned, and the local information security officer is more involved in this process.

EPSO has accepted all audit findings and recommendations and submitted in December 2021 an action plan, which was accepted by IAS, to implement all recommendations by the end of 2022. EPSO has restarted to have regular IT Steering Committee (ITSC) meetings with DIGIT, with the presence of our c-LISO, to also cover any security related matters. Ad-hoc meetings also take place between c-LISO and senior management of EPSO to discuss relevant security matters. Work is on-going on the implementation of the other recommendations (security standards, security controls, roles - due end 2022), with the collaboration of DIGIT.IT Security plans covering all EPSO’s IT systems have been finalised in January 2022.

48.Audit on information technology project management and software development (DG RTD)

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the management and control systems put in place by DG RTD for its information technology project management and software development processes.

There were no observations/reservations in the 2020 Annual Activity Report of DG RTD that relate to the area/process audited.

The IAS noted a number of strengths regarding project management and software development practices in DG RTD. Specifically, that the key elements of the audited processes are mature and well established, notably the respective methodologies, governance structures, effective business-provider relationships and interactions, monitoring/reporting of projects and software development, code/development review and testing, software release management. Also, the common information technology service provides effective project management and software development services to support the defined business needs and services.

More precisely, the IAS noted:

·Defined, formalised and implemented business process and project governance arrangements, involving both information technology service providers and business stakeholders who periodically discuss, monitor and decide on information technology activities and the associated objectives.

·Defined comprehensive information technology work plans with key strategic objectives for the upcoming year.

·Comprehensive involvement of stakeholders through formal project organisation structures. This ensures that business requirements and expectations are identified, continuously validated and, if needed, updated throughout the duration of the project.

·Defined project management and software development methodology (for large majority of projects) aligned with the Commission standards.

·Use of automated tools and tests for ensuring source code and software quality.

The IAS did not formulate any critical or very important recommendations.

Part 2 - FOLLOW-UP ENGAGEMENTS (SUMMARISED)

1.Follow-up audit in DG BUDG on pillar assessment in the external action family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2 (very important): guidance on pillar assessment process

Recommendation No 7 (very important): repository of pillar-assessed entities

Recommendation 10 (important): complementary assessments

Recommendation 11 (important): sub-delegation pillar

2.Follow-up audit in DG BUDG on management of recovery orders for competition fines and for recovery orders in the context of the Commission’s corrective capacity – Phase II (DG BUDG, DG COMP) (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 4 (very important): the offsetting process by the accounting officer

Recommendation No 6 (important): characteristics of the recovery process for competition fines

3.Follow-up audit in CINEA on the effectiveness of the design and of the implementation of the ex post control strategy for the Connecting Europe Facility

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): preparation of the annual audit plan

Recommendation No 2 (very important): assessment of the legality and regularity of the amendments to implementing contracts

4.Follow-up audit in CINEA on WiFi4EU (DG CNECT, DG DIGIT, INEA)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): recovery orders

5.Follow-up audit in DG CNECT on WiFi4EU (DG CNECT, DG DIGIT, INEA) (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2 (important): alignment information technology/business requirements

Recommendation No 6 (important): monitoring the results of the policy objectives

Recommendation No 7 (important): management of legacy

6.Follow-up audit in DG CNECT on implementation of the better regulation principles in the preparation of digital single market policy proposals

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2 (important): monitoring the implementation of the better regulation requirements and document management

7.Follow-up audit in DG CNECT on Connecting Europe Facility telecom governance

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): strengthening the internal governance set-up

Recommendation No 2 (very important): improve the current performance framework of the programme and monitor its progress and the results

8.Follow-up audit in DG COMP on the internal control framework (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2 (important): internal control monitoring criteria

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (very important): identification and assessment of deficiencies.

DG COMP revised its internal control strategy in 2021, which now includes: (1) an assessment of the ongoing monitoring of performance processes; (2) use of ‘other sources’ of information to complement the internal control monitoring criteria self-assessment; and (3) identification and reporting of strengths and deficiencies procedure.

The internal control strategy and the assessment process cycle now provide clear guidance and include all elements to properly perform the annual internal control assessment.

The exercise for the year 2020 has been finalised in March 2021, before the approval of the revised internal control strategy. All internal control principles have been assessed, however, the IAS did not find evidence that the exercise was performed using the assessment forms provided by DG BUDG. Furthermore, the assessment report did not include the following elements: (1) the description, rating and reporting of deficiencies; and (2) the internal control assessment at components level.

Considering the elements already implemented, the recommendation was downgraded from ‘very important’ to ‘important’ as the residual risk level is considered medium.

9.Follow-up audit in DG DIGIT on WiFi4EU (DG CNECT, DG DIGIT, INEA)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 4 (important): awareness on password storage

10.Follow-up audit on past audits in DG DIGIT

Audit on the management of information technology security in DG DIGIT:

Based on the results of the first follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): assurance on the legitimacy of actions performed in production systems.

Recommendation No 2 (very important): technical inventories of management information for security vulnerabilities

Recommendation No 5 (important): security vulnerabilities in software developed in-house.

Audit on information technology project management practices for multi-DG projects in DG DIGIT:

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2 (important): project management methodology

Recommendation No 3 (important): total cost of ownership

Recommendation No 4 (important): risk assessment

The following recommendations were assessed as not fully and/or adequately implemented.

Recommendation No 5 (important): quality control

The IAS acknowledged that DG DIGIT defined an initial set of quality indicators, but noted that these should be systematically and automatically measured through the use of the CITnet platform. In addition these indicators should be included in the regular reporting to the steering committees. Finally, a global quality indicator has yet to be implemented. DG DIGIT prepared a mock-up version, but the analysis of the current state of the key performance indicator dashboard with quality indicators revealed some technical limitations. During the course of 2021, DG DIGIT plans to address this technical limitation by: (1) gathering further requirements from project officers; (2) launching a new contract for further development of the dashboard, along with the global quality indicator; (3) following up the progress by DIGIT.B.4 PMO.

Recommendation No 6 (important): user acceptance testing

The IAS noted that PM2 methodology has been improved to describe a protocol and roles and responsibilities for user acceptance testing. User acceptance testing is now part of the deliverables acceptance management plan and for a particular project, the approach adopted is described in its test plan. Defining acceptance criteria is now part of the requirements management. Once the requirements are approved, the test scenarios are defined and a cross matrix is made to check that every requirement has one or more test scenarios assigned to it.

However, a number of activities have yet to be fully implemented at DG DIGIT, as follows:

·The template for deliverables acceptance management plan including the list of specific deliverables regarding testing activities and its test plan are not defined as artefacts in PM2 methodology.

·There is no standard methodology on the way to define criteria for acceptance of test results with business representatives.

·There is no template for evidencing results of user acceptance testing based on predefined criteria (evaluation sheet / test report).

·There is no evidence that for all projects in the portfolio, the test scenarios are defined with concrete activities to prepare, set-up, execute and report on the testing to check that every requirement has one or more test scenarios assigned to it.

11.Follow-up audit in DG DIGIT on Connecting Europe Facility telecom governance (DG CNECT, DGT, DG DIGIT, DG EMPL, DG GROW, DG JUST, DG SANTE)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): internal governance arrangements

12.Follow-up audit in DGT on Connecting Europe Facility telecom governance (DG CNECT, DGT, DG DIGIT, DG EMPL, DG GROW, DG JUST, DG SANTE)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): performance framework

Recommendation No 2 (important): data protection

13.Follow-up audit in DG EAC on effectiveness of the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were assessed as not fully and/or adequately implemented.

Recommendation No 5 (critical): transfer of personal data to third countries

DG EAC has been in close contact with the Data Protection Officer of the Commission to revise and correct the privacy statement for Erasmus+.

The IAS has performed a desk review of the revised privacy statement for the Erasmus+ programme and a check of the IT system ‘Mobility Tool+’, which is used for the mobility actions, including those triggering international transfers of personal data.

The IAS review showed that the revised privacy statement now includes:

·A clear explanation of who introduces the participants’ personal data in the ‘Mobility Tool+’ and who the data processors are.

·A distinction between the two types of personal data transfers, i.e. to:

·EU/European Economic Area country or countries for which the Commission adopted an adequacy decision ensuring an adequate level of protection,

·third countries for which there is no Commission adequacy decision;

·The clarification that in the case of third countries for which there is no Commission adequacy decision, the protection of the data subjects’ rights with respect to their personal data might not be equivalent to the EU legislation (as it depends on the law or practice of that third country).

·Clear information on who has access to the participants’ personal data in the different scenarios: (i) EU/European Economic Area country and countries for which the Commission adopted an adequacy decision ensuring an adequate level of protection and (ii) other third countries.

·A list of the situations when personal data is transferred to third countries.

Based on the above, the IAS considers that the revised privacy statement for the ‘Mobility tool+’ is transparent and no longer misleading.

DG EAC, in collaboration with central services, must still take the necessary steps in order to identify supplementary measures regarding the transfer of data outside the European Economic Area. For these reasons, the IAS concluded that this recommendation is not fully implemented, but the risk has partially been mitigated, hence justifying its downgrading from ‘critical’ to ‘very important’.

Recommendation No 6 (very important): handling of personal data breaches

The Directors’ Steering Committee of DG EAC adopted a procedure for handling the personal data breaches that follows the guidance of the Data Protection Officer. In particular, this guidance elaborates on the internal handling workflow for personal data breaches, taking into account the Commission decision (EU) 2020/969, as well as the guidance of the European Data Protection Service and the Commission’s Data Protection Officer on this topic.

However, DG EAC has not yet implemented an effective follow up of actions planned after data breaches, in order to avoid that such breaches re-occur. For this reason, the IAS concludes that the recommendation is not fully implemented. However, the risk has partially been mitigated, hence justifying its downgrading from ‘very important’ to ‘important’.

14.Follow-up audit in DG EAC on information technology governance and project management (based on two follow-up audits performed in 2021)

Based on the result of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2 (important): project management methodology and practices

Recommendation No 4 (important): project budgeting and cost monitoring

15.Follow-up audit in DG ECHO on the control strategy for humanitarian aid actions

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): control strategy description

Recommendation No 4 (important): ex post controls at project level

Recommendation No 6 (important): control strategy – assurance building

The following recommendations were assessed as not fully and/or adequately implemented and were downgraded to important:

Recommendation No 3 (very important): ex ante controls on final reports and final payments

DG ECHO has:

·Updated its financial manual to include the requirement that the e-signatory of the Ares workflow for final payments is made visible to middle management, allowing for appropriate supervision of the payments.

·Updated its external audit sector procedures to ensure that final reports (including from field audits) are shared with the financial officers checking the final payments (officers in unit ECHO.E3 Contracts and Finance).

·Made the following improvements to its financial and operational checks on Value Added Tax status of the implementing partners:

·The revised Single Form (applicable since 1 January 2021) used by UN agencies, international organisations and non-governmental organisations requires more information on their Value Added Tax status;

·The template of the final financial report has been changed so that the non-governmental organisations and UN/international organisations explicitly state (if applicable) the amount of Value Added Tax included in the incurred cost;

·Specific checks and instructions related to the Value Added Tax status were included in the checklists to be used before authorising final payments to both UN/international organisations and non-governmental organisations;

·The new DG ECHO audit strategy includes the Value Added Tax exemption status in the list of criteria for selecting partners for risk-based audits;

·DG ECHO reviewed the cases identified by the IAS during the audit where no explanation from the partners on the absence of Value Added Tax exemption was provided, as well as other ECHO-funded projects with the same partners in the same country, and took the necessary actions.

·Revised aspects of the ‘certified correct’ process:

·The template for the ‘certified correct’ note was revised in line with Article 111.4 of the Financial Regulation, to indicate the amount of the total eligible costs accepted by the authorising officer instead of the amount to be paid and whether the action has been carried out in all respects in compliance with the grant agreement;

·Reviewed the assignment of the user profile ‘workflow manager’ in FichOp and introduced an extra layer of control in the form of a log showing who made modifications in the fields and when.

However, the following sub-recommendations have not been implemented:

·The checklists for the financial officers contain a significant number of conditional checks. The financial officers are not instructed to provide information in Fichop about which of these checks are applicable and, when they are, whether they are performed. They only indicate the results of the checks they consider most relevant. Consequently, the authorising officer by sub-delegation may not be informed before authorising a final payment about the complete set of checks that were performed by the financial initiator and verifier;

·DG ECHO has not specified in its financial manual who the financial initiators need to encode in ABAC
  6
  as officer providing the ‘certified correct’ clearance/approval;

·DG ECHO has not introduced checks in the review process of final reports to verify if the UN/international organisations correctly report who were their implementing partners and contractors.

Given that DG ECHO has addressed the high risks identified in the audit, the recommendation was downgraded from ‘very important’ to ‘important'.

Recommendation No 5 (very important): ex post headquarters audits and verifications

DG ECHO has:

·Revised its audit methodology regarding the sampling in ex post audits and verifications.

·Adopted a new ‘Audit Strategy (2021-2027) applicable to Humanitarian Aid and Civil Protection Funds managed by DG ECHO’ in April 2021. Both the strategy and a methodological package were communicated to DG ECHO’s external audit contractors.

·Revised the template of the representation letter requested from the UN agencies after an Headquarters audit.

·Developed a quality control procedure for review of reports from the audit contractors, which includes a checklist and a detailed process flowchart, and communicated it to relevant audit sector staff.

However, the following sub-recommendations have not been implemented:

·The revision of DG ECHO’s audit manual has not been completed.

·The follow-up approach for significant recommendations made to non-governmental organisations has not been revised.

Given that DG ECHO has addressed the high risks identified in the audit, the recommendation was downgraded from ‘very important’ to ‘important'.

16.Follow-up audit in DG ECHO on pillar assessment in the external action family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 5 (important): guidance on pillar assessment process

Recommendation No 15 (very important): substantive changes

Recommendation No 17 (important): pillar assessment of United Nations entities

Recommendation No 22 (critical): agreements signed with pillar assessed entities

Recommendation No 25 (very important): Commission’s services involvement in the pillar assessment process

17.Follow-up audit in DG EMPL on the management of the employment and social innovation programme (EaSI) with special emphasis on the PROGRESS axis

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 4 (important): upscaling of employment and social innovation projects

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 2 (important): monitoring and evaluation framework

In line with the IAS recommendation, unit A3 developed a template for the provision of information by employment and social innovation beneficiaries on the financed projects’ milestones, the progress made against these milestones and any critical implementation risks as well as mitigating actions. This template was uploaded on the Directorate-General’s intranet so that the operational units can publish it together with the new employment and social innovation calls and propose that the beneficiaries of ongoing grants use it to provide the necessary information (at the end of each reporting period).

However, as at the date of the IAS follow-up, the performance framework of the employment and social innovation strand of the European Social Fund+ Regulation
  7
  (setting indicators, targets and baseline values for the EaSI projects financed during the period 2021-2027) was still under development.

The recommendation on the EaSI performance framework was closed on 08 February 2022. All recommendations were effectively implemented as indicated in the follow up note of the IAS.

18.Follow-up audit in DG EMPL on Connecting Europe Facility telecom governance (DG CNECT, DGT, DG DIGIT, DG EMPL, DG GROW, DG JUST, DG SANTE)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): internal governance arrangements

Recommendation No 2 (important): performance framework

19.Follow-up audit in DG ENV on LIFE financial instruments: effectiveness and efficiency of the current framework (DG CLIMA, DG ENV)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): functioning of the steering committee

20.Follow-up audit in DG ESTAT on human resources management

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 8 (very important): human resources monitoring and reporting

21.Follow-up audit in DG FISMA on effectiveness and efficiency of the performance management system

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): performance management framework – planning and monitoring of ‘other tasks’ and objective setting

22.Follow-up audit in FPI on the Partnership Instrument

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was assessed as not fully and/or adequately implemented.

Recommendation No 1 (important): quality of partnership instrument concept notes and action fiches

Sub-recommendations 1 a) and 1 b) have been adequately implemented, as FPI improved the quality of concept notes and action fiches by implementing the following measures:

·The action fiches for the annual action programme exercises now clearly reflect the comments of the quality support group on proposed partnership instrument actions.

·Quality support group quality controls are now also conducted for public diplomacy actions.

Concerning sub-recommendation 1 c), FPI has launched a new study to update the 2015 Analysis of the perception of the EU and of EU's policies abroad. However, as the launch was delayed, the results of the perception study will only be available in September 2021.

Moreover, the external evaluation of public diplomacy actions has been delayed and the contract is expected to start in mid-July 2021.

For these reasons, sub-recommendation 1 c) is not fully implemented.

23.Follow-up audit in FPI on Common Foreign and Security Policy

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 4 (very important): mitigating measures applied for EUCAP Somalia

24.Follow-up audit in FPI on pillar assessment in the external action family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 6 (important): guidance on pillar assessment

Recommendation No 16 (very important): substantive changes

Recommendation No 26 (very important): Commission services’ involvement in the pillar assessment process

25.Follow-up audit in FPI on EC-EEAS coordination (EEAS, FPI, DG INTPA, DG NEAR) (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2.3 (important): working arrangements

Recommendation No 3.5 (important): project level coordination

26.Follow-up audit in FPI on the instrument contributing to stability and peace

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 3 (important): guidance to and supervision of EU Delegations

27.Follow-up audit in DG GROW on Connecting Europe Facility telecom governance (DG CNECT, DGT, DG DIGIT, DG EMPL, DG GROW, DG JUST, DG SANTE)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): internal governance arrangements

Recommendation No 2 (important): performance framework

28.Follow-up audit in DG HR on data protection (DG DIGIT, DG HR, LS, JRC, SG)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 2b (very important): nomination of data protection coordinators

29.Follow-up audit on past audits in DG INTPA (based on three follow-up audits performed in 2021)

Indirect management with entrusted entities (DG INTPA, DG NEAR)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): guidance on the contribution agreement template

Recommendation No 3 (important): negotiating and preparing indirect management contracts

Recommendation No 5 (important): risk-based ex ante checks

Recommendation No 7 (important): implementing contractual provisions: management declarations

30.Follow-up audit in DG INTPA on pillar assessment in the external action family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on three follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 3 (very important): guidance on pillar assessment process

Recommendation No 8 (important): repository of pillar-assessed entities

Recommendation No 13 (very important): substantive changes

Recommendation No 18 (very important, downgraded from critical): pillar assessment of the United Nations Secretariat

Recommendation No 20 (critical): agreements signed with pillar-assessed entities

Recommendation No 23 (very important): Commission services’ involvement in the pillar assessment process

31.Follow-up audit in DG INTPA on management of investment facilities (financial instruments)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): blending project cycle: post-contact signature phase - monitoring of project implementation

Recommendation No 2 (important, downgraded from very important): pre-financing

Recommendation No 5 (important): European Bank for Reconstruction and Development

The following recommendations were assessed as not fully and/or adequately implemented.

Recommendation No 3 (important): blending project cycle: pre-contract signature phase

The blending guidelines now strengthen the role of the EU Delegations in the identification of the projects for blending financial instruments. Moreover, in order to reinforce the technical assessments, in 2018, DG INTPA appointed three supervisors of the blending facilities whose task is to ensure correct and complete use of the project assessment framework.

Finally, DG INTPA revised the blending guidelines which now include a five working days deadline for the preparation of the draft technical assessment meeting and board minutes after the meeting and the same number of days for obtaining comments. These deadlines aim to ensure timely adoption and distribution of the minutes. They also provide a better allocation of the assessment questions among the assessors and include additional guidance for the assessment process. However, the guidelines do not include information on the preparation of the consolidated assessment sheet summarising all assessment results. In addition, the assessment grid template does not include an explicit assessment on the quality of performance indicators.

Recommendation No 4 (important): procedures and guidance for blending operations

The issues related to the definition and recovery of fees were addressed in a revision of the PAGoDA template
  8
  in 2018, in the contribution agreement template adopted 2018 and in the contribution agreement for financial instruments adopted in 2019. The blending guidelines now explain the use of the conditionality clauses related to the pre-financing and provide instruction on the applicable contractual template and framework agreements.

While this addresses to a large extent the recommendation, two specific points were not reflected in the revised blending guidelines: the role of the EU Delegations is signing amendments and riders related to the ongoing agreements and the definition of the content of the project files to be kept for each blending project.

32.Follow-up audit in DG INTPA on EC-EEAS coordination (EEAS, FPI, DG INTPA, DG NEAR)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1.1 (very important): country-level coordination

Recommendation No 3.4 (important): project-level coordination

33.Follow-up audit in JRC on scientific project management

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 4 (important): work programme tiers' terminology

The following recommendations were assessed as not fully and/or adequately implemented.

Recommendation No 1 (important): overall scientific project management set-up

JRC has prepared comprehensive
  9
  guidance for its scientific projects, as part of its Integrated Management System
  10
   based on the PM2 project management methodology.

The guidance includes the roles and responsibilities of all actors involved in JRC’s work programme.

JRC has also enhanced the training of staff in the area of project management, by increasing attendance rates to existing Commission trainings as well as by designing and offering specific PM2 courses adapted to the specificities of JRC.

However, the new procedures and manuals entered into force in 2021, in parallel to the start of the new JRC scientific projects management cycle 2021-2022 during which guidance on planning and monitoring will be further refined. In particular, there is still work in progress regarding project and work programme monitoring in order to develop the new project work plan
  11
   and project monitoring modules in the JRC project browser, which will support improved JRC project and work programme monitoring capabilities. Consequently, it is too early to conclude on its effective and consistent implementation.

Recommendation No 2 (important): planning of scientific projects and work packages

JRC has established corporate guidelines for the detailed planning of scientific projects but has not yet put in place a centralised or harmonised management tool at project level. A new module in JRC project browwer, called the project work plan, was expected to be finalised by the second quarter of 2021 but its development only started recently (as JRC project brower system providers (JRC Unit I.5) had difficulties hiring consultant developers throughout 2020 due to COVID-19). Furthermore, JRC is in the process of putting in place clear guidance on planning, accompanied by a monitoring process to revise the approach to planned outputs (deliverables).

Recommendation No 3 (very important): monitoring of scientific projects’ and work packages’ execution

JRC was recommended to improve the monitoring of the execution of its work programme and work packages by designing and implementing adequate project management monitoring practices for the work packages execution (as part of the new scientific project management methodology and guidance implementation
  12
  ) and by providing a JRC-wide guidance for monitoring at work package, unit and scientific directorate levels
  13
  .

The monitoring of the work package (now called project) execution level is covered by the new procedure ‘IMS-JRC-C1.1-PRO-0012: Execution and monitoring of scientific research projects’. However, the procedure for the monitoring at work programme level
  14
  still has to be completed, pending the finalisation of the new ‘Project work plan’ module in JRC project browser.

34.Follow-up audit in JRC on nuclear decommissioning and waste management programme implementation

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): human resources management

The following recommendation was assessed as not fully and/or adequately implemented.

Recommendation No 2 (important): information technology tools supporting the decommissioning and waste management programme implementation

JRC has made an inventory of the information technology tools supporting the decommissioning and waste management programme implementation (i.e. the software applications used for administration, management of measurements, management of waste, management of sources and measurement instrument purposes) and has concluded that there is no duplication among the tools.

However, the conclusion is not based on a documented analysis of the possible integration of the applications used in different sites. Moreover, there is no documentation of the analysis of the roadmap mentioned in the action plan and JRC has not yet communicated the measures taken to build adequate in house information technology expertise for its critical information technology tools. The purpose of these measures is to decrease JRC’s dependence from external contractors.

35.Follow-up audit in JRC on site management infrastructure support services

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 3 (important): procurement implementation

The following recommendation was assessed as not fully and/or adequately implemented.

Recommendation No 4 (important): asset management: stocktaking exercise for fixed assets

JRC, in the frame of the JRC asset management network:

·Decided to perform physical inventory on a continuous basis in all JRC sites.

·Decided to further analyse the cost-effectiveness of outsourcing physical inventory controls, based on experiences already gained from two sites supporting different approaches including partial outsourcing.

·Requested all units to ensure proper back-up arrangements for stocktaking exercises.

·Acknowledged that adequate storage space has been allocated in Ispra for items to be donated.

However, JRC has not yet completed the analysis of the cost-effectiveness of outsourcing physical inventory controls and has not yet implemented measures to ensure that the responsible units are adequately staffed.

36. Follow-up audit in JRC on information technology governance and project management

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (very important): information technology project management practices

37.Follow-up audit in DG JUST on human resources management and staff allocation

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): DG JUST’s human resource strategy

38.Follow-up audit in DG JUST on Connecting Europe Facility telecom governance (DG CNECT, DGT, DG DIGIT, DG EMPL, DG GROW, DG JUST, DG SANTE)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): internal governance arrangements

39.Follow-up audit in DG MARE on monitoring the implementation and performance of 2014-2020 operational programmes (DG EMPL, DG MARE, DG REGIO)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 3 (important): reporting on implementation

40.Follow-up audit in DG NEAR on indirect management with entrusted entities (DG INTPA, DG NEAR)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 2 (important): guidance on the contribution agreement template

Recommendation No 4 (important): negotiating and preparing indirect management contracts

Recommendation No 8 (important): implementing contractual provisions: management declarations

41.Follow-up audit in DG NEAR on the neighbourhood investment facility and the Western Balkans Investment Framework (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 3 (important, downgraded from very important): financial management

Recommendation No 5 (important): Western Balkans investment framework – screening, assessment and approval of grants

The following recommendation was assessed as not fully and/or adequately implemented.

Recommendation No 8 (very important): Western Balkans investment framework - financial management and financial reporting

DG NEAR has:

·Updated the guidelines on the preparation of the grant application form as regards the preparation of the payments schedules of the projects financed by the European Western Balkans joint fund. The grant application forms funded by the European Western Balkans joint fund approved since 2019 now have payment schedule included in their final version.

·Taken on board the IAS recommendation in its discussions with the European Investment Fund and the European Bank for Reconstruction and Development for the two successor equity funds ENIF
  15
  II and ENEF
  16
  II. The EU contribution for these funds will only be paid in instalments, to respond to the needs of the fund and respective calls for funds. The respective payment forecasts are already encoded in MIS
  17
  .

·Obtained from the European Bank for Reconstruction and Development detailed financial information for 2019 and 2020. The 2019 management declaration contains commitments and disbursements and fees at the level of each EU grant of EU funds received into European Western Balkans joint fund and from European Western Balkans joint fund to international financial institutions for grants signed in 2016 and 2017.

·The IAS observed that the declaration was obtained in December 2020, i.e. one year after the end of the relevant implementation period (2019). The IAS suggests that DG NEAR insists to receive the information earlier so that it enables adequate monitoring of the commitments and disbursements at project level, as well as of the fees due and paid.

·Analysed the open pre-financing and performed the clearing as appropriate. A specific action plan is implemented for each cluster of contracts, namely:

·all open Instrument of Pre Accession I pre-financing that could be reasonably recognised as cost was cleared;

·for contribution arrangements signed after the approval of the new general conditions of the European Western Balkans joint fund in 2016, DG NEAR run last year the first clearing exercise for the three lead international financial institutions implementing EU financed grants under the European Western Balkans joint fund.

DG NEAR has not revised the general conditions linked to the calculation of the fees for cancelled or partially implemented grants. This will be done at the end of 2021, in conjunction with updating of the Western Balkans Investment Facility legal framework. Considering the significant progress made in its implementation, this recommendation is downgraded from ‘very important’ to ‘important’.

42.Follow-up audit in DG NEAR on annual audit plans

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): roles, responsibilities and guidance

The following recommendations were assessed as not fully and/or adequately implemented.

Recommendation No 2 (very important): follow-up of audit results

Sub-recommendation 2.1: follow-up of financial findings

·DG NEAR updated the manual of procedure by instructing the responsible authorising officers by sub-delegation that in case of financial findings he/she shall take actions that ‘go beyond the recovery of ineligible expenditure’ and depend ‘on the type and seriousness of the findings’.

Among the possible actions, the manual quotes ‘meetings with the beneficiary to discuss the findings and possible remedial actions, increasing the probability of the ‘legality and regularity’ risk factor in the risk assessment of other contracts with the same beneficiary, and/or including controls on other contracts with the same beneficiary in the annual control plan’.

In relation to ‘increasing the probability of the legality and regularity risk factor’, ‘DG NEAR’s Guidelines on Risk Assessment and Establishment of the Directorate-General’s Control Plan 2021’ refer to a couple of issues to be taken into consideration when assessing the risk, namely the nature and gravity of findings of previous verifications and audits and the follow-up of findings from previous verifications/ audits.

However, the IAS found that the manual and the risk assessment guidelines are too generic and therefore do not provide sufficient guidance to authorising officers by sub-delegation on actions to take when following up financial findings.

·The part of the action plan concerning the implementation of Article 202 of the Financial Regulation on the extrapolation of audit results and the inclusion of relevant provisions in DG NEAR’s model grant has not yet been implemented. A general corporate template for the model grant agreement reflecting such a possibility was adopted in June 2020
  18
  , however it has not been integrated into the ‘Practical guide on contract procedures for European Union external action’. Moreover, DG NEAR’s contract templates still do not include a relevant provision on the extrapolation of audit results to other grants.

According to DG NEAR, the new corporate model grant agreement is still not in use due to ongoing discussions between DG INTPA, DG NEAR and central services on the complex specificities of external action grants.

Sub-recommendation 2.2: findings stemming from verification missions to international organisations

During the audit on annual audit plans, the IAS found that neither the EU Delegations nor the Headquarters followed up on the non-financial findings stemming from verification missions to international organisations, hence possibly failing to identify repetitive internal control issues that might affect their pillar-compliance and the reliance that can be put on their internal control systems. In its action plan, DG NEAR committed to undertake a yearly in-house (by EU Delegations for their verifications and Unit R.3 for Headquarter verifications) analysis of the findings.

However, this recommendation was put on hold in October 2020 pending the completion of the IAS audit on pillar assessment where a similar issue was detected for the other Directorates-General in the external action family. In the final report of this audit, the IAS recommended to DG INTPA to modify the expenditure verification report template used by both DG INTPA and DG NEAR in order to allow auditors to report on relevant/systemic internal control and pillar compliance-related findings, hence enabling DG NEAR to obtain the information necessary for a proper follow up of non-financial issues. Following DG INTPA’s acceptance of this recommendation, DG NEAR resumed the implementation of its recommendation 2.2 and set a new target date for it completion by 14 January 2022.

Recommendation No 3 (very important): key performance indicators and reporting

Jointly with DG INTPA, DG NEAR adjusted the benchmarks for the audit related key performance indicators 21, 22 and 23, setting revised targets for 2020/2021 and agreed to the establishment of a new key performance indicator 25 measuring the percentage of reduction of expired unclosed audits.

The 2020 and 2021 annual targets are as follow:

| Audit key performance indicators | 2020 | 2021 |
| --- | --- | --- |
| KPI 21 | % of audits contracted Year N | 70% | 70% |
| KPI 22 | % draft audit reports received Year N-1 | 60% | 70% |
| KPI 23 | % final reports received: Year N-2 | 70% | 80% |
| New KPI 25 | % reduction of expired unclosed audits | 30% | 40% |

Audit key performance indicators

2020

2021

KPI 21

% of audits contracted Year N

70%

70%

KPI 22

% draft audit reports received Year N-1

60%

70%

KPI 23

% final reports received: Year N-2

70%

80%

New KPI 25

% reduction of expired unclosed audits

30%

40%

However, the IAS considered that the action plan is not fully implemented for the following reasons:

·The revised targets of the key performance indicators related to effectiveness of DG NEAR’s audit system are not ambitious enough to ensure full completion of the annual audit plan within the three-year implementation timeframe (where only 80% of the final reports are expected to be finalised).

The IAS observed that all directorates of DG NEAR reached the 2020 targets for key performance indicators 21-23 and for the new key performance indicator 25, except for key performance indicator 22 due to the restrictions from the COVID-19 pandemic. Moreover, regarding the revised key performance indicators 21 to 23, DG NEAR strongly encouraged staff to exceed the minimum target values for 2021 and to complete audits as early as possible (earlier than planned) in the three-year implementation period. However, the increase of key performance indicators 22, 23 and 25 targets is too modest to enable the timely completion of the annual audit plan.

·For key performance indicators 21 and 22, the number of audits contracted and draft audit reports received (i.e. intermediate outputs) are still used instead of focusing on the number of approved final reports as recommended.

·The target for former key performance indicator 25 (now key performance indicator 24) ‘ineligible amounts identified by audits as % of audited amount’, has not been dropped
  19
  as recommended.

·Key performance indicators 23 (now key performance indicator 22) and 24 (now key performance indicator 23) have not been correctly reported in DG NEAR’s Annual Activity Report.

DG INTPA also introduced two other indicators I8 and I9 in the key performance indicator dashboard to enable DG NEAR to address the IAS recommendation on monitoring the completion of the audit and verification plans. The new indicators are currently being measured, however:

·No targets have been set. Consequently is it not clear on which basis the Directorate-General will assess the satisfactory implementation of the audit plans.

·They are not yet reported in DG NEAR’s Annual Activity Report. Consequently, it is too early to conclude on the effective implementation of the recommendation.

43.Follow-up audit in DG NEAR on pillar assessment in the external action family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on two follow-up audits performed in 2021)

Based on the results of the follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 4 (very important): guidance on pillar assessment process

Recommendation No 14 (very important): substantive changes

Recommendation No 21 (critical): agreements signed with pillar assessed entities

Recommendation No 24 (very important): Commission services’ involvement in the pillar assessment process

44.Follow-up audit in DG NEAR on EC-EEAS coordination (EEAS, FPI, DG INTPA, DG NEAR)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1.2 (very important): country-level coordination.

45.Follow-up audit in DG NEAR on the grant and procurement award process under the European Neighbourhood Instrument’s direct management

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): procedures and guidance

Recommendation No 2 (important): implementation of grant and procurement award procedures

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 3 (very important): supervision missions

DG NEAR has duly updated its process manual for supervision missions, according to the recommendations on multi-annual planning frequency, performance and follow-up of the missions. It has also addressed the issue of sharing problems identified during missions with other EU Delegations and the external action family of Directorates-General. However, in practice the frequency of missions had not increased despite the requirement in the updated manual of July 2019. Furthermore, as from March 2020, no missions could occur due to the COVID-19 restrictions. The IAS acknowledged that DG NEAR has put in place a temporary methodology to supervise the Delegations remotely. As these measures do not fully mitigate the identified residual risks, the IAS will further follow-up the effective implementation of this recommendation once missions have resumed.

46.Follow-up audit in OP on information technology governance and project management

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): governance practices for monitoring

Recommendation No 3 (important): information technology project management practices

47.Follow-up audit on past audits in PMO

Audit on effectiveness of the management of absenteeism in the Offices (OIB, OIL, PMO)

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was adequately and effectively implemented and was closed:

Recommendation No 1 (important): monitoring and analysis of absences at office level.

Audit on control strategy for the Joint Sickness and Insurance Scheme and accidents insurance:

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (very important): review and documentation of Joint Sickness and Insurance Scheme control strategy.

The IAS recommended PMO to review the various components which make up its control strategy for the Joint Sickness Insurance Scheme and accidents and bring these together in a formalised and consolidated control strategy document, which should clearly describe the control objectives, the main actors and their roles and responsibilities, as well as a risk analysis, including the intensity and frequency of the ex ante and ex post controls. It should also include the automated information technology controls, the anti-fraud measures put in place, the reporting on the results of controls together with their evaluation and follow-up. This document should be regularly reviewed and updated and approved by the Authorising Officer by Delegation.

PMO described in a single document the control strategy which is structured on three control layers (IT controls/warnings, ex ante controls and ex post controls). While the IAS acknowledges the progress made to consolidate the various control documents/guidance available, the consolidated control strategy document needs to be further strengthened. In particular, more information is needed on the roles and responsibilities of the different actors, the results of the risk analysis, the way the different control activities are integrated when calculating error rates and drawing assurance conclusions and how the issues identified are followed-up. Furthermore, this document, which should integrate any changes in the control procedures resulting from the other open recommendations
  20
  , should be approved by the Authorising Officer by Delegation and communicated to all actors concerned.

48.Follow-up audit in DG SANTE on TRAde Control and Expert System (TRACES) (based on two follow-up audits performed in 2021)

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): information technology governance

Recommendation No 4 (important): project management and application support

The following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 2 (very important): information technology security

The recommendation consists of 10 sub-recommendations of which 8 have been implemented.

For the remaining two sub-recommendations, significant progress has been made, but the following actions still need to be completed:

·Finalise the feasibility study to assess whether secure hosting can support the business requirements and service/operations continuity of TRACES.

·Finalise the implementation of the security measures defined in the security plan for TRACES.

The IAS recognised the progress made on strengthening the security of TRACES and considers that the residual risk has been reduced for this recommendation. As a consequence, the recommendation remains but the rating was downgraded from ‘very important’ to ‘important’.

49.Follow-up audit in DG SANTE on Connecting Europe Facility telecom governance (DG CNECT, DGT, DG DIGIT, DG EMPL, DG GROW, DG JUST, DG SANTE)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (important): internal governance arrangements

Recommendation No 2 (important): performance framework

50.Follow-up audit in SG on data protection (DG DIGIT, DG HR, JRC, LS, SG)

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1a (very important): Data Protection Officer: guidance on the Data Protection Coordinator function

Recommendation No 2a (very important): Data Protection Officer: guidance on the shared Data Protection Coordinator function

51.Follow-up audit in DG TAXUD on human resources management

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were adequately and effectively implemented and were closed:

Recommendation No 1 (very important): human resources strategic management

Recommendation No 2 (important): human resources monitoring and reporting

Recommendation No 5 (important): staff development

Of five accepted (all) recommendations, (3 'very important'), DG TAXUD timely implemented three: two important and one very important. Two remaining very important recommendations on mapping tasks and skills and on workload assessment and staff allocation have original implementation date end June 2021, extended until June 2022. By the end 2021, DG TAXUD had implemented some parts on both very important recommendations.

52.Follow-up audit in DG TRADE on human resources management

52.

Follow-up audit in DG TRADE on human resources management

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was assessed as not fully and/or adequately implemented:

Recommendation No 1 (important): flexible project teams.

DG TRADE has provided a definition of flexible project team/task force and has published a guidance document on setting up DG TRADE’s project teams/task forces and the list of the task forces in place.

In particular, the guidance document defines the procedure, rule and guidance for the establishment of project teams/task forces as well as the applicable working arrangements. However, DG TRADE has not defined the final deliverables of project teams/task forces and has not collected feedback and assessed possible improvements of the implementation of these flexible working arrangements after six months of experience with them.

List of audits for which all recommendations have been closed in 2021 after a follow-up audit

Based on the results of the follow-up audits performed in 2021, the IAS assessed that the following audits listed below could be fully closed as all the recommendations had been implemented.

| Audit Title |
| --- |
| 53. Audit on effectiveness and efficiency of the new Early Detection and Exclusion System in protecting the EU financial interests (DG BUDG, DG INTPA, DG REGIO, DG RTD)


  54. Audit on evaluations and studies (DG CLIMA, DG ENV) (based on two follow-up audits performed in 2021)


  55. Audit on dissemination and exploitation of Horizon 2020 results (DG CNECT, ERCEA, REA, DG RTD) (based on four follow-up audits performed in 2021)


  56. Audit on the production process and the quality of statistics not produced by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW, DG JUST) (based on three follow-up audits performed in 2021) |
| 57. Audit on the financial management of the 2014-2020 European Agricultural Fund for Rural Development in DG AGRI


  58. Audit on the design and implementation of CHAFEA’s control strategy


  59. Audit on international activities in DG ENV (based on two follow-up audits performed in 2021)


  60. Audit on the monitoring and enforcement of European Union health law in DG SANTE |
| 61. Audit on Horizon 2020 ex ante controls on payments in DG CNECT


  62. Follow-up audit on past audits in DG ENER:


  Audit on the implementation of the control strategy of DG ENER for the delegated bodies implementing the Nuclear Decommissioning Assistance Programme


  Audit on legacy programmes in DG ENER - management of final payments and closure


  63. Follow-up audit on past audits in DG RTD:


  Audit on the design and set-up of the internal control systems for Horizon 2020 in DG RTD


  Audit on Horizon 2020 ex ante controls on payments in DG RTD


  Consolidated report on Horizon 2020 project management and ex ante controls audits


  Audit on H2020 project management in DG RTD |
| 64. Audit on enforcement of the EU antitrust policy - cooperation with EU national competition authorities and national courts in DG COMP


  65. Audit on supervision of project management and payment for Galileo in DG DEFIS


  66. Follow-up audit on past audits in EASME:


  Audit on H2020 project management in EASME


  Audit on LIFE project management in EASME


  67. Audit on the effectiveness and efficiency of the performance management system in DG ECFIN


  68. Audit on the adequacy of DG GROW's preparation and supervision of the parts of the COSME work programme delegated to EASME


  69. Audit on monitoring of EU law implementation in DG TAXUD |
| 70. Follow-up audit on past audits in DG INTPA:


  Audit on annual audit and verification plans and implementation of audit results in DG INTPA


  71. Audit on direct management of grants (DCI & EDF) in DG INTPA


  72. Audit on the performance management system in DG INTPA


  73. Audit on information technology governance in DG INTPA


  74. Audit on ex ante payments under European Neighbourhood Instrument and European Neighbourhood and Partnership Instrument in DG NEAR |
| 75. Audit on grant management phase III – ex post controls in EACEA


  76. Follow-up audit on past audits in DG JUST:


  Audit on procurement in DG JUST


  Audit on impact assessment in DG JUST |
| 77. Audit on the procurement process in DG DIGIT


  78. Audit on effectiveness of DG ESTAT’s cooperation with external stakeholders


  79. Audit of the Anti-Fraud Information System (AFIS) in OLAF


  80. Limited review on the implementation of the new internal control framework in OP


  81. Audit on management of accidents’ insurance in PMO


  82. Audit on the charge-back process in PMO |
| 83. Audit on the management of information technology security in DG DIGIT


  84. Audit on security of information technology applications supporting nuclear accountancy and inspection processes in DG ENER


  85. Audit on information technology security management in DG RTD


  86. Audit on supervision of outsourced information technology operations in DG TAXUD |

Audit Title

53. Audit on effectiveness and efficiency of the new Early Detection and Exclusion System in protecting the EU financial interests (DG BUDG, DG INTPA, DG REGIO, DG RTD)

54. Audit on evaluations and studies (DG CLIMA, DG ENV) (based on two follow-up audits performed in 2021)

55. Audit on dissemination and exploitation of Horizon 2020 results (DG CNECT, ERCEA, REA, DG RTD) (based on four follow-up audits performed in 2021)

56. Audit on the production process and the quality of statistics not produced by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW, DG JUST) (based on three follow-up audits performed in 2021)

57. Audit on the financial management of the 2014-2020 European Agricultural Fund for Rural Development in DG AGRI

58. Audit on the design and implementation of CHAFEA’s control strategy

59. Audit on international activities in DG ENV (based on two follow-up audits performed in 2021)

60. Audit on the monitoring and enforcement of European Union health law in DG SANTE

61. Audit on Horizon 2020 ex ante controls on payments in DG CNECT

62. Follow-up audit on past audits in DG ENER:

Audit on the implementation of the control strategy of DG ENER for the delegated bodies implementing the Nuclear Decommissioning Assistance Programme

Audit on legacy programmes in DG ENER - management of final payments and closure

63. Follow-up audit on past audits in DG RTD:

Audit on the design and set-up of the internal control systems for Horizon 2020 in DG RTD

Audit on Horizon 2020 ex ante controls on payments in DG RTD

Consolidated report on Horizon 2020 project management and ex ante controls audits

Audit on H2020 project management in DG RTD

64. Audit on enforcement of the EU antitrust policy - cooperation with EU national competition authorities and national courts in DG COMP

65. Audit on supervision of project management and payment for Galileo in DG DEFIS

66. Follow-up audit on past audits in EASME:

Audit on H2020 project management in EASME

Audit on LIFE project management in EASME

67. Audit on the effectiveness and efficiency of the performance management system in DG ECFIN

68. Audit on the adequacy of DG GROW's preparation and supervision of the parts of the COSME work programme delegated to EASME

69. Audit on monitoring of EU law implementation in DG TAXUD

70. Follow-up audit on past audits in DG INTPA:

Audit on annual audit and verification plans and implementation of audit results in DG INTPA

71. Audit on direct management of grants (DCI & EDF) in DG INTPA

72. Audit on the performance management system in DG INTPA

73. Audit on information technology governance in DG INTPA

74. Audit on ex ante payments under European Neighbourhood Instrument and European Neighbourhood and Partnership Instrument in DG NEAR

75. Audit on grant management phase III – ex post controls in EACEA

76. Follow-up audit on past audits in DG JUST:

Audit on procurement in DG JUST

Audit on impact assessment in DG JUST

77. Audit on the procurement process in DG DIGIT

78. Audit on effectiveness of DG ESTAT’s cooperation with external stakeholders

79. Audit of the Anti-Fraud Information System (AFIS) in OLAF

80. Limited review on the implementation of the new internal control framework in OP

81. Audit on management of accidents’ insurance in PMO

82. Audit on the charge-back process in PMO

83. Audit on the management of information technology security in DG DIGIT

84. Audit on security of information technology applications supporting nuclear accountancy and inspection processes in DG ENER

85. Audit on information technology security management in DG RTD

86. Audit on supervision of outsourced information technology operations in DG TAXUD

Part 3: summary of long-outstanding recommendations – state of play as at 31 January 2022

No.

| No. | DG | Audit title | Recommendation | Comments | Final report date | Original agreed completion date | Revised expected completion date |
| --- | --- | --- | --- | --- | --- | --- | --- |
| I | BUDG | Recovery orders and bank guarantees for fines | Dealing with insolvencies and bankruptcies | DG BUDG reported that a substantial part of the recommendation is already implemented. However, the set up of a comprehensive and reliable set of tools at Commission level to monitor the financial and legal situation of contractors and beneficiaries is on-going. This action has been included into the proposal for a corporate strategy for the management of accounts receivable prepared by DG BUDG. The ‘Communication to the Commission - An enhanced corporate debt management strategy’ is planned to be launched in interservice consultation for adoption by the Commission in the second quarter of 2022.


  A follow-up will take place in the second quarter of 2022 as soon as DG BUDG reports the recommendation as ‘ready for review’.


  Expected delay between the originally agreed and revised expected completion dates is 12 months. | 20.11.2019 | 30.6.2021 | 30.9.2022 |
| II | BUDG | Pillar assessment in the external actions family | Corporate oversight | Following the recommendation to further develop its corporate oversight role, create the necessary tools for it and formalise it in the Internal Rules of the Commission, DG BUDG has clarified its role and the mandatory nature of its instructions as regards pillar assessment. In the framework of its function, DG BUDG has developed guidance and instructions, including prior approval, has put in place a central repository of pillar assessed entities and is working on an automated version of this repository to enable access to reliable information by all Services and in a second stage to process all stages of pillar assessments.


  The formalisation of DG BUDG’s corporate oversight role is one of the elements of the Internal Rules revision which is ongoing after the closure of the inter-service consultation on 11 May 2022. DG BUDG has modified the completion date accordingly. The original high risk has however been substantially mitigated meanwhile.


  The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.


  Expected delay between the originally agreed and revised expected completion dates is 12 months. | 29.1.2021 | 30.6.2021 | 30.6.2022 |
| III | TAXUD | HR management in DG TAXUD | Human resources management: task and skills mapping | The IAS recommended that DG TAXUD should implement processes to map tasks and skills covering all the activities of the service.


  The DG reported that the implementation of the recommendation is delayed due the lack of resources and the forthcoming adoption of the Commission’s new corporate HR strategy.


  The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.


  Expected delay between the originally agreed and revised expected completion dates is 12 months. | 28.01.2020 | 30.6.2021 | 30.6.2022 |
| IV | TAXUD | HR management in DG TAXUD | Workload assessment, staff allocation and project team | The IAS recommended that DG TAXUD should develop a workload assessment framework and assess if the current allocation of staff is appropriate by taking into consideration the tasks to be accomplished and the workload across the DG. It should also set up its expectations and the conditions for applying flexitime recuperation and analyse the reasons for non-recoverable overtime. Moreover, it should further promote project teams and put in place relevant guidelines.


  The DG reported that the implementation of the recommendation is delayed due the lack of resources and the forthcoming adoption of the Commission’s new corporate HR strategy.


  The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.


  Expected delay between the originally agreed and revised expected completion dates is 12 months. | 28.01.2020 | 30.6.2021 | 30.6.2022 |
| V | OIB | Procurement process | Procurement procedures | OIB prepared a working document including a proposal to revise substantially the current real estate procedure (‘Kallas procedure’) and submitted it at the end of September 2018 to the working group that was set up to prepare the revision of the procedure to align it with the Financial Regulation. Technical meetings took place with DG HR which submitted the revised new Kallas methodology to OIB in September 2020. The revised procedure was discussed with DG BUDG and the Legal Service. According to OIB, the further delay is due to the COVID-19 pandemic situation and the necessary changes in the Commission’s real estate strategy.


  According to recent information provided by OIB in February 2022, Annex 20 of the Commission Decision C(2018) 5120 on the Internal rules for the implementation of the general budget of the EU, constitutes currently the formalised rules for the management of real estate transactions and they are aligned with the provisions of the Financial Regulation.


  The drafting of the replacement of the above “Kallas methodology”, a methodology deriving from a Communication from the Commission in 2007 (COM(2007) 501), is being finalised. OIB, OIL, BUDG, SG, LS and DG HR have already agreed at operational level on a new document, which describes the various steps to be followed regarding the acquisition/occupation of Commission’s buildings.


  The current state of play (the Financial regulation and Annex 20 of the Commission Decision C(2018) 5120) with the new document describing the methodology for acquisition/occupation of Commission’s buildings sufficiently mitigates the identified weaknesses. Consequently, the OIB reported the recommendation as ‘ready for review’ in mid-February 2022. A follow-up will take place in the second quarter of 2022.


  Expected delay between the originally agreed and revised expected completion dates is 4 years and 3 months. | 20.1.2017 | 22.12.2017 | 31.3.2022 |
| VI | OLAF | Human resources strategy | Human resources strategic plan and monitoring | The IAS found that the human resources strategic plan, adopted in January 2019, did not refer to a detailed analysis of future staffing (in quality and quantity) needed to achieve the business objectives. In addition, OLAF had not established a monitoring framework to follow the implementation of the strategic plan. For consistency purposes, OLAF prefers to wait for the adoption of the Commission’s new corporate HR strategy before it issues a new OLAF HR strategic plan.


  The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.


  Expected delay between the originally agreed and revised expected completion dates is 1 year and 3 months. | 17.12.2019 | 31.12.2020 | 21.4.2022 |
| VII | SANTE | Efficiency and effectiveness of the Health and Food audits and analysis service | Staffing of activities | The IAS recommended that DG SANTE should assess the impact of the remote location (Grange, Ireland) and the recruitment needs of its Health and Food Audits and Analysis Directorate and develop an HR strategy in relation to it.


  The DG reported that the implementation of the recommendation was delayed due the COVID-19 pandemic and the forthcoming adoption of the Commission’s new corporate HR strategy.


  Expected delay between the originally agreed and revised expected completion dates is 2 years and 6 months. | 24.10.2019 | 30.06.2020 | 31.12.2022 |
| VIII | SANTE | Efficiency and effectiveness of the Health and Food audits and analysis service | Time reporting and performance monitoring | The IAS recommended that DG SANTE should assess the scope for introducing a time recording system in the Audit and Analysis Directorate, collect and analyse performance information and finalise the development of the coverage of its audit universe.


  The DG reported that the implementation of the recommendation was delayed due the COVID-19 pandemic.


  Expected delay between the originally agreed and revised expected completion dates is 2 years. | 24.10.2019 | 30.06.2020 | 30.06.2022 |

DG

Audit title

Recommendation

Comments

Final report date

Original agreed completion date

Revised expected completion date

I

BUDG

Recovery orders and bank guarantees for fines

Dealing with insolvencies and bankruptcies

DG BUDG reported that a substantial part of the recommendation is already implemented. However, the set up of a comprehensive and reliable set of tools at Commission level to monitor the financial and legal situation of contractors and beneficiaries is on-going. This action has been included into the proposal for a corporate strategy for the management of accounts receivable prepared by DG BUDG. The ‘Communication to the Commission - An enhanced corporate debt management strategy’ is planned to be launched in interservice consultation for adoption by the Commission in the second quarter of 2022.

A follow-up will take place in the second quarter of 2022 as soon as DG BUDG reports the recommendation as ‘ready for review’.

Expected delay between the originally agreed and revised expected completion dates is 12 months.

20.11.2019

30.6.2021

30.9.2022

II

BUDG

Pillar assessment in the external actions family

Corporate oversight

Following the recommendation to further develop its corporate oversight role, create the necessary tools for it and formalise it in the Internal Rules of the Commission, DG BUDG has clarified its role and the mandatory nature of its instructions as regards pillar assessment. In the framework of its function, DG BUDG has developed guidance and instructions, including prior approval, has put in place a central repository of pillar assessed entities and is working on an automated version of this repository to enable access to reliable information by all Services and in a second stage to process all stages of pillar assessments.

The formalisation of DG BUDG’s corporate oversight role is one of the elements of the Internal Rules revision which is ongoing after the closure of the inter-service consultation on 11 May 2022. DG BUDG has modified the completion date accordingly. The original high risk has however been substantially mitigated meanwhile.

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.

Expected delay between the originally agreed and revised expected completion dates is 12 months.

29.1.2021

30.6.2021

30.6.2022

III

TAXUD

HR management in DG TAXUD

Human resources management: task and skills mapping

The IAS recommended that DG TAXUD should implement processes to map tasks and skills covering all the activities of the service.

The DG reported that the implementation of the recommendation is delayed due the lack of resources and the forthcoming adoption of the Commission’s new corporate HR strategy.

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.

Expected delay between the originally agreed and revised expected completion dates is 12 months.

28.01.2020

30.6.2021

30.6.2022

IV

TAXUD

HR management in DG TAXUD

Workload assessment, staff allocation and project team

The IAS recommended that DG TAXUD should develop a workload assessment framework and assess if the current allocation of staff is appropriate by taking into consideration the tasks to be accomplished and the workload across the DG. It should also set up its expectations and the conditions for applying flexitime recuperation and analyse the reasons for non-recoverable overtime. Moreover, it should further promote project teams and put in place relevant guidelines.

The DG reported that the implementation of the recommendation is delayed due the lack of resources and the forthcoming adoption of the Commission’s new corporate HR strategy.

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.

Expected delay between the originally agreed and revised expected completion dates is 12 months.

28.01.2020

30.6.2021

30.6.2022

V

OIB

Procurement process

Procurement procedures

OIB prepared a working document including a proposal to revise substantially the current real estate procedure (‘Kallas procedure’) and submitted it at the end of September 2018 to the working group that was set up to prepare the revision of the procedure to align it with the Financial Regulation. Technical meetings took place with DG HR which submitted the revised new Kallas methodology to OIB in September 2020. The revised procedure was discussed with DG BUDG and the Legal Service. According to OIB, the further delay is due to the COVID-19 pandemic situation and the necessary changes in the Commission’s real estate strategy.

According to recent information provided by OIB in February 2022, Annex 20 of the Commission Decision C(2018) 5120 on the Internal rules for the implementation of the general budget of the EU, constitutes currently the formalised rules for the management of real estate transactions and they are aligned with the provisions of the Financial Regulation.

The drafting of the replacement of the above “Kallas methodology”, a methodology deriving from a Communication from the Commission in 2007 (COM(2007) 501), is being finalised. OIB, OIL, BUDG, SG, LS and DG HR have already agreed at operational level on a new document, which describes the various steps to be followed regarding the acquisition/occupation of Commission’s buildings.

The current state of play (the Financial regulation and Annex 20 of the Commission Decision C(2018) 5120) with the new document describing the methodology for acquisition/occupation of Commission’s buildings sufficiently mitigates the identified weaknesses. Consequently, the OIB reported the recommendation as ‘ready for review’ in mid-February 2022. A follow-up will take place in the second quarter of 2022.

Expected delay between the originally agreed and revised expected completion dates is 4 years and 3 months.

20.1.2017

22.12.2017

31.3.2022

VI

OLAF

Human resources strategy

Human resources strategic plan and monitoring

The IAS found that the human resources strategic plan, adopted in January 2019, did not refer to a detailed analysis of future staffing (in quality and quantity) needed to achieve the business objectives. In addition, OLAF had not established a monitoring framework to follow the implementation of the strategic plan. For consistency purposes, OLAF prefers to wait for the adoption of the Commission’s new corporate HR strategy before it issues a new OLAF HR strategic plan.

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’.

Expected delay between the originally agreed and revised expected completion dates is 1 year and 3 months.

17.12.2019

31.12.2020

21.4.2022

VII

SANTE

Efficiency and effectiveness of the Health and Food audits and analysis service

Staffing of activities

The IAS recommended that DG SANTE should assess the impact of the remote location (Grange, Ireland) and the recruitment needs of its Health and Food Audits and Analysis Directorate and develop an HR strategy in relation to it.

The DG reported that the implementation of the recommendation was delayed due the COVID-19 pandemic and the forthcoming adoption of the Commission’s new corporate HR strategy.

Expected delay between the originally agreed and revised expected completion dates is 2 years and 6 months.

24.10.2019

30.06.2020

31.12.2022

VIII

SANTE

Efficiency and effectiveness of the Health and Food audits and analysis service

Time reporting and performance monitoring

The IAS recommended that DG SANTE should assess the scope for introducing a time recording system in the Audit and Analysis Directorate, collect and analyse performance information and finalise the development of the coverage of its audit universe.

The DG reported that the implementation of the recommendation was delayed due the COVID-19 pandemic.

Expected delay between the originally agreed and revised expected completion dates is 2 years.

24.10.2019

30.06.2020

30.06.2022