# C_2006312EN.01000101.xml

| 19.12.2006 | EN | Official Journal of the European Union | C 312/1 |
| --- | --- | --- | --- |

19.12.2006

EN

Official Journal of the European Union

C 312/1

---

REPORT

REPORT

on the annual accounts of the European Network and Information Security Agency for the financial year 2005 together with the Agency's replies

(2006/C 312/01)

CONTENTS

| 1-2 | INTRODUCTION |
| --- | --- |

1-2

| 3-6 | STATEMENT OF ASSURANCE |
| --- | --- |

3-6

| 7-8 | OBSERVATIONS |
| --- | --- |

7-8

Tables 1 to 4

The Agency's replies

The Agency's replies

INTRODUCTION

| 1. | The European Network and Information Security Agency (hereinafter the Agency) was created by Regulation (EC) No 460/2004 of the European Parliament and of the Council of 10 March 2004 (1). It became fully autonomous in the second half of 2005. The Agency's main task is to enhance the capability of the Community to prevent and respond to network and information security problems by building on national and Community efforts. In principle its mandate expires in 2009. |
| --- | --- |

1.

The European Network and Information Security Agency (hereinafter the Agency) was created by Regulation (EC) No 460/2004 of the European Parliament and of the Council of 10 March 2004 (1). It became fully autonomous in the second half of 2005. The Agency's main task is to enhance the capability of the Community to prevent and respond to network and information security problems by building on national and Community efforts. In principle its mandate expires in 2009.

1

| 2. | Table 1 summarises the Agency's competences and activities. Key information from the financial statements drawn up by the Agency for the financial year 2005 is presented in Tables 2, 3 and 4. |
| --- | --- |

2.

Table 1 summarises the Agency's competences and activities. Key information from the financial statements drawn up by the Agency for the financial year 2005 is presented in Tables 2, 3 and 4.

Table 1

Tables 2, 3 and 4

STATEMENT OF ASSURANCE

| 3. | This Statement is addressed to the European Parliament and the Council in accordance with Article 185(2) of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 (2); it was drawn up following an examination of the Agency's accounts, as required by Article 248 of the Treaty establishing the European Community. |
| --- | --- |

3.

This Statement is addressed to the European Parliament and the Council in accordance with Article 185(2) of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 (2); it was drawn up following an examination of the Agency's accounts, as required by Article 248 of the Treaty establishing the European Community.

2

| 4. | The Agency's accounts for the financial year ended 31 December 2005 (3) were drawn up by its Executive Director, pursuant to Article 17 of Regulation (EC) No 460/2004, and sent to the Court, which is required to give a statement of assurance on their reliability and on the legality and regularity of the underlying transactions. |
| --- | --- |

4.

The Agency's accounts for the financial year ended 31 December 2005 (3) were drawn up by its Executive Director, pursuant to Article 17 of Regulation (EC) No 460/2004, and sent to the Court, which is required to give a statement of assurance on their reliability and on the legality and regularity of the underlying transactions.

3

| 5. | The Court conducted its audit in accordance with its policies and standards, which are based on international auditing standards that have been adapted to the Community context. The audit was planned and performed to obtain reasonable assurance that the accounts are reliable and the underlying transactions are legal and regular. |
| --- | --- |

5.

The Court conducted its audit in accordance with its policies and standards, which are based on international auditing standards that have been adapted to the Community context. The audit was planned and performed to obtain reasonable assurance that the accounts are reliable and the underlying transactions are legal and regular.

| 6. | The Court has thus obtained a reasonable basis for the statement set out below. |
| --- | --- |

6.

The Court has thus obtained a reasonable basis for the statement set out below.

Reliability of the accountsThe Agency's accounts for the financial year ended 31 December 2005 are, in all material respects, reliable.Legality and regularity of the underlying transactionsThe transactions underlying the Agency's annual accounts, taken as a whole, are legal and regular.The observations which follow do not call the Court's statement into question.

Reliability of the accountsThe Agency's accounts for the financial year ended 31 December 2005 are, in all material respects, reliable.Legality and regularity of the underlying transactionsThe transactions underlying the Agency's annual accounts, taken as a whole, are legal and regular.The observations which follow do not call the Court's statement into question.

OBSERVATIONS

| 7. | The implementation of the budget for the financial year 2005 was marked by a low rate of commitment (70 %) and a substantial rate of carry-over (more than 40 % overall and up to almost 80 % for operating expenditure). This situation was in part due to problems inherent in the Agency's start-up period and to the fact that it did not start becoming operational until the second half of 2005. In future, the Agency should be vigilant concerning this risk, in particular by ensuring strict programming of its activities. |
| --- | --- |

7.

The implementation of the budget for the financial year 2005 was marked by a low rate of commitment (70 %) and a substantial rate of carry-over (more than 40 % overall and up to almost 80 % for operating expenditure). This situation was in part due to problems inherent in the Agency's start-up period and to the fact that it did not start becoming operational until the second half of 2005. In future, the Agency should be vigilant concerning this risk, in particular by ensuring strict programming of its activities.

| 8. | The Court noted that no activity-based management had been brought in, despite the Agency's financial regulation making provision for its introduction, on the lines of that applied to the general budget, with a view to improving the monitoring of performance. In this context, achieving the Agency's aims should not mean merely carrying out a series of tasks. It should rather be seen as contributing to the goals laid down in its basic Regulation. The Agency's work programme should, in principle, express this contribution in operational and measurable terms. |
| --- | --- |

8.

The Court noted that no activity-based management had been brought in, despite the Agency's financial regulation making provision for its introduction, on the lines of that applied to the general budget, with a view to improving the monitoring of performance. In this context, achieving the Agency's aims should not mean merely carrying out a series of tasks. It should rather be seen as contributing to the goals laid down in its basic Regulation. The Agency's work programme should, in principle, express this contribution in operational and measurable terms.

This report was adopted by the Court of Auditors in Luxembourg at its meeting of 28 September 2006.

For the Court of Auditors

Hubert WEBER

President

---

(1)  OJ L 77, 13.3.2004, p. 1.

1

(2)  OJ L 248, 16.9.2002, p. 1.

2

(3)  These accounts were drawn up on 1 July 2006 and received by the Court on 7 July 2006.

3

---

Table 1

European Network and Information Security Agency

| Areas of Community competence | Competences of the Agency
  (Council Regulation (EC) No 460/2004 of 10 March 2004) | Governance | Resources made available to the Agency | Products and services supplied |
| --- | --- | --- | --- | --- |
| The representatives of the Member State governments have, by common agreement, adopted a statement on the creation of a European Network and Information Security Agency. The Agency should operate as a point of reference and establish confidence by virtue of its independence, the quality of the advice it delivers and the information it disseminates, the transparency of its procedures and methods of operating, and its diligence in performing the tasks assigned to it.

  (Council Decision of 19 February 2004, taken on the basis of Article 251 of the Treaty) | Objectives:







  — | enhance the capability of the Community, the Member States and businesses to prevent network and information security problems, |

Areas of Community competence

Competences of the Agency

(Council Regulation (EC) No 460/2004 of 10 March 2004)

Governance

Resources made available to the Agency

Products and services supplied

The representatives of the Member State governments have, by common agreement, adopted a statement on the creation of a European Network and Information Security Agency. The Agency should operate as a point of reference and establish confidence by virtue of its independence, the quality of the advice it delivers and the information it disseminates, the transparency of its procedures and methods of operating, and its diligence in performing the tasks assigned to it.

(Council Decision of 19 February 2004, taken on the basis of Article 251 of the Treaty)

Objectives:

—

enhance the capability of the Community, the Member States and businesses to prevent network and information security problems,

| — | provide assistance and advice to the Commission and the Member States on issues related to network and information security, |
| --- | --- |

—

provide assistance and advice to the Commission and the Member States on issues related to network and information security,

| — | develop a high level of expertise on the basis of national and Community experience, |
| --- | --- |

—

develop a high level of expertise on the basis of national and Community experience,

| — | assist the Commission in the preparatory work for updating and developing Community legislation in the field of network and information security. |
| --- | --- |

—

assist the Commission in the preparatory work for updating and developing Community legislation in the field of network and information security.

Tasks:

| — | collect appropriate information to analyse current and emerging risks, |
| --- | --- |

—

collect appropriate information to analyse current and emerging risks,

| — | provide the European Parliament, the Commission and European or national bodies with advice, |
| --- | --- |

—

provide the European Parliament, the Commission and European or national bodies with advice,

| — | facilitate cooperation between the Commission and the Member States in the development of common methodologies to prevent network and information security issues, |
| --- | --- |

—

facilitate cooperation between the Commission and the Member States in the development of common methodologies to prevent network and information security issues,

| — | track the development of standards for products and services on network and information security, |
| --- | --- |

—

track the development of standards for products and services on network and information security,

| — | cooperate with third countries and international organisations to promote a common global approach to network and information security issues, |
| --- | --- |

—

cooperate with third countries and international organisations to promote a common global approach to network and information security issues,

| — | express its own conclusions independently. |
| --- | --- |

—

express its own conclusions independently.

1. Management Board

Composition

| — | one representative of each Member State, |
| --- | --- |

—

one representative of each Member State,

| — | three representatives from the Commission, |
| --- | --- |

—

three representatives from the Commission,

| — | three representatives, appointed by the Council, without the right to vote, each representing one of the following groups: |
| --- | --- |

—

three representatives, appointed by the Council, without the right to vote, each representing one of the following groups:

| — | the information and communication technologies industry, |
| --- | --- |

—

the information and communication technologies industry,

| — | consumer groups, |
| --- | --- |

—

consumer groups,

| — | academic experts in network and information security. |
| --- | --- |

—

academic experts in network and information security.

Task

Adopt the Agency's annual work programme and its annual report.

2. Executive Director

Appointed by the Management Board on a proposal from the Commission.

3. External audit

Court of Auditors.

4. Internal audit

The Commission's Internal Auditor.

5. Discharge authority

Parliament on a recommendation from the Council.

2005 final budget:

6,3 million euro (100 % Community subsidy).

Staff numbers at 31 December 2005:

38 posts in the establishment plan

posts occupied: 35

+15 other staff (seconded national experts)

Total staff: 50

assigned to the following duties:

operational: 22

administrative: 28

Working groups:

Three working groups were set up in 2005 and finished their work: Risk Management, Awareness Raising and CERTS.

Publications:

| — | one annual report |
| --- | --- |

—

one annual report

| — | ENISA Quaterly Newsletter: 3 issues |
| --- | --- |

—

ENISA Quaterly Newsletter: 3 issues

Cooperation with Member States and the other institutions:

(number of events organised jointly):

| — | Member States: 2 seminars and 7 events organised in the Member States |
| --- | --- |

—

Member States: 2 seminars and 7 events organised in the Member States

Other products/services:

| — | Who's Who on Network and Information Security |
| --- | --- |

—

Who's Who on Network and Information Security

| — | 1 CD-ROM ‘ENISA inventory of CERT activities in Europe’ |
| --- | --- |

—

1 CD-ROM ‘ENISA inventory of CERT activities in Europe’

| — | 1 CD-ROM ‘Raising Awareness in Information Security, Insight and Guidance for Member States’ |
| --- | --- |

—

1 CD-ROM ‘Raising Awareness in Information Security, Insight and Guidance for Member States’

Source: Information supplied by the Agency.

EUROPEAN NETWORK AND INFORMATION SECURITY AGENCY

Source: Agency data — These tables summarise the data supplied by the Agency in its annual accounts.

Table 2

Implementation of the budget for the financial year 2005

| (1000 euro) |
| --- |
| Revenue | Expenditure |
| Source of revenue | Revenue entered in the final budget for the financial year | Revenue received | Allocation of expenditure | Final budget appropriations |
| entered | committed | paid | carried over | cancelled |
| Community subsidies | 6 346 | 4 400 | Title I
  Staff | 2 375 | 1 764 | 1 490 | 257 | 628 |
| | | | Title II
  Administration | 2 483 | 1 772 | 453 | 1 065 | 965 |
| | | | Title III
  Operating activities | 1 488 | 1 004 | 196 | 790 | 502 |
| Total | 6 346 | 4 400 | Total | 6 346 | 4 540 | 2 139 | 2 112 | 2 095 |

(1000 euro)

Revenue

Expenditure

Source of revenue

Revenue entered in the final budget for the financial year

Revenue received

Allocation of expenditure

Final budget appropriations

entered

committed

paid

carried over

cancelled

Community subsidies

6 346

4 400

Title I

Staff

2 375

1 764

1 490

257

628

Title II

Administration

2 483

1 772

453

1 065

965

Title III

Operating activities

1 488

1 004

196

790

502

Total

6 346

4 400

Total

6 346

4 540

2 139

2 112

2 095

Table 3

Revenue and expenditure account for the financial year 2005

| (1000 euro) |
| --- |
| Operating revenue |
| Community subsidies | 4 251 |
| Total (a) | 4 251 |
| Operating expenditure |
| Staff | 1 040 |
| Administration | 1 594 |
| Operating activities | 517 |
| Total (b) | 3 151 |
| Operating result (c = a — b) | 1 100 |

(1000 euro)

Operating revenue

Community subsidies

4 251

Total (a)

4 251

Operating expenditure

Staff

1 040

Administration

1 594

Operating activities

517

Total (b)

3 151

Operating result (c = a — b)

1 100

Table 4

Balance sheet at 31 December 2005

| (1000 euro) |
| --- |
| Assets |
| Fixed assets | 344 |
| Receivables | 13 |
| Cash and cash equivalents | 2 510 |
| Total | 2 867 |
| Liabilities |
| Accumulated surplus/deficit | 0 |
| Economic result for the year | 1 100 |
| Current liabilities | 1 767 |
| Total | 2 867 |

(1000 euro)

Assets

Fixed assets

344

Receivables

13

Cash and cash equivalents

2 510

Total

2 867

Liabilities

Accumulated surplus/deficit

0

Economic result for the year

1 100

Current liabilities

1 767

Total

2 867

---

THE AGENCY'S REPLIES

| 7. | The Agency became operational only in September 2005. Being understaffed, and having limited time available, it proved very difficult to improve the budget implementation rates. The management will take necessary action and it is expected to have higher execution rates for the budget implementation of 2006. |
| --- | --- |

7.

The Agency became operational only in September 2005. Being understaffed, and having limited time available, it proved very difficult to improve the budget implementation rates. The management will take necessary action and it is expected to have higher execution rates for the budget implementation of 2006.

| 8. | Having less than 12 months of operational activity, the Agency lacks the necessary resources in order to introduce and apply effectively an Activity Based Management system. It is true that Activity Based Management would improve dramatically the measurability of the Agency's work. The management will endeavour to have it in place as soon as the Agency is in a position to dedicate the necessary resources for an Activity Based Management system to be developed. |
| --- | --- |

8.

Having less than 12 months of operational activity, the Agency lacks the necessary resources in order to introduce and apply effectively an Activity Based Management system. It is true that Activity Based Management would improve dramatically the measurability of the Agency's work. The management will endeavour to have it in place as soon as the Agency is in a position to dedicate the necessary resources for an Activity Based Management system to be developed.

---