# C_2017417EN.01011501.xml

| 6.12.2017 | EN | Official Journal of the European Union | C 417/115 |
| --------- | -- | -------------------------------------- | --------- |

---

REPORT

on the annual accounts of the European Food Safety Authority for the financial year 2016, together with the Authority’s reply

(2017/C 417/18)

INTRODUCTION

| | 1. | The European Food Safety Authority (hereinafter ‘the Authority’, aka ‘EFSA’), which is located in Parma, was established by Regulation (EC) No 178/2002 of the European Parliament and of the Council( 1 ). The Authority’s main tasks are to supply the scientific information needed for Union legislation to be drawn up concerning food and food safety, to collect and analyse data that allow risks to be identified and monitored, and to provide independent information on these risks. |
| | -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| | 2. | The Table presents key figures for the Authority( 2 ).
Table
Key figures for the Authority
2015
2016 Budget (million euro)( 3 )
78,8
79,5 Total staff as at 31 December( 4 )
434
443 | | 2015 | 2016 | Budget (million euro)( 3 ) | 78,8 | 79,5 | Total staff as at 31 December( 4 ) | 434 | 443 | |
| ---------------------------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ---- | ---- | -------------------------- | ---- | ---- | ---------------------------------- | --- | --- | |
| | 2015 | 2016 | | | | | | | | | | |
| Budget (million euro)( 3 ) | 78,8 | 79,5 | | | | | | | | | | |
| Total staff as at 31 December( 4 ) | 434 | 443 | | | | | | | | | | |
| | | | | | | | | | | | | |

INFORMATION IN SUPPORT OF THE STATEMENT OF ASSURANCE

| | 3. | The audit approach taken by the Court comprises analytical audit procedures, direct testing of transactions and an assessment of key controls of the Authority’s supervisory and control systems. This is supplemented by evidence provided by the work of other auditors and an analysis of management representations. |
| | -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

| OPINION
4.
We have audited:
(a)
the accounts of the Authority which comprise the financial statements( 5 ) and the reports on the implementation of the budget( 6 ) for the financial year ended 31 December 2016, and (b)
the legality and regularity of the transactions underlying those accounts, as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). Reliability of the accounts
Opinion on the reliability of the accounts
5.
In our opinion, the accounts of the Authority for the year ended 31 December 2016 present fairly, in all material respects, the financial position of the Authority at 31 December 2016, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. Legality and regularity of the transactions underlying the accounts
Revenue
Opinion on the legality and regularity of revenue underlying the accounts
6.
In our opinion, revenue underlying the accounts for the year ended 31 December 2016 is legal and regular in all material respects. Payments
Opinion on the legality and regularity of payments underlying the accounts
7.
In our opinion, payments underlying the accounts for the year ended 31 December 2016 are legal and regular in all material respects. Responsibilities of management and those charged with governance
8.
In accordance with Articles 310 to 325 of the TFEU and the Authority’s Financial Regulation, management is responsible for the preparation and presentation of the accounts on the basis of internationally accepted accounting standards for the public sector and for the legality and regularity of the transactions underlying them. This responsibility includes the design, implementation and maintenance of internal controls relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error. Management is also responsible for ensuring that the activities, financial transactions and information reflected in the financial statements are in compliance with the authorities which govern them. The Authority’s management bears the ultimate responsibility for the legality and regularity of the transactions underlying the accounts. 9.
In preparing the accounts, management is responsible for assessing the Authority’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting. 10.
Those charged with governance are responsible for overseeing the entity’s financial reporting process. Auditor’s responsibilities for the audit of the accounts and underlying transactions
11.
Our objectives are to obtain reasonable assurance about whether the accounts of the Authority are free from material misstatement and the transactions underlying them are legal and regular and to provide, on the basis of our audit, the European Parliament and the Council or other respective discharge authorities with a statement of assurance as to the reliability of the accounts and the legality and regularity of the transactions underlying them. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit will always detect a material misstatement or non-compliance when it exists. These can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these accounts. 12.
An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the accounts and the legality and the regularity of the transactions underlying them. The procedures selected depend on the auditor’s judgment, including an assessment of the risks of material misstatement of the accounts and of material non-compliance of the underlying transactions with the requirements of the legal framework of the European Union, whether due to fraud or error. In making those risk assessments, internal controls relevant to the preparation and fair presentation of the accounts and legality and regularity of underlying transactions, are considered in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal controls. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of accounting estimates made by the management, as well as evaluating the overall presentation of the accounts. 13.
For revenue, we verify the subsidy received from the Commission and assess the Authority’s procedures for collecting fees and other income, if any. 14.
For expenditure, we examine payment transactions when expenditure has been incurred, recorded and accepted. Advance payments are examined when the recipient of funds provides justification for their proper use and the Authority accepts the justification by clearing the advance payment, whether in the same year or later. 15.
In preparing this report and Statement of Assurance, we considered the audit work of the independent external auditor performed on the Authority’s accounts as stipulated in Article 208(4) of the EU Financial Regulation( 7 ). | | 4. | We have audited:
(a)
the accounts of the Authority which comprise the financial statements( 5 ) and the reports on the implementation of the budget( 6 ) for the financial year ended 31 December 2016, and (b)
the legality and regularity of the transactions underlying those accounts, as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). | (a) | the accounts of the Authority which comprise the financial statements( 5 ) and the reports on the implementation of the budget( 6 ) for the financial year ended 31 December 2016, and | (b) | the legality and regularity of the transactions underlying those accounts, | | 5. | In our opinion, the accounts of the Authority for the year ended 31 December 2016 present fairly, in all material respects, the financial position of the Authority at 31 December 2016, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. | | 6. | In our opinion, revenue underlying the accounts for the year ended 31 December 2016 is legal and regular in all material respects. | | 7. | In our opinion, payments underlying the accounts for the year ended 31 December 2016 are legal and regular in all material respects. | | 8. | In accordance with Articles 310 to 325 of the TFEU and the Authority’s Financial Regulation, management is responsible for the preparation and presentation of the accounts on the basis of internationally accepted accounting standards for the public sector and for the legality and regularity of the transactions underlying them. This responsibility includes the design, implementation and maintenance of internal controls relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error. Management is also responsible for ensuring that the activities, financial transactions and information reflected in the financial statements are in compliance with the authorities which govern them. The Authority’s management bears the ultimate responsibility for the legality and regularity of the transactions underlying the accounts. | | 9. | In preparing the accounts, management is responsible for assessing the Authority’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting. | | 10. | Those charged with governance are responsible for overseeing the entity’s financial reporting process. | | 11. | Our objectives are to obtain reasonable assurance about whether the accounts of the Authority are free from material misstatement and the transactions underlying them are legal and regular and to provide, on the basis of our audit, the European Parliament and the Council or other respective discharge authorities with a statement of assurance as to the reliability of the accounts and the legality and regularity of the transactions underlying them. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit will always detect a material misstatement or non-compliance when it exists. These can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these accounts. | | 12. | An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the accounts and the legality and the regularity of the transactions underlying them. The procedures selected depend on the auditor’s judgment, including an assessment of the risks of material misstatement of the accounts and of material non-compliance of the underlying transactions with the requirements of the legal framework of the European Union, whether due to fraud or error. In making those risk assessments, internal controls relevant to the preparation and fair presentation of the accounts and legality and regularity of underlying transactions, are considered in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal controls. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of accounting estimates made by the management, as well as evaluating the overall presentation of the accounts. | | 13. | For revenue, we verify the subsidy received from the Commission and assess the Authority’s procedures for collecting fees and other income, if any. | | 14. | For expenditure, we examine payment transactions when expenditure has been incurred, recorded and accepted. Advance payments are examined when the recipient of funds provides justification for their proper use and the Authority accepts the justification by clearing the advance payment, whether in the same year or later. | | 15. | In preparing this report and Statement of Assurance, we considered the audit work of the independent external auditor performed on the Authority’s accounts as stipulated in Article 208(4) of the EU Financial Regulation( 7 ). |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | -- | ---------------------------------------------------------------------------------------------------------------------------------- | | -- | ------------------------------------------------------------------------------------------------------------------------------------ | | -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | -- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | --- | ------------------------------------------------------------------------------------------------------ | | --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | --- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | --- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | --- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| | 4. | We have audited:
(a)
the accounts of the Authority which comprise the financial statements( 5 ) and the reports on the implementation of the budget( 6 ) for the financial year ended 31 December 2016, and (b)
the legality and regularity of the transactions underlying those accounts, as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). | (a) | the accounts of the Authority which comprise the financial statements( 5 ) and the reports on the implementation of the budget( 6 ) for the financial year ended 31 December 2016, and | (b) | the legality and regularity of the transactions underlying those accounts, | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| (a) | the accounts of the Authority which comprise the financial statements( 5 ) and the reports on the implementation of the budget( 6 ) for the financial year ended 31 December 2016, and | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| (b) | the legality and regularity of the transactions underlying those accounts, | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 5. | In our opinion, the accounts of the Authority for the year ended 31 December 2016 present fairly, in all material respects, the financial position of the Authority at 31 December 2016, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 6. | In our opinion, revenue underlying the accounts for the year ended 31 December 2016 is legal and regular in all material respects. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 7. | In our opinion, payments underlying the accounts for the year ended 31 December 2016 are legal and regular in all material respects. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 8. | In accordance with Articles 310 to 325 of the TFEU and the Authority’s Financial Regulation, management is responsible for the preparation and presentation of the accounts on the basis of internationally accepted accounting standards for the public sector and for the legality and regularity of the transactions underlying them. This responsibility includes the design, implementation and maintenance of internal controls relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error. Management is also responsible for ensuring that the activities, financial transactions and information reflected in the financial statements are in compliance with the authorities which govern them. The Authority’s management bears the ultimate responsibility for the legality and regularity of the transactions underlying the accounts. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 9. | In preparing the accounts, management is responsible for assessing the Authority’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 10. | Those charged with governance are responsible for overseeing the entity’s financial reporting process. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 11. | Our objectives are to obtain reasonable assurance about whether the accounts of the Authority are free from material misstatement and the transactions underlying them are legal and regular and to provide, on the basis of our audit, the European Parliament and the Council or other respective discharge authorities with a statement of assurance as to the reliability of the accounts and the legality and regularity of the transactions underlying them. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit will always detect a material misstatement or non-compliance when it exists. These can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these accounts. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 12. | An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the accounts and the legality and the regularity of the transactions underlying them. The procedures selected depend on the auditor’s judgment, including an assessment of the risks of material misstatement of the accounts and of material non-compliance of the underlying transactions with the requirements of the legal framework of the European Union, whether due to fraud or error. In making those risk assessments, internal controls relevant to the preparation and fair presentation of the accounts and legality and regularity of underlying transactions, are considered in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal controls. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of accounting estimates made by the management, as well as evaluating the overall presentation of the accounts. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 13. | For revenue, we verify the subsidy received from the Commission and assess the Authority’s procedures for collecting fees and other income, if any. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 14. | For expenditure, we examine payment transactions when expenditure has been incurred, recorded and accepted. Advance payments are examined when the recipient of funds provides justification for their proper use and the Authority accepts the justification by clearing the advance payment, whether in the same year or later. | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | 15. | In preparing this report and Statement of Assurance, we considered the audit work of the independent external auditor performed on the Authority’s accounts as stipulated in Article 208(4) of the EU Financial Regulation( 7 ). | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

| 16. | The comments which follow do not call the Court’s opinion into question. |
| --- | ------------------------------------------------------------------------ |

COMMENTS ON INTERNAL CONTROLS

| | 17. | In its audit report dated November 2016 the Commission’s Internal Audit Service (IAS) concluded that the controls in place for IT project management are adequate, but referred to significant weaknesses in relation to IT governance. It recommended updating EFSA’s IT governance policy, to introduce an organisation-wide IT risk management framework and risk register and to separate the information security function from the IT Unit. EFSA agreed with the IAS on a plan to take corrective actions. |
| | --- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

FOLLOW-UP OF PREVIOUS YEARS’ COMMENTS

| | 18. | An overview of the corrective action taken in response to the Court’s comments from previous years is provided in the Annex. |
| | --- | ---------------------------------------------------------------------------------------------------------------------------- |

This Report was adopted by Chamber IV, headed by Mr Baudilio TOMÉ MUGURUZA, Member of the Court of Auditors, in Luxembourg at its meeting of 17 October 2017. For the Court of Auditors Klaus-Heiner LEHNE President

---

( 1 )  OJ L 31, 1.2.2002, p. 1.

( 2 )  More information on the Authority’s competences and activities is available on its website: www.efsa.europa.eu

( 3 )  Budget figures are based on payment appropriations.

( 4 )  Staff includes officials, temporary and contract staff and seconded national experts.

Source: data provided by the Authority.

( 5 )  The financial statements comprise the balance sheet, the statement of financial performance, the cash-flow statement, the statement of changes in net assets and a summary of significant accounting policies and other explanatory notes.

( 6 )  The reports on implementation of the budget comprise the reports which aggregate all budgetary operations and the explanatory notes.

( 7 )  Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (OJ L 298, 26.10.2012, p. 1).

---

ANNEX Follow-up of previous years’ comments Year
Court's comments
Status of corrective action
(Completed/Ongoing/Outstanding/N/A) 2012
Following high level risk assessments carried out by an external consultation 2012 and by the Commission’s Internal Audit Service in February 2013 a number of potential critical risks were identified in the operation of the Authority’s internal controls, particularly in the areas of data management, business continuity and IT security. The Authority started a comprehensive self-assessment of its internal control system in 2012. The process is on-going and implementation of corrective actions is planned for 2013.
Completed 2015
The Authority has not yet put in place a clear and comprehensive financial ex post control strategy covering all areas of operations and specifying the frequency and scope of such controls.
Ongoing( 1 ) ( 1 )  EFSA is in the process of developing an improved assurance governance and is fine tuning its Internal Control Framework. In particular, the EFSA approved and implemented a revised control strategy using a risk-based assessment for the mass payments made for scientific meetings and missions that will be incorporated in an EFSA procedure on financial ex ante and ex post control.

---

THE AUTHORITY’S REPLY 5.
EFSA welcomes the unqualified opinions issued by ECA on the reliability of the accounts and on the legality and regularity of the transactions underlying the accounts. This evidences that the control system in place at EFSA adequately ensures overall compliance. 17.
EFSA will duly implement the action plan following the IAS IT Governance audit. All actions concerning the positioning of the Information Security Function, the Business participation and the IT Strategy have been fully implemented. For the IT Governance, the majority of actions have been implemented and the remaining actions are planned to be implemented by the end of 2017.

---