# L_2018248EN.01027801.xml

| 3.10.2018 | EN | Official Journal of the European Union | L 248/278 |
| --- | --- | --- | --- |

3.10.2018

EN

Official Journal of the European Union

L 248/278

---

RESOLUTION (EU) 2018/1398 OF THE EUROPEAN PARLIAMENT

of 18 April 2018

with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security for the financial year 2016

THE EUROPEAN PARLIAMENT,

| — | having regard to its decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security for the financial year 2016, |
| --- | --- |

—

having regard to its decision on discharge in respect of the implementation of the budget of the European Union Agency for Network and Information Security for the financial year 2016,

| — | having regard to Rule 94 of and Annex IV to its Rules of Procedure, |
| --- | --- |

—

having regard to Rule 94 of and Annex IV to its Rules of Procedure,

| — | having regard to the report of the Committee on Budgetary Control (A8-0114/2018), |
| --- | --- |

—

having regard to the report of the Committee on Budgetary Control (A8-0114/2018),

| A. | whereas in the context of the discharge procedure, the discharge authority stresses the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of the performance-based budgeting and good governance of human resources; |
| --- | --- |

A.

whereas in the context of the discharge procedure, the discharge authority stresses the particular importance of further strengthening the democratic legitimacy of the Union institutions by improving transparency and accountability, and implementing the concept of the performance-based budgeting and good governance of human resources;

| B. | whereas, according to its statement of revenue and expenditure (1), the final budget of the European Union Agency for Network and Information Security (the ‘Agency’) for the financial year 2016 was EUR 11 033 974,16, representing an increase of 9,64 % compared to 2015; |
| --- | --- |

B.

whereas, according to its statement of revenue and expenditure (1), the final budget of the European Union Agency for Network and Information Security (the ‘Agency’) for the financial year 2016 was EUR 11 033 974,16, representing an increase of 9,64 % compared to 2015;

| C. | whereas the Union's contribution for the financial year 2016 to the Agency's budget amounted to EURo10 120 000, representing an increase of 10,53 % compared to 2015; |
| --- | --- |

C.

whereas the Union's contribution for the financial year 2016 to the Agency's budget amounted to EURo10 120 000, representing an increase of 10,53 % compared to 2015;

| D. | whereas the Court of Auditors (the ‘Court’), in its report on the Agency’s annual accounts for the financial year 2016 (the ‘Court's report’), has stated that it obtained reasonable assurances that the Agency’s annual accounts are reliable and that the underlying transactions are legal and regular; |
| --- | --- |

D.

whereas the Court of Auditors (the ‘Court’), in its report on the Agency’s annual accounts for the financial year 2016 (the ‘Court's report’), has stated that it obtained reasonable assurances that the Agency’s annual accounts are reliable and that the underlying transactions are legal and regular;

Follow-up of the 2013, 2014 and 2015 discharges

Follow-up of the 2013, 2014 and 2015 discharges

| 1. | Notes with concerns that:






  — | the Agency did not include a chapter on transparency, accountability and integrity in the 2016 annual report and calls on the Agency to include such a chapter in the 2017 Annual activity report; |
| --- | --- | --- |

1.

Notes with concerns that:

—

the Agency did not include a chapter on transparency, accountability and integrity in the 2016 annual report and calls on the Agency to include such a chapter in the 2017 Annual activity report;

| — | payments from the Greek Government are still being made with considerable delay, which in turn causes the payments to the landlords in Athens and Heraklion to be delayed and, while acknowledging that the Agency made great efforts in liaising with the Greek government in order to change the situation, calls on the Agency to report to the discharge authority on the evolution of that situation; |
| --- | --- |

—

payments from the Greek Government are still being made with considerable delay, which in turn causes the payments to the landlords in Athens and Heraklion to be delayed and, while acknowledging that the Agency made great efforts in liaising with the Greek government in order to change the situation, calls on the Agency to report to the discharge authority on the evolution of that situation;

Budget and financial management

Budget and financial management

| 2. | Notes that budget monitoring efforts during the financial year 2016 resulted in a high budget implementation rate of 98,47 %, representing a decrease of 1,53 % compared to 2015, and that the payment appropriations execution rate was 89,18 %, representing an decrease of 3,71 % compared to 2015; |
| --- | --- |

2.

Notes that budget monitoring efforts during the financial year 2016 resulted in a high budget implementation rate of 98,47 %, representing a decrease of 1,53 % compared to 2015, and that the payment appropriations execution rate was 89,18 %, representing an decrease of 3,71 % compared to 2015;

Commitments and carryovers

Commitments and carryovers

| 3. | Notes from the Court’s report that the carry-overs of committed appropriations for Title II (administrative expenditure) were at EUR 300 000 (25 %), compared to EUR 150 000 (22 %) in 2015, i.e. EURo150 000 more; notes that those carry-overs primarily related to investments in IT and a service car near year end — for official use only; |
| --- | --- |

3.

Notes from the Court’s report that the carry-overs of committed appropriations for Title II (administrative expenditure) were at EUR 300 000 (25 %), compared to EUR 150 000 (22 %) in 2015, i.e. EURo

| 4. | Notes that carry-overs are often partly or fully justified by the multiannual nature of the agencies’ operational programmes, do not necessarily indicate weaknesses in budget planning and implementation and are not always at odds with the budgetary principle of annuality, in particular if they are planned in advance by the Agency and communicated to the Court; |
| --- | --- |

4.

Notes that carry-overs are often partly or fully justified by the multiannual nature of the agencies’ operational programmes, do not necessarily indicate weaknesses in budget planning and implementation and are not always at odds with the budgetary principle of annuality, in particular if they are planned in advance by the Agency and communicated to the Court;

Staff policy

Staff policy

| 5. | Observes from the establishment plan that 43 posts (out of a total of 48 posts authorised under the Union budget) were occupied on 31 December 2016, compared to 45 in 2015; |
| --- | --- |

5.

Observes from the establishment plan that 43 posts (out of a total of 48 posts authorised under the Union budget) were occupied on 31 December 2016, compared to 45 in 2015;

| 6. | Notes that on 31 December 2016, the gender balance ratio was 42,1 % female to 57,9 % male staff; notes that all three senior management positions were occupied by men; notes, however, that the gender balance among senior management changed by the end of 2017 so that two out of three Head of Unit posts were occupied by women; |
| --- | --- |

6.

Notes that on 31 December 2016, the gender balance ratio was 42,1 % female to 57,9 % male staff; notes that all three senior management positions were occupied by men; notes, however, that the gender balance among senior management changed by the end of 2017 so that two out of three Head of Unit posts were occupied by women;

| 7. | Notes from the Court's report that in 2016, the Agency moved eight additional staff to Athens, reducing the number of staff in Heraklion to 14; notes from the Agency’s reply that a total of eight members of staff are expected to be in Heraklion at the end of 2017; highlights the fact that, according to the Court's 2013 report, it is likely that costs could be further reduced if all staff were centralised in a single location; calls on the Agency to report to the discharge authority on the possible measures to improve the situation; |
| --- | --- |

7.

Notes from the Court's report that in 2016, the Agency moved eight additional staff to Athens, reducing the number of staff in Heraklion to 14; notes from the Agency’s reply that a total of eight members of staff are expected to be in Heraklion at the end of 2017; highlights the fact that, according to the Court's 2013 report, it is likely that costs could be further reduced if all staff were centralised in a single location; calls on the Agency to report to the discharge authority on the possible measures to improve the situation;

| 8. | Notes that the Agency experiences difficulties in recruiting, attracting and holding suitably qualified staff, mainly due to the types of post that are being offered (contract agents posts) and the low coefficient factor which applies to salaries of the Agency’s employees in Greece; calls on the Agency to report to the discharge authority on any measures taken to mitigate those difficulties; |
| --- | --- |

8.

Notes that the Agency experiences difficulties in recruiting, attracting and holding suitably qualified staff, mainly due to the types of post that are being offered (contract agents posts) and the low coefficient factor which applies to salaries of the Agency’s employees in Greece; calls on the Agency to report to the discharge authority on any measures taken to mitigate those difficulties;

| 9. | Notes that on average the Agency’s staff was on sick leave for six working days in 2016; observes that the number of days spent per staff member on well-being activities in 2016 was two days; |
| --- | --- |

9.

Notes that on average the Agency’s staff was on sick leave for six working days in 2016; observes that the number of days spent per staff member on well-being activities in 2016 was two days;

| 10. | Notes with satisfaction that the Agency has established a network of confidential counsellors for prevention and mediation of work-related conflicts; notes that the Agency organised internal training and awareness raising activities; |
| --- | --- |

10.

Notes with satisfaction that the Agency has established a network of confidential counsellors for prevention and mediation of work-related conflicts; notes that the Agency organised internal training and awareness raising activities;

| 11. | Notes that the Agency has put in place a policy on protecting the dignity of the person and preventing psychological and sexual harassment and provides regular training on preventing harassment; |
| --- | --- |

11.

Notes that the Agency has put in place a policy on protecting the dignity of the person and preventing psychological and sexual harassment and provides regular training on preventing harassment;

| 12. | Notes that the Agency uses official vehicles but does not allow their private use; |
| --- | --- |

12.

Notes that the Agency uses official vehicles but does not allow their private use;

Prevention and management of conflicts of interests, transparency and democracy

Prevention and management of conflicts of interests, transparency and democracy

| 13. | Notes with concern that only the CVs of the Chair of the management board and the executive director are available on the Agency’s webpage; notes with satisfaction that the declarations of interest of the members of the management board, of the executive director and of the permanent stakeholders group have been published; |
| --- | --- |

13.

Notes with concern that only the CVs of the Chair of the management board and the executive director are available on the Agency’s webpage; notes with satisfaction that the declarations of interest of the members of the management board, of the executive director and of the permanent stakeholders group have been published;

| 14. | Notes that a whistleblowing policy is being discussed between the Union’s decentralised Agencies and that a common policy and guidelines will be adopted in 2018; calls on the Agency to report to the discharge authority on the implementation of that policy; |
| --- | --- |

14.

Notes that a whistleblowing policy is being discussed between the Union’s decentralised Agencies and that a common policy and guidelines will be adopted in 2018; calls on the Agency to report to the discharge authority on the implementation of that policy;

| 15. | Points out that the Agency has not yet provided any specific initiative to improve transparency in its contacts with lobbyists and stakeholders; calls on the Agency to enact a proactive lobby transparency policy without further delay and to report to the discharge authority on any measures taken addressing this issue; notes from the Agency's reply that they are in the process of writing a policy addressing the issue; |
| --- | --- |

15.

Points out that the Agency has not yet provided any specific initiative to improve transparency in its contacts with lobbyists and stakeholders; calls on the Agency to enact a proactive lobby transparency policy without further delay and to report to the discharge authority on any measures taken addressing this issue; notes from the Agency's reply that they are in the process of writing a policy addressing the issue;

| 16. | Notes that the Agency makes public the minutes of its management board meetings as soon as they are approved; |
| --- | --- |

16.

Notes that the Agency makes public the minutes of its management board meetings as soon as they are approved;

| 17. | Notes that in 2016 the Agency did not receive any request for access to documents; |
| --- | --- |

17.

Notes that in 2016 the Agency did not receive any request for access to documents;

Main achievements

Main achievements

| 18. | Welcomes the three main achievements identified by the Agency in 2016, namely:






  — | the successful completion of the Pan-European Exercise; |
| --- | --- | --- |

18.

Welcomes the three main achievements identified by the Agency in 2016, namely:

—

the successful completion of the Pan-European Exercise;

| — | its input to the Cooperation Group and proactive secretariat of the network and information security directive; |
| --- | --- |

—

its input to the Cooperation Group and proactive secretariat of the network and information security directive;

| — | the use of the instruments for raising public awareness of cybersecurity, such as the European Cyber Security Month and the Cybersecurity Challenge; |
| --- | --- |

—

the use of the instruments for raising public awareness of cybersecurity, such as the European Cyber Security Month and the Cybersecurity Challenge;

Internal audit

Internal audit

| 19. | Notes that the Agency had no open recommendation by the Commission’s internal audit service (IAS) in 2016; notes that in September 2016, the IAS performed an agency risk assessment which shows the next three topics for auditing: stakeholders’ involvement in the deliverables, human resources and IT; notes that the Agency will take immediate action regarding the construction of a quality management system as well as in implementation of its risk management policy; calls on the Agency to report to the discharge authority on the implementation of those actions; |
| --- | --- |

19.

Notes that the Agency had no open recommendation by the Commission’s internal audit service (IAS) in 2016; notes that in September 2016, the IAS performed an agency risk assessment which shows the next three topics for auditing: stakeholders’ involvement in the deliverables, human resources and IT; notes that the Agency will take immediate action regarding the construction of a quality management system as well as in implementation of its risk management policy; calls on the Agency to report to the discharge authority on the implementation of those actions;

Internal control

Internal control

| 20. | Notes from the Agency that the extensive ex-post control of the financial year 2015, in line with internal control standard No 8 ‘Processes and Procedures’, resulted in a number of recommendations, all of which were addressed during 2016; acknowledges that 267 financial transactions representing 76,43 % of the 2015 Agency’s budget were controlled, resulting in one issued recommendation regarding the delay of payments; acknowledges that the delay did not generate any interest to be paid; notes with satisfaction that the Agency has focused intensively on the verification of results before transactions are initiated (ex-ante verification), in order to achieve the best control possible; |
| --- | --- |

20.

Notes from the Agency that the extensive ex-post

ex-ante

Other comments

Other comments

| 21. | Notes that, according to the Court's report, the 2015 external evaluation, delivered in May 2016, concluded that the Agency’s work and outputs respond to a need for network information security across the Union and within Member States and that the Agency effectively meets its stakeholders’ expectations; notes, however, that there is a need to improve communication between the Agency and its stakeholders, who find the Agency’s mandate and outreach too limited; notes from the Agency's reply that that the management board is discussing the future of the Agency and the best way to reach the Agency’s stakeholders as well as the way to enhance the outreach of the Agency within the available human and financial resources; calls on the Agency to report to the discharge authority on the measures taken to improve the situation; |
| --- | --- |

21.

Notes that, according to the Court's report, the 2015 external evaluation, delivered in May 2016, concluded that the Agency’s work and outputs respond to a need for network information security across the Union and within Member States and that the Agency effectively meets its stakeholders’ expectations; notes, however, that there is a need to improve communication between the Agency and its stakeholders, who find the Agency’s mandate and outreach too limited; notes from the Agency's reply that that the management board is discussing the future of the Agency and the best way to reach the Agency’s stakeholders as well as the way to enhance the outreach of the Agency within the available human and financial resources; calls on the Agency to report to the discharge authority on the measures taken to improve the situation;

| 22. | Welcomes the fact that the Agency started to put in place a quality management system during 2016; notes, that the quality management manual as well as standard operation procedures and work instructions were drafted based on ISO 9001 standards; notes with satisfaction that all those documents are in the phase of revision by the management and will be implemented in 2017; calls on the Agency to report on the discharge authority on the progress made; |
| --- | --- |

22.

Welcomes the fact that the Agency started to put in place a quality management system during 2016; notes, that the quality management manual as well as standard operation procedures and work instructions were drafted based on ISO 9001 standards; notes with satisfaction that all those documents are in the phase of revision by the management and will be implemented in 2017; calls on the Agency to report on the discharge authority on the progress made;

| 23. | Welcomes the fact that the Agency has been, with the aim of ensuring a cost-effective and environmentally friendly working place, recycling paper, glass and plastics, encouraging staff to avoid printing documents and has introduced an electronic system for internal workflows which has significantly reduced the use of physical files; |
| --- | --- |

23.

Welcomes the fact that the Agency has been, with the aim of ensuring a cost-effective and environmentally friendly working place, recycling paper, glass and plastics, encouraging staff to avoid printing documents and has introduced an electronic system for internal workflows which has significantly reduced the use of physical files;

| 24. | Welcomes the fact that the Agency has, with the aim of reducing or offsetting CO2 emissions, encouraged the use of electronic means of communication as an alternative to physical travel, and implemented the ‘Greenhouse Gas Protocol (GHG) Transport tool’ for the first time in 2017 in order to compile the statistical data of business travel undertaken by Agency staff; |
| --- | --- |

24.

Welcomes the fact that the Agency has, with the aim of reducing or offsetting CO2

| 25. | Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of 18 April 2018 (2) on the performance, financial management and control of the agencies. |
| --- | --- |

25.

Refers, for other observations of a cross-cutting nature accompanying its decision on discharge, to its resolution of 18 April 2018 (2

---

(1)  
  OJ C 84, 17.3.2017, p. 7.

1

(2)  Texts adopted, P8_TA(2018)0133 (see page 393 of this Official Journal).

2

---