# IMMC.COM%282022%29292%20final.ENG.xhtml.1_EN_ACT_part1_v4.docx

european flagEUROPEAN COMMISSION Brussels, 7.6.2022 COM(2022) 292 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORSAnnual report to the Discharge Authority on internal audits carried out in 2021 {SWD(2022) 160 final}
Table of Contents 1. Objectives and scope of the report 2. The Internal Audit Service mission: accountability, independence and objectivity 3. Overview of audit work 3.1. Implementation of the 2021 audit plan 3.2. Statistical data on Internal Audit Service recommendations 4. Conclusions based on the audit work performed in 2021 4.1. Conclusion on performance audits 4.1.1. Preparedness for the implementation of the 2021-2027 Multi-annual Financial Framework 4.1.2. Supervision strategies for the implementation of programmes by third parties 4.1.3. Internal control systems in selected Directorates-General: Legality and regularity, compliance 4.1.4. EU law implementation 4.1.5. Information technology security 4.1.6. Other processes 4.2. Internal Audit Service limited conclusions 4.3. Overall opinion on the Commission’s financial management 5. Consultation with the Commission’s financial irregularities panel 6. Mitigating measures for potential conflicts of interest (international internal auditing standards) — Investigation of the European Ombudsman
1. Objectives and scope of the report This report informs the European Parliament and Council, as part of the discharge procedure, about internal audits carried out in 2021 by the Internal Audit Service of the European Commission in the Commission Directorates-General, services and executive agencies 1 . It contains: (i) a summary of the number and type of internal audits carried out; (ii) a synthesis of the recommendations made; and (iii) the action taken on those recommendations. In accordance with Articles 118(8) and 247 of the Financial Regulation 2 , the Commission forwards the report to the European Parliament and to the Council. It is based on the report drawn up in accordance with Article 118(4) of the Financial Regulation by the Commission’s Internal Auditor on Internal Audit Service audits and consulting reports completed in 20 21 3 . 2. The Internal Audit Service mission: accountability, independence and objectivity The mission of the Internal Audit Service is to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight . The Internal Audit Service helps the Commission accomplish its objectives by bringing a systematic, disciplined approach in order to evaluate and improve the effectiveness of risk management, control and governance processes. Its tasks include assessing and making appropriate recommendations to improve the risk management, control and governance processes to achieve the following three objectives: (i) promoting appropriate ethics and values within the organisation; (ii) ensuring effective organisational performance management and accountability; and (iii) effectively communicating risk and control information to appropriate areas of the organisation. In doing this, the Internal Audit Service aims to promote a culture of efficient and effective management within the Commission and its departments. The independence of the work of the Internal Audit Service is enshrined in the Financial Regulation and its mission charter 4 as adopted by the Commission. This charter stipulates that, to ensure objectivity in their judgement and avoid conflict of interest, Internal Audit Service auditors must preserve their independence in relation to the activities and operations they review. If their objectivity is impaired in fact or in appearance, the details of the impairment should be disclosed. If the Internal Auditor considers it necessary, he/she may address himself/herself directly to the President of the Commission and/or the College. The Internal Audit Service performs its work in accordance with the Financial Regulation, the International Standards for the Professional Practice of Internal Auditing, and the Code of Ethics of the Institute of Internal Auditors. The Internal Audit Service reports — and is accountable functionally — to the Audit Progress Committee . The Internal Audit Service: (i) reports to the Audit Progress Committee significant issues arising from its audits and potential improvements to the audited processes; (ii) provides an annual overall opinion on the state of financial management in the Commission; and (iii) reports (at least annually) on its mission and performance, as set out in its annual audit plan. This reporting includes significant risk exposures, control issues, corporate governance issues and other matters. The Audit Progress Committee assists the College of Commissioners in fulfilling its obligations under the Treaties, the Financial Regulation and other statutory instruments. It does this by: (i) ensuring the independence of the Internal Audit Service; (ii) monitoring the quality of internal audit work; (iii) ensuring that internal and external audit recommendations are properly taken into account by the Commission services; and (iv) ensuring that these recommendations receive appropriate follow-up. In this way, the Audit Progress Committee helps improve the Commission’s effectiveness and efficiency in achieving its goals. The Audit Progress Committee also facilitates the College’s oversight of the Commission’s governance, risk management, and internal control practices 5 . The Internal Audit Service does not audit Member States’ systems of control over the EU funds. Such audits reach down to the level of individual beneficiaries, and are carried out by Member States’ internal auditors, national audit authorities, other Commission Directorates-General and the European Court of Auditors. However, the Internal Audit Service does audit measures taken by the Commission to supervise and audit: (i) bodies in Member States; and (ii) other bodies which are responsible for disbursing EU funds, such as the United Nations. As provided for in the Financial Regulation, the Internal Audit Service can carry out these duties on the spot, including in the Member States. 3. Overview of audit work 3.1. Implementation of the 2021 audit plan The Internal Audit Service implemented the 2021 audit plan in the context of the COVID-19 pandemic, in full respect of the applicable working arrangements at corporate level. Despite the challenges brought by these circumstances, the Internal Audit Service completed 143 ‘engagements’ (audits, consulting, follow-ups and reviews), and issued 148 reports (including follow-up and closing notes) 6 . This was achieved by using the digitalisation opportunities available in the Commission, with tools supporting efficient and effective remote auditing processes. The overall number and breakdown by type of engagements and reports completed is contained in the charts below. By the cut-off date of 31 January 2022, 100% of the 2021 audit plan as updated to take account of the evolving risks at mid-year had been implemented. Source: European Commission, Internal Audit Service The initial 2021 plan contained 38 audit engagements (audits, reviews and consulting engagements, but excluding follow-ups) planned to be completed by the cut-off date of 31 January 2022, moreover, the 2021 initial plan contained 35 additional engagements planned to start before 31 January 2022 and to be completed after that date. The 2021 initial plan was updated in September and October 2021. The Audit Progress Committee took both the initial and updated plans into consideration. The Internal Audit Service plans its audit work on the basis of a risk assessment and a capacity analysis. This is required by its charter and international standards, aims at defining a plan that covers the highest risk areas, hence maximising the added value of the Internal Audit Service, and helps ensuring the best use of resources and the efficient and effective implementation of the plan. Its implementation is regularly monitored and adjusted as necessary. 3.2. Statistical data on Internal Audit Service recommendations The figure below shows the number of recommendations the Internal Audit Service issued in 2021.
Source: European Commission, Internal Audit Service An annual comprehensive overview of the Internal Audit Service follow-up of internal audit recommendations which were more than six months overdue on the cut-off date of 31 January 2022 was addressed to the Audit Progress Committee. Moreover, the Internal Audit Service prepares three additional quarterly reports on the implementation of long overdue recommendations, which are discussed during Audit Progress Committee preparatory group meetings. In 2021, the auditees accepted all but one of the Internal Audit Service’s recommendations 7 . In all cases, the auditees drafted action plans, which they then submitted to the Internal Audit Service, who in turn assessed the plans as being satisfactory. At the cut-off date of 31 January 2022, 652 (74%) out of a total of 881 (including partially) accepted recommendations 8 made by the Internal Audit Service during the period 2017-2021 were assessed by the auditees as implemented 9 . This leaves a total of 229 recommendations (26%) that are still open. Source: European Commission, Internal Audit Service Of these 229 open recommendations, none are rated as critical, 72 are rated very important, and 157 are rated important. 65 of these are overdue (i.e. not implemented by the originally agreed implementation date). These overdue recommendations represent 7.4% of the total (partially) accepted recommendations. Of these overdue recommendations, 7 very important ones are classified as long overdue (a recommendation is long overdue when it is still open more than 6 months after the original implementation date). These very important long overdue recommendations represent 0,8% of the total number of accepted recommendations in the period 2017-2021 (compared to 0.6% in the previous reporting period). In addition, one very important recommendation that falls outside the reporting period is also long overdue. The Internal Audit Service has a strict follow-up policy to assess the implementation of its recommendations. Results show that the vast majority of Internal Audit Service recommendations are effectively and timely implemented.
Source: European Commission, Internal Audit Service Overall, the Internal Audit Service considers the implementation of its recommendations to be satisfactory and comparable to previous reporting periods. This state of play indicates that the Commission services are diligent in implementing the critical and very important recommendations, thereby mitigating the risks identified by the Internal Audit Service. Nevertheless, attention should be paid to the individual recommendations rated very important which are long overdue. Part 3 of the Staff Working Document summarises these very important and long overdue recommendations. 4. Conclusions based on the audit work performed in 202 1 4.1. Conclusion on performance audits To contribute to the Commission’s performance based culture and its greater focus on value for money, the Internal Audit Service carried out two types of audits in 2021: performance audits and comprehensive audits 10 covering important aspects of performance. In line with its methodology and best practices, the Internal Audit Service approaches performance in an indirect way, by assessing the performance of departments in implementing policies, programmes and actions by reference to the risks associated with them. With this approach, it aims to ensure that Directorates-General and services have developed appropriate performance frameworks, performance measurement tools, key indicators and monitoring systems. The following sections set out the Internal Audit Service’s conclusions on the various aspects of performance it focused on in the audits it carried out in 2021. 4.1.1. Preparedness for the implementation of the 2021-2027 Multi-annual Financial Framework The 2021-2027 Multi-annual Financial Framework and the recovery package under NextGenerationEU should be implemented in accordance with the Financial Regulation and be complementary as regards the funding opportunities and results to be achieved. A number of audits in 2021 focused on the risks related to the design of the overall package, the Commission’s enhanced role in some areas and its new areas of responsibility. The results of these audits indicate that significant improvements are necessary in this domain going forward, with a number 11 of very important recommendations issued in 2021 addressed to the Directorates-General audited. 1) One audit assessed the preparation of the 2021-2027 programming period in the Directorates-General for Employment, Social affairs and Inclusion, Maritime Affairs and Fisheries, and Regional and Urban Policy. This audit gave rise to seven very important recommendations. The Directorates-General preparation for the 2021-2027 programming period is a process which was still ongoing at the date of the audit report, and therefore the audit was in effect addressing a moving target. Although the Directorates-General had designed and implemented adequate processes to support the start of the 2021-2027 programming period, there were two weaknesses affecting their effectiveness and efficiency, notably as regards the support to Member States and the timing of the preparation and operational start of the programming period.
2) A second audit concerned the preparation for the 2021-2027 programming period of the Directorate-General for Migration and Home Affairs funds. It gave rise to two very important recommendations. The Internal Audit Service noted that the preparation for the 2021-2027 programming period is a process which was still ongoing at the dat e of the audit report. Although the Directorate-General for Migration and Home Affairs had designed and implemented adequate processes to support the start of the 2021-2027 programming period, there remained a number of weaknesses affecting their effectiveness and efficiency, notably as regards delays in work programmes of the thematic facility and the monitoring of progress in the programming of the 2021-2027 period and reporting to senior management. For both audits, given the continuing nature of the preparations and the fact that the audits represented a snapshot at a particular point in time, the weaknesses identified may, if left unaddressed, have an impact on subsequent phases of the programming period. 3) A third audit assessed the European Anti-Fraud Office’s preparedness to implement the Regulation on the establishment of the European Public Prosecutor’s Office 12 . In this audit, the Internal Audit Service found that the internal control system of the European Anti-Fraud Office to prepare for the future cooperation with the European Public Prosecutor’s Office was not fully adequate and effective. It identified weaknesses in the planning and monitoring of the preparatory process, in the investigation and data protection guidelines and in information technology related aspects and issued three very important recommendations. 4) A fourth audit assessed the Directorate-General for Competition’s preparedness of the Competition programme. Although the Directorate-General had put in place a framework for the implementation of the Competition programme under the 2021-2027 Multi-annual Financial Framework, the audit identified a remaining weakness in defining and structuring some of the key elements of the Competition programme, which may in turn affect its effective implementation. The Internal Audit Service issued three very important recommendations. 5) Finally, the audit on the preparedness for the new European Statistical Programme under the 2021-2027 programming period in Eurostat did not identify any significant performance issues. 4.1.2. Supervision strategies for the implementation of programmes by third parties Authorising officers have to set up adequate and effective strategies and activities for supervising and monitoring the delegated entities' effective implementation of the programmes and protection of the EU budget, and for promptly addressing any identified potential difficulties. In previous years, the Internal Audit Service performed several audits of the supervision arrangements in place in Directorates-General and services for the implementation of programmes (and/or policies) by third parties. It frequently identified weaknesses in the effectiveness of the supervision strategies. In its overall opinion on financial management, and as in previous years, the Internal Audit Service once again formulated an emphasis of matter in relation to the supervision strategies for third parties implementing policies. At the same time, based on the 2021 audit results, the conclusion is that, in some policy areas, the situation is improving. 1) In its 2021-2023 strategic audit plan, the Internal Audit Service aimed for an integrated risk-based approach, to perform, where appropriate, audits encompassing both Commission partner Directorates-General and decentralised agencies or other autonomous EU bodies. In 2021, the first two multi-entity audits were finalised, focusing, at the level of the Commission Directorates-General, on the supervision arrangements in place between respectively the Directorate-General for Energy and Fusion for Energy (F4E), (the European joint undertaking managing Europe's contribution to ITER) and between the Directorate-General for Migration and Home Affairs and the European Border and Coast Guard Agency (Frontex). The results were satisfactory with no high residual risks or major weaknesses identified in the Commission Directorates-General audited. 2) Another audit was performed in the Directorates-General for Climate Action and Environment on their relations with the European Environment Agency and the European Chemicals Agency. In contrast to the above two multi-entity audits, the Internal Audit Service did not include these two agencies in the audit scope as the audit was launched in 2020, prior to the reorganisation of the Internal Audit Service. The Directorates-General have both put in place adequate processes to support their relations with the decentralised agencies concerned. However, their effectiveness and efficiency was found to be impaired by a weakness related to the oversight role of both the Directorates-General for Climate Action and Environment on the European Environment Agency’s resources. Another weakness in the Directorate-General for Environment related to the supervision and coordination mechanisms with the European Environment Agency. 3) Finally, an audit aimed at assessing the supervision of Article 185 bodies by the Directorate-General for Research and Innovation. This audit was closed after the preliminary survey, when the inherent risks, initially assessed as high, were re-assessed by the auditors as medium to low, in particular as only two out of the five Article 185 bodies under the responsibility of the Directorate-General for Research and Innovation will continue in the present form under the 2021-2027 framework programme for research, Horizon Europe. 4.1.3. Internal control systems in selected Directorates-General: Legality and regularity, compliance While the Internal Audit Service placed more emphasis on performance issues over the last few years, political stakeholders and the European Court of Auditors maintain an in-depth level of scrutiny of the Commission’s management of the EU budget, as regards legality and regularity, and compliance. Therefore, one of the priorities of the 2021 audit plan (based on the 2021-2023 strategic audit plan) was to provide reassurance to the College and the Directorates-General and services on the efficient and effective functioning of the internal control systems as regards financial management. In the area of shared management, the Internal Audit Service finalised three audits. 1) In the audit on interruptions, suspensions and financial corrections for the 2014-2020 European Structural and Investment Fund, the Internal Audit Service acknowledged that the Directorates-General for Employment, Social Affairs and Inclusion, for Maritime Affairs and Fisheries and for Regional and Urban Policy are operating under the constraints of a very challenging legal framework in the form of the Common Provisions Regulation. In particular, the conditions for the application of net financial corrections are stricter than the Commission’s original proposals. Consequently, the audit findings need to be seen in this context. The Internal Audit Service concluded that there are a number of weaknesses that have an impact on the effective implementation of the Directorates-General’s processes for interruptions, suspensions and financial corrections and had therefore issued eight very important recommendations in total. 2) The land parcel identification system is a key control mechanism based on aerial or satellite photographs, which records all agricultural parcels in the Member States. The system is designed to verify the eligibility for area-based subsidies under the Common Agricultural Policy (‘CAP’) and plays an essential role in checking compliance with various CAP obligations, including in relation to the greening of the CAP. The Internal Audit Service found that although the Directorate-General for Agriculture and Rural Development has put in place adequate controls to support the management of the Member States’ systems and to monitor their quality, their effectiveness is affected by weaknesses. The monitoring and follow-up of the land parcel identification system quality assessment exercise needs to be improved. 3) The audit in the Directorate-General for Agriculture and Rural Development on support, monitoring and checks of the work of certification bodies did not result in the identification of any significant performance issues. The Internal Audit Service also finalised various audits in direct management. 4) In the audit on the implementation of audit results in Horizon 2020, the Internal Audit Service found that the audited Directorates-General and Executive Agencies have overall set-up and implemented an adequate and effective internal control system for the implementation of audit results of the Common Audit Service. Roles and responsibilities are clearly defined and tools are available to the project and financial officers, in compliance with the applicable rules. Nevertheless, weaknesses remain as regards the monitoring and reporting on the implementation of the ex post audit results 13 . 5) The Internal Audit Service also examined the Commission’s ‘single electronic data interchange area’ (SEDIA) initiative. The objective of SEDIA is to fully automate and integrate the process for handling information on procurement and grants, limiting to the strict minimum the manual input of data, and promoting the alignment and reuse of such data along the whole process. The purpose of SEDIA is to provide applicants, candidates and tenderers with a single entry point to communicate and exchange information on procurement and grant procedures. The implementation of the SEDIA initiative supports the achievement of the business objectives of a high number of clients, and ultimately of the whole Commission. Being a recent Commission initiative, unique in its kind, the European Research Executive Agency could not benefit from experience in terms of governance structure, internal control framework and information technology support systems in implementing SEDIA. Moreover, since its launch in 2017, the initiative has faced considerable constraints in terms of availability of adequate information technology tools. Although the Research Executive Agency delivers the services for which it is responsible under the SEDIA initiative in an effective manner, in compliance with the Financial Regulation and as agreed with its clients, there are weaknesses affecting the efficiency of the delivery of the SEDIA-related services and compliance with the rules on the protection of personal data processed in the context of the agency’s SEDIA operations.
6) The Directorate-General for Structural Reform Support delivers a growing number of technical support projects to EU Member States, mainly through the Structural Reform Support Programme for the 2014-2020 programming period and the Technical Support Instrument for the 2021–2027 programming period. The Internal Audit Service found that although the Directorate-General overall designed adequate processes and controls for delivering technical support to the Member States under the Structural Reform Support Programme, weaknesses exist as regards its IT capacities (tools, guidance and practices) for monitoring the effective implementation of projects. 7) The establishment of statutory rights and calculation of individual entitlements are core services provided by the Office for the Administration and Payment of Individual Entitlements to current and former staff of the European Commission and other EU institutions and bodies. The Office processes a large volume of transactions for various categories of rights, based on a complex legal base, and for a variety of EU institutions and clients with different characteristics and needs. In this challenging environment, although the office has designed an adequate control framework to ensure the correct establishment of rights and calculation of entitlements for active and post-active staff, there remains a very important weakness regarding the effectiveness and efficiency of its control strategy. 8) In the audits on: (1) Horizon 2020 grant management in the European Research Council Executive Agency; (2) the Instrument for Pre Accession II grants in direct management in the Directorate-General for Neighbourhood and Enlargement Negotiations; and (3) the closure processes of previous programmes (implemented under different budget implementation modes) in the Directorate-General for Neighbourhood and Enlargement Negotiations, the Internal Audit Service did not identify any significant issues. 4.1.4. EU law implementation A key responsibility of Directorates-General is to support, monitor and enforce the implementation and application of the European Union (EU) law (‘acquis’). 1) Two audits assessed how the Directorates-General concerned: (1) proactively support and monitor Member States in the correct implementation and application of EU legislation before its entering into force and assess the transposition of EU directives; (2) monitor the ongoing application of EU law, including the handling of stakeholder complaints and management of own-initiative cases; and (3) manage the enforcement of potential breaches and weaknesses via dialogues with Member States and infringement procedures. 2) The Internal Audit Service acknowledged the particular resource challenges faced by the Directorate-General for Energy to strike a balance between an increasingly demanding portfolio of responsibilities, in particular as regards achieving the objectives of the European Green Deal, and the increasing workload associated with new policy and legislative initiatives. T he Internal Audit Service concluded that, although the Directorate-General for Energy has overall designed adequate internal controls for the support, monitoring and enforcement of EU energy law application, there remains a weakness with regard to the management supervision of the compliance assessment process, which in turn impacts on its effectiveness and efficiency. 3) At the level of the Directorate-General for Mobility and Transport, the internal control system in place ensures an effective support, monitoring and enforcement of the EU transport law application. 4) In addition, a third audit targeted the stakeholders’ complaints process in the Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs. No significant performance issues were identified. 4.1.5. Information technology security The Internal Audit Service completed two audits concerning information technology security: a central-level audit on the management and monitoring of compliance with the Commission’s information technology security framework and a local-level, multi-Directorate-General audit on information technology security in the human resource family. 1) The first audit on managing and monitoring compliance revealed the magnitude of the task at hand and the challenges faced by the Directorate-General for Informatics to get all Directorates-General to report on their compliance with the very high number of information security controls , particularly when they are faced with many other priorities. Although the Directorate-General for Informatics had put in place the necessary corporate tools to support the effective implementation of information technology security requirements across the Commission, significant weaknesses remained in two areas: (1) in information technology security compliance management and reporting practices; and (2) in the compliance management process. 2) Due to the sensitive nature of the information treated by the services of the human resource family, it is essential to have highly secured information technology systems, and adequate security controls. The audit yielded mixed results in terms of the importance of the issues found and that information technology security is at varying levels of maturity between services. For the Directorate-General for Human Resources and Security, a number of significant weaknesses led the Internal Audit Service to conclude that the information technology governance, management and control processes need to be further improved to sufficiently mitigat e the risks identified. In the Office for Administration and Payment of Individual Entitlements and the European Personnel Selection Office, despite certain weaknesses, the situation was positive overall. As regards the role played by the Directorate-General for Informatics as service provider to the human resource family, the audit found a number of significant weaknesses in how it interacts with those Directorates-General/services. 4.1.6. Other processes Two audits assessed performance aspects of other processes (external stakeholder management and crisis communication) with satisfactory results. The Internal Audit Service did not identify any significant weaknesses. 4.2. Internal Audit Service limited conclusions The Internal Audit Service issued limited conclusions on the state of internal control to every 14 Directorate-General and service in February 202 2 . These limited conclusions contributed to the 2021 annual activity reports of the Directorates-General and services concerned. Drawing on the audit work carried out in the last 3 years, they cover all open recommendations issued. The Internal Audit Service’s conclusion on the state of internal control is limited to the management and control systems that were audited. It does not cover systems not audited by the Internal Audit Service in the past 3 years. 4.3. Overall opinion on the Commission’s financial management As required by its mission charter, the Internal Audit Service issues an annual overall opinion on the Commission’s financial management. This is based on the audit work in the area of financial management in the Commission carried out by the Internal Audit Service during the past 3 years (2019 to 2021). It also takes into account information from other sources, namely the reports of the European Court of Auditors. The overall opinion is issued at the same time as this report and covers the same year. Based on this audit information, the internal auditor considered that, in 2021, the Commission had put in place governance, risk management and internal control procedures which, taken as a whole, are adequate to give reasonable assurance on the achievement of its financial objectives. However, the overall opinion is qualified with regard to the reservations the authorising officers by delegation made in their declarations of assurance issued in their respective annual activity reports.
In arriving at the overall opinion, the internal auditor also considered the combined impact of all amounts estimated to be at risk at payment as these go beyond the amounts put under reservation. The overall amounts at risk at payment are the best estimation of authorising officers by delegation of the amount of the expenditure authorised that was not in conformity with the applicable contractual and regulatory provisions at the time of the payment in 2021. In their annual activity reports, the directorates-general/services estimate amounts at risk at payment to total between approximately EUR 2 78 4 million and EUR 3 24 9 million approximately. This corresponds to between 1.6% and 1.9% of total relevant expenditure 15 from the Commission budget, European Development Fund and EU T rust F und s in 2021 and therefore below the materiality of 2% as defined in the instructions for the preparation of the 2021 A nnual A ctivity R eport s . These amounts at risk at payment in 2021 do not yet include any financial corrections and recoveries related to deficiencies and errors the Directorates-General/services will detect and correct in the future due to the multi-annual corrective mechanisms built into the Commission's internal control systems 16 . Given these elements, the Internal Audit Service considers that the EU budget is adequately protected in total and over time. Without further qualifying the overall opinion, the Internal Audit Service emphasised the following matters: 1. Implementation of the EU budget in the context of the crisis related to the COVID-19 pandemic The health, social, economic and financial situation created by the COVID-19 pandemic entails potentially high, cross-cutting risks for the institution as regards the implementation of the EU budget and the delivery of its policy priorities. This includes the operations which are part of the 2014-2020 multiannual financial framework, for which adequate controls (ex post in particular) still need to be performed, and operations under the 2021-2027 multiannual financial framework and the recovery package under NextGenerationEU, on assurance, compliance and performance aspects. To ensure the budget is duly protected over time in the face of the existing unprecedented challenges, the Internal Audit Service stresses that the Commission’s Directorates-General and services should continue to (i) duly assess the risks caused by the COVID-19 pandemic related to financial management in terms of assurance, performance, compliance with the legal framework, and the potential impact on the effectiveness of the Commission’s ability to implement corrective actions due to possible logistical constraints to undertake controls on the spot and the very challenging economic situation faced at EU and national levels (including the possible bankruptcies of final beneficiaries, which could make it difficult to recover undue amounts); and (ii) define and implement adequate mitigating measures, such as adjusting or redefining their control strategies. Furthermore, the Commission’s Directorates-General should continue to design and implement appropriate financial management, audit and control strategies for operations to support the recovery under NextGenerationEU, in particular as concerns the Recovery and Resilience Facility. Due to the implementation of a new performance-based approach, certain elements of the design of the control strategy covering legality and regularity are still to be further elaborated in 2022, namely the procedures for suspension of payments and reduction of support in cases where milestones and targets for a particular payment request have not been met partially or fully. In addition, the control design has to be completed as concerns the residual responsibility of the Commission in relation to other elements of compliance (i.e. protection of the financial interests of the Union in the case of fraud, corruption, and conflicts of interest or a serious breach of an obligation resulting from the Loan or Financing Agreement). 2. Supervision strategies regarding third parties implementing policies and programmes. Although the Commission remains fully responsible for ensuring the legality and regularity of expenditure and sound financial management (and also for the achievement of policy objectives), it has increasingly relied on third parties to implement its programmes. This is mostly done by delegating the implementation of the EU’s operational budget or certain tasks to countries outside the EU, international organisations or international financial institutions, national authorities and national agencies in Member States, joint undertakings, non-EU bodies and EU decentralised agencies. Moreover, in certain policy areas, alternative funding mechanisms such as financial instruments are increasingly used and entail specific challenges and risks for the Commission, as also highlighted by the European Court of Auditors. To fulfil their overall responsibilities, the Directorates-General have to oversee the implementation of the programmes and policies and provide guidance and assistance where needed. Therefore, they have to define and implement adequate, effective and efficient supervision/monitoring/reporting activities to ensure that the delegated entities and other partners effectively implement the programmes, adequately protect the financial interests of the EU, comply with the delegation agreements, when applicable, and that any potential issues which are identified are addressed as soon as possible. Although actions have been taken in recent years both at the level of the central services and at that of the relevant Directorates-General to mitigate the risks identified as a result of audit work, further improvements are still needed in some areas and in particular as regards pillar assessment in indirect management. This is relevant not only in relation with the closure of activities delegated under the 2014-2020 multiannual financial framework, but more so in view of the increase in the use of equity, guarantee and risk-sharing instruments in the 2021-2027 multiannual financial framework. 3. Reporting on the corrective capacity of the multiannual control systems The Commission has put in place, together with the Member States (when applicable), multiannual control systems to ensure the sound financial management of EU funds. These systems encompass preventive measures (i.e. controls aiming at preventing errors before payments are made) as well as corrective measures (i.e. controls carried out after the payments and until the closure of the programmes, when applicable). These measures constitute the Commission’s overall corrective capacity (including measures implemented by the Member States). Considering the multiannual nature of the Commission’s control system, the control results are reported at two moments of the programmes’ cycle through the estimated ‘risk at payment ’ 17 (i.e. after preventive measures) and ‘risk at closure’ 18 (i.e. after preventive and corrective measures). The ‘risk at closure’ is calculated by subtracting the ‘estimated future corrections’ 19 from the estimated ‘risk at payment’. Overall, the IAS notes some improvements made in the Directorates-General’s 2021 A nnual A ctivity Reports and the (draft) A nnual M anagement and P erformance R eport regarding information on preventive and corrective measures applied by the Commission and Member States. However, considering the increasing importance of corrections implemented by Member States as an integral part of the control architecture in shared management, the information provided about the corrective capacity still needs to be further improved (in terms of its clarity and the split of the relevant data) to adequately substantiate the Commission’s overall corrective capacity (including corrections requested by the Commission and accepted by Member States), the ‘estimated future corrections’ and the resulting ‘risk at closure’. In particular, (a) additional data is needed on the split between preventive and corrective measures implemented by the Member States and (b) the relationship between the ‘estimated future corrections’ and the ‘corrections implemented’ has to be clearly explained and supported by relevant data, firstly at Directorate-General level in the A nnual A ctivity R eport s 20 and secondly at Commission level in the A nnual M anagement and P erformance R eport . 5. Consultation with the Commission’s financial irregularities panel 21 No systemic problems were reported in 2021 by the panel set up pursuant to Article 143 of the Financial Regulation, where it gives the opinion referred to in Article 93 of the Financial Regulation. 6. Mitigating measures for potential conflicts of interest (international internal auditing standards) — Investigation of the European Ombudsman The current Director-General of the Internal Audit Service, Internal Auditor of the Commission, Mr Manfred Kraff, took office on 1 March 2017. Mr Kraff was previously Deputy Director-General and Accounting Officer of the Commission in the Directorate-General for Budget.
In line wit h international audit standards 22 , on 7 March 2017, following his appointment as Director-General and Internal Auditor, Mr Kraff issued instructions on the arrangements to be put in place to mitigate and/or avoid any potential or perceived conflict of interest in Internal Audit Service audit work in relation to his former responsibilities. These arrangements were prolonged in 2018, 2019, 2020, 2021 and in 2022 (until 1 March 2023), through instruction notes to all Internal Audit Service staff issued by Mr Kraff. According to the arrangements, Mr Kraff would not be involved in the supervision of audit work relating to operations for which he was responsible before joining the Internal Audit Service. The supervision of the audit work in such cases ultimately fell/will fall under the responsibility of Mr Jeff Mason, Director in the Internal Audit Service (Directorate B, Audit in Commission, Executive Agencies, EU Agencies and other autonomous bodies II). The arrangements also stated that the Audit Progress Committee would be informed of these instructions and of their implementation and that Mr Mason would refer to the Audit Progress Committee for the assessment of any situation that may be interpreted as impairing Mr Kraff's independence or objectivity. In those cases, Mr Kraff would refrain from any supervision of the audit in question. The arrangements in place were discussed with the Audit Progress Committee at its meeting of March 2018. The committee considered that the measures drawn up by the Internal Audit Service adequately address the risk of conflict of interest in line with the international standards and best practice. The committee also noted with satisfaction that arrangements to ensure organisational independence had been implemented in practice in the relevant audits. The Audit Progress Committee also took note of the continuation of these arrangements during January 2021 (preparatory group) and further noted with satisfaction that these arrangements had been implemented in practice in a number of audits and considered that this was leading practice in the internal audit profession. In the period 2018-2020, during the hearings as part of the reporting year discharge, Mr Kraff presented the arrangements in place to the European Parliament’s Budgetary Control Committee (CONT).
(1) The report does not cover the decentralised European agencies, the European External Action Service or other bodies audited by the Internal Audit Service, which receive separate annual reports.
(2) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU and repealing Regulation (EU, Euratom) N o 966/2012OJ L 193, 30.7.2018.
(3) The audit reports finalis ed in the period 1 February 2021 to 31 January 2022 are included in this report.
(4) Co mmunication to the Commission, Mission Charter of the Internal Audit Service of the European Commission, C(2020)1760 final of 25 March 2020.
(5) For details, see Communication to the Commission, Charter of the Audit Progress Committee of the European Commission, C(2020) 1165 final of 27 February 2020. The Charter of the Audit Progress Committee was updated in 2020 to take account of the 2019—2024 Commission entering into office on 1 December 2019 and changes in the Committee’s membership.
(6) The Internal Audit Service audit universe of the Commission includes in total 50 organisational entities. For some of these entities, more than one final audit, review or consulting rep ort was issued in 2021. See t he Staff Working Document for the detailed overview of entities for which final audit, review or consulting reports were issued.
(7) One important recommendation was rejected by the auditee. Management accepted the residual risk and implemented part of the Internal Audit Service recommendation and no further discussion at Audit Progress Committee preparatory group level was necessary.
(8) One important recommendation was rejected by the auditee. Management accepted the residual risk and implemented part of the Internal Audit Service recommendation and no further discussion at Audit Progress Committee preparatory group level was necessary.
(9) The chart shows the rating of the recommendations at the cut-off date. This may differ from the rating in the original report if actions subsequently taken by the auditee are deemed sufficient by the Internal Audit Service to partly mitigate the risks identified and therefore lead to a downgrading of the rating of the recommendation.
(10) In total, the Internal Audit Service carried out 24 performance and comprehensive audits. For more details see the Staff Working Document .
(11) 15 of the 45 (33%) very important recommendations issued in 2021.
(12) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’)
(13) ‘Audit results’ refers to the Common Audit Service and European Court of Auditors audit results (including audit results extensions), as well as European Anti-Fraud Office’s investigation results (under the form of financial recommendations).
(14) Except for the Directorate-General for European Health Emergency Preparedness and Response Authority (HERA), and for the European Health and Digital executive agency (HaDEA). HERA and HaDEA were set-up during 2021 and therefore no limited conclusions could be provided for these entities. In the case of the advisory service Inspire, Debate, Engage and Accelerate Action (IDEA) no audits were carried out during the 2019-2021 period as no high risks were identified, and therefore no limited conclusions were provided.
(15) Expenditure means the total amount of payments made in 2021 minus the total amount of new prefinancing paid in 2021 plus the total amount of old pre-financing cleared in 2021 as reported by the Commission services in their 2021 A nnual A ctivity R eport s.
(16) In view of the importance of the multi-annual corrective mechanism leading to the amounts at risk at closure, the IAS is carrying out in 2022 a limited review on the reporting of the Commission’s preventive and corrective measures (corrective capacity) in six DGs covering the four policy areas with the highest amounts for these measures.
(17) The ‘risk at payment’ quantifies any errors that remain after preventive measures and payments have been made but before corrective measures have been applied.
(18) The ‘risk at closure’ is the risk estimated when controls are completed and legally no further action can be taken.
(19) The ‘estimated future corrections’ (or ‘estimated corrective measures’) is the amount of expenditure in breach of applicable regulatory and contractual provisions, that the DG conservatively estimates it will identify and correct through controls that will be implemented after the payment is authorised (i.e. not only including those already implemented at the time of reporting (i.e. A nnual A ctivity R eports ) but also those that will be implemented during the next years until the end of the programme).
(20) These key improvements are particularly important in the area of Cohesion as most of the corrections are implemented by Member States. The IAS notes the commitment of the Cohesion DGs to improve the data in this regard.
(21) S ince the entry into application of the new Financial Regulation the functions of all institutions’ financial irregularities panel have been transferred to the Early Detection and Exclusion System Panel referred to in Article 143 of the FR.
(22) The international audit standards, to which the Financial Regulation expressly refers in Article 98 ("Appointment of the Internal Auditor"), state that: ‘If independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment." (IIA-IPPF standard 1130). Moreover, the standards state that: "internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year’ (IIA-IPPF standard 1130.A1).