Annex 4

PILLAR ASSESSMENT REPORT

<AUDITOR'S LETTERHEAD>

[DRAFT, PRE-FINAL OR FINAL] REPORT

[date]

<for the final report this is the date on which the final independent auditor's report is signed; for a draft or pre-final report this is the date on which these reports are sent for consultation>

PILLAR ASSESSMENT

OF [NAME OF THE ENTITY]

Entity subject to assessment: [Entity name] Country: [Country where the entity is established] Auditor: [Audit firm and office responsible for the assessment] Period subject to assessment: [date] to [date] [this should normally be the year (12-month period) ending on the day of the start of the field work (on-site procedures) of the assessment] Dates of assessment fieldwork: [date] to [date]

TABLE OF CONTENTS

Independent Assurance Report 112

1. Executive Summary 117

2. Engagement Context 126

3. Internal Control System 127

4. Accounting System 129

5. Independent External Audit 129

6. Grants 129

7. Procurement 130

8. Financial Instruments 130

9. Exclusion from Access to Funding 131

10. Publication of Information on Recipients 131

11. Protection of Personal Data 131

Annexes 133

INSTRUCTIONS FOR USING THIS MODEL REPORT This model report for a pillar assessment provides a report format and structure for the auditor and includes guidance for the content of the report sections. — All grey shaded text in <Italic> is guidance which should be removed. — All text which is not grey shaded can be used by the auditor for drawing up the report. The auditor can modify text as it sees fit except for the prescribed text of the independent auditor's report. The prescribed text and wording of the independent auditor's assurance report should be respected at all times and not be changed. This instruction page should be removed from the report

INDEPENDENT ASSURANCE REPORT

Pillar assessment

[full name and address of the entity]

We have carried out a pillar assessment (‘assessment’) of [name]; the ‘entity’. The objective of the assessment is to provide reasonable assurance to the European Commission as to whether the entity fulfils the requirements set out in points (a) to (f) of Article 154(4) of the Financial Regulation applicable to the General Budget of the European Commission and Article 29.1 of the Financial Regulation applicable to the European Development Fund with regard to the following pillars:

1. Internal control system

2. Accounting system

3. Independent external audit

4. Grants <remove if not applicable>

5. Procurement <remove if not applicable>

6. Financial instruments (1) <remove if not applicable>

7. Exclusion from access to funding

8. Publication of information on recipients

9. Protection of personal data

The scope of our work and our conclusions for each of the respective pillars are set out below.

Respective responsibilities of the entity's management and the auditor

The entity's management are responsible for ensuring that the systems, controls, rules and procedures connected with the pillars comply with internationally accepted standards and with the criteria set by the European Commission for each pillar. The entity's management is also responsible for providing information, documents and access to systems and entity staff to the auditor insofar as this is necessary and relevant for the purpose of this assessment.

Our responsibility is to assess the systems put into place and the controls, rules and procedures applied by the entity for each pillar against the criteria for each pillar and to report our findings in accordance with the terms of reference for this assessment.

These terms of reference specify that we must carry out our work in accordance with the International Standard for Assurance Engagements 3000 (issued by the International Federation of Accountants) on Assurance Engagements other than Audits or Reviews of Historical Financial Information insofar as this standard can be applied in the specific context of this pillar assessment. This standard requires us to observe applicable ethical standards in the conduct of our work.

Scope of work for all pillars

The scope of our engagement includes an assessment of each pillar and of the systems put in place and controls, rules and procedures applied by the entity.

Depending on the requirements for the pillar concerned our assessment has covered the design or the design and operational effectiveness of the relevant systems, controls, procedures and rules.

Our assessment involved comparing factual information and data relating to systems, controls, rules and procedures against the Commission's criteria. These criteria and the levels of importance (materiality) are set out in Chapter 2.3 of our detailed report.

To determine what is a material weakness or deficiency in systems, controls, rules and procedures we have taken into account the criteria and the levels of importance defined by the Commission as these factors might influence the Commission's decision to entrust budget implementation tasks under indirect management to the entity.

This assessment has primarily looked into the systems, controls, rules and procedures which are in place for the entity's regular operations. The conclusions of this assessment do not relate to specific actions, projects, contracts or agreements, neither present nor future.

Because of its inherent limitations, internal control and other systems, rules and procedures may not necessarily prevent or detect errors. Also, projections of this historic assessment of the design and effectiveness of systems, controls, rules and procedures to future periods are subject to the risk that these systems, controls, rules and procedures may become inadequate because of changes in conditions, or that the degree of compliance with rules and procedures may deteriorate.

We have taken into account all the available evidence presented to us during our fieldwork which we finalised on [date of closing meeting], including the subsequent comments and information of the entity and of the European Commission up to the date of this report.

We believe that the evidence we have obtained is sufficient and appropriate to provide a basis for our conclusions.

PILLAR 1 — INTERNAL CONTROL SYSTEM

The scope of our engagement includes an assessment of whether the entity has set up and ensured the functioning of an effective, efficient and economical internal control system. Consequently the procedures undertaken by us covered the design and the operational effectiveness of the internal control system.

Our work concentrated on the internal control components and controls which the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity has set up and ensured the functioning in all material respects of an effective, efficient and economical internal control system that is in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the internal control system.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity has not set up and ensured the functioning in all material respects of an effective, efficient and economical internal control system that is in accordance with the criteria set by the European Commission.

PILLAR 2 — ACCOUNTING SYSTEM

The scope of our engagement includes an assessment of whether the entity uses an accounting system that provides accurate, complete, reliable and prompt information. The procedures performed by us covered the design and the operational effectiveness of the accounting system.

Our work concentrated on those aspects and components of the accounting system which the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity uses an accounting system that provides in all material respects accurate, complete, reliable and prompt information in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the accounting system.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity does not use an accounting system that provides in all material respects accurate, complete, reliable and prompt information in accordance with the criteria set by the European Commission.

PILLAR 3 — INDEPENDENT EXTERNAL AUDIT

The scope of our engagement includes an assessment of whether the entity is subject to an independent external audit, performed in accordance with internationally accepted auditing standards by an audit service functionally independent of the entity concerned. Consequently the procedures performed by us covered the design of the framework of external audit to which the entity is subject.

Our work concentrated on those aspects and components of the framework for an independent external audit which the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity is subject to an independent external audit, required to be performed in all material respects in accordance with internationally accepted auditing standards by an audit service functionally independent of the entity and in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the framework for an independent external audit.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity is not subject to an independent external audit, required to be performed in all material respects in accordance with internationally accepted auditing standards by an audit service functionally independent of the entity and in accordance with the criteria set by the European Commission.

PILLAR 4 — GRANTS

The scope of our engagement includes an assessment of whether the entity applies appropriate rules and procedures for providing financing from EU funds through grants. Consequently the procedures performed by us covered the design and the operational effectiveness of the grants system.

Our work concentrated on those aspects and components of the grants system which the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity applies appropriate rules and procedures in all material respects for providing financing from EU funds through grants and in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the grants system.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity does not apply appropriate rules and procedures in all material respects for providing financing from EU funds through grants and in accordance with the criteria set by the European Commission.

PILLAR 5 — PROCUREMENT

The scope of our engagement includes an assessment of whether the entity applies appropriate rules and procedures for providing financing from EU funds through procurement. Consequently the procedures performed by us covered the design and the operational effectiveness of the procurement system.

Our work concentrated on those aspects and components of the procurement system which the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity applies appropriate rules and procedures in all material respects for providing financing from EU funds through procurement and in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the procurement system.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity does not apply appropriate rules and procedures in all material respects for providing financing from EU funds through procurement and in accordance with the criteria set by the European Commission.

PILLAR 6 — FINANCIAL INSTRUMENTS (2)

The scope of our engagement includes an assessment of whether the entity applies appropriate rules and procedures for providing financing from EU funds through financial instruments. Consequently the procedures performed by us covered the design and the operational effectiveness of the financial instruments used by the entity.

Our work concentrated on those aspects and components of the financial instruments used by the entity which the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity applies appropriate rules and procedures in all material respects, for providing financing from EU funds through financial instruments and in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the financial instruments used by the entity.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity does not apply appropriate rules and procedures in all material respects for providing financing from EU funds through financial instruments and in accordance with the criteria set by the European Commission.

PILLAR 7 — EXCLUSION FROM ACCESS TO FUNDING

The scope of our engagement includes an assessment of whether the entity applies appropriate rules and procedures for excluding third parties from access to funding.

Consequently the procedures performed by us covered the design and the operating effectiveness of the measures taken by the entity for this purpose.

Our work concentrated on those exclusion grounds and measures taken by the entity that the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity applies appropriate rules and procedures for excluding third parties from access to funding in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the entity's exclusion system.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity does not apply appropriate rules and procedures for excluding third parties from access to funding in accordance with the criteria set by the European Commission.

PILLAR 8 — PUBLICATION OF INFORMATION ON RECIPIENTS

The scope of our engagement includes an assessment of whether the entity makes public information on the recipients of funds in an appropriate and timely manner.

Consequently the procedures performed by us covered the design and the operational effectiveness of the measures taken by the entity for this purpose.

Our work concentrated on those requirements that the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity applies appropriate rules and procedures for making public information on the recipients of funds in an appropriate and timely manner in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the entity's system of publication of information on recipients.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity does not apply appropriate rules and procedures for making public information on the recipients of funds in an appropriate and timely manner in accordance with the criteria set by the European Commission.

PILLAR 9 — PROTECTION OF PERSONAL DATA

The scope of our engagement includes an assessment of whether the entity ensures protection of personal data equivalent to that referred to in Article 5 of the Financial Regulation.

Consequently the procedures performed by us covered the design and the operational effectiveness of the measures taken by the entity for this purpose.

Our work concentrated on those requirements and measures taken by the entity that the Commission considers important and which are detailed in the assessment questionnaires.

Conclusion

<wording to be used for a positive conclusion; remove this part if not applicable>

Overall, in our opinion, based on the work we have performed, the entity applies appropriate rules and procedures for ensuring protection of personal data in accordance with the criteria set by the European Commission.

<wording to be used for an adverse conclusion; remove this part if not applicable>

We refer to our findings as set out in Section 1.3: Summary of Findings of our detailed report which sets out the material weaknesses and deficiencies in the entity's exclusion system.

Overall, in our opinion, because of the material nature of the matters referred to in the preceding paragraph and based on the work we have performed, the entity does not apply appropriate rules and procedures for ensuring protection of personal data in accordance with the criteria set by the European Commission.

Distribution and use

The entity has requested this report and it is intended solely for the information and use of the entity and the European Commission.

Auditors' signature <person or firm or both, as appropriate>.

Name of auditor signing <person or firm or both, as appropriate>.

Auditor's address <office having responsibility for the audit>.

Date of signature <not be used for draft reports. The date when the final report is signed.>

1. EXECUTIVE SUMMARY

1.1. Conclusions

A summary of our conclusions for each pillar is provided below.

PILLAR CONCLUSION 1. Internal control system YES/NO Has the entity set up and ensured the functioning in all material respects of an effective, efficient and economical internal control system and in accordance with the criteria set by the European Commission? 2. Accounting system YES/NO Does the entity use an accounting system that provides in all material respects accurate, complete, reliable and prompt information that is in accordance with the criteria set by the European Commission? 3. Independent external audit YES/NO Is the entity subject to an independent external audit, required to be performed in all material respects in accordance with internationally accepted auditing standards by an audit service functionally independent of the entity and in accordance with the criteria set by the European Commission? 4. Grants YES/NO/NA Does the entity apply appropriate rules and procedures for providing financing from EU funds through grants and in accordance with the criteria set by the European Commission? 5. Procurement YES/NO/NA Does the entity apply appropriate rules and procedures in all material respects for providing financing from EU funds through procurement and in accordance with the criteria set by the European Commission? 6. Financial instruments YES/NO/NA Does the entity apply appropriate rules and procedures in all material respects for providing financing from EU funds through financial instruments and in accordance with the criteria set by the European Commission? In particular, does the entity apply appropriate rules and procedures with reference to: Credit risk management system and use of an internal risk rating system? YES/NO/NA Tax avoidance and non-cooperative jurisdictions? YES/NO/NA Anti-money laundering and countering terrorism financing? YES/NO/NA 7. Exclusion from access to funding YES/NO/NA Does the entity apply appropriate rules and procedures for excluding third parties from access to funding through procurement, grants and/or financial instruments? YES/NO/NA 8. Publication of information on recipients YES/NO/NA Does the entity make public information on the recipients of funds appropriately and within a reasonable timeframe? YES/NO/NA 9. Protection of personal data YES/NO/NA Does the entity ensure protection of personal data equivalent to that referred to in Article 5 of the Financial Regulation (3)? YES/NO/NA

1.2. Roadmap

<Suggested length of the roadmap: maximum 2 pages>

We have concluded that the entity does not fully comply with the requirements of pillar(s) [specify pillar(s)].

We have found significant deficiencies and weaknesses in … <briefly describe the main weaknesses and deficiencies for the pillar(s) concerned in accordance with the findings in Section 1.3>.

We have made a number of critical recommendations to remedy these key weaknesses <briefly describe the critical recommendations for the pillar(s) concerned in accordance with the recommendations in Section 1.3>.

We suggest that the entity implements these recommendations for it to become eligible for being entrusted with budget implementation tasks under indirect management by the European Commission.

For this purpose we propose an action plan, i.e. a roadmap that includes a timetable to address and remedy the deficiencies and weaknesses. This roadmap and accompanying timetable for implementing our proposed measures has been discussed and agreed with the entity <The roadmap should, to the extent possible, be agreed with the entity prior to the issuing of the auditor's final report. If this is not possible the reasons should be clearly explained>.

Roadmap

<Describe here the roadmap by addressing the following key aspects for each pillar concerned:

— a brief narrative of the main findings, i.e. material weaknesses or deficiencies in systems, controls, procedures and rules;

— a brief narrative of the proposed action plan to remedy these weaknesses or deficiencies. The action plan should clearly set out which proposed measures (i.e. critical recommendations) will be implemented and how they will be implemented and a clear and realistic timetable.>

1.3. Summary of findings and recommendations

See below a summary of our findings and recommendations for each pillar.

Findings

The main findings are the ones that relate to material weaknesses or deficiencies in systems, controls, rules and procedures. ‘Material’ means that we consider these factors to be so important for the Commission that they might influence the Commission's decision to entrust budget implementation tasks under indirect management to the entity. Therefore, where we have found material findings for a pillar it has led us to express a negative conclusion for it.

The main findings also include cases where several findings which taken individually do not relate to a material weakness or deficiency but which taken together involve a finding of material weakness or deficiency. The combined impact of such findings is considered so important (i.e. material) that it has led us to conclude that the entity does not meet the requirements for the pillar concerned (i.e. the conclusion is ‘no’).

The other findings are all non-material findings which we believe should be brought to the entity's attention. These findings relate to weaknesses and deficiencies in systems, controls, rules and procedures which, individually or together, carry a less immediate level of risk of the objectives for the pillar concerned not being achieved.

Recommendations

The critical recommendations relate to material weaknesses and deficiencies in systems, controls, rules or procedures and to cases where the European Commission's criteria and/or internationally accepted standards for pillars are not (regularly) complied with.

Our other recommendations relate to all other findings which are not of a material nature. In these cases the weaknesses and deficiencies in systems, controls, rules or procedures have no major and immediate impact on the objectives of these systems, controls, rules or procedures. Nevertheless, we believe that it is relevant for the entity to implement the suggested measures to have the opportunity to improve systems, controls, rules or procedures and to achieve greater effectiveness and/or efficiency.

Each of our recommendations is detailed in Chapters 3 to 8.

We suggest that the entity implements our critical recommendations as set out in the roadmap in Section 1.2 of this report.

PILLAR 1 — INTERNAL CONTROL SYSTEM Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 3.3.1 respectively Section 3.3.2.





PILLAR 2 — ACCOUNTING SYSTEM Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 4.3.1 respectively Section 4.3.2.





PILLAR 3 — INDEPENDENT EXTERNAL AUDIT Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 5.3.1 respectively Section 5.3.2.





PILLAR 4 — GRANTS Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 6.3.1 respectively Section 6.4.2.





PILLAR 5 — PROCUREMENT Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 7.3.1 respectively Section 7.3.2.





PILLAR 6 — FINANCIAL INSTRUMENTS Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 8.3.1 respectively Section 8.3.2.





PILLAR 7 — EXCLUSION FROM ACCESS TO FUNDING Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 9.3.1 respectively Section 9.3.2.





PILLAR 8 — PUBLICATION OF INFORMATION ON RECIPIENTS Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 10.3.1 respectively Section 10.3.2.





PILLAR 9 — PROTECTION OF PERSONAL DATA Main findings/critical recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Other findings/other recommendations No Description of the finding/recommendation 1 Finding: <short description of the finding, maximum 2 lines> Recommendation: <short description of the recommendation, maximum 2 lines> 2 3 Etc. Note: The number and description of the finding/recommendation must correspond with the detailed finding/recommendation in Section 11.3.1 respectively Section 11.3.2.

2. ENGAGEMENT CONTEXT

2.1. Context

Article 154 of the Financial Regulation (4) (‘FR’) applicable to the general budget of the European Union (‘EU’) sets out the methods of implementing the budget, including ‘indirect management’. Under indirect management, the Commission can entrust budget implementation tasks to the countries, organisations and bodies (further referred to as ‘entities’) indicated in Article 62 of the FR. The following entities may be concerned:

— third countries or the bodies they have designated e.g. Ministry of Interior, Kingdom of Cambodia;

— international organisations and their agencies e.g. United Nations Development Programme (UNDP);

— public law bodies e.g. Kreditanstalt für Wiederaufbau (KfW);

— bodies governed by private law but with a public service mission, to the extent that they provide adequate financial guarantees e.g. Cassa Depositi e Prestiti (CDP).

When such entities manage EU funds, they are required to guarantee a level of protection of the EU's financial interests equivalent to that required under the FR. More specifically, they must meet requirements with regard to nine ‘pillars’. These pillars relate to:

(1) the internal control system;

(2) the accounting system;

(3) an independent external audit;

as well as rules and procedures for:

(4) providing financing from EU funds through grants;

(5) procurement;

(6) financial instruments (5)

and also:

(7) exclusion from access to funding;

(8) publication of information on recipients;

(9) protection of personal data.

Entities wishing to work with EU funds under the indirect management mode must therefore undergo a comprehensive pillar assessment. Based on the results of the pillar assessment, the Commission will decide whether: (i) it can entrust budget implementation tasks to the entity; and (ii) it can conclude specific agreements (i.e. indirect management delegation agreements) with the entity.

2.2. Description of the entity subject to the assessment

<Provide a description of the entity. Suggested maximum: 2 pages.

Main features and characteristics of the entity, organisational structure, nature of activities and operations, etc.>

2.3. Criteria used for the assessment and materiality

For each pillar there are three levels of criteria that have been defined by the European Commission through the formulation of (key) questions in Annex 2 and 2a of the terms of reference (Assessment questionnaire and criteria and Assessment questionnaire). To determine what is a material weakness or deficiency in systems, controls, rules and procedures, we have taken into account the criteria and the levels of importance (i.e. the scoring thresholds) defined by the Commission, as these factors might influence the Commission's decision to entrust budget implementation tasks under indirect management to the entity.

Level 1 (Financial Regulation)

For each pillar there is one overarching level 1 question (in Annex 2 Assessment questionnaire and criteria) defined on the basis of the Financial Regulation. Only two answers are possible:

— The answer to the question at level 1 is ‘yes’. This means that the entity complies with the requirements for the pillar concerned. Our conclusion is positive, which is equivalent to an ‘unqualified opinion’.

— The answer to the question at level 1 is ‘no’. This means that the entity does not comply with the requirements of the pillar concerned. In this case our conclusion is negative, which is equivalent to an ‘adverse opinion’ under international standards.

Level 2 (Pillar key components)

Key questions at level 2 relate to criteria which the Commission considers essential. For this purpose, key questions and criteria are defined for the key components of each pillar. Components are essentially ‘sub-pillars’ which in turn are composed of blocks of questions in Annex 2a Assessment questionnaire.

We have applied professional judgement to attribute a score on a scale of 0 to 10 to each level 2 component in Annex 2 Assessment questionnaire and criteria based on the information and evidence we have obtained in Annex 2a .

Level 3 (Assessment questionnaire with blocks of questions)

Annex 2a Assessment questionnaire includes blocks of questions which relate to the pillars' key components at level 2. These blocks of detailed questions have guided us and are basically non-exhaustive examples. This means that we can — but do not necessarily have to — use (all) these (blocks of) questions to determine a score for each component at level 2.

We have formulated additional questions and performed additional procedures and tests as we deemed necessary or appropriate. We have fully applied our professional judgement for all questions in Annex 2a to attribute scores to the pillars' key components at level 2.

3. INTERNAL CONTROL SYSTEM

3.1. Description of the internal control system

<Describe the main features of the entity's internal control system. Suggested maximum: 2 pages>

3.2. Summary of work performed and criteria used for the assessment

<Provide a summary description of the work, i.e. procedures and tests performed to assess the internal control system pillar. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

3.3. Findings and recommendations

Our detailed findings and recommendations are set out below.

<The use of the table format below is compulsory and it must be respected at all times>

3.3.1. Main findings and critical recommendations

Finding/Rec. No: [number] Title: [short description of the finding and recommendation] Description of the finding: [describe the finding in detail, covering facts, criteria, cause and impact] Description of the recommendation: [describe the recommendation in detail] Comments from the entity: [state whether the entity agrees or disagrees with the finding/recommendation and describe the entity's comments] Comments from the Commission: [Describe the Commission comments] Further comments of the auditor: [complete only if the entity does not agree with the auditor's finding/recommendation despite the auditor still believing that the finding/recommendation is valid. In that case, the auditor should rebut the entity's comments here and justify why the finding is maintained]

3.3.2. Other findings and recommendations

Finding/Rec. No: [number] Title: [short description of the finding and recommendation] Description of the finding: [describe the finding in detail, covering facts, criteria, cause and impact] Description of the recommendation: [describe the recommendation in detail] Comments from the entity: [state whether the entity agrees or disagrees with the finding/recommendation and describe the entity's comments] Comments from the Commission: [Describe the Commission's comments] Further comments of the auditor: [complete only if the entity does not agree with the auditor's finding/recommendation despite the auditor still believing that the finding/recommendation is valid. In that case, the auditor should rebut the entity's comments here and justify why the finding is maintained]

4. ACCOUNTING SYSTEM

<See Chapter 3: Internal Control System. The same structure and content should be used.>

4.1. Description of the accounting system

[…]

4.2. Summary of work performed and criteria used for the assessment

<Provide a summary description of the work, i.e. procedures and tests performed to assess the accounting pillar. Briefly describe the criteria used to assess this Pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

4.3. Findings and recommendations

Our detailed findings and recommendations are set out below.

i. Main findings and critical recommendations […]

ii. Other findings and recommendations […]

5. INDEPENDENT EXTERNAL AUDIT

<See Chapter 3: Internal Control System. The same structure and content should be used.>

a) Description of the framework for independent external audit […]

b) Summary of work performed and criteria used for the assessment <Provide a summary description of the work, i.e. procedures and tests performed to assess the independent external audit pillar. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

c) Findings and recommendations Our detailed findings and recommendations are set out below. i. Main findings and critical recommendations […] ii. Other findings and recommendations […]

6. GRANTS

<See Chapter 3: Internal Control System. The same structure and content should be used.>

a) Description of the grants system […]

b) Summary of work performed and criteria used for the assessment <Provide a summary description of the work, i.e. procedures and tests performed to assess the grants pillar. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

c) Findings and recommendations Our detailed findings and recommendations are set out below. i. Main findings and critical recommendations […] ii. Other findings and recommendations […]

7. PROCUREMENT

<See Chapter 3: Internal Control System. The same structure and content should be used.>

a) Description of the procurement system […]

b) Summary of work performed and criteria used for the assessment <Provide a summary description of the work, i.e. procedures and tests performed to assess the procurement pillar. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

c) Findings and recommendations Our detailed findings and recommendations are set out below. i. Main findings and critical recommendations […] ii. Other findings and recommendations […]

8. FINANCIAL INSTRUMENTS (6)

<See Chapter 3: Internal Control System. The same structure and content should be used.>

a) Description of the financial instruments […]

b) Summary of work performed and criteria used for the assessment <Provide a summary description of the work, i.e. procedures and tests performed to assess the financial instruments pillar. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

c) Findings and recommendations Our detailed findings and recommendations are set out below. i. Main findings and critical recommendations […] ii. Other findings and recommendations […]

9. EXCLUSION FROM ACCESS TO FUNDING

<See Chapter 3: Internal Control System. The same structure and content should be used.>

a) Description of the system used for excluding recipients from access to funding […]

b) Summary of work performed and criteria used for the assessment <Provide a summary description of the work, i.e. procedures and tests performed to assess the pillar on exclusion from access to funding. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

c) Findings and recommendations Our detailed findings and recommendations are set out below. i. Main findings and critical recommendations […] ii. Other findings and recommendations […]

10. PUBLICATION OF INFORMATION ON RECIPIENTS

<See Chapter 3: Internal Control System. The same structure and content should be used.>

a) Description of the system used for publishing information on recipients […]

b) Summary of work performed and criteria used for the assessment <Provide a summary description of the work, i.e. procedures and tests performed to assess the pillar on publication of information on recipients. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

c) Findings and recommendations Our detailed findings and recommendations are set out below. i. Main findings and critical recommendations […] ii. Other findings and recommendations […]

11. PROTECTION OF PERSONAL DATA

<See Chapter 3: Internal Control System. The same structure and content should be used.>

a) Description of the system used for ensuring the protection of personal data […]

b) Summary of work performed and criteria used for the assessment <Provide a summary description of the work, i.e. procedures and tests performed to assess the pillar on the protection of personal data. Briefly describe the criteria used to assess this pillar. The auditor may refer to Chapter 2.3 and to the completed Assessment questionnaire and criteria in Annexes 2 and 3.>

c) Findings and recommendations Our detailed findings and recommendations are set out below. i. Main findings and critical recommendations […] ii. Other findings and recommendations […]

(1) Reference to financial instruments is deemed to include budgetary guarantees.

(2) This includes budgetary guarantees, taxation and AML/CTF requirements. Please provide conclusions for each sub-section (6a, 6b, 6c), in addition to general conclusions for the overall pillar.

(3) Without prejudice to Regulations (EU) 2018/1725 and (EU) 2016/679.

(4) Regulation (EU, Euratom) 2018/1046.

(5) A reference to ‘financial instruments’ is deemed to also include budgetary guarantees.

(6) Including budgetary guarantees.