EUROPEAN COMMISSION Brussels, 8.6.2021 COM(2021) 292 final REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS





















Annual report to the Discharge Authority on internal audits carried out in 2020 {SWD(2021) 132 final}



Table of Contents 1.Objectives and scope of the report 2.The Internal Audit Service mission: accountability, independence and objectivity 3.Overview of audit work 3.1.Implementation of the 2020 audit plan 3.2.Statistical data on Internal Audit Service recommendations 4.Conclusions based on the audit work performed in 2020 4.1.Conclusion on performance audits 4.1.1.Data and information management 4.1.2.Data protection 4.1.3.Supervision strategies for the implementation of programmes by third parties 4.1.4.Control strategies for selected Directorates-General and services 4.1.5.Human resource management processes 4.1.6.Reviews assessing the implementation of the new internal control framework in the Commission 4.1.7.Other processes 4.2.Internal Audit Service limited conclusions 4.3.Overall opinion on the Commission’s financial management 5.Consultation with the Commission’s financial irregularities panel 6.Mitigating measures for potential conflicts of interest (international internal auditing standards) — Investigation of the European Ombudsman

1.Objectives and scope of the report This report informs the European Parliament and Council, as part of the discharge procedure, about internal audits carried out in 2020 by the Internal Audit Service of the European Commission in the Commission Directorates-General, services and executive agencies. It contains: (i) a summary of the number and type of internal audits carried out; (ii) a synthesis of the recommendations made; and (iii) the action taken on those recommendations. In accordance with Articles 118(8) and 247 of the Financial Regulation, the Commission forwards the report to the European Parliament and to the Council. It is based on the report drawn up in accordance with Article 118(4) of the Financial Regulation by the Commission’s Internal Auditor on Internal Audit Service audits and consulting reports completed in 2020. 2.The Internal Audit Service mission: accountability, independence and objectivity The mission of the Internal Audit Service is to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight. The Internal Audit Service helps the Commission accomplish its objectives by bringing a systematic, disciplined approach in order to evaluate and improve the effectiveness of risk management, control and governance processes. Its tasks include assessing and making appropriate recommendations to improve the risk management, control and governance processes to achieve the following three objectives: (i) promoting appropriate ethics and values within the organisation; (ii) ensuring effective organisational performance management and accountability; and (iii) effectively communicating risk and control information to appropriate areas of the organisation. In doing this, the Internal Audit Service aims to promote a culture of efficient and effective management within the Commission and its departments. The independence of the work of the Internal Audit Service is enshrined in the Financial Regulation and its mission charter as adopted by the Commission. This charter stipulates that, to ensure objectivity in their judgement and avoid conflict of interest, Internal Audit Service auditors must preserve their independence in relation to the activities and operations they review. If their objectivity is impaired in fact or in appearance, the details of the impairment should be disclosed. If the Internal Auditor considers it necessary, he/she may address himself/herself directly to the President of the Commission and/or the College. The Internal Audit Service performs its work in accordance with the Financial Regulation, the International Standards for the Professional Practice of Internal Auditing, and the Code of Ethics of the Institute of Internal Auditors. The Internal Audit Service reports — and is accountable functionally — to the Audit Progress Committee. The Internal Audit Service: (i) reports to the Audit Progress Committee significant issues arising from its audits and potential improvements to the audited processes; (ii) provides an annual overall opinion on the state of financial management in the Commission; and (iii) reports (at least annually) on its mission and performance, as set out in its annual audit plan. This reporting includes significant risk exposures, control issues, corporate governance issues and other matters. The Audit Progress Committee assists the College of Commissioners in fulfilling its obligations under the Treaties, the Financial Regulation and other statutory instruments. It does this by: (i) ensuring the independence of the Internal Audit Service; (ii) monitoring the quality of internal audit work; (iii) ensuring that internal and external audit recommendations are properly taken into account by the Commission services; and (iv) ensuring that these recommendations receive appropriate follow-up. In this way, the Audit Progress Committee helps improve the Commission’s effectiveness and efficiency in achieving its goals. The Audit Progress Committee also facilitates the College’s oversight of the Commission’s governance, risk management, and internal control practices. The Internal Audit Service does not audit Member States’ systems of control over the EU funds. Such audits reach down to the level of individual beneficiaries, and are carried out by Member States’ internal auditors, national audit authorities, other Commission Directorates-General and the European Court of Auditors. However, the Internal Audit Service does audit measures taken by the Commission to supervise and audit: (i) bodies in Member States; and (ii) other bodies which are responsible for disbursing EU funds, such as the United Nations. As provided for in the Financial Regulation, the Internal Audit Service can carry out these duties on the spot, including in the Member States. 3.Overview of audit work 3.1.Implementation of the 2020 audit plan The Internal Audit Service implemented the 2020 audit plan in the context of the COVID-19 pandemic, with business continuity arrangements in place as of mid-March 2020, in line with the Commission arrangements at corporate level. Despite the challenges brought by the exceptional 2020 circumstances, the Internal Audit Service completed 137 ‘engagements’ (audits, consulting, follow-ups and reviews), as well as one risk assessment, and issued 140 reports (including follow-up notes and one management letter). This was achieved by using the digitalisation opportunities available in the Commission, with tools supporting efficient and effective remote auditing processes. A breakdown of the types of engagements and reports completed is contained in the charts below. By the cut-off date of 31 January 2021, 95% of the updated 2020 audit plan had been implemented (i.e. 100% of the assurance type engagements planned to be completed in 2020, while the finalisation of 2 consulting engagements was reprioritised and postponed to 2021). This audit plan included audits in the Commission and executive agencies . The initial 2020 plan contained 43 audit engagements (audits, reviews and consulting engagements, but excluding follow-ups) planned to be completed by the cut-off date of 31 January 2021. The plan contained 37 additional engagements planned to start before 31 January 2021 and to be completed after that date. The 2020 plan was updated mid-year. The Audit Progress Committee took both the initial and updated plans into consideration. In 2020, the Internal Audit Service also carried out in-depth risk assessments in the various Directorates-General and services. Based on the results of these assessments, the 2021-2023 strategic audit plan as regards the Commission was adopted by the internal auditor. The Internal Audit Service plans its work on the basis of a risk assessment and a capacity analysis. This is required by its charter and international standards and helps to ensure efficient and effective implementation of the audit plan. Its implementation is regularly monitored and adjusted as necessary. Source: European Commission, Internal Audit Service

3.2.Statistical data on Internal Audit Service recommendations The figure below shows the number of recommendations the Internal Audit Service issued in 2020. Source: European Commission, Internal Audit Service In 2020, the auditees accepted all of the Internal Audit Service’s 185 recommendations. In all cases, the auditees drafted action plans, which they then submitted to the Internal Audit Service, who in turn assessed the plans as being satisfactory. Over the period 2016-2020, 725 (72%) out of a total of 1 010 (partially) accepted recommendations made by the Internal Audit Service were assessed by the auditees as implemented on the cut-off date of 31 January 2021. This leaves a total of 285 recommendations (28%) that are still open. Source: European Commission, Internal Audit Service Of these 285 open recommendations, 5 are rated ‘critical’, 83 ‘very important’, and 76 are overdue (i.e. not implemented by the originally agreed implementation date). These overdue recommendations represent 7.5% of the total of 1 010 (partially) accepted recommendations. Of these 76 overdue recommendations, 6 very important ones are classified as long overdue (a recommendation is long overdue when it is still open more than 6 months after the original implementation date). These very important long overdue recommendations represent 0.6% of the total number of critical and very important accepted recommendations in the period 2016-2020 (compared to 0.3% in the previous reporting period). Source: European Commission, Internal Audit Service Overall, the Internal Audit Service considers the implementation of its recommendations to be satisfactory and comparable to previous reporting periods. This state of play indicates that the Commission services are diligent in implementing the critical and very important recommendations, thereby mitigating the risks identified by the Internal Audit Service. Nevertheless, attention should be paid to the individual recommendations rated very important which are long overdue. Part 3 of the annex to this report summarises these very important and long overdue recommendations. A report specifically on the implementation of internal audit recommendations has been drawn up and sent to the Audit Progress Committee. 4.Conclusions based on the audit work performed in 2020 4.1.Conclusion on performance audits To contribute to the Commission’s performance-based culture and its greater focus on value for money, the Internal Audit Service carried out two types of audits in 2020: performance audits and comprehensive audits covering important aspects of performance. They were included in the Internal Audit Service’s 2019-2021 strategic audit plan. In line with its methodology and best practices, the Internal Audit Service approached performance in an indirect way. It does so by examining whether and how management has set up control systems to assess and provide assurance on the performance (efficiency and effectiveness) of its activities. With this approach, it aims to ensure that Directorates-General and services have developed appropriate performance frameworks, performance measurement tools, key indicators and monitoring systems. The following sections set out the Internal Audit Service’s conclusions on the various aspects of performance it focused on in the audits it carried out in 2020. 4.1.1.Data and information management Data are a strategic asset for a public sector organisation. EU policies and the implementation of EU programmes are increasingly data-driven. Policymakers use quantified evidence to make informed decisions. Data are also used to demonstrate the EU budget’s performance and the progress made towards achieving the objectives of its spending programmes. Across the Commission services, data should be widely available and shared where appropriate, to improve cost-effectiveness. At the same time, the Commission must ensure full compliance with legal and other confidentiality requirements and guarantee a high level of security for sensitive information. The need to preserve high privacy, security, safety and ethical standards without impinging on the flow and wide use of data is an integral part of the political guidelines and underlined in the working methods of the von der Leyen Commission.

In this challenging context, the Internal Audit Service carried out a series of audits covering different aspects of data management. The results of these audits clearly indicate that significant improvements are necessary in this area going forward, with a number of very important recommendations issued in 2020 being related to data management. The data, information and knowledge management audit assessed the effectiveness of the Commission’s data, information and knowledge management strategy. It concluded that the Commission should set up a dedicated strategy and structure with the aim of: (1) improving the way data, information and knowledge are gathered, managed, shared and preserved; and (2) developing new opportunities for collaborative working. The Internal Audit Service acknowledged that within the boundaries of the current strategy and governance set-up, important steps had been taken to set priorities, coordinate and manage the activities in the data, information and knowledge management area. However, there is a need for proportionate improvements in key areas that would enable the Commission to have a data, information and knowledge management strategy fully aligned with its political objectives and priorities, to enhance the oversight role of the governing body (the Information Management Steering Board) and to ensure effective data, information and knowledge management. The proposed improvements aim at complementing the existing framework, to better reply to the challenges and changes that the implementation of a fully data-driven Commission brings along. A related issue of alignment with Commission-wide priorities and objectives was identified in the audit on the Joint Research Centre’s work in support of EU policy and knowledge management. The Joint Research Centre is the European Commission’s science and knowledge service. Considering that one of its main objectives is to support EU policies with the highest quality of independent scientific evidence throughout the whole policy cycle in a variety of areas, adequate data, information and knowledge management is critical success factor for the Centre. Although policy support and knowledge management processes are efficiently implemented to enable the Centre to mobilise the available expertise to provide timely high quality deliverables, which satisfy the client’s policy support needs, there is a significant (very important) weakness in the design of the processes affecting their effective implementation. The Commission-wide identification of policy support needs at corporate and Directorate-General level should be significantly strengthened to enable more effective prioritisation of the Centre’s activities, in line with the Commission’s priorities. Another key aspect of data management is the safeguarding of information and the preservation of the confidentiality of the data managed. This is all the more important for classified information, as the unauthorised disclosure of such information may significantly harm the interests of the EU or one or more of its Member States. In the audit on Horizon 2020 grant management in the Research Executive Agency, the auditors found that although the ex ante controls on Horizon 2020 payments and the processes for the closure of Horizon 2020 projects were effective, weaknesses existed in the management of projects involving EU-restricted information, ultimately resulting in security breaches. The Commission’s digital strategy is complementary to its data, information and knowledge management strategy. The digital strategy sets out a vision for a digitally transformed, user-centred and data-driven administration. One of the enablers of this transformation is cloud computing. Public cloud computing aims to bring benefits such as business agility, ease of use, data availability, cost savings and sustainability. However, adequate data protection should also be a key consideration when adopting information technology solutions in the cloud. In the audit on the management of public cloud services, the Internal Audit Service recognised the efforts made in recent years to develop a vision of cloud-based information technology infrastructure solutions. While acknowledging the steps already taken by the Commission to put in place appropriate arrangements for the use of public ‘infrastructure as a service’ and ‘platform as a service’ cloud services, the Internal Audit Service concluded that the governance and security of these cloud security services needed to be significantly enhanced to ensure that they achieve their objectives while reducing risk exposure. 4.1.2.Data protection Two audits assessed the efficiency and effectiveness of the internal control systems that enable the Commission Directorates-General concerned to demonstrate compliance with Regulation (EU) 2018/1725 on the protection of personal data. Both audits revealed significant weaknesses in the internal control systems in place. This exposes the Commission to reputational risks, which may affect the achievement of its general objective to become a ‘modern, high-performing and sustainable European Commission’, in particular because of its key role in the adoption of data protection regulations in Europe. 1.The first audit covered five Directorates-General and services at corporate and local level and gave rise to eight very important recommendations in total. The Internal Audit Service concluded that, although the Commission has made good progress in putting in place control systems enabling the Directorates-General and services to demonstrate compliance with the applicable legal base, there remains a number of significant improvements needed to reinforce the effectiveness and efficiency of these systems in the move towards achieving full compliance. These concern: (1) the general framework governing data protection aspects; (2) the role and actions of the data protection officer to support the data protection process across the Commission; and (3) the use of targeted measures to improve compliance with key provisions of Regulation (EU) 2018/1725. These improvements should be seen as complementary measures aimed at enhancing the existing governance structures and processes relating to data protection issues, while respecting the principles of the Commission’s current decentralised model, which remain valid. 2.The second audit was conducted in the Directorate-General for Education, Youth, Sport and Culture that is responsible for programmes such as Erasmus+ and the European Solidarity Corps, and gave rise to one critical and four very important recommendations. In the context of their participation in these programmes, a high number of persons provide some personal data to the Directorate-General. As delegated data controller, the Directorate-General processes these personal data and transmits them to National Agencies in EU Member States and third countries, which are in charge of implementing the projects at national level. Together with the National Agencies, which act as data processors, the Directorate-General for Education, Youth, Sport and Culture has to ensure that the data received from the participants to the programmes are adequately protected by all actors having access to these data. The Internal Audit Service found that: (1) the Directorate-General introduced certain elements related to personal data protection in the guiding documents and agreements that govern the programmes; and (2) personal data protection is explicitly mentioned in the National Agencies’ management declarations. These elements are building blocks of the control system for handling personal data, however they are not always adequately implemented and more specifically they do not constitute the safeguards, as required by Regulation (EU) 2018/1725, for international data transfers outside the EU/European Economic Area countries. The internal control system in place for the protection of the personal data of beneficiaries and participants in the Erasmus+ and European Solidarity Corps programmes was not found to be effective in ensuring compliance with the Regulation’s key provisions. A crosscutting issue that emerged from these two audits concerns the transfer of personal data to third countries. The invalidation of the EU-US Privacy Shield (the ‘Schrems II judgement’) poses concrete challenges for the services transferring personal data to third countries or using the cloud. In response to an order of the European Data Protection Supervisor, the Commission took stock of more than 600 processing records that might concern problematic international transfers of personal data. The critical recommendation addressed by the Internal Audit Service to the Directorate-General for Education, Youth, Sport and Culture was related to the transfer of personal data to third countries. Following the action taken by the Directorate-General, the Internal Audit Service performed, after the cut-off date of this annual report, an assessment of some of the measures implemented by the auditee. The Internal Audit Service concluded that the Directorate-General for Education, Youth, Sport and Culture partially mitigated the risks and, as a result, downgraded the risk level for two recommendations (from ‘critical’ to ‘very important’ and from ‘very important’ to ‘important’). Finally, in another audit related to the management of experts in Horizon 2020 grants, one issue was found on the processing of the experts’ personal data, giving rise to a very important recommendation. 4.1.3.Supervision strategies for the implementation of programmes by third parties Authorising officers have to set up adequate and effective strategies and activities for supervising and monitoring the delegated entities' effective implementation of the programmes and protection of the EU budget, and for promptly addressing any identified potential difficulties. In previous years, the Internal Audit Service performed several audits of the supervision arrangements in place in Directorates-General and services for the implementation of programmes (and/or policies) by third parties. It frequently identified weaknesses in the effectiveness of the supervision strategies. In its overall opinion on financial management, the Internal Audit Service formulated an emphasis of matter for 6 years in a row (2015 to 2020) on the supervision strategies for third parties implementing policies. In 2020, three audits focused on EU contributions implemented via indirect management. The multi-entity audit on pillar assessments revealed significant weaknesses in the internal control system for delegating funds under indirect management, at corporate and local level in a number of Directorates-General of the external action family. Even though the Commission has undertaken serious efforts to put in place an effective system for pillar assessments and is continuing to invest in further developing a corporate approach to increase a coherent implementation and reduce the high inherent risks, the system needs significant strengthening. This is necessary to ensure a level of protection of the EU budget that is equivalent to when the budget is implemented directly. The significant weaknesses identified concern (1) agreements signed with the United Nations Secretariat and related entities without prior positive pillar assessment and without taking appropriate supervisory measures (this observation led to critical recommendations being formulated by the Internal Audit Service to the auditees); (2) incorrect information on the status of pillar assessments which led the Directorates-General and services to sign agreements with entities without prior positive pillar assessment and without taking appropriate supervisory measures; (3) inadequate corporate oversight; (4) inadequate monitoring of substantive system changes of pillar-assessed entities; and (5) insufficient involvement by the Directorates-General and services in the pillar assessments performed by third parties. Based on these observations, the Internal Audit Service issued overall 4 critical and 15 very important recommendations in total to the five Directorates-General concerned. Details of them are in the annex to this report. At the same time, the other two audits of (1) indirect management with entrusted entities in the Directorate-General for International Partnerships and the Directorate-General for Neighbourhood and Enlargement Negotiations and (2) the supervision of the implementation of the 2014-2020 programme for the European geostationary navigation overlay service in the Directorate-General for Defence Industry and Space painted a generally positive picture of the audited processes. These audits did not identify any critical or very important issues. 4.1.4.Control strategies for selected Directorates-General and services Directorates-General and services must ensure the legality, regularity and sound financial management of programmes and projects financed using the EU budget. Authorising officers by delegation design a control strategy. This strategy encompasses ex ante and ex post controls that are the key building blocks supporting the annual declaration of assurance. In 2020, the Internal Audit Service performed various audits in this area. They included: (1) an audit on the design and implementation of the control strategy in the Consumers, Health; Agriculture and Food Executive Agency; (2) an audit on the effectiveness of the design and implementation of the ex post control strategy for the Connecting Europe Facility in the Innovation and Networks Executive Agency; (3) an audit on the Horizon 2020 ex post audit strategy in the Directorate-General for Research and Innovation; and (4) an audit on ex post controls in the Education, Audiovisual and Culture Executive Agency. The 2020 audits paint a generally positive picture, even though two of the four audits revealed the following weaknesses. The Common Implementation Centre is administratively part of the Directorate-General for Research and Innovation and provides audit services for the various Horizon 2020 implementing bodies by way of financial (ex post) audits, carried out either by its own auditors or by external audit firms, to verify the eligibility of costs declared by beneficiaries. The Internal Audit Service identified a weakness in the design of the ex post audit strategy for Horizon 2020 and issued two very important recommendations. Although in the Innovation and Networks Executive Agency, the ex post control strategy was found to be overall adequately designed and effectively implemented, one weakness concerned the assessment of amendments of procurement contracts during ex post audits and the documentation of work performed by the on-the spot auditors.

4.1.5.Human resource management processes In recent years, the Internal Audit Service has carried out various audits of human resource management processes in several Commission Directorates-General and services. Issues identified in previous years were also identified this year in a human resources audit of Eurostat. The Internal Audit Service identified weaknesses in human resources strategic management, human resources planning and human resources monitoring and reporting. It recommended Eurostat take targeted action in these areas. 4.1.6.Reviews assessing the implementation of the new internal control framework in the Commission In 2019, the Internal Audit Service launched a series of limited reviews in six Directorates-General and services to assess the implementation of the Commission’s new internal control framework. In 2020, this initiative was continued with three additional limited reviews on the same topic, focusing on the assessment process, not the internal control system itself. The generally satisfactory results observed in 2019 were confirmed in 2020, with only one very important recommendation issued. These confirm that the Commission’s assessment processes of the internal control systems are not a high risk area. 4.1.7.Other processes Several audits assessed performance aspects of other processes implemented by various Directorates-Generals and services. Most of them did not identify any significant performance issues. Only in a few cases did they identify a significant issue. External experts are key players in the Horizon 2020 grant management process during the evaluation of proposals and project implementation. The Internal Audit Service found that although the Directorates-General and Executive Agencies have in general set up and implemented adequate and effective internal control systems for the expert management process, weaknesses remain in the effectiveness of monitoring expert participation patterns and adherence to rotation rules. One weakness was identified in the design and effectiveness of the Joint Research Centre’s information technology project management practices. A weaknesses was also identified in the performance management framework of the Service for Foreign Policy Instruments. The Directorate-General for Trade’s control system for planning and monitoring the evaluation process was not found to be fully adequate or effective (including the use of resources). 4.2.Internal Audit Service limited conclusions The Internal Audit Service issued limited conclusions on the state of internal control to every Directorate-General and service in February 2021. These limited conclusions contributed to the 2020 annual activity reports of the Directorates-General and services concerned. Drawing on the audit work carried out in the last 3 years, they cover all open recommendations issued by the Internal Audit Service and former Internal Audit Capabilities (insofar as the Internal Audit Service has taken over these recommendations). The Internal Audit Service’s conclusion on the state of internal control is limited to the management and control systems that were audited. It does not cover systems not audited by the Internal Audit Service in the past 3 years. 4.3.Overall opinion on the Commission’s financial management As required by its mission charter, the Internal Audit Service issues an annual overall opinion on the Commission’s financial management. This is based on the audit work in the area of financial management in the Commission carried out by the Internal Audit Service during the past 3 years (2018 to 2020). It also takes into account information from other sources, namely the reports of the European Court of Auditors. The overall opinion is issued at the same time as this report and covers the same year. As in the previous editions, the 2020 overall opinion is qualified with regard to the reservations made in the declarations of assurance by authorising officers by delegation. In arriving at its overall opinion, the Internal Audit Service considered the combined impact of: (1) the amounts estimated to be at risk as disclosed in the annual activity reports; (2) the corrective capacity, as evidenced by financial corrections and recoveries of the past; and (3) estimates of future corrections and amounts at risk at closure. Given the magnitude of financial corrections and recoveries of the past and assuming that corrections in future years will be made at a comparable level, the EU budget is adequately protected as a whole (not necessarily individual policy areas) and over time (sometimes several years later). Without further qualifying the overall opinion, the Internal Audit Service emphasised the following matters: 1.Implementation of the EU budget in the context of the current crisis related to the COVID-19 pandemic: need for a continuous monitoring and assessment of (new/emerging) risks and for the definition and implementation of corresponding mitigating measures The health, social, economic and financial situation created by the COVID-19 pandemic entails potentially high, cross-cutting risks for the institution as regards the implementation of the EU budget and the delivery of its policy priorities. This includes the operations conducted prior to the crisis (as part of the 2014-2020 multiannual financial framework), for which adequate controls (ex-post in particular) still need to be performed, and forthcoming operations under the 2021-2027 multiannual financial framework and the recovery package under Next Generation EU, on assurance, compliance and performance aspects. As the crisis has continued since early 2020, this context poses challenges, in particular as regards: