EUROPEAN COMMISSION Brussels, 15.9.2017 SWD(2017) 306 final COMMISSION STAFF WORKING DOCUMENT Summary of Executive summaries



Internal audit engagements finalised by the IAS in 2016 Accompanying the document Report from the Commission to the European Parliament and the Council Annual report to the Discharge Authority on Internal audits carried out in 2016

(Art 99(5) of the Financial Regulation) {COM(2017) 497 final}







Content of this Staff working document: Part 1 of this SWD contains the objective and scope, key findings and the critical and very important recommendations of the IAS engagements which were part of the 2016 IAS audit plan (cut-off date for the exercise: 31 January 2017). Important and desirable recommendations are not reproduced in this SWD. The information contained in this SWD reflects the state of play when the audit engagements were finalised as stated in the executive summary of the audit report. Each executive summary underwent the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation and aims to provide a quick understanding of the audits and their main results. Part 2 of this SWD contains a summary of the IAS follow-up engagements in the period from 1 February 2016 to 31 January 2017. Part 3 provides a summarised overview of the 18 long overdue very important recommendations as at 31 January 2017. PART 1: Final reports 1.Horizontal audits 1.1. Audit on the management of intra-muros contractors Audit objectives and scope The overall objective of the audit was to assess if the Commission uses the external contractors working intra-muros in an effective and efficient way. The audit covered the arrangements both at the corporate level aimed at facilitating the management of intra-muros contractors by DGs and the way in which they are managed in practice at the individual DG level. At the corporate level, the audit scope included the overall framework put in place by DG HR, responsible for coordinating the personnel and administrative policy of the Commission, as well as by DG BUDG, responsible for laying down the procurement procedures and contract templates. The audit also focussed on DG DIGIT, given that a large number of intra-muros contractors work in the IT domain. At the individual DG level, the audit scope included the process of monitoring the work performed by intra-muros contractors to ensure that DGs get value for the money spent and that the associated risks are adequately identified and appropriate mitigating measures put in place. There are no observations/reservations in the 2015 Annual Activity Reports of any of the DGs covered by this audit that relate to the area/process audited. The fieldwork was finalised on 25 May 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified two very important issues: ·Lack of a corporate framework for the use of intra-muros contractors

Despite the significant number of intra-muros contractors in the Commission, there is no corporate framework and there are no comprehensive corporate guidelines to support DGs in their management. Certain DGs have developed guidelines at the local level, but these lack the corporate dimension needed to properly address not just the contractual issues, but also to allow them to take into account the HR implications of significant dependency levels. The need for such corporate guidance was clearly expressed by the audited DGs. ·Value for money in "time and means" contracts DGs/Services can use two major categories of service contracts. Either "result" contracts, which involve buying pre-defined deliverables, or "time and means" contracts, which are used to purchase human resource capacity with certain skills for a given period of time, but without necessarily pre-defined deliverables. Although "time and means" contracts may be appropriate in certain circumstances, for example in the early stages of a project or operational service in which an output cannot be clearly defined upfront, they tend to be used more because of their flexibility and the relatively lighter contract preparation work needed up front. However, they generally involve much less stringent reporting requirements on the work actually performed by the contractor and, unless properly monitored, provide less assurance on the achievement of value for money. Although the IAS identified certain good practices where framework contracts used on a "time and means" basis also included reporting requirements to allow implementation progress to be tracked, these appear to be exceptions rather than the rule. Furthermore, DG DIGIT's recent guidelines on outsourcing in the IT domain do not clearly advise DGs to use "result" contracts in preference over "time and means" contracts. Recommendations To address these issues, the IAS formulated the following recommendations: ·A corporate framework for the use of intra-muros contractors The IAS recommends that the responsibility for defining the corporate framework for the use of intra-muros contractors should be allocated to the main central services involved (DGs BUDG, HR and DIGIT), under the general oversight of the ABM Steering Group. These central services should work with the DGs that make most significant use of intra-muros contractors to define a corporate framework. This should build upon the existing guidance at local level and be more specific in spelling out which types of contract are most applicable to different situations. ·Value for money in "time and means" contracts As corporate domain leaders in IT and communication, DGs DIGIT and COMM should, for any new framework contract using "time and means" and, to the extent possible, for existing ones, build in contractual safeguards aimed at ensuring value for money. This could include the use of indicative milestones and/or defining deliverables, together with reporting requirements on the activities performed by intra-muros contractors. Finally, DG DIGIT should revise the recently finalised guidelines to clearly state that a reflection should be carried out prior to the launch of the procurement procedure and that "result oriented" contracts should be privileged over "time and means" contracts. 1.2. Audit on coordination and working arrangements with EU decentralised Agencies in DG SANTE and DG HOME Audit objectives and scope The overall objective of the audit was to assess the adequacy of the coordination and working arrangements of the partner DGs (HOME and SANTE) with their Agencies to ensure that Agencies' activities contribute efficiently and effectively to the DGs' policy objectives. The audit focussed on the following three areas: (1) the clarity of the role and responsibility of the partner DG vis à vis its Agencies; (2) the adequacy of the overall strategy of the partner DG vis à vis its Agencies to ensure that their activities contribute efficiently and effectively to the achievement of the DG's policy objectives and (3) the adequacy of the organisational structure of the partner DG in order to have efficient and effective interactions with its Agencies. As the areas under review are managed separately and under different organisational structures in the partner DGs (HOME and SANTE), two separate reports have been issued by the IAS for clarity purposes and to facilitate the follow up of the recommendations at partner DG level. There are no observations/reservations in the 2014 Annual Activity Reports (AAR) of the DGs that relate to the area/process audited. The fieldwork was finalised on 15 January 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified one very important issue with regard to the overall strategy of each partner DG towards its Agencies in three key areas (i.e. programming, monitoring and control/reporting) as follows:

DG HOME ·Partner DG's contribution to Agencies' programming and link to the DG's own programming activities The Commission (via DG HOME) has to provide an opinion on the work programmes of its Agencies as requested by the Agencies' Founding Acts. The IAS observed that the work programmes of certain Agencies lack quality in terms of objective setting (i.e. no SMART objectives) and the definition of Key Performance Indicators (KPIs) (i.e. no result and impact indicators). Furthermore, some issues on the programming process have been noted: delays in providing the Commission's opinion, the need for closer links between the partner DG and the Agency and for a more proactive Commission's role to facilitate the timely assessment of Agency's budget needs. In addition, despite the link between the DG's policy objectives and the outputs of the Agencies, performance indicators are not systematically included in the DG's Management Plan which reflect the Agencies' contribution towards the achievement of DG HOME's policy objectives. Finally, DG HOME does not explicitly take into account the extent to which the risks reported by the Agencies may hamper the achievement of those policy objectives. ·Partner DG's monitoring of Agencies' activities The main mechanisms for monitoring the performance of decentralised Agencies are through the work of the respective Management Boards as well as through regular (informal) contacts. As is the case for other partner DGs, DG HOME is represented on the Boards of its Agencies. Key to effective monitoring is to have appropriate KPIs and adequate performance measurement systems and reporting at Agency's level. While this is the Agencies' responsibility, DG HOME has a vested interest that these arrangements adequately support the achievement of its own policy objectives. As noted above appropriate KPIs are not always in place and the quality and regularity of performance measurement and reporting in the Agencies varies considerably. Furthermore, although the DG has supported the Agencies in implementing certain actions under the 'Common approach' and associated 'Roadmap' aimed at making the Agencies more coherent, effective and accountable, the IAS considers that it could further strengthen its monitoring in this area. ·Partner DG's control strategy to build assurance and report on the tasks entrusted to its Agencies in the framework of the Annual Activity Report DG HOME has not formalised yet its control strategy towards its Agencies, including a provision for adapting the intensity of controls to match the Agencies' respective risk profiles. Furthermore, no 'differentiated' control strategy exists for the two Agencies which have been entrusted by DG HOME with budget implementation tasks through 'Delegation Agreements'. The risks of fraud and of conflict of interest (CoI) are not systematically monitored by the partner DG as a member of the Management Board. In addition, there is room for improvement in the way in which the DG builds up its assurance on the activities of the Agencies, due to the inefficient use of independent sources of assurance such as evaluation and audit work but also due to the limited nature of the reporting process on Agencies' matters by the AOSD which does not systematically report on the results of the Agencies' activities and on the DG's monitoring arrangements towards its Agencies. DG SANTE ·Partner DG's contribution to Agencies' programming and link to the DG's own programming activities DG SANTE has a very limited role in the establishment of the work programmes of its Agencies. This is mainly due to the fact that under the Agencies' Founding Acts, there is no legal requirement for the DG to provide an opinion on the work programmes, but also due to the fact that in some cases the Agencies allow the DG only a limited opportunity to participate in the discussions at an early stage of the programming phase. The IAS observed that the work programmes of certain Agencies lack quality in terms of objective setting (i.e. no strategic objectives) and KPIs (i.e. no result and impact indicators). Furthermore, despite the link between the DG's policy objectives and the outputs of the Agencies, there are no performance indicators in the DG's Management Plan which reflect the Agencies' contribution towards the achievement of DG SANTE's policy objectives. In addition, in its risk assessment, DG SANTE does not document the extent to which the risks reported by the Agencies may hamper the achievement of those policy objectives. ·Partner DG's monitoring of Agencies' activities The main mechanisms for monitoring the performance of decentralised Agencies are through the work of the respective Management Boards and Audit Committees (when applicable) as well as through regular (informal) contacts. To support these monitoring activities, amongst other sources of information, appropriate performance indicators should be in place. While this is the Agencies' responsibility, DG SANTE has a vested interest that these indicators adequately support the monitoring of the achievement of the DG's policy objectives. As noted above this is not always the case. Furthermore, although the DG has supported the Agencies in implementing certain actions under the 'Common approach' and associated 'Roadmap' aimed at making the Agencies more coherent, effective and accountable, the IAS considers that it could further strengthen its monitoring in this area. Finally, although the IAS acknowledges that the quality checks performed by DG SANTE on its Agencies' scientific opinions necessarily follow different approaches depending on the particular circumstances, it found that neither the common principles nor the justification for the different approaches were documented. ·Partner DG's control strategy to build assurance and report on the tasks entrusted to its Agencies in the framework of the Annual Activity Report The IAS notes that DG SANTE has formalised its overall control strategy towards its Agencies. Although this is risk-based, it does not describe the different Agencies' risk profiles and does not explain how the intensity of controls should be adapted to those risk profiles. In addition, there is room for improvement in the way in which the DG builds up its assurance and reports on the activities of the Agencies. Currently, independent sources of assurance such as evaluation and audit work are not used as efficiently as they could be and the reporting made by the AOSD on Agencies matters focuses more on budget execution than on results linked to policy achievements, operations and monitoring arrangements. Recommendations To address these issues, the IAS formulated the following recommendations for each partner DG: DG HOME ·Partner DG's contribution to Agencies' programming and link with DG's programming DG HOME should reinforce its leverage effect on Agencies' programming. Firstly by being involved earlier in the programming phase to support more effectively the Agencies for the setting of adequate objectives and the definition of appropriate KPIs and secondly by establishing closer links between Agencies (i.e. field expertise) and Commission (i.e. 'Policy') to ensure that lessons learnt can feed into all levels of policy development. The DG should also reinforce its risk assessment process by taking account of the risks reported by the Agencies and strengthen its planning documents (i.e. Strategic Plan (2016/2020) and annual Management Plans), by explaining clearly how the Agencies activities contribute to the achievement of the policy objectives and how this is in turn supported/measured by appropriate indicators. ·Partner DG's monitoring of Agencies' activities

Through its role as a member of the respective Management Boards, DG HOME should strengthen its performance monitoring using the KPIs established by the Agencies. It should further promote and support the implementation of the 'Common Approach' by its Agencies and follow up on the implementation of the 'Roadmap' in each individual Agency. ·Partner DG's control strategy for building assurance and report on the tasks entrusted to its Agencies in the framework of the Annual Activity Report DG HOME should strengthen its control and assurance building process as follows. Firstly, a control strategy should be formalised for the Agencies, allowing for different levels of control intensity in line with the Agencies' respective risk profiles. Secondly, a separate control strategy for Agencies with delegated budget implementation tasks (i.e. Delegation agreements) should be established as the discharge in respect of the delegated funds is given to the Commission (not to the Agency) and the Director General of DG HOME is the Authorising Officer by Delegation (not the Director of the Agency). Thirdly, the building blocks supporting the Authorising Officer by Delegation's declaration of assurance should be reinforced by a more efficient use of independent sources of assurance and by a more systematic bottom-up reporting process aimed at ensuring that the information needed for the DG's AAR on the Agencies' activities is reported consistently and on a timely basis and properly identifies issues which could have an impact on the declaration of assurance. Fourthly, the information included in the AAR on the Agencies' activities should be improved, particularly with regard to the main results and the contribution to DG HOME's policy objectives. Finally, the DG should monitor that Agencies establish adequate Anti-Fraud and conflict of interest policies which we recommend to be adopted by their respective Management Boards. DG SANTE ·Partner DG's contribution to Agencies' programming and link with DG's programming DG SANTE should reinforce its leverage effect on Agencies' programming. Firstly by being involved earlier in the programming phase to support more effectively the Agencies for the setting of adequate objectives and the definition of appropriate KPIs and secondly by establishing closer links between Agencies (i.e. science/field expertise) and Commission (i.e. 'Policy'), while respecting both the independence of the Agencies and the role of the Commission to ensure that lessons learnt can feed into all levels of both organisations. The DG should also reinforce its risk assessment process by documenting properly how the risks reported by the Agencies are taken into account. It should also strengthen its planning documents (i.e. Strategic Plan (2016/2020) and annual Management Plans) by explaining clearly how the Agencies activities contribute to the achievement of the policy objectives and how this is in turn supported/measured by appropriate indicators. ·Partner DG's monitoring of Agencies' activities Through its role as a member of the respective Management Boards, DG SANTE should strengthen its performance monitoring using the KPIs established by the Agencies. It should further promote and support the implementation of the 'Common Approach' by its Agencies and follow up on the implementation of the Roadmap in each individual Agency. The DG should ensure that the different approaches used as regards quality checks on Agencies' scientific opinions are properly documented and justified accordingly. ·Partner DG's control strategy for building assurance and report on the tasks entrusted to its Agencies in the framework of the Annual Activity Report DG SANTE should strengthen its control and assurance building process as follows. Firstly, the control strategy should describe the different Agencies' risk profiles and how the level of control intensity should be adapted to these risk profiles. Secondly, the building blocks supporting the AOD Declaration of assurance should be reinforced by a more efficient use of independent sources of assurance. Thirdly, there should be a more systematic bottom-up reporting process aimed at ensuring that the information needed for the DG's AAR on the Agencies' activities is reported consistently and on a timely basis. Finally, the information included in the AAR on the Agencies' activities should be improved, particularly as regards the main results and the contribution to DG SANTE's policy objectives. 1.3. Audit on performance and coordination of Anti-Fraud activities in the Traditional Own Resources area Audit objectives and scope The overall objective of the audit engagement was to assess whether or not the Anti-Fraud activities in the area of Traditional Own Resources (TOR) are planned, managed and coordinated in an effective manner to ensure the best protection of the Commission's financial interests. The scope of this audit engagement covered the Commission’s Anti-Fraud activities in the TOR area with a particular focus on customs duties and cigarette smuggling. The audit covered: · The Commission Anti-Fraud Strategies (CAFS) and high level coordination and policy in the TOR area; · Anti-Fraud Strategies (AFS) of the main DGs involved in TOR-related activities; · Operational activities in the audited DGs to address the fraud risks at each stage of the Anti-Fraud cycle; · Communication and information within the framework of Commission governance and reporting such as the annual risk assessment exercise, the Annual Activity Reports (AARs), Management Plans (MPs), etc.

The audit focused on the activities of OLAF, DG BUDG and DG TAXUD. There are no observations or reservations in the 2015 AARs of the audited DGs, which relate to the audited process. The fieldwork was finalised on 30 September 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified three very important issues: ·Anti-Fraud Strategies in own resources at Commission and DG level The CAFS and the individual DGs' AFSs do not sufficiently address specific fraud risks in the domain of EU own resources. In particular, the CAFS does not provide a clear framework for fighting fraud in the own resource areas as a whole (including TOR), while concerning the AFSs, the TOR DGs do not coordinate their preparation to ensure that common fraud risks are adequately identified and addressed. ·OLAF support OLAF's support and facilitation activities on fraud prevention and detection in the TOR area are less structured and comprehensive than in the expenditure area. In particular, the central guidance, support and coordination provided to the DGs, the training programme and the information provided in the Anti-Fraud website are mostly focusing on the expenditure area and very limitedly on TOR. There is moreover no working group or forum for all the TOR DGs to discuss and share common challenges and best practices in the TOR area. ·Roles and responsibilities in the TOR area There is no clear overview of how the TOR DGs share the Commission's competence for fraud prevention and detection in the TOR area, and how they ensure effective cooperation and resolve strategic issues on fraud prevention and detection. In addition, the different committees with the Member States address Anti-Fraud aspects to a very limited extent, not all the TOR DGs attend them or are involved in the preparation of meetings to define a common EC position or propose issues for discussion. Lastly, the TOR DGs do not sufficiently coordinate their preparation and distribution of reports to the Member States on Anti-Fraud activities and performance. Recommendations To address these issues, the IAS formulated the following recommendations: ·Anti-fraud Strategies in own resources at Commission and DG level OLAF should revise the CAFS in order to address appropriately issues and risks related to own resources, including TOR and facilitate a better coordination among the TOR DGs to enable identifying common risks and defining coordinated mitigating actions. ·OLAF support OLAF should strengthen its support to the TOR DGs by ensuring an enhanced service to TOR DGs as for expenditure DGs. This should include revising the AFS guidance in the TOR area, developing an appropriate range of awareness, communication and training tools and ensuring that the Fraud, Prevention and Detection Network addresses TOR issues. ·Roles and responsibilities in the TOR area OLAF, DG BUDG and DG TAXUD should better cooperate by setting up a strategic steering function responsible for AFS in TOR, defining clearly the respective roles and responsibilities and establishing procedures for the cooperation among them (including when preparing reports on Anti-Fraud activities). The DGs should also review and formalise the different current practices for Member State committees and working groups. 1.4. Audit on the new Better Regulation agenda in the Commission - what is the state of play approximately one year after its adoption?

Audit objectives and scope The overall objective of the audit was to assess the state of play of the Better Regulation (BR) package approximately one year after its adoption. Although still relatively early for such an important and wide ranging initiative, with expectation levels so high, it is important to assess the progress made so far, confirm or otherwise that it is on track and to highlight as early as possible any areas for possible improvement/corrective action. The audit scope included: ·At the corporate level: the framework put in place to support the implementation of the BR package at Commission level and the measures taken by the SG so that DGs are ready to manage, monitor and report on the efficient and effective implementation of the package; ·At the DG level: the preparedness of a sample of DGs (EMPL, ENV and GROW) to efficiently and effectively implement the BR package in practice. ·There are no observations/reservations in the 2015 Annual Activity Reports of the audited services that relate to the area/process audited. The fieldwork was finalised in mid-June 2016 and all observations and recommendations relate to the situation as of that date. However, the situation is continuously evolving and various factors and events have come to light since the end of the fieldwork. These have been taken into account when finalising the audit engagement. Major audit findings The IAS identified two very important issues: ·State of play of the main Better Regulation components Although the Commission has put in place the main components of the package (REFIT - Regulatory Fitness and Performance Programme - Platform, Regulatory Scrutiny Board, feedback/consultation mechanism and agenda planning etc.), it has yet to establish proper monitoring and measurement arrangements for assessing whether these components are functioning adequately in practice. The IAS notes that the continual development of the supporting IT tools (the BR portal and Decide) will allow key data/statistics to be collected and indeed this is already underway. However, it still remains to be decided how these will be best used for monitoring and assessment purposes. As regards the REFIT platform, the IAS found that the working arrangements still need to be finalised, together with clearer explanations as to precisely what is expected from the platform. At the fieldwork date, these were still not clear to the platform's members. Concerning the Regulatory Scrutiny Board (RSB), there is a need for DGs to be better informed about the quality and content requirements for impact assessments and evaluations, as this would help them to prepare high-quality outputs from the outset. Furthermore, the RSB's rules of procedure and working arrangements, which were available only in draft at the time of fieldwork, still need to be finalised. Although the feedback and consultation mechanisms have been strengthened as part of an attempt to reach out to stakeholders, in practice this has proven to be a challenge as the response rate is, with a few notable exceptions, generally quite low. The language requirement appears to be a particular problem with less than 20% of the 2016 open public consultations being made in all EU languages. This poses a natural barrier in the attempts to reach out to all EU citizens. In addition, the operational DGs audited expressed concerns as to the proportionality of the feedback/consultation mechanism, although the IAS acknowledges that it may be too early to draw conclusions in this area in the absence of relevant performance information referred to above. As regards the new approach for planning and validating major initiatives, the statistics available for 2016 at the time of the fieldwork show that the average time for the validation process is very encouraging overall, at ten working days, but about one quarter experienced considerable delays. In order to address this issue, the IAS notes that towards the end of the fieldwork the SG simplified the process and it expects the situation to improve. ·Fostering the Better Regulation culture The new impetus that the BR agenda brought also requires a change in culture whereby the objectives and principles need to be deeply embedded in the regulatory activities of the Commission. To this end, the IAS found that whilst tools and guidelines have been made available, much less emphasis was given in practice to helping foster the necessary change in culture. However, it notes that a communication strategy was developed early this year and is gradually being put in place in the context of the roll-out of the new BR portal. Furthermore, the audit identified a need to communicate more clearly on the workflow for policy development, the roles and responsibilities within the SG and the support that the SG is offering to the DGs. In addition, the coordination within the SG, in particular between the Directorate responsible for the BR agenda and those responsible for coordinating the policies throughout the Commission needs to be improved. The role of the SG is pivotal in fostering the BR culture and it follows therefore that the BR principles are understood, applied and communicated to the DGs in a coherent manner. The IAS also noted room for improvement with regard to quality review by the SG. In particular, supporting documents to guide the quality review are not used consistently and there is no indicative timeline for the submission of documents. Recommendations

To address these issues, the IAS formulated the following recommendations: ·State of play of the main Better Regulation components SG and, where relevant, the RSB, should define appropriate performance measures for the main components of the BR package and monitor and evaluate these in practice. Furthermore, the SG should explain to the REFIT platform members more precisely what is expected from them and from the process and should ensure that the working arrangements are agreed and properly understood amongst the platform's members. The RSB, in collaboration with the SG, should make it clear to the DGs what is expected of them in terms of quality and content for impact assessments and evaluations and should also finalise its rules of procedure and working arrangements. Concerning the feedback/consultation mechanisms, the SG should carefully monitor progress, particularly as regards both the application of the language regime used for consultations, and the proportionality of the efforts made (inputs) to responses received (outputs) in relation to both consultation and feedback mechanisms. Furthermore, it should investigate the reasons for the low feedback rate and adapt the communication approach accordingly. Finally, as regards the planning of major initiatives, the SG should monitor the application of the new simplified process to assess whether the expected benefits are actually being achieved in practice and take any necessary remedial action. ·Fostering the Better Regulation culture To better foster the BR culture in the Commission and building on what is in place already, the SG should further develop its communication strategy promoting the BR objectives. Particular emphasis should be placed on the importance of the 'tone at the top' and for Senior Management to be sending the right signals as to the importance of this initiative. This could be further complemented through stronger support from the political level. On a very practical level, the SG should clearly set out (and communicate accordingly) who does what and when, highlighting key review points for documents. Finally, the SG should strengthen its internal coordination and quality review arrangements to provide more consistent support to the DGs/services 1.5. Audit on financial management in the SG, LS, EPSC and DGT The overall objective of the audit was to assess the adequacy of the financial management of the SG, LS, EPSC and DGT. In particular, it reviewed the design and the implementation of the controls in place to assess whether they ensure the legality and regularity of the financial transactions. Furthermore, the audit assessed the efficiency of the financial workflow. This audit covered the key controls designed and implemented in the following processes: ·The procurement process, from the determination of the needs and planning to the effective implementation of the contract; ·The financial circuits of procurement, including commitments, payments (including payment deadlines) and recovery orders, to ensure proper segregation of duties and authorisation; ·The recording of exceptions and ABAC access rights; ·The risk register and Anti-Fraud strategy; ·The reporting of the financial activity in the Annual Activity Report (AAR). The engagement covered the period 2015 and the first five months of 2016. There are no reservations in the 2015 AAR of the SG, LS, EPSC and DGT that relate to the area/process audited. The fieldwork was finalised during September and October 2016. All observations and recommendations relate to the situation as of that date.

Major audit findings The SG, EPSC and DGT The IAS did not identify any material risks that would give rise to critical or very important recommendations. The LS The IAS identified one very important issue: ·Procurement process: Weaknesses in documentation The IAS found that as regards the procurement procedures relating to legal services, the documentation lacks a sufficient degree of formalisation to ensure a proper audit trail, as required by the Financial Regulation (FR). For example, there is no trail of the exclusion, selection and award criteria used for the procedure. In addition, exceptions to the FR and its rules of application (RAP) are not properly documented as required by the relevant internal control standard. Moreover, there is no formal evaluation and award decision and the relevant manual used by the LS is very brief and does not explain in sufficient detail the main steps to be followed for the procurement procedure. The IAS also noted that the LS does not request a declaration on honour from the legal service contractors and is currently seeking the opinion of DG BUDG on the necessity to do so. Finally, the audit found that the requirements of the RAP regarding the publication of contracts awarded were not fully complied with. Their publication on the website of the LS was not exhaustive and did not meet the deadline as set in the RAP. Recommendation To address this issue, the IAS formulated the following recommendation: ·Procurement process: Weaknesses in documentation The LS should: ·Develop a document (or further develop the existing template), which formalises the main steps of the procurement procedure for legal services, including exceptions to the FR and RAP; ·Update its internal operational manual (Guide sur l'activité "contentieux" du service juridique - 2016) to provide more detailed guidance to the legal officers in this respect; ·Clarify with DG BUDG whether the LS has to request the ESPD/declaration of honour before awarding a contract for legal services and follow the position as expressed by DG BUDG. For procurement procedures below EUR 15 000, carry out a risk assessment in order to assess whether or not to request these documents; ·Publish a full list of all legal service contracts awarded in a given year respecting the deadline of 30 June year n+1. 1.6. Audit on the early implementation of ESIF control strategy 2014-2020 in DGs REGIO, EMPL and MARE Audit objectives and scope The overall objective of the audit was to assess if the control strategy of DGs REGIO, EMPL and MARE for the management of their European Structural and Investment Fund (ESIF) was properly designed, effectively implemented and well-coordinated in the early stages of the 2014-2020 programming period.

The scope of the audit focussed on the following three main areas for the ESI funds managed by DGs REGIO (ERDF and CF), EMPL (ESF) and MARE (EMFF): ·The appropriateness of the design of the control strategy for building up assurance on the management of the ESI funds for the 2014-2020 period; ·The effective implementation of the control strategy in the early stages of the 2014-2020 period to ensure that sufficient assurance is available before reception of the first assurance packages with declared expenditure; ·The appropriateness of the coordination arrangements between the three DGs (i.e. internal coordination) and with Member State authorities (i.e. external coordination) to ensure a consistent and sound control approach as well as an efficient use of resources in the early stages of the 2014-2020 period. The assessment of the IT systems used for the control/audit activities were excluded from the scope of the audit. There are no observations/reservations in the 2015 Annual Activity Reports (AAR) of DGs REGIO, EMPL and MARE that relate to the area/process audited. The fieldwork was finalised on 29 July 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified two very important issues: ·Design of the ESIF control strategy 2014-2020 DGs' assurance process The legal basis for the 2014-2020 programming period introduced a number of new features which the DGs are yet to fully assess in terms of their impact from a control/assurance perspective. In particular, this concerns the impact of the 10% retention of interim payments on: (a) the procedure for interruption and suspension of payments, (b) the DG's decisions whether or not to issue a reservation in the AAR and its quantification and (c) the calculation of the 'amount at risk'. Also, it is not yet clear how multi-fund Operational Programmes (OPs) will be treated (a) when drawing conclusions and making financial corrections based on audit results resulting from common samples (i.e. covering both funds) and (b) when defining in the audit methodology the scope when covering those OPs. Finally, also not yet fully addressed is the control approach to be applied on the legality and regularity of payments under each stage of the control cycle. DGs' audit plans Delays in the start-up of the 2014-2020 programming period have resulted in the need for continuous adjustments of the DGs' audit plans. Although these are risk-based (in line with auditing standards) and properly supported by a workload analysis, there is a lack of consistency between the DGs on how to take into account resources shortages when developing their plans and it is not clear to what extent those shortages might impact on the assurances needed for a given reporting period. 'Control-related' simplification measures It is not yet sufficiently clear how the control related simplification measures introduced in the 2014-20 programming period will deliver the expected results. Issues still to be clarified include: (1) article 148 of the Common Provisions Regulation (CPR) on 'proportional control of OPs', setting out provisions to avoid overlap with Member States/ECA audits under certain conditions, (2) article 140(1) of the CPR on 'shorter retention period of documents', limiting the time for audit activities and financial corrections and (3) article 122(3) of the CPR on 'e-Cohesion', providing that by 31/12/2015 Member States have to exchange all information between beneficiaries and their national authorities by means of electronic data exchange systems. ·Implementation of the ESIF control strategy in the early stages Designation review The Commission's progress in reviewing Member States designations depends very much on progress made by the Member States on the designation process itself, which is under their responsibility and has been subject to persistent delays. As at September 2016, the Commission had received notice of complete designation for only 214 out of the 538 approved OPs (i.e. 40%). The DGs have provided guidance to help facilitate the designation process and some Audit Authorities found this to be useful. However, others raised concerns about the feasibility to implement the so-called 'Light designation' for management and control systems, whereby the authorities concerned have essentially the same systems which existed in the previous period.

The risk factors used by the Commission to select OPs subject to designation reviews (DR) are driven mainly by the amount of EU-co-financing at stake, rather than other factors such as the reliability of the Independent Audit Body (IAB). The IAS considers the latter to be more critical given the objective of the DR is to confirm the reliability of the IAB report. Also, although the DGs' methodology for the DR and guidelines to IABs on how to treat IT issues at the designation stage are clear on paper, the IAS found that in two out of the four sampled cases, either the DG's auditors (in one case) or the IAB (in the second case), had not completely followed the set procedures in practice. Early Preventive System Audits (EPSA) Concerning the EPSA methodology, the IAS notes that the impact of such audits on the application of article 148 of the CPR (which limits the audits that can be performed on the same beneficiary by the DGs, the AA and the ECA) has not been properly reflected in the methodology. Also, the DGs have yet to update the checklist to verify compliance with the EU public procurement directive to cover the contracts published from April 2016. Additionally, the risk assessment process used to select OPs for such audits is lacking in so far as the decision-making is not always clearly documented and weightings are not adequately assigned to certain risk factors. Review of National Audit Strategies (AS) The DGs' review of the AS is risk-based and includes the AS of the OPs which are subject to DR. However, the DR automatically excludes lower-value OPs (i.e. below the thresholds in the legal basis) even though these may have a high-risk profile. The IAS notes that the DGs do not currently plan to review the AS for certain OPs identified as risky according to the EPSA risk assessment. Also, there is room for improvement on the process and tools used for monitoring the reviews of AS. Thematic audits on: (1) Performance Data Reliability (PDR) and (2) Financial Instruments (FI) The single audit strategy attaches priority in the first years of implementation, in addition to the compliance audits, to audits on the reliability of data in the Member States and on Financial Instruments. However, at the end of the IAS audit fieldwork, in REGIO and MARE there had been no audits on assessing data reliability and a number of underlying methodological issues have yet to be resolved in the existing methodology developed jointly by the DGs. These include the question as to which performance indicators should be included in the scope of the audit, the risk factors used for selecting OPs, the extent to which desk officers and evaluation experts can be used and finally the impact on suspension/interruption of payments and on financial corrections. Concerning Financial Instruments, there is no audit methodology in place yet and no audits performed so far. However, the IAS notes that a working group has been set up to develop a methodology for mid-2017. Recommendations To address these issues, the IAS formulated the following recommendations: ·Design of the ESIF control strategy 2014-2020 DGs REGIO, EMPL and MARE should clarify: (1) the impact of the 10% retention from interim payments on the interruption and suspension of payments, on the calculation of the 'amount at risk' and when deciding on the need to qualify the annual declaration of assurance by a reservation; (2) the impact of the 'multi-fund' OPs on the sampling method and the scope of the enquiry planning memorandum when covering those OPs and (3) the control approach and level of assurance for each type of payment and for each stage of the control cycle and clearly disclose this in the AAR. The DGs should revise their audit plans for the 2016-June2017 period to address any changes needed as a result of new events (e.g. new AA system audits reported). The plans should be either aligned to the resources available or alternatively explain the impact of any shortages in resources on the level of assurance in the reporting year. Finally, the DGs should address some points resulting from the control-related simplification measures: (1) clarifying the sampling implications and a process to exchange information on samples at beneficiary level, so as to avoid overlaps between audits on the same beneficiary by the DGs, the AAs and, under certain conditions, the ECA as per article 148 of the CPR; (2) consideration of the time limit for audit as per article 140.1 of the CPR in the risk assessment used for the selection of the OPs to be audited and (3) addressing the potential audit detection risk resulting from the use of 'e-cohesion' through audit work on this topic. ·Implementation of the ESIF control strategy in the early stages DGs REGIO, EMPL and MARE should: ·'Designations': in the short term, better facilitate the designation process through, for example, bilateral contacts with the Member States, giving priority to the risky OPs selected for designation review. In the long term, the DGs should assess the experiences of the 2014-2020 designation process to draw lessons and define the control approach for the post-2020 legislative framework; ·'EPSAs': strengthen the methodology and risk assessment process, including improving the audit trail and attaching a higher weight to the reliability of the AA's work; ·'Review of national audit strategies': include as part of their review the additional high risk OPs identified in the EPSA risk assessment. DGs should also improve the existing tools and further develop the monitoring process; ·'PDR audits': strengthen the methodology by clarifying the scope, the role of desk officers and evaluation experts and the impact of any errors detected and ensure that such audits are carried out on the selected OPs as a matter of priority; ·Audits on 'Financial Instruments': develop the necessary methodology and launch audits as soon as possible, after taking due consideration of any audit work by the AA on Financial Instruments to respect the "single audit principle" and based on the first substantial data on Financial Instruments reported by the Member States.

1.7. Audit on effectiveness of simplification measures under 2014-2020 ESI Funds in DG EMPL, REGIO and MARE Audit objectives and scope The overall objective of this audit was to assess whether or not DGs REGIO, EMPL and MARE have put in place the necessary processes to ensure that the simplification measures introduced in the 2014-2020 regulatory framework are effective in achieving the objective of reducing the administrative burden (at beneficiary and Member State level), whilst at the same time obtaining the necessary assurances on legality and regularity of transactions and performance of programmes. The IAS audit focused on the following three areas: ·The appropriateness of the design of the processes for implementing simplification measures; ·The activities of the European Structural and Investment Funds (ESIF) DGs in the areas of promoting the use and monitoring the take-up of simplification measures and in identifying any weaknesses in their implementation; ·The DGs' efforts to identify any further simplification measures as well as take action in order to address the identified weaknesses in the existing measures. The scope of the Commission's simplification exercise for the multi-annual financial framework period 2014-2020 encompasses the Member States' national authorities as well as the beneficiaries of ESIF grants. It does not include simplification measures at the Commission level. The main simplification measures covered by this audit are: ·Measures related to simplifying cost reimbursement rules, notably Simplified Cost Options (SCO), simplifying eligibility rules and reducing "gold plating", and simpler rules for revenue generating projects; ·Joint Action Plans (JAP); ·e-Cohesion. Another 2016 IAS audit on 'Early implementation of ESIF control strategy 2014-2020 in DGs REGIO, EMPL and MARE' has covered the design aspects of several control related simplification measures. There are no observations/reservations in the DGs' 2015 Annual Activity Reports that relate to the area/process audited. The fieldwork was finalised on 28 September 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified two very important issues: ·Uptake and impact of simplification measures and the DGs' processes to promote and monitor these measures The provisional results of a DG REGIO study show that the reduction in administrative costs is likely to be lower than expected, largely as a result of the lower than expected uptake of a number of simplification measures. A notable exception concerns the ESF, where the expected uptake of SCO represents some 36% of the total ESF funding. This compares to some 2% for the ERDF/CF, and zero for the EMFF. For the ESF, this is a significant increase in comparison to the 7% uptake rate for the 2007-2013 programming period, but still below the ambitious target of 50% set for this period. For the other Funds, the DGs have not set any targets for the 2014-2020 programming period and there is no significant increase in the use of SCO yet in comparison to the previous period. Furthermore, the e-Cohesion requirements were fulfilled for only 58% of the ERDF/CF Operational Programmes (OPs) as at 31 December 2015. No information was available on the uptake of this measure in the case of the ESF. In addition, there has been no take up of JAP so far. Despite the ESIF DGs' efforts, they have not yet succeeded in overcoming a number of obstacles to further increase the uptake of simplification measures and to reduce the administrative burden of beneficiaries and the administrative costs of the Member States.

The expected uptake of SCO is very much dependent on the type of projects funded. ESF funded actions are often more suitable for applying SCO. For ERDF/CF and EMFF, it is often not feasible to use flat rates, unit costs or lump sums. According to a survey of ESF Management Authorities carried out by DG EMPL, all intend to use SCO in this programming period. However, other surveys/studies indicate that respondents have certain doubts about the attractiveness of SCO that need to be addressed. Furthermore, SCO under article 67 Common Provisions Regulation cannot be used for operations that are fully publically procured. This limits the potential for the further uptake of SCO for ERDF/CF and EMFF. The different rules applicable to State Aid and simplification measures have not yet been sufficiently clarified and explained. The lengthy adoption procedure of delegated acts under article 14(1) of the ESF Regulation is among the blocking factors for Member States opting for SCO. The lack of legal certainty on the Commission accepting the Member States SCO calculation methodologies is also an obstacle the DGs need to overcome, except for DG EMPL when applying article 14(1) of the ESF Regulation. The DGs lack a comprehensive analysis of the Member States' rules and procedures implementing the ESI Funds at the local level to be able to help them reduce gold-plating in general and assess if the target for reducing gold-plating at the national level can be reached. Furthermore, overall, corrective actions for a significant number of Management Authorities not yet complying with the e-Cohesion legal requirements are not yet sufficiently clear. Finally, whilst acknowledging that it is early in the programming period, the IAS found a number of weaknesses in the arrangements the DGs have put in place for monitoring the uptake and impact of simplification measures. ·Mitigating risks associated with simplified cost options SCO expose the ESIF DGs to a number of risks they will need to address in the current programming period. The impact assessment supporting the legislative proposal for the 2014-2020 programming period did not sufficiently assess the impact of applying simplified rules on the level of assurance on legality and regularity to be obtained when using these new instruments. Furthermore, it is not certain if the new flat rates introduced in the Omnibus Regulation are a reliable proxy for real costs of certain types of funded operations, as these have not been backed-up by an in-depth study into the various types of cost categories that comprise the financed operations of the ESI funds. Applying article 14(1) of the ESF Regulation does not guarantee simplification for the final beneficiaries. Firstly, national managing authorities can use a SCO to reimburse beneficiaries which is different to the one approved under article 14(1) or can reimburse them based on actual costs incurred, necessitating a double accounting system adding administrative burden. Secondly, beneficiaries have to keep a full audit trail when the operations are financed by more than one ESI fund and the Member State has chosen a SCO provided under article 67 of the CPR for part of the financed operation (i.e. when the operations are 'cross-financed'). The IAS has also found certain weaknesses in the procedures for applying article 14(1), mainly regarding key supporting documentation. Furthermore, the ESIF DGs have yet to develop their approach for assessing the continued relevance of the methodologies approved ex-ante under article 14(1) and possible over or under reimbursements to beneficiaries if they take another form than the SCO applied under article 14(1) for the reimbursement of Member States by the Commission. DG EMPL considers that the principle behind the use of article 14(1) ESF SCO means that this is not required. The use of SCO does not necessarily result in a stronger focus on results, as Member States using article 14(1) have chosen to be reimbursed based on process or output based indicators rather than results in several cases. Furthermore, previous Commission audits have identified risks concerning the reliability of performance data collected and reported by the Member States, but it is unclear how the DGs and national audit authorities intend to cover the reliability of performance measurement indicators for SCO. It is also not yet clear how the DGs will keep an overview of all the findings concerning SCO resulting from audit work in order to be able to identify systemic issues and identify the need for a thematic approach to audit SCO. Finally, the role of the national audit authorities in providing assurance on the SCO calculation methods is yet unclear, as the applicable Regulations are silent about their precise role in this area. Certain national audit authorities are reluctant to get involved in assessing these methods because they fear that this would endanger their independence. Recommendations To address these issues, the IAS formulated the following recommendations: ·Uptake and impact of simplification measures and the DGs' processes to promote and monitor these measures DGs EMPL, REGIO and MARE should, for the 2014-2020 period, further remove the above obstacles hindering the implementation of simplification measures, monitor the uptake and effectiveness of the simplification measures further along the programming period and take corrective measures where necessary. For the post 2020 period, they should gather up-to-date data on the Member States' progress regarding simplification before submitting their legislative proposals for the post 2020 period. They should also set targets and indicators for the improved uptake of simplification measures and ensure that these are translated into the different funding priorities and OPs for the post 2020 period to enable both the Member States and the Commission to monitor the Member States' actions in the area of simplification. ·Mitigating risks associated with Simplified Cost Options DG EMPL should further strengthen its procedures for approving the Member States' SCO methodologies under article 14(1) of the ESF Regulation. The DG should also analyse any potential instances of significant differences between reimbursement by the EC of the Member State and payments made by the Member State to beneficiaries to assess the underlying reasons and decide whether or not the approved SCOs need to be adjusted for future operations, where appropriate. DGs EMPL and REGIO should ensure that their own or the national audit authorities' audit work sufficiently covers the risks related to using an SCO throughout the 2014-2020 programming period, if necessary through thematic audit work. They should also ensure that the SCO related data/indicators are output/results based where possible and their quality is sufficiently covered by audit work. For the post 2020 period the DGs should properly assess the effects of simplification on the assurance on legality and regularity of the underlying transactions and performance, and analyse the cost profiles and real costs incurred by publically financed projects that have similar characteristics to those funded under the ERDF/CF, ESF and EMFF to provide a solid basis for calculating the flat rates proposed in the EU Regulations. 1.8. Audit on the processes for managing and sharing data on agri-environmental-climate issues in DG AGRI, DG CLIMA and DG ENV Audit objectives and scope The overall objective of the audit was to assess whether DG AGRI, DG CLIMA and DG ENV have put in place effective and efficient processes for managing and sharing agri-environmental-climate data.

Agri-environmental-climate data was defined for the purpose of this audit as data and information related to the impact of agriculture on the environment and climate. The concept of knowledge management, which involves elements over and above the simple sharing of data, namely the use of skills and expertise needed to analyse and interpret data, was not included in the scope of the audit. The audit covered the review of the following processes in DG AGRI, DG CLIMA and DG ENV: ·Processes for identifying and prioritising agri-environmental-climate data needs for policy support; ·Processes for collecting agri-environmental-climate data, including the identification and mapping of available data; ·Processes for storing, sharing and disseminating agri-environmental-climate data. The audit also included the review of the collaboration between DG AGRI, DG CLIMA and DG ENV and with other Commission services and European Union (EU) bodies that play a major role in the collection and dissemination of agri-environmental-climate data, in particular Eurostat, the Joint Research Centre (JRC), DG RTD and the European Environmental Agency (EEA). However, the audit did not cover the data management and sharing processes in these other Commission services and EU bodies. The audit work took into account the rules and regulations regarding access to documents, protection of personal data and confidential statistical data and protection of intellectual property rights. However, its primary purpose was not to assess compliance with these rules and regulations. The 2015 Annual Activity Reports of DG AGRI, DG CLIMA and DG ENV do not contain any reservation/observation related to the processes audited. The fieldwork was finalised on 11 November 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified two very important issues: ·Mapping of information needs and available data related to agri-environmental-climate issues Despite certain initiatives undertaken by the DGs to list information needs and available data, there is no comprehensive and coordinated inventory of information needs, together with a list of already available data in the field of agri-environmental-climate issues. Existing inventories are limited in scope and not always shared amongst the three DGs. As a consequence, the IAS noted during its review of a sample of contracts for procuring studies in the agri-environmental-climate field, that it was often left to the contractors to make an inventory of available data/ information, including data/ information produced by the Commission itself, by the EEA and through EU research projects. In the addition, current coordination mechanisms do not always function effectively. The IAS found in particular that there is insufficient coordination on the indicators related to agri-environmental-climate data and that DG AGRI, DG ENV as well as Eurostat and the EEA have developed indicators which either address the same information needs, but are formulated differently or, should be the same, but in fact are calculated using different sources and/or methodologies and hence lead to different results. ·Coordination of Member State reporting requirements and reuse of data There is insufficient coordination of the Member State reporting requirements, including insufficient reuse of collected data. This results in overlaps in Member State reporting requirements, increase in the workload and possible inconsistencies. The DGs informed the IAS that in some cases this was caused by insufficient coordination in Member States themselves, coupled with resistance on their part to build into the underlying legislation the need for consistency between the different reports/data they are responsible for. In addition, the IAS noted that the spatial data collected by Member States (and belonging to Member States) under the Common Agricultural Policy (CAP) control system and which could be useful for environmental/climate policy, is not in fact available to be used in this way in certain Member States or in the Commission. In practice, this data is used essentially for controlling the CAP on the basis that under the personal data protection rules, as recalled in the CAP horizontal regulation, personal data should not be used for another purpose than it was collected for. These restrictions occur in spite of the requirements of the Inspire Directive for sharing spatial data for environmental purposes. Recommendations

To address these issues, the IAS formulated the following recommendations: ·Mapping of information needs and available data related to agri-environmental-climate issues DG AGRI, DG CLIMA and DG ENV should (taking account of the role played by the main EU data providers and building on existing arrangements) reinforce the coordination of agri-environmental-climate data and related indicators and enhance its sharing. They should also establish a coordinated inventory of agri-environmental-climate information needs and available data. ·Coordination of Member State reporting requirements and reuse of data DG AGRI, DG ENV and DG CLIMA should: Actively coordinate between themselves and with the EEA and Eurostat to ensure better consistency and, where possible, simplification through more effective re-use of collected data in Member States reporting requirements. In particular, this can be included in the European Commission's Regulatory Fitness and Performance Programme (REFIT) aimed at making EU law simpler and reducing the regulatory costs. In addition, DG AGRI, DG CLIMA and DG ENV should: Clarify with the Legal Service what can be legally required from Member States under EU legislation, regarding the sharing of CAP spatial data between public authorities at national level and with the European Commission and the EEA for environmental/climate purposes. Upon clarification of the Legal Service, work together and with Member States to define clear arrangements/processes for the sharing of the CAP spatial data for environmental-climate purposes. 1.9. Audit on the procurement process in OIB, OIL and DG BUDG Audit objectives and scope The overall objective of the audit was to assess the adequacy of the design and the effective implementation of DG BUDG, OIB and OIL's internal control systems for the management of the procurement process and the effectiveness and efficiency of the related financial circuits. This audit tested the key controls as well as management and monitoring controls throughout the procurement process, from the identification and planning of the needs until the signature of the contract, including amendments and price revisions, if applicable. The audit covered the controls on the financial transactions in the period 1 January 2015 – 31 May 2016 related to procurement procedures awarded in the same period as well as payments for procurement processed in the same period, which may however not necessarily be linked to procurement procedures awarded in the period under review. There are no reservations in DG BUDG, OIB or OIL's 2015 Annual Activity Reports relating to the process audited. The fieldwork was finalised in November 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified four very important issues: OIB ·Procurement procedures

The audit identified weaknesses in the planning phase (i.e. needs analysis) and in relation to the transparency of public procurement procedures. During testing of the planning phase, the IAS found weaknesses in OIB's needs analysis in one of the eleven high value procedures tested. In this case, OIB did not sufficiently consider local building regulations before the start of the procedure. As a consequence, OIB could not sufficiently demonstrate the proper use of an exceptional procurement procedure. The IAS also noted that the real estate procedure currently in place (the 'Kallas procedure') has not been updated to reflect the changes made to the Financial Regulation that requires a greater degree of involvement of the Budgetary Authorities. The 'Kallas procedure' is currently being revised and OIB has already prepared a first draft. Transparency is one of the fundamental principles in public procurement law. In this respect, the audit found that in the real estate procedure tested, OIB excluded one tenderer without formally explaining the grounds on which the decision was taken. However, a bilateral meeting was arranged at a later stage with the tenderer excluded. The IAS also noted that OIB did not take minutes of the meetings held with tenderers at the initial stages of the negotiation phase. ·Ex-post controls The audit also identified weaknesses in the methodology applied to ex-post controls. In particular, no pre-determined risk factors are defined and applied to the additional risk based sample of OIB. Furthermore, OIB does not make use of advanced sampling techniques, such as stratification of the population, which could increase the efficiency of the ex-post control function. In addition, the IAS found that the OIB had not tested the full number of transactions required for statistically meaningful results. This occurred because OIB made certain assumptions when selecting the sample during the year without assessing the need to adjust it at year-end in order to take account of significant differences between the assumptions made and the actual situation. Also, it did not correctly extrapolate the errors found in the sample across the entire population. The IAS does acknowledge however, that this had no significant impact on the 2015 error rate. Furthermore, although the services subjected to ex-post control receive recommendations from the ex-post control team, they do not establish action plans which could help foster the timely implementation of these recommendations. Finally, the IAS noted that a high number of recommendations are still open some of which were classified as errors of importance up to level 2 which means that they could have a financial or reputational impact. However, OIB has not carried out an assessment of the actual risks that the office is facing by not implementing these recommendations and whether it would be cost-effective to do so. OIL ·Procurement procedures The audit identified weaknesses mainly concerning the initial steps of procurement procedures, namely the planning phase and the drafting of tender specifications. As regards the planning, the IAS found that that OIL does not provide sufficient information on how such needs have been quantified, which meant in practice that OIL could not sufficiently justify using exceptional procedures. Furthermore, in one particular case, services vital for the implementation of a contract were not included at the needs assessment stage and consequently the tender specifications. They needed to be estimated by the Commission services at the evaluation stage. Regarding the tender specifications, the audit found that in one case, these were overly specific and even included brands, which had the effect of limiting the competition. In one of the real estate procedures we tested, the award criteria were not clearly defined, although this constitutes a key element of the procurement procedure. ·Ex-post controls The audit also identified weaknesses in the methodology applied for ex-post control. In particular, OIL's ex-post controls do not cover procurement procedures. Hence, a key risk is not covered, even though this constitutes a key building block for the assurance of the Authorising Officer by Delegation. In addition, the statistical method for selecting the sample and the extrapolation of the error rate were not correctly applied in practice. Recommendations To address these issues, the IAS formulated the following recommendations: OIB ·Procurement procedures OIB should improve the needs analysis by including compliance with specific building laws and regulations.

Furthermore, OIB should take the necessary steps to launch a College decision on the revision of the 'Kallas procedure' by taking into account, inter alia, the changes to the Financial Regulation by including the new procedure as stipulated in Art. 203 of the Financial Regulation and Art. 286 of the Rules of Application to the Financial Regulation. All relevant actors in the field of real estate procurement should be consulted during the course of the revision. OIB should also formally justify to tenderers when the decision is taken to exclude any one of them. ·Ex-post control OIB should comprehensively document its sampling methodology, in particular the risk factors applied for the additional risk based sample. Furthermore, OIB should consider stratifying the sampled population to increase the efficiency of the sample testing. It should also assess the need to adjust the selection of the sample at year-end to take account of significant differences between the assumptions made and the actual situation as required by the Monetary Unit Sampling technique and correctly apply the statistical methodology when extrapolating the errors identified. Finally, the services that are subjected to the ex-post control should establish an action plan with target dates for the most significant recommendations made by the ex-post control team. Furthermore, OIB should make an assessment of the risks associated with open recommendations for the lesser important errors and evaluate whether it is still cost-effective to implement these. OIL ·Procurement procedures OIL should improve the needs analysis and, in particular, document how it has quantified its needs. When drafting tender specifications, it should avoid restrictive clauses or references to brands or trademarks, except for duly substantiated exceptions. Furthermore, OIL should also set clear award criteria for real estate procurement procedures. ·Ex-post control OIL should include the key steps of the public procurement procedures in the scope of its ex-post controls and correctly apply the statistical method when sampling and extrapolating the errors identified. 1.10. Audit on the procurement process in DG COMM, DG Interpretation (SCIC) and EPSO/EUSA Audit objectives and scope The overall objective of the audit was to assess the adequacy of the design and the effective implementation of the service's internal control system with regard to the management of the procurement process and, in particular, its compliance with the Financial Regulation and its Rules of Application. This audit tested the key controls related to the procurement process, including the management and monitoring controls. Testing covered the identification and planning of the needs until the signature of the contract, including amendments and price revisions, if applicable. It also included payments relating to procurements processed in 2015. The responsibilities of DG HR laid down in the Service Level Agreement concluded between EPSO/EUSA and DG HR for the provision of financial management and procurement services were also included in the audit scope. There are no reservations in DG COMM, SCIC or EPSO/EUSA 2015 Annual Activity Reports that relate to the area/process audited. The fieldwork was finalised between 25 May and 13 June 2016. All observations and recommendations relate to the situation as of that date. Major audit findings DG COMM and EPSO/EUSA

The IAS did not identify any material risks that would give rise to critical or very important recommendations. SCIC The IAS identified one very important issue: ·Procurement process: weaknesses in tender documents, compliance issues The audit revealed non-compliance issues with the Financial Regulation (FR), its Rules of Applications (RAP) or the case law of the European Court of Justice. More specifically, the IAS found weaknesses in the tender documents, such as one procedure in which an award criterion which referred to the experience of the tenderer and therefore overlapped with a similar selection criterion and two procedures in which the tender specifications were either not entirely clear for the tenderers or not fully defined. With regard to the evaluation of tenders, the IAS identified two cases in which the tender specifications were not strictly followed. Furthermore, in one procedure, some tenderers were contacted without ensuring that the other tenderers received the same level of information. Finally, the IAS noted one missing declaration of honour by a tenderer and four missing award decisions for low value procedures. DG SCIC's manual on public procurement provides for a formal visa by the finance unit at the stage of the draft tender documents. However, in practice this control is exercised only in an informal manner. The audit showed that, while the relevant ex-ante controls were carried out at the stage of the budgetary and legal commitment, i.e. after the evaluation and before awarding and signing of the contract, they neither prevented nor detected and corrected the weaknesses observed by the IAS. Recommendation To address this issue, the IAS formulated the following recommendation: ·Procurement Process: weaknesses in tender documents, compliance issues DG SCIC should: · Remind all services and potential members of evaluation committees to ensure compliance with the FR, its RAP and the case law of the European Court of Justice for the cases identified through this audit; · Update its procedures on ex-ante controls on public procurement procedures and formalise the control ensuring that the tender specifications meet the main requirements as set out by the FR and the RAP before the tender documents are published. This should be done for all high value procedures, together with a risk-based selection of low-value procedures; · Revise the internal checklists used for commitments and payments by specifically including the main elements to be checked. 2.Agriculture, natural resources and health 2.1. Audit on the design of DG AGRI's performance measurement system for the CAP 2014-2020 Audit objectives and scope The overall objective of the audit was to assess whether DG AGRI has adequately designed the Common Monitoring and Evaluation Framework (CMEF), including the Common Monitoring and Evaluation System (CMES), in order to monitor, evaluate and report on the performance of the CAP 2014-2020. As the CMEF is still in an early stage of implementation, the audit focused on its design and covered the following main steps:

·A review of the design of the Common Agricultural Policy (CAP) intervention logic, including the CAP objectives and their related indicators; ·A review of the design and preparedness of the processes put in place by DG AGRI for ensuring that reliable data will be available on time for calculating the CMEF indicators values and reporting on them; ·A review of the processes put in place by DG AGRI for providing support to the Member States in the implementation of the CMES, including through the European Evaluation Helpdesk for Rural Development; ·A review of the processes put in place by DG AGRI for planning evaluations of the CAP 2014-2020. The audit scope did not include the following: ·Processes related to the detailed monitoring activities performed by the different units of DG AGRI for the policies they implement; ·Processes for conducting evaluations, as well as processes for managing the contractual relationship with the contractors implementing the European Evaluation Helpdesk; ·Processes for the performance review linked to the performance reserve that Regulation (EU) No 1303/2013 introduced for the European Structural and Investment Funds (ESIF), including the EAFRD. This is a specific process, which may be the subject of a separate audit at a later stage. DG AGRI's 2014 Annual Activity Report (AAR) does not contain any reservation related to the performance measurement framework. The fieldwork was finalised on 4 February 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified three very important issues: ·Quality of objectives, indicators and intervention logic The specific objectives set for Pillar I/Horizontal Provisions (and related indicators) do not always clearly define what the related policy is expected to achieve and, in a few cases, appear not to cover some essential aspects of the CAP's general objectives. In addition, the intervention logic does not always allow to identify which CAP instruments contribute to which objectives and how. ·Consistency and completeness of the CMEF The CMEF does not cover all the various CAP instruments, although it should be noted that those which are not included are subject to performance measurement provisions laid down in their individual legal bases. Furthermore, while the CMEF integrates Pillar I/Horizontal provisions and Pillar II at the level of impact indicators, this is not the case for result indicators. This complicates the work of DG AGRI in demonstrating the combined direct effect of different CAP instruments pursuing the same specific objectives (for example for the payment for young farmers under Pillar I and the measures for young farmers under Pillar II). ·Reliability and availability of data Despite the fact that DG AGRI cooperates effectively with Eurostat, it faces continued problems in obtaining reliable data for calculating the values of certain CMEF indicators, in particular for environmental indicators. This mainly concerns those for which there is no explicit legal basis for requiring the data from Member States. According to DG AGRI, there is a strong resistance from Member States to provide additional data due to the costs involved.

Recommendations To address these issues, the IAS formulated the following recommendations: ·Quality of objectives, indicators and intervention logic DG AGRI should ensure that the CAP specific objectives for Pillar I/Horizontal Provisions are more compliant than at present with the SMART criteria and assess whether there is a need to include related additional indicators, based where possible on available data and taking into account cost effectiveness considerations in order to better demonstrate the achievement of policy objectives. The CAP intervention logic needs to be explained much more clearly. ·Consistency and completeness of the CMEF DG AGRI should develop additional indicators to cover the CAP instruments which are not adequately addressed through the current set of CMEF indicators and use if possible existing data to integrate Pillar I and Pillar II aspects. This does not necessarily mean including additional rural development indicators, which have already been established. In the longer term and for the next multi-annual financial framework programming period, DG AGRI should consider developing a set of result indicators aimed at showing the combined effects of both rural development and Pillar I/Horizontal Provisions. ·Reliability and availability of data For the data which is currently missing, including that relating to environmental indicators, it should follow this up with Eurostat and seek to obtain additional data through the mapping and cross-linking of available data, as well as through research projects. For the data needed to support the CMEF indicators, but for which there is no specific legal obligation on Member States to provide, the DG should assess whether this needs to be addressed through an implementing regulation. 2.2. Audit on DG AGRI's management and control system for Voluntary Coupled Support (VCS) Audit objectives and scope The overall objective of the audit was to assess the design and as far as possible, depending on their stage of implementation, the processes put in place by DG AGRI for managing and controlling VCS. The audit assessed in particular whether these processes effectively contribute to the DG's assurance building process and ensure an effective monitoring of the VCS scheme. The audit assessed the management and control system put in place by DG AGRI for VCS, including performance aspects. It covered the processes put in place by DG AGRI for the review of Member State notifications on their VCS decisions, the guidance provided to Member States, the general design of the internal monitoring process for the implementation of the scheme and the preparedness of the conformity clearance of accounts process regarding the VCS. The audit scope did not include certain provisions permitted under the amended delegated act (i.e. modulated per unit amounts and transfers between measures), as the related processes were either only in progress during the fieldwork of the audit or only applicable to claim year 2016 to be paid under financial year 2017. The first claim year for the VCS was 2015. The Commission reimburses only since the beginning of 2016, the expenditure made by a Member State for 2015. Thus, the 2015 Annual Activity Report (AAR) includes no reservations relating to the VCS. However, it includes a reservation on Direct Payments with regard to 10 Paying Agencies involving 6 Member States. Moreover, in annex 10 of the AAR concerning direct payments (including VCS), DG AGRI identifies risks linked to the past implementation of art. 68 of Regulation (EC) No 73/2009, which might affect the implementation of VCS. It also identifies risks linked to the implementation of the reformed system of Direct Payments, having as root cause the greater complexity of the support schemes, the flexibility given to Member States and their diverging interpretations. In the same annex, DG AGRI defines actions to mitigate these risks. The fieldwork was finalised on 7 June 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified three very important issues: ·Follow-up of VCS notification assessments Through its assessment of VCS notifications, DG AGRI identified a number of issues, which indicated non-compliance and/or the risk of non-compliance and in certain cases had started planning EU pilot procedures. However, there is currently no formalised typology used to categorise the detected issues according to their nature, scope, frequency and seriousness. In addition, there is no clear approach on how to follow up these issues through appropriate available tools (e.g. EU PILOT procedures, reduction or suspension as well as conformity clearance procedures). Finally, it is not clear which service in DG AGRI should primarily be responsible for following up the specific cases where DG AGRI detected a risk of potential cumulative/overlapping support with rural development. ·Monitoring and control of the 2015 financial ceilings

DG AGRI is required under the legislation to monitor and control that the amounts of support per measure do not breach the measure-specific ceilings. However, these ceilings are not always clearly specified. Furthermore, for the claim year 2015, although the general VCS ceiling per Member State is systematically controlled on a monthly basis by the EAGF financial unit, this is not the case for the measure-specific ceilings. The IAS analysed the draft working arrangements that were being developed in this regard at the time of the audit fieldwork and concluded that they needed to be further improved from an effectiveness and efficiency viewpoint. ·Monitoring of VCS performance The objective of the VCS scheme is to create an incentive to maintain agricultural production in vulnerable sectors and /or regions. In monitoring the performance of VCS, DG AGRI compares the total area and the total number of animals for which VCS has been paid with the area or number of animals notified by the Member State in 2014. However, the data on which this analysis is based is not always correct or clear (cases were identified where data were missing and/or calculations were erroneous). In addition, the IAS found only very limited evidence that DG AGRI had assessed whether the amount of support given is proportionate to the difficulties described in relation to those sectors or regions concerned. Also, there is no structured monitoring of the impact of VCS in areas of high overall aggregated EU support or in those areas which are most vulnerable to agricultural market crises. Currently the monitoring arrangements focus more on whether quantitative limits, as notified by the Member States, are respected, rather than at assessing the effect of VCS on the corresponding sector and/or regions. Recommendations To address these issues, the IAS formulated the following recommendations: ·Follow-up of VCS notification assessments DG AGRI should send letters of findings in the context of the conformity clearance procedure as soon as possible so that Member States can resolve the deficiencies identified in time for the claim year 2017. It should also clarify the main conditions on how to follow up issues identified both in the 2014 notifications and for future years, for example through triggering EU PILOT procedures, reduction or suspension provisions as well as conformity clearance procedures. DG AGRI should also develop internally a typology to support the comments made when assessing the VCS notifications. Finally, where DG AGRI detects a risk of potential cumulative/overlapping support with rural development, it should ensure that they are properly followed up on a timely basis. The unit primarily responsible should be clearly designated. ·Monitoring and control of the 2015 financial ceilings DG AGRI should ensure that, for all VCS measures, a fixed measure-specific ceiling is defined. It should also specifically check for the claim year 2015 that the respective ceilings are met and ensure that the staff responsible for this task are properly trained. As from claim year 2016, the checks should be automated. ·Monitoring of VCS performance DG AGRI should identify those VCS measures where the risks of not meeting the scheme's objectives are highest and where there is the greatest likelihood of market distortion. For these measures, DG AGRI should strengthen the current monitoring arrangements, for example by making more use of available complementary data and analysis. 2.3. Audit on public procurement in DG CLIMA Audit objectives and scope The overall objective of the audit was to assess the adequacy of the design and the effective implementation of the service's internal control system with regard to the management of the procurement process and, in particular, its compliance with the Financial Regulation (FR) and its Rules of Application (RAP). This audit tested the key controls throughout the procurement process, from the identification and planning of the needs through to the signature of the contract, including amendments and price revisions and related payments. The audit covered the procurement procedures awarded in 2015 and in 2016 as well as procurement related payments processed in 2015. The activities of the Advisory Committee were also covered. Public procurement procedures relating to budget appropriations that CLIMA has sub-delegated to other DGs or that DG CLIMA has received as sub-delegation from other DGs were excluded from the scope of the audit. There are no reservations in DG CLIMA's 2015 Annual Activity Report that relate to the area/process audited. The fieldwork was finalised on 24 June 2016. All observations and recommendations relate to the situation at that date. Major audit findings

The IAS identified one very important issue: ·Justification of public procurement needs The audit revealed weaknesses in relation to the justification of public procurement needs. More specifically, it was not always possible to clearly demonstrate that a needs analysis had been systematically and consistently made. Furthermore, the documentary evidence to support the justification, verification and approval of certain significant changes to the procurement plan initially decided (for example procurement procedure or budget line) was very limited in practice. The IAS also identified additional weaknesses concerning the definition and the assessment of award criteria and the way in which studies are identified. Recommendation To address this issue, the IAS formulated the following recommendation: DG CLIMA should: ·Ensure that a systematic and consistent analysis of the needs for procurement is performed and documented and that any major modifications in planned procurement procedures during the year are properly justified in writing, approved and documented; ·Intensify awareness-raising activities (guidance, training) and strengthen ex-ante controls (internal supervision) as appropriate to ensure full compliance with the applicable rules and guidance (notably as regards award criteria and identification of studies). 2.4. Audit on staff allocation and process management in response to staff reduction in DG ENV Audit objectives and scope The overall objective of the audit was to assess whether, in the light of the challenges it faces, DG ENV has adequate systems in place for allocating staff and is ensuring that its processes are managed as efficiently as possible. The audit covered DG ENV's HR management processes and in particular, the procedures, systems, methods and tools used to allocate staff aligned with the DG's key priorities and objectives. It also covered the DG's overall approach (including methodologies and practices in place) to identify, propose and implement efficiency gains in its processes. However, the audit did not address the issue as to whether or not the DG has the right organisational structure in place. The 2015 Annual Activity Report (AAR) of DG ENV do not include any reservations related to the process audited. The fieldwork was finalised on 10 June 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS identified one very important issue: ·Workload assessment Currently, DG ENV does not have a structured monitoring framework, together with key workload indicators (including proxy indicators), providing regular and quantitative information on workload in the DG. Recommendation

To address this issue, the IAS formulated the following recommendation: DG ENV should develop key workload indicators, supported by a clear methodological base and ensure that these are periodically monitored and reported in order to optimise the efficient and effective allocation of its resources. 2.5. Audit on pilot projects and preparatory actions in DG SANTE Audit objectives and scope The overall objective of the audit was to assess the effectiveness of the controls covering the financial management of pilot projects and preparatory actions in DG SANTE. In particular, the design and the implementation of the controls in place were reviewed to assess whether they ensure the legality and regularity of the financial procedures and the financial transactions and whether they are effective. The audit also assessed DG SANTE's internal organisation for the prior assessment of the proposed pilot projects and preparatory actions as well the design and implementation of the financial circuits. This audit covered the key controls designed and implemented in the following processes of the financial management of pilot projects and preparatory actions for 2014-2015: ·The processes for ex-ante assessment of the proposed pilot projects and preparatory actions, allocating them within DG SANTE and monitoring and reporting on their implementation; ·The procurement process, from the determination of the needs and planning to the effective implementation of the contract; ·The grants process, from the planning and preparation of the call for proposal to the closure of the grant; and ·The financial circuits of the related grants and procurement, including commitments, payments, de-commitments and recovery orders. Major audit findings The IAS did not identify any material risks that would give rise to critical or very important recommendations. 3.Research, energy and transport 3.1. Audit on Human Resources management in DG CONNECT Audit objectives and scope The overall objective of the audit was to assess the effectiveness of DG CONNECT's Human Resource management system to support the achievement of the DG's priorities and core business. The audit aimed to answer the following main question: "Has DG CONNECT designed and implemented an adequate HR management process to deploy a competent and engaged workforce, in order to deliver the DG's priorities and core business?"

The audit covered the design and implementation of the HR strategy and the HR planning process, including workforce planning (in the light of potential efficiency gains), staff allocation and change management. The audit also covered the activities performed in terms of learning & development, redeployment and career management. Major audit findings The IAS did not identify any material risks that would give rise to critical or very important recommendations. 3.2. Audit on closure of projects of legacy programmes in DG CONNECT Audit objective and scope The objective of the audit was to assess the effectiveness of the process for the closure of DG CONNECT’s projects belonging to the following legacy programmes: ·The Sixth Research Framework Programme (FP6 2003-2006); ·The Seventh Research Framework Programme (FP7 2007-2013); ·The Competitiveness and Innovation Framework Programme (CIP 2007-2013); ·Safer Internet (2009-2013). The audit covered the monitoring and reporting on the closure of projects and the management of the financial distribution report, decommitments, archiving, amendments, complaints and of the implementation of ex-post audit results. There are no observations/reservations in DG CONNECT's 2015 Annual Activity Report that relate to the area/process audited. The following reservations were however made in the 2015 Annual Activity Report concerning legacy programmes: ·For FP7, DG CONNECT estimated a residual error rate of 2.58%, which is above the 2% materiality threshold, and therefore issued a reservation in line with similar reservations expressed by the other DGs of the research family. ·The residual error rate for CIP amounts to 4.42%. DG CONNECT estimated that the residual error rate will not decrease under the materiality threshold at the end of the programme and therefore expressed a reservation on the legality and regularity of these payments. The fieldwork was finalised on 28 November 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS did not identify any material risks that would give rise to critical or very important recommendations.

3.3. Audit on the management and functioning of Euratom Safeguards in DG ENER Audit objective and scope The overall objective of the audit engagement was to assess the efficiency and effectiveness of the systems and procedures in place in DG ENER in ensuring that the EC fulfils its obligations stemming from the Euratom Treaty and international agreements. The audit focused on (1) the EC governance framework associated with the Euratom Safeguards; (2) the design and methodologies of the safeguards system; (3) the procurement of services and equipment supporting inspection activities and (4) human resources management. The audit did not cover IT systems and related operations, the cooperation and coordination with the Euratom Supply Agency and with ENER.D - Nuclear energy, safety and ITER, as well as accompanying inspectors to on-site missions. There are no observations/reservations in the DG's 2014 Annual Activity Report that relate to the area/process audited. The fieldwork was finalised on 16 March 2016. All observations and recommendations relate to the situation as of that date. Major audit findings The IAS did not identify any material risks that would give rise to critical or very important recommendations. 3.4. Audit on the supervision of ITER in DG ENER Audit objective and scope The overall objective of the audit was to assess whether the strategy for the supervision of the ITER project has been adequately designed and effectively implemented. The audit focused in particular on: ·The legal/administrative arrangements of the supervision framework; ·The Commission's supervision strategy on the ITER project management; ·Participation in the work of the ITER IO/F4E governance bodies. There have been no observations/reservations in the Annual Activity Reports of the respective DGs (RTD until 2014, ENER in 2015) that relate to the area/process audited. The fieldwork was finalised on 31 March 2016. All observations and recommendations relate to the situation on that date. However, during the validation/reporting stage, the IAS also took note of the discussion of the evolution of the ITER project, which led to the agreement ad referendum of the long-term schedule by the ITER Council (IC) in June 2016 for the period until 2025. Major audit findings

This IAS identified two very important issues: ·DG ENER's supervision strategy for the ITER organisation and project A number of internal notes on ITER supervision highlight the different aspects and weaknesses of the ITER project set-up (including action plans) but the Commission has not yet defined and implemented a comprehensive supervision strategy for the ITER project. It is no