COMMISSION NOTICE

Guidelines on annual audit reports to be submitted in accordance with Article 15(8) of Directive 2014/40/EU in the context of the EU traceability system for tobacco products

(Text with EEA relevance)

(2020/C 167/01)

DISCLAIMER: The aim of this document is to provide guidance to an approved auditor on the scope of the audit and the procedure for submitting the annual audit report. It is not legally binding but provides general guidelines with recommendations and reflects on best practices. These guidelines are without prejudice to any national rules.

1. Introduction

Articles 15 of Directive 2014/40/EU of the European Parliament and of the Council (1) provide for the establishment of an EU-wide system of traceability for tobacco products in order to address the issue of illicit trade. The system became operational on 20 May 2019.

As part of that system Article 15(8) of Directive 2014/40/EU requires Member States to ensure that manufacturers and importers of tobacco products conclude data storage contracts with an independent third party (‘third-party provider’) for the purpose of establishing a data storage facility to host data related to tobacco products of individual manufacturers and importers (‘primary repository’).

To safeguard the independent operation of the traceability system, Article 15(8) of Directive 2014/40/EU stipulates that an external auditor shall monitor the activities of the primary repository and its third-party provider. The auditor shall be proposed and paid by the tobacco manufacturer, and be approved by the Commission. The external auditor shall submit its assessment by means of an annual report to the national competent authorities and to the Commission assessing in particular any irregularities in relation to access.

This document is intended to provide guidance to an approved auditor on the scope of the audit and the procedure for submitting the annual audit report. It should be read in conjunction with Commission Implementing Regulation (EU) 2018/574 (2), which sets out the technical requirements for the establishment and operation of the traceability system, including for primary repositories and Commission Delegated Regulation (EU) 2018/573 (3) defining the key elements of data storage contracts to be concluded as part of a traceability system.

This document is offered as a tool to assist approved auditors; these are non-binding guidelines and they do not create any new legal obligations. To the extent that these guidelines may interpret legislation, the Commission’s position is without prejudice to any interpretation of this Directive that may be issued by the Court of Justice of the European Union.

2. General context of audits

Each primary repository contracted by a manufacturer is subject to an annual audit process. Where the same third-party provider operates two or more primary repositories, a separate audit should be carried out and a separate audit report should be submitted for each repository.

An audit should be conducted in relation to a primary repository and its related services, including an assessment of whether the respective third-party provider and, if applicable, its sub-contractors comply with the relevant legislative requirements set out in Directive 2014/40/EU, Implementing Regulation (EU) 2018/574 and Delegated Regulation (EU) 2018/573.

Each manufacturer or importer must notify the Commission of the auditor it proposes to audit its primary repository and the respective third-party provider. All proposed auditors are subject to approval by the Commission.

3. Scope of audits

Scope and objective

Audit reports should be submitted in order to inform the national competent authorities and the Commission about the findings of auditors, in particular concerning any irregularities in relation to access to the data stored by primary repositories.

Audit reports should dedicate separate chapters to each of the six domains outlined below. Each chapter should address the verification points of the respective domain, as listed in the checklist provided in the Annex.

Audits should be carried out in accordance with that checklist, which sets out the required domains and verification points in line with ISO/IEC 27001:2013 on Information Security Management Systems (4). To that end, auditors should note that Article 10 of Commission Delegated Regulation (EU) 2018/573 refers to ISO/IEC 27001:2013 as the preferred information security management standard in the context of operating primary repositories.

Domain Objectives Organisational and physical security To establish a management framework for information security within the organisation. To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered. To prevent unauthorised physical access, damage or interference to organisation, including information and information processing facilities. To prevent loss, damage, theft or compromise of assets and interruption to the organisation’s operations. Operations Security To ensure correct and secure operations of information processing facilities. To protect against loss of data. To record events and generate evidence. To ensure integrity of operational systems. To prevent exploitation of technical vulnerabilities. Access control (users and applications) To limit access to information and information processing facilities. To ensure authorised user access and to prevent unauthorised access to system and services. To make users accountable for safeguarding their authentication information. To prevent unauthorised access to systems and applications. To ensure that information security is designed and implemented within the development lifecycle of information systems. Communications security To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information. To ensure the protection of information in networks and its supporting information processing facilities. To maintain the security of information transferred within the organisation and within external entities. Business continuity To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses. Information security continuity shall be embedded in the organisation business continuity management systems. To ensure availability of information processing facilities. To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements. Assets and Data integrity To identify the organisational assets and define the appropriate protection responsibilities. To ensure that information receives an appropriate level of protection. To prevent unauthorised disclosure, modification, removal or destruction of information stored on media.

Conclusions and recommendations

Conclusions of an audit should be provided for each verification point listed in the checklist.

An audit report should only highlight and elaborate findings related to non-compliance issues or other identified risks. Findings should also be accompanied by appropriate recommendations setting out the actions required to eliminate the issues and shortcomings identified during the audit.

4. Procedural aspects

Frequency

Auditors are required to submit their audit reports on an annual basis. Since the traceability system became operational on 20 May 2019, auditors are invited to submit their first annual audit reports, covering the first operational year of the traceability system (i.e. 20 May 2019 to 19 May 2020), by 30 November 2020. Thereafter, auditors are invited to submit annual reports for subsequent operational years by the end of October of each calendar year.

Audit follow-up

Where a follow-up is carried out to assess whether the concerned third-party provider has adequately implemented the recommendations of the annual audit report, the auditor, where possible, is invited to submit the results to the Commission and to the national competent authorities within three months from the submission of the annual audit report.

5. Procedural aspects of audit reports

Information on auditors

The names of the auditor(s) and, where applicable, the associated audit firm(s), should be indicated in the introduction of the audit report.

Format

The audit report should be provided in electronic format (searchable, non-protected PDF).

If possible, the auditors are invited to submit the annual reports to the Commission in English.

Submission procedure

The annual audit report and any follow up to such report, should be submitted electronically via email to SANTE-TT-SW@ec.europa.eu with the following subject: ‘Audit report [Follow-up to the audit report] for [year] – [Name of contracting manufacturer] – [Name of audited third-party provider]’

Transparency

In order to promote the overall transparency and accountability of the traceability system for tobacco products, the Commission invites the manufacturers, on a voluntary basis, to agree with their respective auditors to submit to the Commission also a public version of their audit report, excluding any personal and commercially sensitive data.

Such public versions of the audit reports would be published on Commission’s dedicated webpage.

(1) Directive 2014/40/EU of the European Parliament and of the Council of 3 April 2014 on the approximation of the laws, regulations and administrative provisions of the Member States concerning the manufacture, presentation and sale of tobacco and related products and repealing Directive 2001/37/EC (OJ L 127, 29.4.2014, p. 1).

(2) Commission Implementing Regulation (EU) 2018/574 of 15 December 2017 on technical standards for the establishment and operation of a traceability system for tobacco products (OJ L 96, 16.4.2018, p. 7).

(3) Commission Delegated Regulation (EU) 2018/573 of 15 December 2017 on key elements of data storage contracts to be concluded as part of a traceability system for tobacco products (OJ L 96, 16.4.2018, p. 1).

(4) ISO/IEC 27001:2013. Information technology – Security techniques – Information security management systems – Requirements. The requirements set out in ISO/IEC 27001:2013 are generic and are intended to be applicable to all organisations, regardless of type, size or nature.