EUROPEAN COMMISSION Brussels, 29.4.2019 SWD(2019) 171 final COMMISSION STAFF WORKING DOCUMENT FRAUD RISK ASSESSMENT Accompanying the document COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE, THE COMMITTEE OF THE REGIONS AND THE COURT OF AUDITORS Commission Anti-Fraud Strategy: enhanced action to protect the EU budget {COM(2019) 196 final} - {SWD(2019) 170 final}



COMMISSION STAFF WORKING DOCUMENT FRAUD RISK ASSESSMENT Accompanying the document COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE, THE COMMITTEE OF THE REGIONS AND THE COURT OF AUDITORS Commission Anti-Fraud Strategy: enhanced action to protect the EU budget TABLE OF CONTENTS Key abbreviations 1.Introduction 2.Scope and methods 3.Focus and structure 4.Detected fraud and fraud patterns in EU spending 4.1.Detected fraud 4.2.Fraud patterns 4.2.1. Overview 4.2.2.External fraud 4.2.3.Internal fraud 4.2.4.Fraud trends 5.Fraud vulnerabilities 5.1.Data collection and analysis

5.2.Coordination, cooperation and processes 5.2.1.Coordination of fraud risk management 5.2.2.Cooperation with other EU bodies and with Member States 5.2.3.Cooperation and flow of information between OLAF and Commission services/executive agencies and other EU bodies 5.2.4. Procurement under shared management 5.2.5.Procurement and grants in direct management 5.2.6.Financial instruments and budgetary guarantees 5.2.7.External aid 5.2.8.Cybersecurity 5.3.Integrity and compliance 5.4.Know-how and equipment 5.5.Transparency 5.6.Legal framework 6.Revenue fraud 6.1.Traditional own resources (TOR) 6.2.Value added tax (VAT) Key abbreviations

Abbreviations Meaning AOD Authorising Officer by Delegation APC Audit Progress Committee CAFS Commission Anti-Fraud Strategy COCOLAF Advisory Committee for the Coordination of Fraud Prevention DG Directorate-General DG BUDG Directorate-General for Budget DG TAXUD Directorate-General for Taxation and Customs Union ECA European Court of Auditors EDES Early Detection and Exclusion System EIB European Investment Bank EIF European Investment Fund EPPO European Public Prosecutor’s Office EU European Union Eurojust EU Agency for Criminal Justice Cooperation Europol EU Agency for Law Enforcement Cooperation FDR Fraud detection rate FN Footnote FR Financial Regulation IAS Internal Audit Service IDOC Investigation and Disciplinary Office of the Commission IMS Irregularity Management System MAA Mutual Administrative Assistance MFF Multiannual Financial Framework OLAF European Anti-Fraud Office OLAF Regulation Regulation (EU, Euratom) No 883/2013 PIF Protection of the EU’s financial interests PIF Directive Directive (EU) 2017/1371 PIF Report The Commission’s annual report to the European Parliament and to the Council on the protection of the European Union’s financial interests — Fight against fraud, provided for in Article 325(5) TFEU SOCTA Serious and Organised Crime Threat Assessment TFEU Treaty on the Functioning of the European Union TOR Traditional own resources VAT Value added tax WHO World Health Organisation



1. Introduction On 24 June 2011, the Commission adopted its current anti-fraud strategy. This comprised two documents: (i) a Communication from the Commission to the other EU institutions, describing strategic objectives and key operational steps to attain them; and (ii) a more detailed Commission-internal Action Plan . Taking into account developments in the (anti-)fraud landscape and in the design of EU policies, the Commission has reviewed its anti-fraud strategy to prepare for the Multiannual Financial Framework (MFF) 2021 – 2027. The Commission services have carried out a fraud risk assessment for that purpose, involving also the executive agencies. The results are presented in this staff working document, which accompanies the Communication ‘Commission Anti-Fraud Strategy: enhanced action to protect the EU budget’ . The two main vulnerabilities identified in the fraud risk assessment are: (i) an underdeveloped central analytical capacity and (ii) certain gaps in the Commission’s supervision of fraud risk management at department level. The priority objectives of the review, explained in the Communication, are therefore to equip the Commission with a stronger analytical capability and a more centralised system of oversight for the anti-fraud action of its departments. The other key objectives, also based on the fraud risk assessment and on the guiding principles and standards of the 2019 Commission Anti-Fraud Strategy (‘the 2019 CAFS’) , are to maintain the highest standards of professional ethics and competence, to optimise the legal framework for and transparency of EU funding and to improve the fight against revenue fraud. The Commission has prepared an action plan in the form of a staff working document to achieve the objectives and rectify the weaknesses identified by the fraud risk assessment. Another (separate) staff working document presents an evaluation of the 2011 CAFS .



2. Scope and methods In 2017, the Commission adopted a Communication on a revised Internal Control Framework . This includes risk assessment as one of its five main components (alongside control environment, control activities, information/communication and monitoring activities). As part of the risk assessment component, Principle 8 of the Internal Control Framework requires that ‘The Commission considers the potential for fraud in assessing risks to the achievement of objectives’. In that context, fraud is characterised as a broad concept which includes ‘notably fraudulent reporting, loss of assets, disclosure of sensitive information and corruption.’ The scope of the 2019 CAFS strikes a balance between the nonspecific concept of fraud in the Internal Control Framework and a narrow understanding of fraud as a criminal offence. More broadly, the 2019 CAFS focuses on protecting the EU’s financial interests from fraud, corruption and other intentional irregularities and from the risk of serious wrongdoing inside the EU’s institutions and bodies. These areas are also central to the legislator in the fight against fraud. As a result, the 2019 CAFS covers: ofraud – including VAT fraud –, corruption and misappropriation affecting the EU’s financial interests, as defined in Articles 3 and 4 of the ‘PIF Directive’ ; oother criminal offences affecting the EU’s financial interests, e.g., offences linked to an abuse of procurement procedures where they affect the EU budget; oirregularities as defined in Article 1(2) of Regulation (EC, Euratom) No 2988/95 (insofar as they are intentional but not already captured by the criminal offences referred to above); and oserious breaches of professional obligations by Members or staff of the EU’s institutions and bodies, as referred to in Article 1(4) of the OLAF Regulation and in the second subparagraph of Article 2(1) of Commission Decision (EC, ECSC, Euratom) No 352/1999 . Other non-financial types of fraud affecting EU interests in specific policies such as intellectual property or food safety are of a less cross-cutting nature. Coordinating the Commission’s fight against such types of fraud is therefore not prioritised in the 2019 CAFS, which focuses on preparing for the MFF post-2020. To prepare for the CAFS review, all Commission services and executive agencies were asked to update their own service-level fraud risk assessments to feed into a corporate fraud risk assessment. As the lead service for the CAFS, OLAF facilitated the exercise by organising five workshops among services with a comparable profile. OLAF’s methodological guidance for service-level anti-fraud strategies sets out minimum standards for fraud risk assessments but leaves the Commission services and executive agencies a certain margin of discretion, in accordance with the decentralised model of financial management, which — pursuant to the second sentence of Article 74(2) of the Financial Regulation — assigns the responsibility for risk analysis to the authorising officers by delegation (AODs). A bottom-up approach has been taken to assess fraud risks at Commission level, meaning that the departments’ point of view is taken into account and a variety of methods are applied to risk assessment at department level depending on its specific characteristics.

OLAF has compiled a qualitative fraud risk assessment for the Commission. This is based on the contributions received, a desk review of Commission reports, audit observations and other sources (such as the annual OLAF reports and Europol’s Serious and Organised Crime Threat Assessments). This assessment is qualitative in that it is mainly built on the professional judgement of managers, internal control coordinators, operational services, financial units, OLAF investigators and OLAF contact points in the Commission services and executive agencies and supported in part by data from audit results, investigations and other sources. At present, the Commission does not have a comprehensive centralised data collection and analysis capacity which would enable it to develop a quantitative fraud risk assessment. Therefore, the risk assessment does not categorise the fraud risks in order of likelihood and impact, as that could create a misleading impression of mathematical accuracy. The qualitative fraud risk assessment presented below focuses on issues that affect all Commission departments or that are particularly significant. More specific risks, on the other hand, should continue to be reflected in the services’ anti-fraud strategies. The assessment does not give an exhaustive overview of policy-specific fraud risks as this would take away from the big picture.

3. Focus and structure The fraud risk assessment has been guided by the questions of why and how fraud is committed. According to the traditional criminological model of the ‘Fraud Triangle’ , three elements must coincide for fraud to occur: (i) ‘pressure’ as the motivation; (ii) ‘rationalisation’ as a self-justifying attitude; and (iii) perceived ‘opportunity’. The traditional Fraud Triangle has recently been developed into a slightly more complex ‘New Fraud Triangle’, The New Fraud Triangle further differentiates the elements of pressure/motivation and rationalisation/self-justification as follows. ·Pressure or motivation comprises the aspects of money, ideology, coercion and ego. For example: –ideological motivation is that which considers participation in a fraud act as a means to achieve some perceived greater good; –coercion occurs when individuals may be unwillingly pulled into a fraud scheme, but those individuals can turn into whistle-blowers; –ego may provide a motive for fraud where the offence serves to protect the offender’s reputation or position of power.

·Rationalisation or self-justification reflects the potential offender’s personal belief system and their standards of personal integrity. From a practical point of view, observing a person’s commitment to ethical decision-making can help in assessing integrity and thus an individual’s likelihood to commit fraud. The New Fraud Triangle also adds the fraudster’s capabilities to the equation . While the motivation and technical capabilities of perpetrators are difficult to observe, the above model suggests that any weaknesses of the Commission’s internal control system and any deficiencies in staff members’ integrity can increase fraud risks. The Commission’s fraud risk assessment therefore focuses on potential systemic weaknesses. As deficiencies in integrity are difficult to observe directly before an act of fraud is committed, the fraud risk assessment looks at typical pitfalls and at the quality of systems in place to prevent them. The assessment below summarises vulnerabilities in seven categories: (i) data collection and analysis; (ii) coordination, cooperation and processes; (iii) integrity and compliance; (iv) know-how and equipment; (v) transparency; (vi) legal framework; and (vii) revenue. The objectives set out in the Communication on the 2019 CAFS aim to mitigate the risks related to these categories. As the accompanying Action Plan refers to the objectives of the 2019 CAFS, it indirectly refers to the risk categories outlined in the Fraud Risk Assessment. For each action point, the Action Plan indicates which objective it serves and, thus, which kind of vulnerability that particular action is supposed to reduce. The assessment of vulnerabilities is complemented by key figures that show the dimension of detected fraud and an overview of generic fraud patterns as perceived by the Commission’s departments. Knowledge about relevant fraud patterns helps us analyse how fraudsters may take advantage of vulnerabilities and what can be done to prevent it. 'The risk assessment gives an overview of detected fraud and fraud patterns, which may take advantage of one or more than one of the vulnerabilities discussed, and then addresses each of the seven categories mentioned above. For revenue fraud, both fraud patterns and vulnerabilities are discussed in the last chapter of this staff working document.



4. Detected fraud and fraud patterns in EU spending 4.1. Detected fraud

Based on the Commission’s accounting system and the Member States’ reporting on fraud cases in shared management, in 2013–2017 the overall detected fraud in EU spending amounted to 0.27 % of total payments (fraud detection rate) . The fraud detection rate (FDR) varies between spending areas. For the reference period 2013-2017, the FDR in the overall area of ‘natural resources’ was 0.13 %, with a higher estimate for the subsection ‘rural development’ (0.25 %) than for ‘support to agriculture’ (0.09 %). In the same period the FDR for ‘direct expenditure’ was 0.03 %. Given the multiannual framework for spending in the ‘cohesion and fisheries’ area, the relevant FDR is calculated for the whole programming period. For 2007-2013, the FDR was 0.44 %. With the implementation still under way, there is insufficient data to provide a meaningful analysis for the 2014-2020 programming period. Fraud-related damage to the financial interests of the EU, which appears to be rather limited according to these figures, is not the only dimension of fraud. Internal fraud, i.e. misconduct by EU staff or Members of EU institutions with potential impact on the institutions’ reputation is also an issue. For example, internal fraud was found in 12 OLAF investigations concluded in 2017 resulting in recommendations for follow-up across all EU institutions and bodies and in 24 cases concluded in 2017 with follow-up by the Commission’s Investigation and Disciplinary Office (IDOC) . However, these figures must be taken in context. They represent a very small proportion of the roughly 32 000 people working for the Commission and approximately 50 000 working for all EU institutions and bodies. With the data and analytical tools currently available, the Commission is not in a position to provide a reliable estimate of undetected fraud. Out of roughly 1 000 examined transactions per year, the European Court of Auditors found suspected fraud in 11 cases in 2016, down from 27 in 2015 . This indicates that although the proportion of fraud may be higher than in the above detection statistics, it remains limited. 4.2. Fraud patterns 4.2.1. Overview Regarding fraud patterns, the suspected fraud found by the European Court of Auditors most frequently concerned: (i) the artificial creation of conditions to meet eligibility criteria; (ii) the non-delivery of goods/services; (iii) a declaration of costs that does not meet the eligibility criteria; (iv) conflicts of interest; and (v) other procurement irregularities. According to feedback by the Commission’s departments in the risk assessment exercise, the ‘top 10’fraud patterns cited were: EXTERNAL FRAUD Cited by % of services Cost overcharging in general Falsification of invoices or certificates Double-funding (Self-)Plagiarism Collusion between tenderers Falsification of timesheets Irregular subcontracting 50 % 43 % 38 % 33 % 26 % 19 % 19 % INTERNAL FRAUD Cited by % of services Undeclared conflict of interest 60 % Leakage of confidential information 57 % Fraudulent entitlement claims 21 % These figures obviously only give a rough idea of fraud patterns based on the professional judgement of managers and staff responsible for operations and internal control in the Commission services and executive agencies. However, they are partly supported by investigative experience. 4.2.2. External fraud The OLAF Report 2016 cites public procurement fraud — facilitated for example through corruption, irregular or fictitious subcontracting or the use of offshore accounts — as the most important focus of OLAF investigations . Recent OLAF reports also highlight plagiarism, fraudulent double-funding, falsification of CVs and timesheets and creating bogus subsidiaries or hiding links between companies as frequent fraud patterns . The vulnerability of public procurement is also reflected in the European Court of Auditors’ observation that ‘Failure to comply with public procurement rules has been a perennial and significant source of error’ , although it should be noted that the complexity of rules is itself a significant source of errors. Involvement of organised criminal groups has been detected both in expenditure and revenue fraud, and is especially significant in the latter . The EU’s response to organised crime is coordinated between EU institutions and agencies and the Member States in the framework of a ‘policy cycle’ in which Europol and the Council’s Standing Committee on operational cooperation on internal security play key roles . This policy cycle comprises: (i) fact-finding and policy development; (ii) policy setting and decision-making; (iii) implementation and monitoring; and (iv) evaluation and recommendations for further policy development. For the period 2018-2021, the Council has defined 10 policy priorities, several of which relate to the fight against fraud . The EU strategy for the fight against cigarette smuggling and other forms of illicit trade in tobacco products , whose action plan was recently updated, also puts a strong focus on tackling organised crime. 4.2.3. Internal fraud Regarding internal fraud, conflicts of interest and breaches of confidentiality are recurrent forms of internal misconduct examined by the Commission’s Investigation and Disciplinary Office (IDOC) . However the frequency of such incidents does not match the high alert they raise among Commission services and executive agencies . There are three possible explanations for this discrepancy, alone or in combination: (i) an insufficient detection rate; (ii) conflict of interest may be an issue observed under shared management more than under direct management; and (iii) services are very concerned about conflicts of interest and breaches of confidentiality because of the potentially high reputational impact but less so because of the likelihood of those risks to materialise. Analysing this further, reporting on irregularities by Member States does not support the second explanation: According to the statistics for 2016 , around 2 % only of irregularities reported as fraudulent were linked to ethics and integrity. While this finding would not rule out the first explanation, i.e. an insufficient detection rate in general, that explanation is not supported, at least for direct management, by observations of the European Court of Auditors, which attest to the good standard of procurement procedures managed by the EU institutions – a domain that is particularly prone to conflict of interest and breaches of confidentiality. In conclusion, the most persuasive explanation for the widespread concern about those issues among Commission services and executive agencies is the potentially serious impact of such infringements of professional ethics on the institution's reputation, rather than an elevated likelihood of those infringements to occur within the Commission or its executive agencies. The IDOC’s annual reports reveal that one of the most frequent types of alleged misconduct registered in 2015–2017 was harassment and other inappropriate behaviour . Harassment and other behaviour reflecting adversely on a member of EU staff is prohibited by Articles 12a and 12, respectively, of the Staff Regulations . As a serious breach of professional obligations, harassment could fall under the concept of fraud as outlined in Section 2 above. However, although harassment and other inappropriate behaviour may negatively affect work inside the EU institutions and thus decrease the effectiveness of the EU’s fight against fraud, the Commission considers that the challenge is being met through existing means of legal recourse. These are most notably the institutions’ disciplinary powers and their obligation to assist the victim in line with Article 24 of the Staff Regulations but also informal mechanisms —particularly the Network of Confidential Counsellors put in place by the Commission . While the CAFS does not, therefore, look into the issue of harassment and other inappropriate behaviour in more depth, some of the measures proposed, for example on awareness-raising and whistle-blowing, will also help with the fight against harassment and other such personal misconduct. 4.2.4. Fraud trends The above overview of fraud patterns does not point to any ground-breaking emerging trends in the ‘fraud landscape’. Ongoing and future developments are/could be linked to: –changes in the Commission’s delivery model with the increased use of digital communication channels and related increase in exposure to cybersecurity risks; –changes in commercial delivery models that frustrate the usual control procedures (e.g. paperless boarding passes or, more generally, the rapid expansion of e-commerce and the challenges it poses to customs and tax administrations); and/or

–new technology that provides fresh opportunities for fraudsters, for example enabling ever more sophisticated forgery . Risks related to the adequacy of measures to prevent and respond to IT security threats are already among the top critical risks affecting the Commission as a whole.



5. Fraud vulnerabilities 5.1. Data collection and analysis Data collection and analysis contribute to the fight against fraud in various ways. oObserving the ‘(anti-)fraud landscape’ in the EU and beyond may provide insight into emerging fraud patterns and innovative ways of preventing and detecting fraud.

oCollecting and analysing data on established and suspected cases of fraud may deepen knowledge on vulnerabilities, fraud patterns and profiles of fraudsters and help to deploy control mechanisms and resources in the most effective and efficient way possible. oProject databases combined with tools that process data on risk profiles and fraud indicators (‘red flags’) may help with fraud detection or potentially reduce the risk of double-funding or overcharging of cost claims. Conversely, any missed opportunities in this respect could potentially weaken the Commission’s defences against attempts of fraud. The Commission is already active in anti-fraud intelligence and analysis. oTo observe the global anti-fraud landscape and to exchange views with experts from the public and the private sector, OLAF and other Commission departments regularly take an active part in anti-fraud and anti-corruption fora, such as: –the conference of international investigators ; –the Economic Crime Agencies’ Network (ECAN) ; –European Partners against Corruption (EPAC) and the European contact point network against corruption (EACN) ; –OECD’s Global Anti-Corruption and Integrity Forum ; –the International Association of Anti-Corruption Authorities (IAACA) ; –the International Corruption Hunters’ Alliance (ICHA) .

–the Conference of State Parties to the United Nations Convention against Corruption and two of its subsidiary bodies, the Implementation Review Group meetings and the Open-ended Intergovernmental Working Group on the Prevention of Corruption ; –the G20 Anti-corruption working group; and –the EU anti-corruption experience-sharing programme . oData on cases of established and suspected fraud are mainly collected in two databases. 1)Irregularity Management System (IMS):

In shared management, sector-specific legislation obliges Member States to report established and suspected irregularities, including fraud, to the Commission. OLAF provides the necessary technical infrastructure — the IMS — and coordinates reporting procedures. Data collected through the IMS are increasingly analysed and used to prevent fraud.

2)Early Detection and Exclusion System (EDES):

The EDES, established under Articles 135–145 of the Financial Regulation, is a significant advance in sanctioning fraudsters swiftly and effectively and in proactively protecting the EU budget while respecting due process. It allows Commission services and other EU institutions and bodies to flag up financial risks posed by (potential) recipients of EU funds and to exclude unreliable ones from EU funding in direct and indirect management. OLAF investigations, audits conducted by Commission services or by the European Court of Auditors (ECA), alerts received from entrusted entities under indirect management and reports transmitted by national authorities through the IMS provide valuable information for this process.

oThe Commission processes risk profiles and supports the analysis of big data for fraud prevention purposes through a number of projects. Examples include:

–‘DAISY’ — an analytical tool for the departments responsible for research that processes risk profiles and red flags to focus audit capabilities and other control resources on the most risk-prone projects.

–‘ARACHNE’ promotes a risk-based approach to project verification in shared management (European Structural and Investment Funds). ARACHNE is a risk scoring tool that feeds a database of projects with publicly available information to identify the most risk-prone projects. Based on a set of pre-defined risk indicators, it continually sifts through internal and external data on beneficiaries, contractors and sub-contractors and determines potentially irregular circumstances.

–The Single Electronic Data Interchange Area (‘SEDIA’), put in place for public procurement and grants in direct management in line with Article 147(1) of the Financial Regulation can also facilitate checks for double-funding to a certain extent.

–‘DIGIWHIST’, a project coordinated by the University of Cambridge and co-financed under the Horizon 2020 programme, is developing an open data assessment tool for public procurement. This tool will systematically collect, analyse, and broadly disseminate information on public procurement and on systems that increase the accountability of public officials. It covers 35 countries (EU-28 plus some neighbouring countries). This data will be linked to data on company and public body finances and ownership and on systems that increase public officials’ accountability. The aim is to systematically investigate the patterns and systems of allocating public resources in Europe. However, more remains to be done in each of these areas concerning data collection and analysis, resources permitting. oTo observe the (anti-)fraud landscape, a more intense exchange of views with academia from a criminological angle could be sought, e.g., by commissioning studies of national crime and organised crime statistics, studies of illegal or black markets and perception surveys, among others. Policy suggestions gathered at international fora could be evaluated more systematically and criminological research on fraud could be supported and exploited more proactively.

oData quality in the IMS is affected by inconsistent reporting practices among Member States. This shortcoming is only partially mitigated by guidance developed by national experts in the Advisory Committee for Coordination of Fraud Prevention with support from OLAF. The analytical dimension of the IMS has not yet been fully explored, and the EDES cannot store any information on fraud patterns but only records entities excluded due to fraud or other grounds provided for in the Financial Regulation.

oRisk scoring tools are only available for a few Commission services and spending programmes and have not been put into use by all the Member States in shared management, although some Member States use their own alternative tools .

Such gaps in the availability and analysis of data for fraud prevention and detection purposes could be filled if the Commission were to have a strong and centralised analytical capability. In the area of traditional own resources, timely data analysis is crucial in the fight against fraud and has accordingly been put into practice. In addition to its key role in collecting data and providing EU-wide databases, the Commission — notably through its Joint Research Centre and OLAF — has developed several tools to monitor and identify suspicious activities. These include the Automated Monitoring Tool (AMT) and the Contraffic project . This work is shared with Member States who may react to OLAF alerts or conduct their own analysis. Feedback is encouraged, and OLAF is keen to engage with users to identify possibilities for refining its alerts, including expanding their scope and using wider data sources to improve accuracy. The Commission is also developing data analysis tools together with Member States to make better use of the available data sources to fight customs fraud. 5.2. Coordination, cooperation and processes This section examines possible vulnerabilities in three areas: (i) in the coordination of fraud risk management across Commission services and executive agencies; (ii) in the structure of cooperation with other EU bodies and with Member States; and (iii) in processes for the prevention and detection of fraud in specific fields.

5.2.1. Coordination of fraud risk management Coordination of fraud risk management ensures that largely homogeneous and consistent approaches and methods are applied across Commission services and executive agencies and that the resources available to prevent and detect fraud are deployed effectively and efficiently. Conversely, a lack of coordination decreases the effectiveness and efficiency of the Commission’s fight against fraud. Fraud risk management in the Commission is organised in a decentralised way. In line with Articles 74(2), 36(2)(d) of the Financial Regulation, internal control, including fraud prevention and detection, is under the responsibility of authorising officers by delegation. As set out in Article 1(2) of the OLAF Regulation, OLAF contributes to the design and development of methods to prevent and combat fraud, corruption and any other illegal activity that affects the EU’s financial interests. The heads of Commission services and executive agencies play a key role in shaping the Commission’s anti-fraud policies at the stages of: oplanning (service-level anti-fraud strategies, management plans), oimplementation (control activities, recovery, administrative sanctions), and oreporting (annual activity reports, contributions feeding into the Commission’s Annual Management and Performance Report and annual Report on the Protection of the EU’s Financial Interests). To fulfil those tasks, Commission services and executive agencies are supported by the Commission’s Secretariat General and Directorate-General for Budget (DG BUDG) and by OLAF, in particular through: omethodological guidance and, on request, individual advice for services’ anti-fraud strategies (OLAF); othe Commission’s Internal Control Framework and Network of Internal Control Coordinators, chaired by DG BUDG; oreview and advice on the anti-fraud aspects of services’ management plans and annual activity reports (OLAF); oOLAF’s leading role in compiling the Commission’s annual Report on the Protection of the EU’s financial interests; oDG BUDG’s role in carrying out recoveries and as lead service for the Early Detection and Exclusion System; and omoderation of the Commission’s Fraud Prevention and Detection Network as a forum for the exchange of best practice among services’ anti-fraud experts (OLAF). Moreover, in accordance with Article 118(1) of the Financial Regulation, the Commission’s Internal Audit Service (IAS) assesses departments’ risk management and advises the institution in that respect. The quality and content of internal audit work and the follow-up given to internal and external audit recommendations and to requests made by the discharge authority are monitored by the Commission’s Audit Progress Committee in line with its charter . These coordination and monitoring activities provide services with several channels of advice and exchange while leaving them plenty of room to develop their own anti-fraud policies. Despite this significant support at corporate level, OLAF’s support role is only advisory in nature, which means that service-level approaches may diverge. OLAF’s review of management plans and annual activity reports respects the departments’ autonomy and is mostly limited to avoiding major inconsistencies and observing a few formal criteria such as the frequency of updates and monitoring exercises for services’ anti-fraud strategies. Services’ fraud risk assessments and mitigation strategies are rarely challenged in substance. Given the above, a residual risk exists that the effectiveness and efficiency of anti-fraud controls across the spectrum of Commission services and executive agencies varies and that controls can be suboptimal in some cases. Risks related to certain weaknesses in corporate oversight were also flagged in a 2015 audit by the Commission’s IAS on the ‘Adequacy and effective implementation of DG’s anti-fraud strategies’. OLAF is taking up a stronger role providing effective and targeted oversight in that regard. 5.2.2. Cooperation with other EU bodies and with Member States Other EU bodies for which the Commission bears a certain measure of political responsibility, namely decentralised agencies, joint undertakings (JU) and joint technology initiatives (JTI), are in charge of their own anti-fraud policies. In defining these policies, those bodies are subject to similar legal principles as the Commission and the executive agencies. Unlike the latter, the afore-mentioned EU bodies do not form part of the Commission’s Fraud Prevention and Detection Network, but policy coordination happens in different ways. In the research area, JUs have adopted the Research family anti-fraud strategy and are fully integrated in the groups managing the anti-fraud efforts. For decentralised agencies, coordination – to a lesser degree – is arranged through an Inter-Agency Network. The Commission is also represented on the management boards or similar governing bodies of decentralised agencies, JU and JTI.

This relatively loose coordination poses risks to the quality of EU bodies’ anti-fraud controls. OLAF, DG BUDG and the partner DGs of decentralised agencies, JU and JTI mitigate such risks in the following ways: (i) by using methodological guidance for anti-fraud strategies; (ii) by participating in training/knowledge-sharing organised by the Inter-Agency Network; and (iii) through the monitoring of anti-fraud policies by the agencies’ management boards. However, the legal autonomy of the EU bodies in question sets limits to coordination. In the case of JU and JTI, cultural differences brought about by cooperation with partners from the private sector may add to potential difficulties but can also provide innovative perspectives. Concerning Member States, national authorities involved in shared management are subject to the principle of sound financial management but have some leeway as to its implementation. In the area of European Structural and Investment Funds , in accordance with the Common Provisions Regulation (CPR) , national authorities must prevent, detect and correct irregularities (Article 122(2) CPR) and put in place effective and proportionate anti-fraud measures taking into account the risks identified (Article 125(4)(c) CPR). Yet, statistics gathered from Member States’ reporting through the IMS show that among EU countries, the fraud detection rate (i.e. the proportion of payments found to be affected by fraud out of total payments), varied between less than 0.01 % and 1.02 % in 2013-2017 . While there could be many reasons for such discrepancies, there is at least a possibility that they are due to differences in the effectiveness of anti-fraud measures between individual Member States. A lack of consistently effective anti-fraud policies in shared management, which accounts for up to 80 % of the EU budget, exposes the budget to substantial risks. Commission services responsible for shared management and OLAF regularly work with experts from the Member States to coordinate anti-fraud policies. Under the Advisory Committee for the Coordination of Fraud Prevention (COCOLAF), OLAF continues to encourage Member States to develop national anti-fraud strategies, and in 2016 COCOLAF adopted guidelines in this respect. Ideally, anti-fraud measures required under the CPR should be embedded in a comprehensive national anti-fraud strategy. To date, 10 Member States have put in place a national strategy. The European Parliament expressed regret that not all Member States have taken that step . 5.2.3. Cooperation and flow of information between OLAF and Commission services/executive agencies and other EU bodies Article 8(1) of the OLAF Regulation requires the institutions, bodies, offices and agencies to transmit to OLAF without delay any information relating to possible cases of fraud, corruption or any other illegal activity affecting the financial interests of the EU . OLAF has observed wide variations in the quality and quantity of the information flow on suspected fraud from the various Commission departments and the other institutions, bodies, offices and agencies. These variations in the information flow may lead to inconsistency of treatment or even to some suspicions not being treated at all. OLAF has prepared a document entitled ‘Tasks and responsibilities of the OLAF Contact Points (OCPs) of the EU Commission services and Executive Agencies and OLAF’ for the Commission and its executive agencies. This document describes the role entrusted to the OCPs and spells out their tasks and duties and those of their department or agency, and of OLAF, on all aspects of their cooperation. The necessary flow of information is also a topic in anti-fraud training and in the exchange of best practice through the Commission’s Fraud Prevention and Detection Network. Problems with the flow of information are even more acute for the decentralised agencies, whose dispersed location and employment of non-permanent personnel as the large majority of their staff may risk weakening the anti-fraud process to some extent. Several measures could be taken to remedy such weaknesses. OLAF could provide targeted training to raise awareness of the agencies’ management and staff about specific risks such as conflicts of interest and breaches of professional secrecy, including leaks. These training sessions could help reinforce the message that OLAF’s involvement is key for addressing fraud-related issues appropriately to their benefit, and that it does not cause them additional difficulties. Training could also cover other aspects of their anti-fraud responsibilities. It could be provided during a meeting of the Inter-Agency Legal Network which provides its members with training and updates and a forum to exchange best practices. The network has a specific working group on anti-fraud issues. OLAF should regularly participate in this group. 5.2.4. Procurement under shared management As OLAF’s investigations have shown, public procurement, which remains the largest channel of public spending, is an attractive marketplace for fraudsters, who use corruption and offshore accounts to facilitate fraud. Many procurement fraud cases are transnational, as the new fraud scenarios often involve a contracting authority from one Member State and bidders from several other Member States who subcontract their works to companies in different countries . Over a 5 year period (2012–2016), 20 % of all irregularities reported by Member States through the IMS have related to breaches of public procurement rules which account for 30 % of all reported irregular financial amounts . In 2014, the EU adopted new procurement directives , which was one of the priority actions of the 2011 CAFS. Among the features of the new directives were: ocreating a dedicated legal framework for concession contracts; ointroducing e-procurement as of 2018; ostrengthening the provisions on conflict of interest; oclarifying the rules on modifying contracts after they are awarded; and ostrengthening the exclusion grounds. In 2017, the Commission adopted a procurement package whose aims included professionalising Member States’ procurement staff and introducing a voluntary upstream assessment of large infrastructure projects. The Commission departments responsible for shared management put in place a comprehensive public procurement action plan in 2013, which has been updated several times. An updated version was officially endorsed in April 2017 and includes a revised state of play of the actions to put a greater emphasis on strategic procurement and transparency. It also includes measures which contribute to preventing fraud and corruption in public procurement.

One important measure of the action plan which is relevant for the CAFS is the ‘Integrity Pacts: A Civil Control Mechanism for Safeguarding EU Funds’ . This project is implemented in cooperation with the ‘Transparency International and pilots Integrity Pacts’ in a number of projects in the Member States co-financed by the EU Structural and Cohesion Funds. Another measure in the action plan is the public procurement guidance that aims to help practitioners avoid the most common errors in projects funded by the European Structural and Investment Funds . The updated version, published in February 2018, incorporates the key changes introduced by the new Public Procurement Directive 2014/24/EU and takes procurement officers step-by-step through all stages of the process — from planning to contract implementation — while highlighting risk areas. It includes examples of good practice, case studies and useful links to help those who are involved in the planning, selection and implementation of EU-supported projects. Member States’ managing authorities/intermediate bodies will also be provided with both internal and external training on the new directives and on strategic procurement. All of these initiatives will gradually improve the quality of procurement procedures in the Member States and strengthen the fight against fraud. But in the meantime, public procurement in shared management is likely to remain a fraud-prone field of activities for many years . 5.2.5. Procurement and grants in direct management In the departmental fraud risk assessments , a considerable number of services engaged in direct management mentioned public procurement as one of the most significant areas of fraud risk. Fraud risks include collusion among tenderers and conflicts of interest of a staff member. However, there are also fraud risks during a project’s implementation phase due to falsification of timesheets and other documents, which play an equally important role as double-funding in fraud related to grants. The Commission has put in place an array of safeguards and controls in both grants and procurement management. Thanks to such measures, the European Court of Auditors has given a positive assessment of the institutions’ ‘robust’ procurement procedures . Progress should continue as the Commission extends its use of IT tools such as e-procurement and e-grants, as these can help to detect double-funding, for instance. For grants, the increasing use of simplified cost options and the use of financing not linked to costs could reduce fraud risks still further . Financing that is linked to outputs or results rather than costs and output-based lump sums largely remove the relevance of accounting for eligible costs and related risks of falsification and deceit. In parallel, the Commission services and executive agencies will have to avoid vulnerabilities regarding technical checks on whether all conditions have been met and the results achieved by beneficiaries. These checks need to be thorough and effective if simplification measures are to reduce fraudulent and non-fraudulent irregularities. Fraud risks at the point that lump sums are determined on the basis of estimated budgets also need to be dealt with. In procurement and possibly also in cases of financing not linked to costs or simplified forms of contributions (lump sums, unit costs and flat rates), further risks could come from knowledge gaps, where services do not carry out preliminary market consultations when preparing their calls for tenders or proposals. It should also be noted that dropping the requirement of time recording due to simplification will increase the importance of the control of the deliverables. 5.2.6. Financial instruments and budgetary guarantees Through financial instruments, the EU directly or indirectly provides, or contributes to, funding which helps to attain EU policy objectives with financial support in the form of equity participation, loans, guarantees or other risk-sharing instruments. Financial instruments provide benefits such as a high degree of flexibility, possibilities to bridge investment gaps and opportunities to combine EU funding with funds from national budgets and international organisations, national and international financial institutions and private investors. As a result, financial instruments have become a significant delivery model for the EU budget. During the 2014-2020 programming period, EU funds invested in financial instruments are expected to amount to around EUR 9 billion in direct and indirect management and around EUR 21 billion in the European Structural and Investment Funds . Most financial instruments are characterised by a contribution from the EU budget given to an entrusted entity – usually the European Investment Bank (EIB), the European Investment Fund (EIF) or another international financial institution such as the European Bank for Reconstruction and Development (EBRD). It can also be a national promotional bank in a Member State such as KfW Group in Germany, which funds projects directly or indirectly, i.e. through other financial institutions acting as financial intermediaries and sub-intermediaries or by contributing to an investment fund or ‘fund of funds’. Where possible, EU funding will be combined with investment capital made available by the entrusted entity, the financial intermediaries and sub-intermediaries and by other contributors to funds and ‘funds of funds’. Apart from the risk of possible misrepresentation by the final recipient, other fraud risks and systemic vulnerabilities may be present at each level of the financial instrument’s implementation — from the Commission service, executive agency or (shared management) managing authority providing the EU funding over the entrusted entity to financial (sub-) intermediaries and fund managers. They include, in particular, risks of staff misconduct, weaknesses of internal control systems and a lack of coordination of control priorities between the various actors involved at different levels of implementation. oStaff misconduct could include misuse of confidential sensitive information.

oSome of the implementation partners, especially local partners of entrusted entities and managing authorities, may have weak administrative capacities and internal control systems.

oDiverging control priorities at different levels of implementation could affect the effectiveness of anti-fraud controls.

oA multitude of funding schemes branching out under a variety of programmes may also increase the risk of double-funding.

Despite those potential fraud risks, financial instruments do not rank high on services’ internal fraud risk assessments. In practice, those risks rarely seem to materialise, as confirmed by a low number of OLAF investigations in the field of financial instruments . Mitigating factors that play an important role in this respect are: othe alignment of entrusted entities and intermediaries’ interests as they often invest with their own risk capital and therefore have an economic interest in the success of the portfolio of projects invested in; othe chain of partners intervening in the process which creates vulnerabilities and also multiple layers of control; and

ocomprehensive and sophisticated anti-fraud policies put in place by entrusted entities, most notably by the EIB . Nevertheless, mitigation is not complete and should therefore be reinforced where a systemic issue emerges. For budgetary guarantees, an assessment of related fraud risks has to factor in the reliability of the counterpart and the risk profile of the transactions supported by the guarantee. Here it should be noted that the setting of the risk profile is in itself a key moment of risk. An erroneous, possibly manipulated, setting of the risk (i.e. setting the risk at an unrealistically low level) could lead to a substantial loss for the EU budget. It has to be ensured that the controls for this risk setting operation are sound. The largest guarantee issued by the EU budget is the one underpinning the European Fund for Strategic Investments (EFSI) whose amount is limited to EUR 26 billion. While the EIB Group is a reliable counterpart, financing operations under the EFSI are similar to financial instruments, except that related operations will either involve no funding or only partial funding from the EU budget, with the remaining investment coming from the EIB or EIF, backed partially by the EU guarantee. Conclusions on financial instruments will therefore apply to a certain degree also to budgetary guarantees keeping in mind that the multitude of funding schemes will be reduced in the next MFF. In the longer run, it should be re-examined whether the implementation framework for budgetary guarantees is in line with their increasing importance as a delivery model of EU financial support. 5.2.7. External aid The Commission services responsible for external aid, namely oService for Foreign Policy Instruments (FPI); oDirectorate-General Neighbourhood and Enlargement Negotiations (DG NEAR); oDirectorate-General International Cooperation and Development (DG DEVCO); oDirectorate-General European Civil Protection and Humanitarian Aid Operations (DG ECHO); work in particularly complex and challenging geographical, political and organisational settings which entail specific vulnerabilities to fraud. A number of factors make up the operational environment specific to the external relations sector, in particular: ogeographically dispersed activities, including in areas with difficult legal and/or political conditions; ovarying levels of efficiency of the national legal, regulatory and institutional framework and of responsiveness and enforcement regarding fraud and corruption in the areas of operation;

omultiple aid instruments and delivery models under different, and sometimes changing, management modes (direct/indirect management); oa large volume of financial management performed by implementing authorities in non-EU countries; odiversity of implementing organisations and partner countries with different management and control capacities; odifficulties in exchanging information with those partners; oa high number of operations and associated financial transactions with limited resources to ensure full-scale supervision, and strong reliance on desk reviews at headquarters; and oa mixed composition of staff in local operations, characterised by –a high ratio of contract agents and local agents; –regular turn-over of officials and contract agents; and –difficulties in attracting staff in countries marked by (post-)crisis or (post-) conflict situations. All the departments concerned have put in place comprehensive anti-fraud controls such as staff training, requirements for authorisation by headquarters, vetting of implementing partners and upstream verification of a significant proportion of financial transactions under indirect management. Still, the great variety of implementing partners and limits to checks, notably regarding non-EU countries and international organisations, expose the EU budget to potential weaknesses as regards fraud risk management by such implementing partners. Similarly, the latest OLAF report highlights vulnerabilities to fraud in the area of humanitarian aid . With regard to EU trust funds, the European Court of Auditors has called for more transparency in the selection of implementing organisations. It has also voiced concerns that implementing organisations being represented on the operational committee of a trust fund could lead to potential conflicts of interest . Untargeted budget support is an element of the increasing part of EU funding that is not linked to the reimbursement of specific costs but to the fulfilment of ‘conditionalities’, which are in the external aid context of a political, social or economic nature This feature is shared by macro-financial assistance managed by the Directorate General Economic and Financial Affairs (DG ECFIN). Difficulties in verifying such pre-conditions for support in a non-EU country need to be anticipated. Financial instruments are widely used in the external aid sector. They have recently been complemented by the European Fund for Sustainable Development , an investment vehicle backed by a guarantee from the EU budget, similar to the EFSI. In this respect, the risk assessment for financial instruments and budgetary guarantees in the preceding section applies with the proviso that the involvement of a broad spectrum of implementing partners from the external aid sector, including bodies governed by private law in a Member State or partner country, may carry additional risks. 5.2.8. Cybersecurity As mentioned in Section 4.2.4. (p. 14), risks related to the adequacy of measures to prevent and respond to IT security are among the top critical risks for the Commission as a whole. Cybersecurity risks in general are increasing exponentially. Studies suggest that the economic impact of cybercrime rose fivefold between 2013 and 2017, and could further quadruple by 2019 . Cybersecurity incidents are diversifying both in terms of who is responsible (fraudsters, hacktivists, state actors but also insiders in organisations) and what they seek to achieve (data breach or identity theft, political attention or defamation, theft of confidential information or dissemination of incorrect information, theft of user and administrator log-ins and passwords to manipulate financial circuits or databases used for internal reporting, and many other purposes). Tools available within the deep web or darknet (‘crime-as-a-service’) make it easier for potential perpetrators to acquire cyberattack capabilities. Such risks are increasingly relevant to the Commission and other EU institutions and bodies due to the increased use of IT systems supporting EU policies, as required notably by the EU e-Government action plan for 2016-2020 and in Articles 146–149 of the Financial Regulation. The Commission has responded at policy level in a number of ways. It adopted the 2013 EU cybersecurity strategy and proposed the NIS Directive . It also recently adopted initiatives such as a reform of the EU Agency for Network and Information Security, a Cybersecurity Certification Framework, a Cybersecurity Emergency Response Fund and a European Cybersecurity Research and Competence Centre. Further details of this policy response can be found in a Joint Communication with the High Representative of the Union for Foreign Affairs and Security Policy of 13 September 2017 . At managerial level, the Commission has put in place a new information security governance structure, which provides the foundation for a prioritised and business-driven development of IT security capabilities. Already in 2015, following recommendations by the Internal Audit Service, the Commission created an Information Security Steering Board, chaired by a Deputy Secretary-General and reporting to the Corporate Management Board at corporate level. Inter-service coordination between the lead services — the Secretariat General, the Directorate-General for Human Resources and Security and the Directorate-General for Informatics, has thus been reinforced. In November 2016, the Information Security Steering Board adopted an IT security strategy for the European Commission. In 2017, the Commission reviewed and updated its rulebooks to improve implementation of IT security controls in a way which addresses critical risks and meets business priorities. Finally, in November 2018, the European Commission Digital Strategy created a new internal policy framework for a digitally transformed Commission by 2022, whose working methods should be embedded in a sound data ecosystem, which is adequately protected from cyber threats. The implementation of the strategy will be overseen by the new Information Technology and Cybersecurity Board, a subgroup of the Corporate Management Board; it is taking over the responsibilities of the Information Security Steering Board and other actors. Despite these actions, because of the rapidly evolving threat landscape, the Commission remains exposed to a critical risk from politically or economically motivated criminal actors. Lower-level risks come from factors such as the outsourcing of IT services, opportunistic non-targeted attacks such as phishing attempts and the management of IT access rights.

5.3. Integrity and compliance The effectiveness of even the best anti-fraud procedures could be undermined if integrity and compliance of staff were weak. Real and apparent lapses in integrity and impartiality also risk harming the institutions’ reputation in a particularly serious way. With this in mind, Commission services have ranked undeclared conflicts of interest and breaches of confidentiality as high in their internal fraud risk assessments. However, that ranking does not imply an elevated likelihood of conflict of interest or breaches of confidentiality and the Commission has no evidence of a high rate of such infringements at corporate level . Regarding the framework in place to ensure staff adhere to ethical conduct, a number of measures have been taken since the 2011 CAFS: oFar-reaching amendments to the Staff Regulations entered into force on 1 January 2014 . That reform tightened the rules on the professional ethics of EU staff, for example in the following areas: –conflict of interest, notably avoidance of conflicts of interest when a staff member is recruited or reintegrated after a leave on personal grounds (Article 11, third and fourth paragraph); –lobbying activities by senior officials after leaving the service (Article 16, third and fourth paragraph); and –whistle-blowing, for which institutions are required to adopt implementing rules and procedures and to inform staff accordingly (Article 22c). oThe Commission adopted guidelines on whistle-blowing already in 2012 and was the first EU institution to do so;

At the time of the Staff Regulations reform, the Commission revised its rules on outside activities of staff members , thereby strengthening its prevention of conflicts of interest. Since then, the rules have been updated once again . The Commission’s staff is also strongly encouraged to participate in the diverse range of training available on professional ethics. Therefore, the Commission does not identify any particular weaknesses of the rules of staff conduct or the way those rules are applied. However, the ECA’s ongoing audit of the Commission’s ethical framework should help refine that analysis. The Commission has recently revised the code of conduct for its members , strengthening safeguards for impartiality of Commissioners, for instance through an extended cooling-off period for post-mandate activities and greater transparency on financial interests. Furthermore, the EU legislator and the Commission have taken steps to apply some of the rules that protect integrity in managing the EU budget to staff working for national authorities and other actors in the Member States. Apart from sectoral legislation, this drive is reflected in: oArticle 61 of the new Financial Regulation, which explicitly extends the concept of conflict of interest to those involved in shared management at Member State level; and othe Commission’s proposal for a Directive of the European Parliament and of the Council on the protection of persons reporting on breaches of EU law . 5.4. Know-how and equipment Services' resilience to fraud also depends on their staff members’ awareness of fraud risks and on staff members’ skills in counteracting attempts at fraud. Therefore, awareness-raising and training already featured in the 2011 CAFS . Numerous training activities continue to be carried out by OLAF and other departments. oThe Commission’s permanent anti-fraud training programme comprises an introductory course for all staff and an advanced class for auditors and investigators. oThat programme is complemented by training given by OLAF for the staff of individual Directorates-General (including in the EU delegations), executive agencies, decentralised agencies, Civilian Common Foreign and Security Policy (CFSP) Missions European Union Special Representatives and other EU institutions and bodies. Many Commission departments have developed local awareness-raising measures as part of their service-level anti-fraud strategies.



oOLAF and other Commission departments also organise training for the staff of Member State authorities and take part in knowledge-sharing events in the Member States.

oOccasionally, OLAF trains the staff of international organisations and other implementing partners. Further awareness-raising activities include: odeveloping and maintaining a comprehensive Commission-internal anti-fraud website; and

oencouraging and/or facilitating the exchange of views and best practice: –between representatives of Commission services and executive agencies in the Commission’s Fraud Prevention and Detection Network; –with and among staff members of decentralised agencies and similar EU bodies in the Inter-Agency Network; and –with and among experts from the Member States in the Advisory Committee for the Coordination of Fraud Prevention. Nevertheless, according to the internal fraud risk assessment, 43 % of the participating services identified insufficient know-how as a fraud vulnerability. The Commission departments responsible for external aid, seconded by the European External Action Service, put special emphasis on training needs in the delegations, including for Heads of Delegation, as well as in the civilian CFSP missions and in the offices of EU Special Representatives. The Commission departments responsible for shared management underlined the importance of continued awareness-raising, training and professionalisation efforts for the benefit of staff working in Member States, and so does the Commission for public procurement, taxation and customs matters . The limited availability of appropriate data mining tools and of certain types of hardware (e.g. X-ray scanners for border controls) may also expose the EU budget to risks. Through relevant spending programmes, notably the new EU anti-fraud programme proposed by the Commission (provided it is approved by the co-legislators) , the Commission will continue to co-finance awareness-raising measures and anti-fraud tools and equipment, such as data mining and optical scanning tools, for national authorities. 5.5. Transparency The public’s access to data on public financial management is a tool in the fight against fraud, because — up to a certain degree that will depend on the scope of public access — it allows civil society and media to police the propriety of transactions such as contract and grant awards. Transparency was therefore already an integral part of the 2011 CAFS . As required by Article 38 of the Financial Regulation, the Commission operates a ‘Financial Transparency System’ , which gives the public access to some information on recipients of EU funding under direct management. The Commission has also committed to supporting the International Aid Transparency Initiative (IATI) , which promotes the timely, comprehensive and forward-looking publication of aid information. However, the Financial Transparency System is limited to direct management and does not contain detailed information on contracts and grant agreements, tenders and grant applications, or the terms of a financial instrument. Providing such detailed information would open up far greater possibilities of analysing the conduct of spending services but would have to be weighed against the rights of entities and persons concerned. Data protection legislation must be respected, and further measures, also protecting organisations, might be necessary in some cases. 5.6. Legal framework ‘Fraud-proofing’ the legal framework, i.e. optimising its resilience to fraud, corruption and other irregularities, has long been part of the Commission’s anti-fraud policy, including the 2011 CAFS . In practice, fraud-proofing should be fostered both through awareness-raising and the training of staff working in policy-making departments and by consulting OLAF from an early stage of the drafting process. Fraud-proofing is not limited to legislation. It must extend to implementing rules, model contracts/agreements, procedures, workflows, etc. While the 2011 CAFS established anti-fraud clauses in the basic acts of spending programmes , the legislation governing the programming period after 2020 will have an all-encompassing provision on the protection of the EU’s financial interests (Article 129 of the revised Financial Regulation). The requirements regarding access rights for the competent EU institutions, bodies and offices laid down in that provision will have to be clarified and implemented in the non-legislative legal documentation of the different spending programmes and funding mechanisms to avoid legal uncertainty and to ensure swift checks, audits and investigations in cases of suspected fraud. Another feature of the new programming period — partly already present in the current and even the past one, though to a far lesser extent — will be an emphasis on lump sums and/or financing not linked to costs in direct and shared management. In the external aid sector, instruments like budget support and macro-financial assistance (MFA) take a similar approach and are also widely used. The main characteristic of such funding schemes is that funding depends on the recipient fulfilling certain conditions rather than providing proof of the eligible costs they incurred. Where these forms of funding involve pre-financing , there is a risk that fraudulent non-/under-delivery of the agreed conditions (by a recipient who never intended to meet the conditions) may go undetected. This risk may be aggravated by reduced possibilities to verify the recipient’s operations. Therefore, in the framework of lump sums and financing not linked to costs, there is a need to develop – across the different management modes – control strategies for deliverables and for the analysis of non-/under delivery with a view to detecting fraud.

Fraud-proofing also has to look into the legal framework for investigating fraud. The setting up of the European Public Prosecutor’s Office and the ongoing transposition and implementation of the PIF Directive significantly improve the legal framework for the protection of the EU’s financial interests by means of criminal law. The recent evaluation of the OLAF Regulation concluded that it allowed OLAF to deliver concrete results in protecting the EU budget. The 2013 changes brought about clear improvements in the conduct of investigations, in cooperation with partners and in the rights of persons concerned. The evaluation also identified certain shortcomings in the application of the Regulation that reduce the effectiveness of OLAF investigations and thus the EU’s fight against fraud. Shortcomings that should be addressed in the short term concern, in particular: oConducting on-the-spot checks and inspections; oAssistance of national competent authorities before and during an investigation; oAccess to information on bank accounts; and oOLAF's tools for the investigation of VAT fraud.

The Commission has consequently tabled a proposal to amend the OLAF Regulation . The amendments proposed will allow OLAF to cooperate closely with the EPPO and to operate more effectively in its investigations. Finally, a sound legal framework is essential in international cooperation beyond the territorial scope of the EU Treaties. In a world with global trade, financial, travel and data flows, fraud takes on a globalised perspective and so too should the fight against fraud. The EU’s external borders often set limits to cooperation and investigation, so OLAF’s competences need a basis in international instruments (or ad-hoc permission) for any investigation outside the territory of EU Member States. Consequently, agreements with non-EU countries and international organisations normally have a clause on the protection of EU financial interests. OLAF investigations can sometimes be conducted more easily where Administrative Cooperation Arrangements — concluded between OLAF and a non-EU country or an international organisation — lay down implementing rules. Aside from investigative purposes, international agreements may also serve to set up data exchange between administrations, which is often crucial for fraud prevention and detection. A notable example is the WHO Protocol to Eliminate Illicit Trade in Tobacco Products, which has been ratified by the EU but not yet by all Member States. While the network of international cooperation in the fight against fraud is far from complete, every international cooperation agreement helps to close a loophole. 6. Revenue fraud Revenue fraud affects traditional own resources and value added tax. In this type of fraud, the harm done by organised crime groups is especially significant . 6.1. Traditional own resources (TOR) Fraud in the area of TOR does considerable damage to the EU budget. In 2016, the fraud detection rate of 0.33 % in TOR exceeded the 0.21 % fraud detection rate on the expenditure side of the budget. Even though the ‘gap’ was narrower , this trend continued in 2017 (0.30 % against 0.29 %). The detected fraud mainly concerned anti-dumping, countervailing and other customs duties. Fraud may be committed through smuggling, for example cigarette smuggling, especially trafficking in non-branded cigarettes (‘cheap whites’) . Fraud may also occur through the false declaration of the origin of imported goods, of the value of goods (undervaluation) or of their classification under the Combined Nomenclature , pursuant to Article 57 of the Union Customs Code . It can also take the form of ‘transit fraud’ — situations where goods are declared to be only transiting through the EU but in reality never leave the EU . Three Commission departments (DG TAXUD, DG BUDG and OLAF) share the main responsibilities in this area. Policy-making is mainly the responsibility of the Commission’s Directorate-General for Taxation and Customs Union (DG TAXUD). A new Union Customs Code has been in application since 1 May 2016. It aims to: ostreamline customs procedures; oharmonise the implementation of customs legislation; obetter protect the internal market from safety, security and other threats linked with the flow of goods across the external borders; and obetter safeguard the financial interests of the EU and the Member States.