COMMISSION STAFF WORKING DOCUMENT

Implementation of recommendations and audit executive summaries

Accompanying the document

Report from the Commission to the European Parliament and the Council

Annual Report to the Discharge Authority on internal audits carried out in 2011 (Article 86(4) of the Financial Regulation)

TABLE OF CONTENTS

1........... Implementation of Recommendations.............................................................................. 9

2........... Executive summaries..................................................................................................... 10

2.1........ Governance.................................................................................................................. 10

2.1.1..... Fraud........................................................................................................................... 10

2.1.1.1.. AGRI Fraud Prevention and Detection.......................................................................... 10

2.1.2..... Ethics........................................................................................................................... 11

2.1.2.1.. COMP: Follow up on Handling of sensitive information and Ethics................................. 11

2.1.3..... Business Continuity management................................................................................... 11

2.1.3.1.. Consolidated: Follow up on Business Continuity Management........................................ 11

2.2........ Assessing the Commission's Performance...................................................................... 12

2.2.1..... ENTR & EACI: Performance Audit of the Entrepreneurship and Innovation Programme (EIP) managed by DG ENTR and the EACI.................................................................................................... 12

2.2.2..... ECHO: Performance of ECHO's operational activities................................................... 13

2.2.3..... MARKT: Monitoring by DG MARKT of the Application of Public Procurement Rules in the Member States 15

2.3........ Control strategies.......................................................................................................... 16

2.3.1..... Research Area.............................................................................................................. 16

2.3.1.1.. INFSO: DG INFSO's Control Strategy for on-the-spot control and fraud prevention and detection 16

2.3.1.2.. RTD: DG RTD's Control Strategy for on-the-spot control and fraud prevention and detection 17

2.3.2..... External Aid................................................................................................................. 19

2.3.2.1.. DEVCO: EDF Grants................................................................................................... 19

2.3.3..... Rural Development....................................................................................................... 20

2.3.3.1.. AGRI: Audit on the Internal Control System for managing the Instrument for Pre-Accession Assistance for Rural Development in DG AGRI............................................................................................ 20

2.3.4..... TEN-T EA................................................................................................................... 21

2.3.4.1.. TEN-T EA: Control strategy in the Trans-European Transport Network Executive Agency (TEN-T EA) 21

2.4........ Global Navigation Satellite System Programs (GNSS)................................................... 22

2.4.1..... ENTR: Global Navigation Satellite System Programs (part: Governance, Risk management and Project Management)............................................................................................................... 22

2.4.2..... ENTR : Global Navigation Satellite System Programs (part: Actions, Grant & Procurement Management) 23

2.4.3..... ENTR: Global Navigation Satellite System Programs (part: Financial Circuits, Financial Management and Accounting for Fixed Assets)........................................................................................ 25

2.5........ Financial Management Process..................................................................................... 26

2.5.1..... Guarantees................................................................................................................... 26

2.5.1.1.. Consolidated: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)................. 26

2.5.1.2.. BUDG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI).......................... 27

2.5.1.3.. ELARG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)........................ 27

2.5.1.4.. DIGIT: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)........................... 28

2.5.1.5.. EACI: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)............................ 28

2.5.2..... Procurement................................................................................................................. 28

2.5.2.1.. OIB: Management of Procurement in OIB..................................................................... 28

2.5.2.2.. HR: Management of Procurement by DG HR................................................................ 29

2.5.2.3.. OIB: 2nd Follow-up Audit of the management of Procurement Contracts in OIB........... 29

2.5.2.4.. JRC: Follow-up audit on Procurement in JRC............................................................... 29

2.5.3..... Recoveries................................................................................................................... 30

2.5.3.1.. EAC: Follow-up audit on Recoveries............................................................................ 30

2.5.3.2.. BUDG: Follow-up audit on Recoveries......................................................................... 30

2.5.3.3.. LS: Follow-up audit on Recoveries............................................................................... 30

2.5.3.4.. INFSO: Follow-up audit on Recoveries........................................................................ 30

2.5.3.5.. DEVCO: Follow-up audit on Recoveries...................................................................... 30

2.5.3.6.. EACEA: Follow-up audit on Recoveries....................................................................... 31

2.6........ Information Technologies.............................................................................................. 31

2.6.1..... Local IT....................................................................................................................... 31

2.6.1.1.. DG EMPL: Audit on Management of Local IT in DG EMPL......................................... 31

2.6.2..... Security of IT environment in subcontracted projects IT................................................. 32

2.6.2.1.. REGIO: Audit on Security of IT environment in subcontracted projects IT in DG REGIO 32

2.6.3..... Management of the telecommunication infrastructure and services sTESTA.................... 33

2.6.3.1.. DIGIT: Audit on the Management telecommunication infrastructure and services sTESTA in DG DIGIT 33

2.6.4..... Enterprise Europe Network IT tools............................................................................. 34

2.6.4.1.. EACI: Audit on Enterprise Europe Network IT tools in EACI....................................... 34

2.6.5..... Follow-ups on IT audits................................................................................................ 35

2.6.5.1.. TAXUD: Follow-up audit on the large IT Systems in DG TAXUD................................ 35

2.6.5.2.. TAXUD: Follow-up audit on New IT Organisation and Contractual Framework............ 35

2.6.5.3.. PMO: Follow-up audit on Management of Local IT...................................................... 35

2.6.5.4.. LS: Follow-up audit on Management of Local IT........................................................... 36

2.6.5.5.. OLAF: Follow-up audit on the Anti-fraud Information System (AFIS)........................... 36

2.6.5.6.. INFSO: Follow-up Audit on the Management of Research Information Systems in DG INFSO 36

2.6.5.7.. RTD: Follow-up Audit on the Management of Research Information Systems in DG RTD 36

2.7........ Other audits.................................................................................................................. 36

2.7.1..... JRC: Audit on Competitive Activities............................................................................. 36

2.7.2..... BUDG: Implementation of the Internal Control standard 13 on Accounting and Financial reporting 38

2.8........ Follow-up audits (if not in the above categories)............................................................ 39

2.8.1..... RTD: Follow-up audit on DG RTD's Internal Control System for managing FP7 – Design 39

2.8.2..... REA: Follow-up audit on the set up of Internal Controls and Financial Management Systems – Design in REA 39

2.8.3..... HR-DS: Follow-up audit on Monitoring of Security as managed by HR-DS................... 39

2.8.4..... AGRI: Follow-up audit on Rural Development.............................................................. 39

2.8.5..... INFSO: Follow-up audit on DG INFSO's Internal Control System for managing FP7 – Design 40

2.8.6..... ERCEA: Follow-up audit on ERCEA on the set up of internal controls/financial management system – Design 40

2.8.7..... EMPL: Follow-up of the audit on the internal control systems for managing the new Structural Funds programming period – Phase II.......................................................................................................... 40

2.8.8..... REGIO: Follow-up of the audit on the internal control systems for managing the new Structural Funds programming period – Phase II.......................................................................................................... 40

2.8.9..... HOME: 2nd Follow-up audit on Grants under Shared management of the European Refugee Fund in DG HOME.................................................................................................................................... 40

2.8.10... TEN-T EA: Joint IAS/TEN-T EA IAC Follow-up audit on Audit of the Management of the Operational Budget in TEN-T EA................................................................................................................... 40

2.8.11... ECHO: 2nd Follow-up audit of NGOs funding in DG ECHO........................................ 41

2.8.12... ELARG: 2nd Follow-up audit on "Ex-post control activities in DG ELARG".................. 41

2.8.13... FPI: Follow-up audit on the financial management of the Common Foreign and Security Policy Budget 41

2.8.14... OIL: Second follow-up audit on the Evaluation of targeted internal control standards in OIL 41

2.8.15... HR & OIB: 2nd Follow-up Audit of the Management of Building Procurement Contracts by DG HR and OIB 41

2.8.16... EACI: Follow-up audit on the management of the Operational Budget of the EACI........ 42

2.8.17... MARKT: Follow-up audit on Monitoring the Implementation of EU law........................ 42

2.8.18... ENV: Follow-up audit on Monitoring the Implementation of EU law.............................. 42

2.8.19... SG: Follow-up audit of the Consolidated report on Monitoring the Implementation of EU law 42

2.8.20... MARE: Follow-up audit on the European Fisheries Fund as managed by DG MARE..... 42

2.8.21... OIB: Follow-up audit on the Inventory Process as managed by OIB.............................. 42

2.8.22... OIL: Follow-up audit on the Inventory Process as managed by OIL.............................. 43

2.8.23... EPSO: Follow-up of the Limited Review on the selection process as managed by EPSO 43

2.8.24... SANCO: Second Follow-up on Grant management (Food & Feed) in DG SANCO..... 43

2.8.25... PMO: Follow-up audit on the activities of PMO/6 ISPRA............................................. 43

2.8.26... DEVCO: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG AIDCO 43

2.8.27... EAC: Follow-up audit of remaining recommendations on 2004 IAS In-depth Audit of DG EAC 44

2.8.28... ELARG: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG ELARG 44

2.8.29... ESTAT: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG ESTAT 44

1. Implementation of Recommendations

Table 1 sums up the level of implementation of accepted recommendations, based on the auditees’ assessments, for IAS recommendations made during the period 2007-2011[1]. The recommendations not yet implemented are broken down by period overdue on the right-hand side of the table.

Year || Priority || Total || Implemented || In progress (by number of months overdue)

|| || || No || % || No || % || No delay || 0-6 || 6-12 || 12+

2007 || Critical || 4 || 4 || || || || || || ||

Very important || 123 || 121 || || 2 || || || || || 2

Important || 159 || 158 || || 1 || || || || || 1

Desirable || 33 || 32 || || 1 || || || || || 1

|| 319 || 315 || 99% || 4 || 1% || || || || 4

2008 || Critical || 0 || 0 || || || || || || ||

Very important || 138 || 130 || || 8 || || 1 || || || 7

Important || 164 || 154 || || 10 || || 1 || || || 9

Desirable || 13 || 12 || || 1 || || || || || 1

|| 315 || 296 || 94% || 19 || 6% || 2 || || || 17

2009 || Critical || 2 || 2 || || || || || || ||

Very important || 138 || 127 || || 11 || || || || || 11

Important || 144 || 132 || || 12 || || || || || 12

Desirable || 5 || 5 || || || || || || ||

|| 289 || 266 || 92% || 23 || 8% || || || || 23

2010 || Critical || 2 || 2 || || || || || || ||

Very important || 126 || 79 || || 47 || || 18 || 25 || 4 ||

Important || 149 || 104 || || 45 || || 14 || 24 || 5 || 2

Desirable || 4 || 3 || || 1 || || || || 1 ||

|| 281 || 188 || 67% || 93 || 33% || 32 || 49 || 10 || 2

2011 || Critical || 0 || 0 || || || || || || ||

Very important || 56 || 6 || || 50 || || 44 || 6 || ||

Important || 101 || 13 || || 88 || || 83 || 5 || ||

Desirable || 1 || 1 || || || || || || ||

|| 158 || 20 || 13% || 138 || 87% || 127 || 11 || ||

|| || || || || || || || || ||

TOTAL 2007-2011 || 1362 || 1085 || 80% || 277 || 20% || 161 || 60 || 10 || 46

Table 1. Level of implementation of recommendations based on auditees’ assessments

2. Executive summaries

This working document also contains the original executive summaries (reflecting the state of play at the time when the audits were finalised) of audit engagements finalised by the IAS in 2011[2]. Each summary underwent the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of finalisation. It also contains statistical information for the acceptance of the recommendations

2.1. Governance

2.1.1. Fraud

2.1.1.1. AGRI Fraud Prevention and Detection

a. Background

DG AGRI budget finances the Common Agricultural Policy expenditure mainly through two shared management Funds, the European Agricultural Guarantee Fund (EAGF) which fully finances EU direct aid and market measures (43,7 billion € in 2011) and the European Agricultural Fund for Rural development (EAFRD) which co-finances rural development programmes (14,4 billion €). Expenditure under both funds is managed through some 81 national or regional paying agencies (sometimes through delegated bodies as well) in the 27 Member States (MSs). The Commission performs a supervisory role over national systems to obtain reasonable assurance on the effective functioning of national systems and assumes final responsibility for the implementation of the budget.

b. Audit Objectives

The main objective of the audit was to assess the adequacy and effective application of the governance, risk management and internal control process for fraud prevention, detection and follow-up of fraud cases by DG AGRI in accordance with the competences established by the Commission.

c. Audit Scope

The scope of the audit has covered:

· DG AGRI internal control system for combating fraud; in particular, prevention, detection and corrective measures, including its supervisory role with respect to MSs in the framework of shared management;

· The division of competencies and the coordination between OLAF and DG AGRI.

DG AGRI's Annual Activity Report 2010 included one reservation concerning serious deficiencies in the Integrated Administration and Control Systems (IACS) in Bulgaria, Romania and Portugal.

The fieldwork was finalised at the end of June 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 28 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 4 || 4 || 100 || 0 || 0%

Important || 0 || 0 || 0% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.1.2. Ethics

2.1.2.1. COMP: Follow up on Handling of sensitive information and Ethics

The objective of this engagement was to assess the progress made in implementing the remaining accepted recommendations addressed to DG COMP following the final audit report on handling of sensitive information and ethics in DG COMP issued in 2009.

Based on the results of its follow-up audit, finalized on 27 June, the IAS assessed that they have all been adequately and effectively implemented, except for one important recommendation.

2.1.3. Business Continuity management

2.1.3.1. Follow up on Business Continuity Management

In 2009 the IAS finalised the audit on Business Continuity Management (BCM). The overall objective of the audit, conducted in the Secretariat-General (in its central role) and in three operational DGs (DG HR, DG JLS and DG TAXUD), was to assess the adequacy and the effectiveness of the BCM process in the Commission. At that time, the IAS considered the process of implementing and adapting BCM to be still evolving. Consequently providing an audit opinion was deemed more appropriate at the moment of following up the original audit, when the BCM process was expected to be more mature and the accepted recommendations addressed to the different DGs implemented.

The in-depth follow-up evaluated the progress made by each of the Services in implementing the respective action plans (the results of which are described in individual notes, one per DG) and re-assessed the adequacy of controls as a whole, to provide an opinion on the BCM process in the Commission. The IAS assessed that all the recommendations addressed to individual DGs had been adequately and effectively implemented (except for one recommendation addressed to the SG) and that the control system in place provides reasonable assurance regarding the achievement of the business objectives set up for the BCM process, except for the issue relating to BCM supervision. The re-assessment of the control system in place did not identify any additional significant (Critical or Very Important) weaknesses. The follow-up audit was finalised on 31 January 2012.

2.2. Assessing the Commission's Performance

2.2.1. ENTR & EACI: Performance Audit of the Entrepreneurship and Innovation Programme (EIP) managed by DG ENTR and the EACI

a. Background

In order to meet the objectives of the renewed Lisbon strategy, and thus stimulate growth and employment in Europe, a Competitiveness and Innovation Framework Programme (CIP) has been adopted for the period 2007-2013. It entered into force on the 9 November 2006 with a budget of € 3.6 billion. The Entrepreneurship and Innovation Programme (EIP) is the largest expenditure component within the CIP with €2.17 billion. Its aim is to improve the competitiveness and innovativeness of European enterprises and particularly small and medium sized enterprises. The EIP comprises a wide variety of actions. It is managed by DG Enterprise and Industry (ENTR), DG Economic and Financial Affairs (ECFIN) (Financial Instruments), DG Environment (ENV) (Eco-Innovation) and the Secretariat-General. DG Information Society and Media (INFSO) and DG Energy (ENER), which participate in CIP, are not involved in EIP. The implementation of certain parts of the EIP has been delegated to the European Investment Fund (EIF) (Financial Instruments) and Executive Agency for Competitiveness and Innovation (EACI) (Eco-Innovation market replication projects, Enterprise Europe Network and Intellectual Property Rights [IPR] projects).

The IAS audit took place in a context of growing interest in programme performance. The current Multiannual Financial Framework (MFF) 2007-2013 will soon come to an end and intensive discussions are currently ongoing about the next Multiannual Financial Framework 2014-2020, the new legal base and the future of the EIP. Furthermore, attention in the ongoing revision of the Financial Regulation and the discussions on the new legal bases will be put on simplification and efficiency gains. The Commission reiterated its commitment to simplification in its June 2011 Communication on the next Multiannual Financial Framework. The Secretary-General and the Director General of DG BUDG also recently issued guidance on simplification and performance measure­ment for post-2013 spending programmes.

b. Audit Objectives

The objective of the audit was to assess:

· the adequacy of the policies and procedures put in place by management for promoting, monitoring and evaluating performance;

· the adequate and effective application of the internal control system (ICS) supporting this process, and

· the risk management and governance processes related to the EIP managed by DG ENTR, DG ENV and the EACI. In particular, the audit assessed whether the ICS provides reasonable assurance regarding:

– compliance with the main rules and guidelines in use in the Commission;

– economy, effectiveness and efficiency of the processes mentioned in the scope. In this respect, the need for simplifying internal administrative rules and procedures was taken into account; and

– reporting of information on performance. The audit will focus on the internal control systems related to the reporting processes between DGs as well as with EACI and the usefulness of the milestones and indicators in place for an effective and efficient monitoring of the programme.

c. Audit Scope

The scope of the audit included the Entrepreneurship and Innovation Programme (EIP) since it is the largest component of the Competitiveness and Innovation Programme (CIP) and because the successor of the current CIP under the new Multiannual Financial Framework will probably not include the two other programmes of the CIP. Only the parts of the EIP managed by DG ENTR and the EACI were included in the scope. The parts of the EIP managed by DG ECFIN (financial instruments) were excluded from the scope, because they are managed under a different mode (joint management) and because the European Court of Auditors has recently audited them. DG ENV, which outsourced almost the whole management of Eco-innovation to EACI, was consulted but not subjected to this audit.

There are no observations/reservations in the respective DGs' and Agency's AARs that relate to the area/process audited.

The fieldwork was finalised on 7 June 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 19 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.2.2. ECHO: Performance of ECHO's operational activities

a. Background

The Directorate General for Humanitarian Aid and Civil Protection (ECHO) aims at saving and preserving life, preventing and alleviating human suffering and safeguarding the integrity and human dignity of populations affected by natural or man-made disasters. It provides humanitarian aid to the most vulnerable victims of disasters in their immediate aftermath and also in cases of complex and protracted crises, whenever needs arise that overwhelm capacities of authorities of the countries concerned. Beyond disaster response, ECHO strives to enhance disaster prevention and preparedness, both within the EU and beyond.

In 2010, the Commission's commitments to new or protracted crises and disaster preparedness totalled €1.115 million. An important share of the funding was devoted to protracted crises in Africa. Substantial assistance was also provided in South West Asia (Afghanistan and Pakistan) and the Caribbean Region (Haiti).

ECHO does not implement assistance programmes itself. It fulfils its mission by funding actions through partners that have been screened in terms of financial and operational capacity and with which it has signed a Framework Partnership Agreement. In 2010, ECHO's budget for humanitarian actions was implemented through a wide range of implementing partners, i.e. 50% by NGOs, 39% by UN Agencies and 11% by International Organisations.

b. Audit Objectives

One of the objectives of the IAS is to carry out performance audits focussing on the effectiveness, efficiency and economy of the use of resources. The IAS examines performance in the context of the "proper implementation of budgetary procedures", (Article 85 FR) that include the concept of "sound financial management" (Article 27 and 28a FR), and the assessment of "the performance of departments in implementing policies, programmes and actions", (Article 86 FR).

Taking into account ECHO's mission and objectives mentioned above, the general IAS audit objective was to reply to the following question: Is ECHO spending on humanitarian crises used to best effect for preventing and alleviating the consequences of disasters?

Detailed audit objectives included ECHO's:

· Preparedness to meet the needs of populations affected by disasters.

· Investment in DRR and disaster preparedness to increase the resilience of regions recurrently affected by disasters.

· Rapidity and flexibility of procedures to ensure that the delivery of aid can be executed within a reasonable period of time.

· Quality of the aid delivered.

· Visibility and communication policies.

· Sustainability of the aid through the implementation of strategies to ensure a smooth transition between relief, rehabilitation and development.

c. Audit Scope

The scope of this audit included the performance of ECHO's activities linked to emergency, protracted and forgotten crises. Disaster preparedness and Disaster Risk Reduction (DRR) strategies and Information and Communication activities have also been assessed.

The fieldwork was finalised in October 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 8 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.2.3. MARKT: Monitoring by DG MARKT of the Application of Public Procurement Rules in the Member States

a. Objectives and Scope

The objective of the audit was to assess the effectiveness and efficiency of the monitoring by DG MARKT of the application of public procurement rules in the Member States (MS), with a particular attention for Directives 2004/17/EC and 2004/18/EC3.

This audit was notably intended to contribute to the Commission's objective of achieving an increasingly positive DAS from the European Court of Auditors (EGA). Problems found by the EC A in the application of public procurement rules in MS have an important impact on the level of the error rate detected in the framework of its Declaration of Assurance (DAS), in particular as regards Cohesion Policy. There are a large number of national, regional and local authorities involved, which may explain the difficulties in transposing, implementing and monitoring the EU regulatory framework.

In defining the scope of the present audit, the IAS took into account previous relevant audit work by the IAS and the EGA, and in particular the IAS audit on "Monitoring the Implementation of EU Laws" and its follow-up audit.

There are no observations/reservations in DG MARKT 2010 Annual Activity Report (AAR) that relate to the area/process audited.

The fieldwork was finalised on 30 March 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 16 May.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 1 || 1 || 100% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.3. Control strategies

2.3.1. Research Area

2.3.1.1. INFSO: DG INFSO's Control Strategy for on-the-spot control and fraud prevention and detection

a. Background

Together with the other Research Commission Services (RCS), DG INFSQ implements EU research policy and supports the development of the European Research Area mainly through the Research Framework Programmes. Under the Seventh Framework Programme (FP7) for 2007-2013, which is currently being implemented, DG INFSO's share is some EUR 10 billion in total. In 2010, DG INFSO's payments were EUR 1.23 billion for FP7 and EUR 150 million for non-research programmes. Although the programming period for the Sixth Framework Programme (FP6) for 2003-2006 has finished, DG INFSO made payments amounting to EUR 160 million against cost claims during 2010 for on-going projects financed under FP6.

In recent years there have been a range of initiatives aimed at addressing the difficulties which have characterised the previous programming periods, in particular the development of common control and audit strategies amongst the RCS and in particular a common FP7 audit, or on-the-spot control, strategy designed to test the veracity of cost claims submitted by beneficiaries at different stages of the project cycle.

In line with the increased focus on fraud prevention and detection in the Commission, and following a recommendation made by the IAS3, DG INFSO has developed an Anti-Fraud Control Strategy. This document outlines its anti-fraud strategy and sets out existing anti-fraud controls, those being presently developed and outlines future developments.

b. Audit Objectives

The objective of the audit was to assess the internal controls underpinning DG INFSO's on-the-spot controls processes and the adequacy and effective application of the fraud governance, risk management and internal control processes for fraud prevention and detection.

c. Audit Scope

The audit of the on-the-spot control processes focused particularly on:

– the on-the-spot audit strategy and planning processes for ex-ante, interim and ex-post audits;

– the methodology, guidelines and procedures and the coordination with the other research DGs and executive agencies;

– the implementation/execution of the audit plan by the ex-post audit unit directly and by the external audit firms (outsourced audits);

– the monitoring and reporting arrangements;

– the measures to ensure the quality of the work undertaken;

– the follow-up given to audit results including the monitoring and implementation of corrective actions.

The scope of the audit encompassed both fraud prevention and detection controls. Prevention encompasses controls to reduce opportunity and decrease motive. Detection encompasses controls, which indicate possibility of fraud. The audit covered the different internal control system components as defined by the COSO model: control environment, risk assessment, control activities, information and communication, monitoring. The scope included the control systems to the extent they cover FP6, FP7 and other programmes managed by DG INFSO (Non-research programmes).

DG INFSO has made reservations in recent years on the rate of residual errors on the accuracy of cost claims in FP6. Nevertheless in its 2010 AAR there is no reservation that relates to the process audited on the grounds that the cumulative residual error rate for FP6 (2.2%) is close to the materiality level and expected to fall below 2% in the course of 2011 (once all ongoing audits are closed and all initiated extrapolation exercises have been completed). Therefore, the reservation regarding the accuracy of FP6 claims made in previous AARs was lifted.

The fieldwork was finalised on 3 June 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 6 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 6 || 6 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.3.1.2. RTD: DG RTD's Control Strategy for on-the-spot control and fraud prevention and detection

a. Background

Together with other Research Commission Services (RCS), DG RTD implements EU research policy and supports the development of the European Research Area mainly through the Research Framework Programmes. Under the Seventh Framework Programme (FP7) for 2007-2013, which is currently being implemented, DG RTD’s share is some EUR 25.2 billion in total. Although the programming period for the Sixth Framework Programme (FP6) for 2003-2006 has finished, DG RTD made payments amounting to EUR 753 million against cost claims during 2010 for on-going projects financed by FP6.

In recent years there have been a range of initiatives aimed at addressing the difficulties which have characterised the previous programming periods, in particular the development of common control and audit strategies amongst the RCS and in particular a common FP7 audit, or on-the-spot control, strategy designed to test the veracity of cost claims submitted by beneficiaries at different stages of the project cycle.

In addition, in line with the increased focus on fraud prevention and detection in the Commission, and following a recommendation made by the IAS, DG RTD has developed an Anti-Fraud Control Strategy. This strategy has resulted in an action plan which the DG is currently in the process of implementing. With such a key share of the overall research area spending budget, it is essential that DG RTD has a sound and credible control strategy and robust approach to dealing with the possibility of beneficiary fraud.

b. Audit Objectives

The objective of the audit was to assess the internal controls underpinning DG RTD’s on-the-spot controls processes and the adequacy and effective application of the fraud governance, risk management and internal control processes for fraud prevention and detection.

c. Audit Scope

The audit of the on-the-spot control processes focussed particularly on:

· the on-the-spot audit strategy and planning processes;

· the methodology, guidelines and procedures and coordination with the other research DGs and executive agencies;

· implementation of the audit plan by the ex-post audit units either directly or by the external audit firms (EAFs);

· monitoring and reporting arrangements;

· monitoring the effectiveness of the system of audit certification;

· measures to ensure the quality of the work undertaken;

· the follow-up given to audit results including the monitoring and implementation of corrective actions.

The scope of the audit encompassed fraud prevention controls aimed at reducing the opportunity and motivation to commit fraud and detection measures to indicate the possibility of fraud. The audit covered the different internal control system components as defined by the COSO model: control environment, risk assessment, control activities, information and communication, monitoring.

The scope included the control systems to the extent they cover FP6, FP7 and other programmes managed by DG RTD (Research Fund for Coal and Steel). The control systems for the REA, ERCEA and the Joint Undertakings were not included. It should be noted that as part of its 2010 AAR the DG made a reservation concerning the rate of the residual errors with regard to the accuracy of cost claims in the FP6. The fieldwork was finalised on 21 June 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 29 September.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.3.2. External Aid

2.3.2.1. DEVCO: EDF Grants

a. Background

The European Development Fund (EDF) is the main instrument for providing EU development and cooperation aid to the African, Caribbean and Pacific (ACP) States and Overseas Countries and Territories (OCT). It is funded by Member States and governed by its own financial regulation. The European Commission is responsible for the financial implementation of operations funded by EDF resources, with DG DEVCO managing most of the programmes either from its Headquarters (HQ) in Brussels or through the EU Delegations (EUDs) in ACP countries.

b. Audit Objectives

The objective of this audit was to asses DG DEVCO's compliance with procedures and the effectiveness and efficiency of its controls on grants financed by the EDF in order to ensure that they support a control strategy that is able to provide assurance to the Director-General when signing off the Annual Activity Report.

c. Audit Scope

The audit focused on activities carried out during the period 2008-2010 and covered the following main processes:

· grants awarding,

· grants contracting,

· ex-post evaluation.

In reviewing these processes, the audit also assessed the reliability and accuracy of financial and operational data in CRIS and the effectiveness of HQ supervision for the assurance process.

Other aspects of the grant management process (e.g. project implementation and monitoring, ex-post controls), as well as regional programmes, grants managed under decentralised management within the imprest component of Programme Estimates, and grants and contribution agreements with the United Nations, the World Bank and the African Union, were excluded from the scope of this audit. These have been covered in other audits already completed or are planned by the IAS and/or the Internal Audit Capability (IAC) of DEVCO.

There are no observations/reservations in the 2010 Annual Activity Report that relate to the processes audited.

The fieldwork was finalised on 8 July 2011. All observations and recommendations relate to the situation as at that date. The audit was finalised on 14 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 7 || 7 || 100% || 0 || 0%

Total || 10 || 10 || 100% || 0 || 0%

2.3.3. Rural Development

2.3.3.1. AGRI: Audit on the Internal Control System for managing the Instrument for Pre-Accession Assistance for Rural Development in DG AGRI

a. Background

Council Regulation (EC) 1085/2006 established the Instrument for the Pre-Accession (IPA) providing the basis for the co-ordination, management and implementation of the Commission's pre-accession strategy.

IPARD, one of the five IPA components, assists the Candidate Countries(CCs) (Croatia, Turkey and the Former Yugoslav Republic of Macedonia) in preparing for the implementation of the "acquis communautaire" of the Common Agricultural Policy (CAP) and alignment to EU structures, through the provision of financial assistance under multi-annual rural development programmes. These programmes' financial envelope is 1.145,8 € millions for the 2007-2013 period.

The Commission implements IPARD through fully decentralised management mode according to the provisions laid down in the Framework, Sectoral and Multi-Annual Agreements between the Commission and the Candidate Country.

b. Audit Objectives

The main objective of the audit was to assess the adequacy and effective application of the governance, risk assessment and internal control process for managing the Instrument for Pre-Accession Assistance for Rural development (IPARD).

c. Audit Scope

The scope of the audit covered the preparation and implementation of IPARD programmes for the period 2007-2013 and the roles and responsibilities of DG AGRI's units involved.

There are no observations/reservations in the AAR that relate to the process audited.

The fieldwork was finalised on 25 November 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 20 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 2 || 2 || 100% || 0 || 0%

Important || 1 || 1 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.3.4. TEN-T EA

2.3.4.1. TEN-T EA: Control strategy in the Trans-European Transport Network Executive Agency (TEN-T EA)

a. Background

The Trans-European Transport Network Executive Agency (TEN-TEA) was created by the European Commission in 2006 and is responsible for managing the technical and financial implementation of the Trans-European Transport Network Programme (TEN-Т). The projects funded under the TEN-Т Programme cover all transport modes plus logistics and intelligent transport systems, and involve all EU Member States. More than 300 projects amounting to more than 7 billion EUR (out of a budget of more than 8 billion EUR) have already been launched under the 2007-2013 financial perspective. The Agency also manages more than 60 ongoing projects set up under the previous financial perspectives, which represents 290 million EUR.

The IAS-IAC joint-audit on The Control Strategy in the Trans-European Transport Network Executive Agency (TEN-TEA) was included in the IAS/TEN-TEA coordinated 2011 Audit Work Programme because of the relative importance of the operational budget of the Agency and the audit will therefore contribute to the IAS Overall Opinion.

b. Audit Objectives

The objective of the audit was to assess the adequacy and effective application of the internal control system (ICS), risk management and governance processes related to the Control Strategy of the operational budget in TEN-Т E A

In particular, the audit assessed whether the ICS provided reasonable assurance regarding compliance with the relevant legislation, the reliability of financial and management information and the effectiveness and efficiency of the processes mentioned in the scope below.

c. Audit Scope

As a result of the desk review and the interviews carried out during the Preliminary Survey, the scope of this audit focussed on the following processes:

· Ex-ante financial controls in the Agency regarding commitments, payments (prefinancing - interim payments - final payments), recoveries and decommitments of the operational budget.

· Ex-post controls (external audit) and on-the-spot audit strategy regarding the operational budget.

There were no observations/reservations made in the 2010 AAR of DG MOVE and TEN-T EA concerning the processes under the scope of this audit:

During the audit, no scope limitations were identified.

The fieldwork was finalised on 20 October 2011. All observations and recommendations relate to the situation as at that date and do not consider improvements introduced since then. The audit was finalised on 3 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Important || 7 || 7 || 100% || 0 || 0%

Total || 7 || 7 || 100% || 0 || 0%

2.4. Global Navigation Satellite System Programs (GNSS)

2.4.1. ENTR: Global Navigation Satellite System Programs (part: Governance, Risk management and Project Management)

a. Objectives and Scope

The objective of the audit was to assess the adequacy and effective application of the internal control system (ICS), risk management and governance processes related to the Global Navigation Satellite System (GNSS), managed by DG ENTR. In particular, the audit assessed whether the ICS provided reasonable assurance regarding compliance with the relevant legislation, and the effectiveness and efficiency of the processes mentioned in the scope below.

As a result of the desk review and the interviews carried out during the Preliminary Survey, three sub-engagements were decided, covering:

· Governance, Risk Management and Project Management

· Financial circuits, financial management and accounting for Fixed Assets

· Grants (under indirect centralised management) and Procurement

This part deals with the conclusions of the first sub-engagement "Governance, Risk Management and Project Management". The scope of the audit focussed on the governance structure of GNSS, including the compliance with legal bases, roles and responsibilities of each Institution and body and the oversight and supervision function of the Commission, the risk management, including the methodology, monitoring and reporting, and the project management, including change management, monitoring and reporting.

There were no observations/reservations made in the 2009 AAR of DG TREN concerning the processes under the scope of this audit.

During the audit, no scope limitations were identified.

The fieldwork was finalised on 21 December 2010. All observations and recommendations relate to the situation as at that date and do not consider several improvements introduced since then (e.g. the appointment of a Deputy Director General). The audit was finalised on 13 April.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 6 || 6 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 11 || 11 || 100% || 0 || 0%

2.4.2. ENTR : Global Navigation Satellite System Programs (part: Actions, Grant & Procurement Management)

a. Background

EGNOS' and Galileo's aim is to provide a state-of-the-art global and high-accuracy positioning system upon which European Union can rely independent from the Russian GLONASS and US GPS systems, whose full services are limited to military applications and which can be disabled for public applications in times of conflict. The fully deployed system will consist of 30 satellites and the associated ground infrastructure. In 2007-2008, the Galileo programme was reorganised with a new planning, a new funding scheme, and a new governance model involving notably the Commission as Programme Manager, the European Space Agency (ESA) as Project Manager and the Member States through different bodies. The current total budget amounts to EUR 7,5 billion.

The audit on The Global Navigation Satellite System (GNSS) was included in the IAS coordinated Audit Work Programmes for 2010 and 2011 because it was assessed as a high risk area.

This part deals with the conclusions of the third sub-engagement "Grant and Procurement Management", mentioned under point IV.1.

b. Audit Objectives

The objective of the audit was to assess the adequacy and effective application of the internal control system (ICS) relating to Grant (under indirect centralised management) and Procurement Management for GNSS.

In particular, the audit assessed whether the ICS provided reasonable assurance regarding compliance with the relevant legislation, the reliability of financial and management information and the effectiveness and efficiency of the processes mentioned in the scope below.

c. Audit Scope

As a result of the desk review and the interviews carried out during the Preliminary Survey, the scope of this audit focussed on the following processes:

– Actions (Grants under indirect centralised management): the payments from the Commission to the European Space Administration (ESA) following the Delegation Agreement.

– Procurement management: needs analysis and planning – preparation of the contract (call for tenders, evaluation of tenders, award of contract, and budgetary and legal commitment) – payments (prefinancing, deliveries, intermediate payments, and final payment) and ex-post controls.

The following reservation was made in the 2010 AAR of DG ENTR concerning the processes under the scope of this audit:

"Reservation concerning the reliability of the financial reporting by the European Space Agency (ESA) for its own costs(*) about the joint implementation of the space component of the Global Monitoring for Environment and Security (GMES) and about the implementation of the EU satellite navigation (EGNOS and Galileo) programme."

(*) It should be noted that the above reservation relates to ESA entitlement to be reimbursed for its own costs incurred in the implementation of the delegated tasks and not the industrial procurement expenditure.

During the audit, no scope limitations were identified.

The fieldwork was finalised on 9 May 2011. All observations and recommendations relate to the situation as at that date and do not consider improvements introduced since then. The audit was finalised on 14 October.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 6 || 6 || 100% || 0 || 0%

Total || 9 || 9 || 100% || 0 || 0%

2.4.3. ENTR: Global Navigation Satellite System Programs (part: Financial Circuits, Financial Management and Accounting for Fixed Assets)

a. Background

The EGNOS', and Galileo (projects, which form together The Global Navigation Satellite System (GNSS) aim to provide a state-of-the-art global and high-accuracy positioning system upon which European Union can rely independently from the Russian GLONASS and US GPS systems. The fully deployed system will consist of 30 satellites and the associated ground infrastructure. In 2007-2008, following a key reform to address serious project cost overrun and delay issues, the Galileo programme was reorganised with a new planning and funding scheme, as well as a governance model involving the Commission as Programme Manager, the European Space Agency (ESA) as Project Manager, and the Member States through different bodies. The governance reform accordingly entrusted the ownership of the infrastructure from the Galileo and EGNOS programmes to the Commission and made it owner of the assets and responsible for managing these programmes. The current total budget amounts to EUR 7 billion.

This part deals with the conclusions of the second sub-engagement “Financial Circuits, Financial Management and Accounting for Fixed Assets, mentioned under point IV.1.

b. Audit Objectives

The audit was conducted in two parts:

· the DG’s accounting for fixed assets,

· the financial circuits and financial management.

The IAS audit objectives for the accounting for fixed assets were:

· to assess the adequacy and effective application of the Internal Control System (ICS) in respect of the management of the transfer of EGNOS fixed assets from ESA to the Commission as of 1st April 2009; and

· to ensure the existence, completeness, security, and correct valuation and disclosure of the EGNOS and all the GNSS Fixed Assets (including those to be replaced or transferred in future financial periods under EGNOS and the IOC (Initial Operational Capability) and FOC (Full Operational Capability)) in the financial statements of the Commission.

The objective of the audit in relation to financial circuits and financial management was to assess the adequacy and effective application of the DG’s internal control system (ICS) and financial circuits relating to the GNSS funds managed by DG ENTR (together with the European Space Agency (ESA)).

c. Audit Scope

The scope of this audit focused on the implementation of the provisions of Regulation 683/2008 and the detailed requirements of the two Delegation Agreements agreed between the EC and ESA on the further implementation of these two programmes. In respect of fixed assets, the audit scope was extended to cover the assets acquired under standard (centralised procurement) Commission contracts for EGNOS, and those to be transferred from ESA.

The audit did not cover expenditures funded under the Research Programme budget of the Commission or expenditures on the GMES programme.

In respect of the audit on both financial circuits and financial management and accounting for fixed assets, the following reservation was made in the 2010 AAR of DG ENTR concerning the processes under the scope of this audit:

"Reservation concerning the reliability of the financial reporting by the European Space Agency (ESA) for its own costs about the joint implementation of the space component of the Global Monitoring for Environment and Security (GMES) and about the implementation of the EU satellite navigation (EGNOS and Galileo) programme."

During the audit, no scope limitations were identified.

The fieldwork was finalised on 27 June 2011. All observations and recommendations relate to the situation as at that date and do not take account of any improvements introduced since then. The audit was finalised on 17 November.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 5 || 5 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 10 || 10 || 100% || 0 || 0%

2.5. Financial Management Process

2.5.1. Guarantees

2.5.1.1. Consolidated: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

a. Background

Commission Services are required to ask for guarantees to protect the financial interests of the EU. According to the Financial Regulation (FR) and its Implementing Rules (IR), the contracting authority can ask tenderers and contractors to lodge a guarantee to avoid that bids will not be withdrawn (tender guarantee), to ensure full performance of the contract (performance guarantee) or to limit the financial risks connected with payment of pre-financing (pre-financing guarantee). Pre-financing guarantees can also be asked in case of grant agreements.

DG BUDG, in its central role, provides instructions, interpretative notes and model contracts for guarantees to support the Commission Services in the correct implementation of the FR and its IR. In addition, it organises training courses and is responsible for the IT application for recording and managing guarantees in ABAC. Financial guarantees, as part of the annual accounts of the Commission, are recorded off-balance sheet.

b. Audit objectives and audit scope

The overall objective of this audit was to assess the compliance of the management of guarantees with the FR and other applicable rules and regulations and its effectiveness and efficiency. In particular, the audit assessed the support and guidance provided by DG BUDG to operational Services, the internal control systems implemented in the Commission Services for managing guarantees and the adequacy of the related monitoring and reporting systems in place.

The scope of the audit, conducted in DG BUDG (in its central role) and in a sample of operational DGs and Executive Agencies (DG ELARG, DG DIGIT and the Executive Agency for Competitiveness and Innovation - EACI), covered the management of performance guarantees for procurement contracts and pre-financing guarantees for procurement contracts and grant agreements. The audits were finalised on 19 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 6 || 5 || 83% || 1 || 17%

Important || 16 || 15 || 94% || 1 || 6%

Total || 22 || 20 || 91% || 2 || 9%

2.5.1.2. BUDG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 7 || 7 || 100% || 0 || 0%

Total || 10 || 10 || 100% || 0 || 0%

2.5.1.3. ELARG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 0 || 0% || 1 || 100%

Important || 5 || 4 || 80% || 1 || 20%

Total || 6 || 4 || 67% || 2 || 33%

2.5.1.4. DIGIT: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.5.1.5. EACI: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.5.2. Procurement

2.5.2.1. OIB: Management of Procurement in OIB

a. Background

Procurement is vital to OIB's core business, as most operational activities are made possible via a large number of procurement procedures and the signature of numerous contracts.

b. Audit Objectives

The objective of the audit was to assess the control measures implemented in order to ensure the legality and regularity of the public procurement process managed by OIB. In addition, efficiency and effectiveness of internal procedures have also been addressed in this context.

c. Audit Scope

For the purpose of this audit, the procurement process was considered in the broad sense, i.e. including both the pre-award activities (from the needs analysis and planning to the signing of the contract) as well as the post-award activities (from the execution of the contract to its monitoring, ex-post controls and the feedback on the procurement process).

The specific area of Buildings Procurement was excluded from the scope of this audit, since the relevant framework is currently being revised.

The fieldwork was finalised on 5 December 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 17 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 1 || 1 || 100% || 0 || 0%

Important || 2 || 2 || 100% || 0 || 0%

Total || 3 || 3 || 100% || 0 || 0%

2.5.2.2. HR: Management of Procurement by DG HR

a. Objectives and Scope

The objective of the audit was to assess the legality and regularity of the public procurement process managed by DG HR. Aspects of efficiency and effectiveness of internal procedures were also considered in this context.

For the purpose of this audit, the procurement process was considered in the broad sense, i.e. including both the pre-award activities (from the needs analysis and planning to the signing of the contract) and the post-award activities (from the execution of the contract to its monitoring, ex-post controls and the feedback on the procurement process).

The fieldwork was finalised on 20 May 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 28 July.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Important || 5 || 5 || 100% || 0 || 0%

Total || 5 || 5 || 100% || 0 || 0%

2.5.2.3. OIB: 2nd Follow-up Audit of the management of Procurement Contracts in OIB

Based on the results of its follow-up engagement, finalised on 11 November, the IAS assessed that all the relevant recommendations addressed to OIB had been implemented, except for one recommendation, of which the effective implementation was further assessed as part of the wider on-going audit on procurement in OIB.

2.5.2.4. JRC: Follow-up audit on Procurement in JRC

Based on the results of a follow-up audit, finalised on 23 September, the IAS concluded that all the recommendations addressed to DG JRC that resulted from the audit on Procurement have been adequately and effectively implemented, except for the recommendation no 3, which remains open. However, the priority of recommendation 3 was downgraded from Very Important to Important as parts of the actions have been already implemented and the residual risk has been reduced. As the procurement planning tool is not yet fully operational, the risk of difficult retrieval of information in the units where procurement files are kept only on paper remains. The table below summarises the remaining actions to be implemented.

2.5.3. Recoveries

The IAS performed in 2008 an audit on the Recovery process in the Commission. The audit was conducted in DG BUDG and LS (it their central role) and in four operational DGs/Agencies (DG AIDCO, EAC, INFSO and EACEA). The follow-up audits were finalised on 25 March 2011.

2.5.3.1. EAC: Follow-up audit on Recoveries

According to Issue Track, the EAC considered all recommendations as implemented ("Ready for review"). Based on the results of its follow-up audit, the IAS assessed that they had all been adequately and effectively implemented, except for four recommendations.

2.5.3.2. BUDG: Follow-up audit on Recoveries

According to Issue Track, DG BUDG considered all recommendations as implemented ("Ready for review"). Based on the results of its follow-up audit, the IAS assessed that all accepted recommendations had been adequately and effectively implemented.

2.5.3.3. LS: Follow-up audit on Recoveries

According to Issue Track, the LS considered five out of the ten recommendations as implemented ("Ready for review"). Based on the results of its follow-up audit, the IAS assessed that all five recommendations had been adequately and effectively implemented. Furthermore, one recommendation, which had an "open" status in Issue Track, was assessed as being adequately implemented and could therefore be closed in the system.

At the end of the follow-up engagement, the IAS considered the remaining four recommendations still open. These will be the subject of a second follow-up audit in line with the IAS methodology.

2.5.3.4. INFSO: Follow-up audit on Recoveries

Based on the results of its follow-up audit, the IAS assessed that all the recommendations from the original audit have been adequately implemented and risks mitigated.

2.5.3.5. DEVCO: Follow-up audit on Recoveries

According to Issue Track, DEVCO considered all recommendations as implemented ("Ready for review"). Based on the results of its follow-up audit, the IAS assessed that they had all been adequately and effectively implemented, except for one recommendation.

Furthermore, the IAS considered one recommendation (Important) as implemented, but nevertheless wanted to raise the DG's attention to the need to properly monitor its consistent implementation.

2.5.3.6. EACEA: Follow-up audit on Recoveries

Based on the results of its follow-up audit, the IAS assessed that all the recommendations from the original audit had been adequately implemented and risks mitigated.

2.6. Information Technologies

2.6.1. Local IT

2.6.1.1. DG EMPL: Audit on Management of Local IT in DG EMPL

a. Background

The activities of DG EMPL depend heavily on IT systems. Some of them support the operational and financial management of the projects financed by DG EMPL and other DGs, while others permit to interconnect Member States and other stakeholders to exchange information, which makes the reputational risk especially relevant.

The DG EMPL IT unit's mission is to provide all users with a modem, secure and efficient informatics system to sustain and extend the strategies and objectives of DG EMPL.

b. Audit Objectives and scope

The overall objective of the audit was to assess the internal control system put in place by DG EMPL to ensure an adequate and effective management of its local IT activities, with a particular focus on the following areas:

· IT Governance;

· Organization and management of the IT activities and projects;

· Physical and logical security arrangements

The audit focused in particular on the activities performed by unit EMPL G4 (Information Technologies). Other units and key staff (G2 - Financial Resources, adviser of Directorate G) were also consulted regarding their respective responsibilities. The audit was finalised on 20 January 2012.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 4 || 4 || 100% || 0 || 0%

Important || 9 || 9 || 100% || 0 || 0%

Total || 13 || 13 || 100% || 0 || 0%

2.6.2. Security of IT environment in subcontracted projects IT

2.6.2.1. REGIO: Audit on Security of IT environment in subcontracted projects IT in DG REGIO

a. Background

DG REGIO's activities are supported by, among other IT systems, WFS (for decisional and financial procedures related to the programming and financial execution activity phases of Structural Funds programmes management) and SYS AUDIT (for monitoring audit activities in the context of the control of structural funds).

The DG outsourced their evolutive maintenance to an external IT Consortium, which performs its development activities mainly abroad. The servers are hosted by DG DIGIT, who is also responsible for their administration and for the provision of a secure connection between the Commission network and the contractor's Data Centre.

Because WFS and SYSAUDIT manage and store sensitive and personal data and development activities are performed "extra-muros", an increased inherent risk of breaches in security and unauthorised access to sensitive and personal data exists.

b. Audit Objectives

The overall objective of the audit was to assess the internal control systems put in place by DG REGIO to provide adequate physical and logical security arrangements, as well as proper management of the subcontracted IT development activities related to the outsourced evolutive maintenance of WFS and SYSAUDIT.

c. Audit Scope

The engagement focused on the following priority areas and processes related to the evolutive maintenance of WFS and SYSAUDIT3:

· Planning and organisation: quality management, risk assessment and project management

· Acquisition and implementation: maintenance of application software, change management and testing and deployment in production of new developments

· Operations: management of service levels, management of third party services and systems (logical) security

The audit covered DG REGIO's IT Unit (A4) in its capacity of defining security requirements and monitoring the correct implementation of the contract with SEII , and the contractor (SEII), in its capacity of delivering software development, project management, operational and technical support, user guidance and training services.

DG REGIO did not include any reservations in its AAR that relate to the area/process audited.

The fieldwork was finalised in March 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 22 July.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 6 || 6 || 100% || 0 || 0%

Important || 7 || 7 || 100% || 0 || 0%

Desirable || 1 || 1 || 100% || 0 || 0%

Total || 14 || 14 || 100% || 0 || 0%

2.6.3. Management of the telecommunication infrastructure and services sTESTA

2.6.3.1. DIGIT: Audit on the Management telecommunication infrastructure and services sTESTA in DG DIGIT

a. Background

The secured Trans-European Services for Telematics between Administrations (sTESTA) is the largest project funded by the ISA programme, the objective of which is to improve electronic cooperation among public administrations in EU Member States.

This network, which is the successor of the previous TESTA I and TESTA II , is provided by the Commission to European Institutions, European Agencies and National Administrations across Europe in sectors such as justice and home affairs, health, consumer protection and statistics.

sTESTA is based on a dedicated and private infrastructure operated by a consortium which provides the network infrastructure and supporting services. The outsourced activities are monitored through regular quality and security audits conducted by specialised external service providers.

DG DIGIT is the system owner of sTESTA. Its main responsibility is to ensure the provision of high quality and secure networking services through the management of outsourcing contracts. This includes defining the security requirements and providing technological directions to the project, controlling the providers' performances, following up the corrective actions and tracking incidents. Relations with the stakeholders and dissemination of information among them are also part of DG DIGIT responsibilities.

The main inherent risks related to the management and operation of the sTESTA network relate to possible breaches in the security (unauthorised disclosure, modification or destruction of information while being transported over the sTESTA network) and interruption of activity (due to failure of the equipment/software, external attack or of lack of diligence in implementing and operating the sTESTA network systems). If not adequately mitigated, they might ultimately affect the provision of high quality and secure networking services and have a negative impact on the Commission's reputation.

b. Audit Objectives

The overall objective of the audit was to assess the internal control systems put in place by DIGIT to ensure that sTESTA is adequately managed and monitored. The audit focused in particular on the definition of the service requirements and on the definition and implementation of a quality review and monitoring programme.

c. Audit Scope

The engagement covered the following priority areas (COBIT processes):

· DS1 : Define and manage service levels;

· DS2: Manage third-party services;

· MEI : Monitor and evaluate IT performance;

· ME3: Ensure compliance with external requirements.

The audit covered the activities of Sector DIGIT.C2.002 (N1 - Network Infrastructure) in its capacity of defining sTESTA security and operational requirements and monitoring the correct implementation of the different related contracts. The audit was finalised on 6 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Important || 4 || 4 || 100% || 0 || 0%

Total || 4 || 4 || 100% || 0 || 0%

2.6.4. Enterprise Europe Network IT tools

2.6.4.1. EACI: Audit on Enterprise Europe Network IT tools in EACI

a. Objectives and Scope

The Enterprise Europe Network (EEN) is a network of contact points providing information and advice to EU companies on EU matters regarding developing business in new markets, facilitating technology transfers and accessing EU funding. Initially developed by DG ENTR, it is now operated and further developed by the Executive Agency for Competitiveness and Innovation (EACI). The EEN has close to 600 member organisations from 48 countries using the system.

EACI provides IT tools to support EEN activities. These IT tools are the bridge between EEN partners and form the basis of their collaboration. Using Europe's largest database, containing more than 13,000 profiles of cutting-edge technologies, the EEN brings together research and commercial applications. EACI decided to update EEN IT tools and launched the development project "Enterprise Europe Network 2.0 - Merlin".

The IT audit of the Audit on Enterprise Europe Network IT tools is included in the 2010 Work Programme of the IAS. This follows the audit risk assessment as part of the lAS's Strategic Audit Plan for 2010-2012.

The audit was planned because of the visibility of the Enterprise Europe Network IT tools, which are used by a number of users outside the Commission and because one might wonder whether an executive agency can manage a system of this size developed by another organisational entity.

The objective of the EEN IT tools audit was to assess the adequacy and effective application of the internal control systems, IT governance, IT Project Management and IT Development related to the EEN IT tools in EACI. It also complements previous audits performed in the area of IT Project Management and will help the audited agency to identify the areas for improvement to focus on.

The scope of this audit was limited to the Merlin development project and related IT processes and procedures. During the audit, no scope limitations have been identified.

The fieldwork was finalised on 15 April 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 22 June.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 4 || 4 || 100% || 0 || 0%

Important || 4 || 4 || 100% || 0 || 0%

Total || 8 || 8 || 100% || 0 || 0%

2.6.5. Follow-ups on IT audits

2.6.5.1. TAXUD: Follow-up audit on the large IT Systems in DG TAXUD

Based on the results of its follow-up audit, the IAS assessed that all three remaining recommendations addressed to DG TAXUD that resulted from the audit "IAS Audit of the large IT Systems in DG TAXUD" had been adequately and effectively addressed and could be closed. The follow-up audit was finalised on 23 June.

2.6.5.2. TAXUD: Follow-up audit on New IT Organisation and Contractual Framework

Based on the results of its follow-up audit, the IAS assessed that all the recommendations addressed to DG TAXUD that resulted from the audit on New IT Organisation and Contractual Framework had been adequately and effectively implemented. The follow-up audit was finalised on 21 November.

2.6.5.3. PMO: Follow-up audit on Management of Local IT

According to Issue Track, 19 out of 20 recommendations were considered as implemented by the PMO, while for one recommendation some improvements were still needed and consequently remained open.

Based on the results of its follow-up audit, the IAS assessed that all the recommendations considered by the PMO as "Ready for review" had been adequately and effectively implemented, except for four recommendations. The follow-up audit was finalised on 8 February.

2.6.5.4. LS: Follow-up audit on Management of Local IT

According to Issue Track, 16 out of 25 recommendations were considered as implemented by the LS. Based on the results of its follow-up audit, the IAS assessed that all of them had been adequately and effectively implemented, except for three recommendations. The follow-up audit was finalised on 27 May.

2.6.5.5. OLAF: Follow-up audit on the Anti-fraud Information System (AFIS)

Based on the results of its follow-up audit, the IAS assessed that all the recommendations addressed to OLAF that resulted from the audit on the Anti-Fraud Information System (AFIS) had been adequately and effectively implemented, except for one recommendation. The follow-up audit was finalised on 23 September.

2.6.5.6. INFSO: Follow-up Audit on the Management of Research Information Systems in DG INFSO

Based on the results of its follow-up audit, the IAS assessed that all the recommendations addressed to DG INFSO that resulted from the audit "IAS Audit on the Management of Research Information Systems at DG INFSO" had been adequately and effectively implemented and could be closed.

DG INFSO made progress in their controls over management of information systems and had reached the maturity level that IAS considered as sufficient for closing the recommendations. However, the IAS considered that improving further these controls would benefit DG INFSO. The follow-up audit was finalised on 7 July.

2.6.5.7. RTD: Follow-up Audit on the Management of Research Information Systems in DG RTD

Based on the results of its follow-up audit, the IAS assessed that all the recommendations addressed to DG RTD that resulted from the audit "IAS Audit on the Management of Research Information Systems at DG RTD" had been adequately and effectively implemented and could be closed. The follow-up audit was finalised on 23 June.

2.7. Other audits

2.7.1. JRC: Audit on Competitive Activities

The mission of the Joint Research Centre (JRC) is to provide customer-driven scientific and technical support for the conception, development, implementation and monitoring of European Union policies. As a service of the European Commission, the JRC functions as a reference centre of science and technology for the Union. Close to the policy-making process, it serves the common interest of the Member States, while being independent of special interests, whether private or national. In 2010, JRC's total budget for expenditure amounted to some EUR 389 million and mainly covered the implementation of direct actions under the Framework Programme 7 (FP7) EC and Euratom research programmes, together with decommissioning activities.

Its revenue budget in 2010 was EUR 72 million, mainly from Competitive Activities which is made up of work undertaken on behalf of third parties or providing assistance to Commission DGs. Under a decision from Council, JRC is required to earn part of its income from additional sources through Competitive Activities to demonstrate its scientific competitiveness. The target is currently 15% of the overall JRC budget and split between the various Institutes. In 2010, competitive cashed income amounted to EUR 62,5 million and the target for 2011 is set at EUR 65,1 million.

The main objective is the development of added value to its institutional programme next to the acquisition/development of knowledge, increasing networks, benchmarking and ensuring scientific excellence. Under the Financial Regulation, any revenue of competitive activities will be used to provide additional expenditure appropriations. Expenditure relates to the resources needed, such as goods and services and the major component, staff costs.

a. Audit Objectives

The overall objective of this engagement was to assess the internal controls underpinning the Competitive Activities processes. Specifically, the audit has assessed:

· governance arrangements;

· internal controls and procedures exercised at the different stages of the process (from planning up to closure, monitoring and reporting);

· reliability of reporting on competitive activities;

· compliance with Financial Regulations and other applicable rules /regulations;

· effectiveness and efficiency of certain aspect of the procurement process when carried out exclusively in the frame of competitive activities. More specifically, whether the services/goods purchased were justified and adequately 'invoiced' (such as verification of needs identification, timely planning, cost aspects).

b. Audit Scope

The audit focussed in particular on key controls of the three types of competitive activities, for the following components of the internal control system:

· Overall governance, strategic framework and overall planning:

– Systems, policies, procedures and tools required for an effective governance and organizational framework for competitive activities.

– Planning of the overall competitive activities at corporate/institute level.

· From initial request up to the closure of the competitive project: The complete cycle of activities, including identification of potential customers, selection and preparation of proposals or participation in calls for proposals for indirect actions, contracting and project implementation.

· Debt and treasury management: Budgeting and cashing of competitive income responsibilities performed by JRC.

· Overall monitoring and reporting: Specific procedures and monitoring arrangements, management scoreboards (or equivalent tools), KPI's and loop back to priorities and targets fixed, ex post controls, supporting tools.

Excluded from the scope was the Management and Cost Reporting process for the Indirect Actions element of Competitive Activities and the measures for hedging third party liability (e.g. safety and legal aspects, insurance policies), as these are subject of recently conducted/ongoing audits of JRC Internal audit Capability (IAC). There were no observations/reservations made by JRC in its 2010 Annual activity Report (AAR) which related to the processes audited. The fieldwork was finalised in November 2011. All observations and recommendations relate to the situation as of that date. The audit was finalised on 22 December.

Acceptance Status || || Yes || No

Priority || # || # || % Total || # || % Total

Very Important || 3 || 3 || 100% || 0 || 0%

Important || 5 || 5 || 100% || 0 || 0%

Total || 8 || 8 || 100% || 0 || 0%

2.7.2. BUDG: Implementation of the Internal Control standard 13 on Accounting and Financial reporting

An audit on the Implementation of Internal Control Standard 13 was launched in January 2011. The objective of the audit was to assess the internal control systems and the related monitoring activities in place in the Commission to ensure reliability (accuracy, completeness and timeliness) of the accounting information provided by the DGs, and used by DG BUDG as a basis for the preparation of the Commission annual accounts.

As a result of the preliminary review, the IAS identified that the main risks that may affect the reliability of the accounting data and the key controls in place (centrally and locally) are regularly audited by the Court of Auditors[3] (in the context of the Annual Report on budget execution) and by the IACs (when reviewing the closure and/or cut-off procedures in their DGs).

On the basis of a close review of other auditors work programmes and results, the IAS concluded that the main areas are adequately covered and decided to close the present audit without performing any detailed testing on the internal control and monitoring systems implemented. The audit was finalised on 11 May.

2.8. Follow-up audits (if not in the above categories)

In addition to the follow-up audits carried out by the IAS, the latter also regularly reports to the APC on the state of play regarding implementation of IAS audit recommendations. Overall, 80% of the recommendations made over the period 2007-2011 are considered by auditees as implemented as of 31 January 2012.

2.8.1. RTD: Follow-up audit on DG RTD's Internal Control System for managing FP7 – Design

Based on the results of its follow-up audit, finalised on 20 January 2012, the IAS assessed that the recommendations addressed to DG RTD that resulted from the original audit had been implemented with the exception of two important recommendations.

2.8.2. REA: Follow-up audit on the set up of Internal Controls and Financial Management Systems – Design in REA

The IAS made ten recommendations in total, eight of which were reported as implemented at the date of the follow-up audit finalised on 19 January 2012. Based on the results of its follow-up work, the IAS assessed that six out of these had been implemented. The two remaining recommendations, for which a certain limited number of actions still needed to be finalised, were assessed as partially implemented.

2.8.3. HR-DS: Follow-up audit on Monitoring of Security as managed by HR-DS

Based on the results of its follow-up audit, finalised on 19 January 2012, the IAS assessed that globally all the recommendations resulting from the original audit which were reported as "ready for review" by DG HR had been implemented

2.8.4. AGRI: Follow-up audit on Rural Development

Based on the results of its follow-up audit finalised on 13 January 2012, the IAS assessed that all the recommendations addressed to DG AGRI that resulted from the original audit had been adequately and effectively implemented, except for one recommendation which was assessed partially implemented.

2.8.5. INFSO: Follow-up audit on DG INFSO's Internal Control System for managing FP7 – Design

Based on the results of its follow-up audit finalised on 13 January 2012, the IAS assessed that all the recommendations addressed to DG INFSO that resulted from the original audit had been implemented, with the exception of one important recommendation, which was assessed partially implemented.

2.8.6. ERCEA: Follow-up audit on ERCEA on the set up of internal controls/financial management system – Design

Based on the results of its follow-up audit finalised on 3 January 2012, the IAS assessed that seven out of eight recommendations addressed to ERCEA that resulted from the original audit had been adequately and effectively implemented.

2.8.7. EMPL: Follow-up of the audit on the internal control systems for managing the new Structural Funds programming period – Phase II

Based on the results of its follow-up audit finalised on 22 December, the IAS assessed that all the recommendations addressed to DG EMPL that resulted from the audit on DG EMPL's internal control systems for managing the new Structural Funds programming period - Phase II had been adequately and effectively implemented.

2.8.8. REGIO: Follow-up of the audit on the internal control systems for managing the new Structural Funds programming period – Phase II

Based on the results of its follow-up audit finalised on 22 December, the IAS assessed that all the recommendations addressed to DG REGIO that resulted from the audit on DG REGIO's internal control systems for managing the new Structural Funds programming period - Phase II had been adequately and effectively implemented.

2.8.9. HOME: 2nd Follow-up audit on Grants under Shared management of the European Refugee Fund in DG HOME

Based on the results of its second follow-up audit finalised on 16 December, the IAS assessed that all the recommendations addressed to DG HOME that resulted from the audit on Grants under Shared Management of the European Refugee Fund and that remained open after its first follow-up had been adequately and effectively implemented.

2.8.10. TEN-T EA: Joint IAS/TEN-T EA IAC Follow-up audit on Audit of the Management of the Operational Budget in TEN-T EA

The objective of this engagement was to assess the progress made in implementing the remaining accepted recommendations addressed to DG MOVE and to TEN-T EA following the first follow-up of the "Audit of the Management of the Operational Budget in TEN-TEA” carried out in 2009.

Based on the results of its follow-up audit finalised on 15 December, the IAS assessed that all the recommendations addressed to DG MOVE and TEN-T EA that resulted from the Audit of the Management of the Operational Budget in TEN-TEA had been adequately and effectively implemented, except for two recommendations addressed to DG MOVE and two recommendations addressed to TEN-T EA.

2.8.11. ECHO: 2nd Follow-up audit of NGOs funding in DG ECHO

The objective of this engagement was to assess the progress made in implementing the remaining accepted recommendations addressed to DG ECHO following the first follow-up of the audit carried out in 2007 (final report dated 6 June 2007).

Based on the results of its follow-up audit finalised on 12 December, the IAS assessed that all the recommendations addressed to DG ECHO that resulted from the audit had been adequately and effectively implemented.

2.8.12. ELARG: 2nd Follow-up audit on "Ex-post control activities in DG ELARG"

The objective of this engagement was to assess the progress made in implementing the remaining accepted recommendations addressed to DG ELARG following the first follow-up carried out in 2008 (final report dated 18 July 2008).

Based on the results of its follow-up audit finalised on 7 December, the IAS assessed that all the recommendations addressed to DG ELARG that resulted from the audit "Ex-post control activities" and from the first follow-up audit had been adequately and effectively implemented.

2.8.13. FPI: Follow-up audit on the financial management of the Common Foreign and Security Policy Budget

According to Issue Track, 10 out of 11 recommendations were reported as implemented by the auditee. One recommendation was not included in the scope of the follow-up as it was not ready for review at the time of the follow-up.

Based on the results of its follow-up audit finalised on 6 December, the IAS assessed that all the recommendations addressed to the former DG RELEX and now transferred to FPI that resulted from the audit on the financial management of the Common Foreign and Security Policy Budget had been adequately and effectively implemented, except for four recommendations.

2.8.14. OIL: Second follow-up audit on the Evaluation of targeted internal control standards in OIL

Based on the results of its follow-up audit finalised on 29 November, the IAS assessed that globally all the recommendations addressed to OIL that resulted from the audit on the Evaluation of targeted Internal Control Standards in OIL had been implemented.

2.8.15. HR & OIB: 2nd Follow-up Audit of the Management of Building Procurement Contracts by DG HR and OIB

Based on the results of its follow-up engagement finalised on 22 November, the IAS assessed that all the relevant recommendations addressed to DG HR and OIB which were reported as ready for review had been implemented.

2.8.16. EACI: Follow-up audit on the management of the Operational Budget of the EACI

Based on the results of its follow-up audit finalised on 30 September , the IAS assessed that all the recommendations addressed to EACI, DG MOVE, DG ENER, DG ENTR and DG ENV that resulted from the audit on 'Management of the Operational Budget of the Executive Agency for Competitiveness and Innovation' in 2009 had been adequately and effectively implemented.

2.8.17. MARKT: Follow-up audit on Monitoring the Implementation of EU law

Based on the results of its follow-up audit finalised on 6 September, the IAS assessed that all the recommendations addressed to DG MARKT that resulted from the audit on "Monitoring the Implementation of EU law" had been adequately and effectively implemented.

2.8.18. ENV: Follow-up audit on Monitoring the Implementation of EU law

Based on the results of its follow-up audit finalised on 6 September, the IAS assessed that all the recommendations addressed to DG ENV that resulted from the audit "Monitoring the implementation of EU law" had been adequately and effectively implemented.

2.8.19. SG: Follow-up audit of the Consolidated report on Monitoring the Implementation of EU law

Based on the results of its follow-up audit finalised on 6 September, the IAS assessed that all the recommendations addressed to SG that resulted from the audit "Consolidated report on Monitoring the implementation of EU law" had been adequately and effectively implemented.

2.8.20. MARE: Follow-up audit on the European Fisheries Fund as managed by DG MARE

Based on the results of its follow-up audit finalised on 15 July, the IAS assessed that all the recommendations addressed to DG MARE that resulted from the audit on the European Fisheries Fund as managed by DG MARE had been adequately and effectively implemented.

2.8.21. OIB: Follow-up audit on the Inventory Process as managed by OIB

This follow-up audit does not result in a re-assessment of the adequacy of controls as a whole, but focuses on the specific recommendations in the original audit. It was carried out in accordance with the IAS methodological guidelines.

The assessment of the state of implementation was based on a desk review of evidence provided by OIB in Issue Track.

Based on the results of the follow-up audit finalised on 12 July, the IAS assessed that all the recommendations addressed to OIB that resulted from the audit have been adequately and effectively implemented, although in some cases there is still room for improvement. The IAS would specifically like to invite OIB to consider the following points for attention:

· due to IT-related issues, the finalisation of the tracking exercise analysis has been postponed by three months, and will not be completed before the end of September 2011. While acknowledging OIB's efforts to perform this analysis, the IAS considers, based on the information received, that significant attention is still required in order to complete it in the best conditions (Recommendation 2);

· the report function from ABAC SAM (DG BUDG owner) has some weaknesses and is still in the process of being tested (Recommendation 2);

· OIB is invited to send a note and/or instruction for newly appointed GBIs, in order to raise their awareness on their responsibility to verify the items (tracking) on a timely and regular basis (Recommendation 4);

· back-up arrangements have not yet been established to ensure business continuity for the warehouse management. OIB is invited to include them in its Business Continuity Plan (Recommendation 7Based on the results of its follow-up audit, the IAS assessed that all the recommendations addressed to OIB that resulted from the audit had been implemented.

2.8.22. OIL: Follow-up audit on the Inventory Process as managed by OIL

Based on the results of its follow-up audit finalised on 12 July, the IAS assessed that all the recommendations addressed to OIL that resulted from the audit on the Inventory process as managed by OIL, had been adequately and effectively implemented.

2.8.23. EPSO: Follow-up of the Limited Review on the selection process as managed by EPSO

Based on the results of its follow-up engagement finalised on 12 July, the IAS assessed that all the relevant recommendations addressed to EPSO had been implemented.

2.8.24. SANCO: Second Follow-up on Grant management (Food & Feed) in DG SANCO

This follow-up audit focused on the four outstanding recommendations of the first follow-up of the audit on Grant Management (Food & Feed) in DG SANCO in 2010.

Based on the results of its second follow-up audit finalised on 12 July, the IAS assessed that all the recommendations addressed to DG SANCO that resulted from the above mentioned audit had been adequately and effectively implemented.

2.8.25. PMO: Follow-up audit on the activities of PMO/6 ISPRA

Based on the results of its follow-up audit finalised on 5 July, the IAS assessed that all the recommendations addressed to PMO that resulted from the audit on the activities of PMO/6 ISPRA had been adequately and effectively implemented.

2.8.26. DEVCO: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG AIDCO

Based on the results of its third follow-up, finalised on 28 June, to assess the implementation of the seven recommendations from the 2003 in-depth audit in ex-DG AIDCO that remained open after the two follow-ups carried out in 2006 and 2008, the IAS assessed that the recommendations had been implemented, except for one recommendation which will be followed up as part of the implementation of DG DEVCO's action plan in response to the 2007 and 2008 IAS audits on Financial Management of Directorates D and B respectively.

2.8.27. EAC: Follow-up audit of remaining recommendations on 2004 IAS In-depth Audit of DG EAC

Based on the results of its third follow-up, finalised on 7 June, to assess the implementation of the ten recommendations from the 2004 in-depth audit in DG EAC that remained open after the two follow-ups carried out in 2005 and 2008, the IAS assessed that all the recommendations had been implemented, except for six recommendations which will be followed-up as part of the implementation of DG EAC's action plan in response to the 2010 IAS audit on Monitoring and Supervision of National Agencies by DG EAC.

2.8.28. ELARG: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG ELARG

Based on the results of its follow-up review finalised on 7 June, the IAS assessed that the recommendation had been implemented.

2.8.29. ESTAT: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit of DG ESTAT

Based on the results of its follow-up review finalised on7 June, the IAS assessed that the recommendations had been implemented.

[1] The duplication of recommendations resulting from DGs' split and cut-off consideration to classify recommendations by year explains the changes of figures compared to Table 1 in the 2010 report.

[2] The reports finalised by 1 February 2011 and the ML on the split of the DGs finalised in March 2011, are included in the 2010 report and are, therefore, not included in the 2011 report. Likewise, the reports issued in 2011 but finalised by 31 January 2012 are included in the 2011 report.

[3] Concerning the ECA, their audits in the context of annual report on budget execution includes focus on "the control systems put in place by the Commission to ensure that accounting data is not affected by errors". In particular, the ECA assessment "is mainly based on the evaluation of the results of the [accounting quality] project’s implementation by the examined DGs in the different areas of controls by which it is made up." The Court assessed in particular the accounting control environment, the closing process and cut-off procedures.