EUROPEAN COMMISSION Brussels, 21.9.2018 SWD(2018) 429 final COMMISSION STAFF WORKING DOCUMENT Summary of Executive summaries. Internal audit engagements finalised by the IAS in 2017 Accompanying the document Report from the Commission to the European Parliament and the Council Annual report to the Discharge Authority on Internal audits carried out in 2017 {COM(2018) 661 final}



Contents Content of this Staff working document: PART 1: Final reports 1. Horizontal audits 1.1.Audit on management of recovery orders for competition fines (incl. guarantees for competition fines) and for recovery orders in the context of the Commission's 'corrective capacity' – Phase I (Directorates-General CONNECT, ENER, LS, EACEA) 1.2.Audit on HR management and staff allocation in Directorate-General HOME and Directorate-General JUST 1.3.Audit on amendments of 2014-2020 OPs in Directorates-General REGIO, EMPL and MARE 1.4.Audit on the Commission's framework/arrangements for the estimation, assessment and reporting on the cost-effectiveness of controls (Directorates-General BUDG , NEAR, REGIO, RTD) 1.5.Audit on the Commission's supervision of the implementation of CEF financial instruments in Directorate-General ENER and Directorate-General MOVE 1.6.Audit on the Commission’s governance/oversight arrangements concerning risk management, financial reporting and the ex-post verification/audit function (Secretariat-General and Directorates-General AGRI, BUDG, DEVCO, REGIO, RTD) 1.7.Audit on the production process and the quality of statistics not produced by Eurostat (ESTAT and Directorates-General ENER, FISMA, GROW and JUST) 2. Agriculture, natural resources and health 2.1.Audit on Directorate-General AGRI's management of agricultural market crises 2.2.Audit on Directorate-General AGRI's implementation of RDPs 2.3.Audit on Directorate-General AGRI's control strategy for the CAP 2014-2020 2.4.Audit on CHAFEA's management and control system for the implementation of the measures for the promotion of agricultural products 2.5.Audit on LIFE + phasing out in Directorate-General ENV 2.6.Audit on monitoring and enforcement of EU environmental law in Directorate-General ENV 2.7.Audit on Directorate-General SANTE’s food safety crisis preparedness

3. Cohesion 3.1.Audit on policy and funding for youth employment in Directorate-General EMPL 3.2.Audit on monitoring the implementation and performance of FEAD OPs in Directorate-General EMPL 3.3.Audit on major projects in Directorate-General REGIO 4. RESEARCH ENERGY AND TRANSPORT 4.1.Audit on H2020 project management in Directorate-General CONNECT 4.2.Audit on procurement in DG CONNECT 4.3.Audit on closure of FP7 projects in ERCEA 4.4.Audit on grant management - phase 2: project management and payments for CEF in INEA 4.5.Audit on HR management in INEA 4.6.Audit on scientific project management in JRC 4.7.Audit on HR management – recruitment of scientists in JRC 4.8.Audit on the effectiveness of the set-up and supervision of Shift2Rail by Directorate-General MOVE 4.9.Audit on closure of FP7 projects in REA 4.10.Audit on HR management in Directorate-General RTD 5. EXTERNAL ACTIONS 5.1.Audit on management of investment facilities (financial instruments) in Directorate-General DEVCO 5.2.Audit on Directorate-General ECHO’s grant management in response to the Syrian crisis in the Middle East (Headquarters and Field Offices) 5.3.Audit on procurement under Instrument for Pre-Accession (direct management and indirect management with beneficiary countries) – phase II in Directorate-General NEAR 5.4.Limited review of grant and procurement procedures in the EU Delegation of Armenia – Directorate-General NEAR

5.5.Audit on preparedness for the mid-term review of ENI and IPA Regulations in Directorate-General NEAR 6. EDUCATION AND CITIZENSHIP 6.1.Consulting report on Directorate-General EAC's process to granting full financial autonomy to the EIT 6.2.Audit on Erasmus+ and Creative Europe – grant management phase 1 (from the call to the signature of contracts) in EACEA 6.3.Audit on HR management in EACEA 7. ECONOMIC AND FINANCIAL AFFAIRS 7.1.Audit on enforcement of the EU antitrust policy in Directorate-General COMP: cooperation with EU national competition authorities and national courts 7.2.Audit on financial management of procurement contracts and grants in Directorate-General COMP 7.3.Audit on the governance and operational organisation of the Investment Plan for Europe in Directorate-General ECFIN 7.4.Audit on HR management in EASME 7.5.Audit on H2020 project management in EASME 7.6.Audit on evaluation in Directorate-General ECFIN 7.7.Audit on financial management of procurement and grants in Directorate-General FISMA 7.8.Limited review of the calculation and the underlying methodology of the residual error rate for the 2016 reporting year in Directorate-General GROW 7.9.Audit on the accuracy of information on the Internal Market in Directorate-General GROW 7.10.Audit on the supervision of the implementation of the Copernicus programme in Directorate-General GROW – phase 1: control strategy on ESA entrusted budget 7.11.Audit on internal processes supporting trade policy negotiations in Directorate-General TRADE 8. GENERAL SERVICES 8.1.Audit on the procurement process in DIGIT 8.2.Audit on the charge-back of services in Directorate-General HR

8.3.Audit on ethics in OLAF 8.4.Audit on the procurement process in PO 8.5.. Consulting engagement on the efficiency of the workflow for parliamentary questions in SG 8.6.Audit on the financial management of the SRSS 9. IT AUDITS 9.1.Audit on corporate IT governance framework and portfolio management (DIGIT, SG) 9.2.Audit on management of IT security in DIGIT 9.3.Audit on security of IT applications supporting nuclear accountancy and inspection processes in Directorate-General ENER 9.4.Audit on IT programme and project management in the HR family (DIGIT, HR, EPSO, PMO) 9.5.Audit on IT logical security controls in OLAF 9.6.Audit on supervision of outsourced IT operations in Directorate-General TAXUD PART 2: Follow-up engagements (summarised) 1.Follow-up audit on the management of intra-muros contractors 2.Follow-up audit on the new Better Regulation (BR) agenda in the Commission 3.Follow-up audit on effectiveness of the management of absenteeism in the Offices (OIB, OIL and Directorate-General HR) 4.Follow-up audit on early implementation of the ESIF control strategy in Directorates-General REGIO, EMPL and MARE 5.Follow-up audit on information security governance in the Commission 6.Follow-up audit on the Participant Guarantee Fund for FP7 and Horizon 2020 in Directorate-General RTD, Directorate-General ECFIN and ERCEA 7.Follow-up audit on Directorate-General AGRI's management and control system for Voluntary Coupled Support (VCS) 8.Follow-up audit on the management of grants under 2014-2020 consumer and health programmes in CHAFEA

9.Follow-up audit on public procurement in Directorate-General CLIMA 10. Follow-up audit on Human Resources management in Directorate-General CNECT 11.Follow-up audit on strategic planning and programming/ activity based management (SPP/ABM) in JRC 12.Follow-up audit of the ex-IAC audit on document management in JRC 13.Follow-up audit of the ex-IAC audit on nuclear decommissioning and waste management programme in JRC 14.Follow-up audit of former IAC recommendations in Directorate-General JRC 15.Follow-up audit on H2020 grant management in the REA 16. Follow-up audit on H2020 grant management in Directorate-General RTD: from the preparation of the work programme to the signature of the grant agreements 17.Follow-up audit on the set up of the Common Support Centre (CSC) for H2020 18.Follow-up audit on grant management in Directorate-General JUST 19.Follow -up audit on the management of the African Peace Facility in Directorate-General DEVCO 20.Follow-up audit of the limited review of Directorate-General NEAR’s residual error rate (RER) methodology and calculation 21.Follow-up audit on control strategy in Directorate-General NEAR 22.Follow-up audit on the effectiveness and efficiency of Erasmus+ control strategy in the Education, Audio-visual and Culture Executive Agency (EACEA) and in National Agencies (Directorate-General EAC) 23.Follow-up audit on financial management and grant processes in Directorate-General ECFIN. 24.Follow-up audit on former IAC recommendations in ESTAT 25.Follow-up audit on the procurement process in Directorate-General COMM 26.Follow-up audit on former IAC recommendations in PMO 27.Follow-up audit on business continuity management in OP 28.Follow-up audit on management of European Commission Authentication Service - ECAS

29.Follow-up audit on the management of the security of EU ETS IT system 30.Follow-up audit on management of local IT in Directorate-General COMP 31.Follow-up audit on management and supervision of contracts for outsourced IT services (IT contract management) in DIGIT 32.Follow-up audit on effectiveness of measures to handle manual interventions in ABAC List of follow-up audits performed in 2017 for which all recommendations have been closed after the follow-up PART 3: Summary of long outstanding recommendations as at 31 January 2018



Content of this Staff working document: Part 1 of this Staff Working Document contains the objective and scope, key findings and the critical and very important recommendations of the Internal Audit Service engagements which were part of the 2017 Internal Audit Service audit plan (cut-off date for the exercise: 31 January 2018). Important and desirable recommendations are not reproduced in this Staff Working Document. The information contained in this Staff Working Document reflects the state of play when the audit engagements were finalised as stated in the executive summary of the audit report . The executive summary of each audit underwent the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation and aims to provide a quick understanding of the audits and their main results. Following the Internal Audit Service audits, the DGs/services have developed action plans which have been implemented or which are in the process of being implemented. Additional information on the measures defined and/or implemented by the DGs/services is provided at the end of each section of the audit concerned. The effective implementation of the actions taken by the Commission’s DGs/Services will be assessed by the Internal Audit Service in due course, in accordance with its follow-up policy. Part 2 of this Staff Working Document contains a summary of the Internal Audit Service follow-up engagements conducted in the period from 1 February 2017 to 31 January 2018 . Part 3 provides a summarised overview of the 12 long overdue very important recommendations as at 31 January 2018. PART 1: Final reports 1.Horizontal audits 1.1. Audit on management of recovery orders for competition fines (incl. guarantees for competition fines) and for recovery orders in the context of the Commission's 'corrective capacity' – Phase I (Directorates-General CONNECT, ENER, LS, EACEA) Audit objectives and scope The objective of the audit was to assess whether the Commission has put in place an effective and efficient control system for the management of the recovery orders in the context of the Commission's 'corrective capacity' both at the central and the operational level. The audit was conducted under a phased approach in order to manage a perceived conflict of interest situation:

Phase I of the audit assessed the efficiency and effectiveness of the system put in place for the management of recovery orders in the three sample-Directorates-General CONNECT, ENER and EACEA. It also assessed timeliness and efficiency of the enforced recovery process performed by the LS, as well as support and guidance offered by that service to Authorising Officers by Delegation (AOD). Phase II of the audit will start during the second half of 2018 to take into account the "cooling-off period" as prescribed by IPPF standard 1130 A.1 (internal auditors must refrain from assessing specific operations for which they were previously responsible), due to the arrival of the Internal Audit Service Director-General from the Directorate-General Budget. It will cover the efficiency and effectiveness of the system put in place for the management of recovery orders in Directorate-General COMP and of the corporate framework for the management of the recovery process put in place by the Directorate-General Budget. It will also assess the efficiency and effectiveness of the pre-litigation phase managed by the Directorate-General Budget and the management of the credit risk of provisionally cashed fines and the financial guarantees provided in the context of competition fines. Given the distinct responsibilities of the actors involved in the recovery process, the scope of the audit covered/will cover: ·At the central level, for the Directorate-General Budget (in 2018) and LS (in 2017), whether the current framework put in place for this process supports Authorising Officers by Delegation in carrying out effective and efficient recovery procedures. It will also examine the control systems of the Directorate-General Budget and the LS for their own distinct areas of responsibility, including the pre-litigation and enforcement phases, managed by the Directorate-General Budget and LS, respectively. ·At the operational level, a sample of Directorates-General/EAs (in 2017) to assess the efficiency and effectiveness of the management of recovery orders. The entities sampled were

Directorate-General ENER, Directorate-General CONNECT, Directorate-General COMP (in 2018) and EACEA. There were no observations/reservations in the 2016 Annual Activity Reports of the LS,

Directorate-General CONNECT, EACEA or Directorate-General ENER that relate to the area/process audited. The fieldwork was finalised on 27 June 2017. All observations and recommendations relate to the situation as of that date. Strengths (CONNECT) The auditors recognised the ongoing efforts made by Directorate-General CNECT in order to develop and improve the recovery process at their level. In particular, the auditors identified the following strengths: a) Centralisation of the recovery monitoring activity with unit R2 Unit R2's mandate is to monitor the overdue recovery orders issued by the Directorate-General as well as to liaise with operational Directorates, the Directorate-General Budget and LS. Therefore, the roles and responsibilities of each actor for the recovery orders process within Directorate-General CNECT are clearly established and the audit did not identify overlaps among the tasks assigned to the services intervening in the process. b) Customised IT tools used Directorate-General CNECT uses an appropriate IT tool to support the recovery orders process (iFlow), which automates some of the controls (for example, recovery orders coming from implementation of ex-post controls are encoded as Irregularities by default). c) Checklists used by unit R2 Directorate-General CNECT uses detailed checklists for the recovery orders, including necessary steps, guidance and actors involved in the process. d) Pro-activeness in searching for off-setting possibilities Directorate-General CNECT proactively searches for offsetting possibilities with other Directorates-General, in particular for Horizon 2020. When Directorate-General CNECT identifies upcoming payments to the same beneficiaries in other Directorates-General (by using the Corda application available at Commission level), it contacts the other Directorates-General to inform them of the existence of recovery orders. Directorate-General CNECT also informs the Directorate-General Budget in order to ensure that the offsetting is processed. Strengths (EACEA) The auditors recognised the ongoing efforts made by EACEA in order to develop and improve the recovery process at their level. In particular the auditors identified the following strengths: a) Monitoring of the Recovery Order process

The monitoring of the recovery orders process in EACEA enables it to follow-up the recovery orders (ROs) assigned to the Authorising Officer responsible. This is especially important as the recovery orders process is highly decentralised in the Agency: - Ten Operational Units who identify the ROs, encode ROs, send pre-information letters, send debit notes and prepare files for enforced recoveries; - This is complemented by the central Unit R2 "Finance Accounting Programming" which verifies waivers, cancellations of recovery orders, the files for enforced recoveries, monitors the workload of the Executive Agency regarding recoveries and sets priorities for the Operational Units based on appropriate criteria. b) Measurement of the performance of the Recovery Order process The Agency has defined an appropriate objective, with indicators and targets to measure the performance of the Recovery Order process across the Agency. These are presented to the management of the Agency as part of a monthly dashboard. c) Analysis of the performance of the Recovery Order process The Finance Coordinators within the Central Unit R2 provide the Accounting Sector with an analysis of the quarterly targets and also identify the root causes in case of not achieving the quarterly targets. This explanation is provided to the Director of EACEA and also to the relevant actors in the Operational Units. Strengths (ENER) The auditors recognised the ongoing efforts made by Directorate-General ENER in order to develop and improve the recovery process at their level. In particular, the auditors identified the following strengths: a) Use of checklist Directorate-General ENER has developed and uses a detailed checklist that includes the necessary steps, guidance and actors involved in the recovery order process. b) Roles and responsibilities are well defined The roles of each actor, as well as the related responsibilities, are clearly established. The audit did not identify overlaps among the tasks assigned to the Directorates-General/Services intervening in the process, or aspects not covered. Strengths (LS) The auditors recognised the ongoing efforts made by the Legal Service in order to develop and improve the recovery process at their level. In particular, the auditors identified the following strengths: a) Procedures and guidelines Procedures for the enforcement of recovery orders are well established and defined, and supported by the Guide to the enforced recovery of Commission entitlements, information on BUDGWEB and case law. b) IT tools The Legal Service uses a number of IT tools (RECO database, Base contentieux and NAT) to support the process of enforcement of recovery orders. Major audit findings

Following on from Phase 1, the Internal Audit Service did not identify any critical or very important issues in Directorate-General CONNECT, Directorate-General ENER, EACEA or the LS. 1.2. Audit on HR management and staff allocation in Directorate-General HOME and Directorate-General JUST Audit objectives and scope The objective of the audit was to assess whether Directorate-General HOME and Directorate-General JUST have put in place adequate governance, risk management and internal control processes for allocating and managing its human resources (HR), enabling the Directorates-General to deliver on their policy priorities, objectives and core tasks. The scope of the audit did not include the allocation of establishment plan posts to the Directorates-General at corporate level or an in-depth assessment of the Commission's new HR management (HRM) delivery model. There were no observations/reservations in the 2016 Annual Activity Reports of Directorate-General HOME or Directorate-General JUST that relate to the area/process audited. The fieldwork was finalised on 22 September 2017. All observations and recommendations relate to the situation as of that date. Strengths (HOME) The auditors recognised the ongoing efforts made by Directorate-General HOME to: a) assess and communicate to the corporate level its staff needs for responding to its new tasks and responsibilities; b) align its organisational structure to its priorities; c) follow up on the 2016 Staff Survey results with a detailed Action Plan; d) support the corporate initiative on the prevention of psychosocial risks at the workplace through its participation in Directorate-General HR's pilot project on that topic. Strengths (JUST) The auditors recognised the ongoing efforts made by Directorate-General JUST to: a) provide a quick and effective response to a number of areas for improvement identified in the 2016 Commission Staff Survey. In particular, the Directorate-General has taken effective measures to increase the efficiency and effectiveness of its business processes in three priority areas; b) involve and engage its staff in an open dialogue with senior management through regular staff consultation on key areas and in particular through consultation and communication activities aimed at making the reorganisation as transparent and as democratic as possible. Major audit findings The Internal Audit Service identified two very important issues for Directorate-General HOME and one very important issue for Directorate-General JUST:

Directorate-General HOME's strategic approach to HRM The Internal Audit Service found that HR management in Directorate-General HOME is not supported by a comprehensive HR strategy or policy. The Directorate-General had not yet put in place an established framework defining its main challenges related to HRM, its main objectives, the measures that it intends to take to achieve its goals, and the tools through which it plans to ensure the effective implementation of HR measures, including monitoring mechanisms. Furthermore, important strategic HRM processes had not yet been defined in sufficient detail, in particular on internally matching human resources to needs and on increasing staff performance through sustainable people management measures. The Internal Audit Service also underlined the inherent link between HRM and the Directorate's-General broader organisational culture. Allocation of HR (for both Directorate-General HOME and Directorate-General JUST) The Internal Audit Service found that neither of the Directorates-General had put in place a robust and transparent system for taking HR allocation decisions. More specifically, staff allocation decisions did not adequately take into account the Directorates’-General core tasks and priorities; the workload affecting different parts of the organisation; and information on existing talents and special competencies of the workforce. Furthermore, the Directorates-General had not yet put in place an established system or mechanism that would facilitate closing the gaps between identified needs and available resources, in particular through measures of flexible and rapid redeployment of existing staff to areas where they are most needed. Recommendations Directorate-General HOME's strategic approach to HRM Directorate-General HOME should establish an HR strategy/policy that brings together existing HRM processes and measures into a comprehensive framework, sets out the Directorate's-General main HRM related objectives, identifies key HR challenges/risks and mitigating measures/actions, and defines the arrangements for monitoring its implementation. The Directorate-General should also strengthen its organisational culture by addressing key weaknesses in communication between senior management and staff, leadership style, respect, fair treatment and development of the workforce. Allocation of HR Both Directorates-General should strengthen their HR allocation system by establishing a structure/mechanism for identifying HR needs and for rapidly deciding on solutions to close gaps. HR allocation decisions should be supported by relevant information on (1) tasks, priorities and resources attached to them; (2) workload affecting the Directorate's-General units; and (3) skills and competencies of staff; and should be made more transparent and objective through the use of quantifiable data and objective criteria. Finally, the Directorates-General are encouraged to establish a process for prioritising work (including the identification of negative priorities) in order to use their existing workforce in the most efficient manner. Additional information provided by Directorates-General HOME and JUST on the measures defined and/or implemented following the Internal Audit Service audit The two recommendations to be followed regarding DG HOME's strategic approach to human resource management (recommending the development of a Human Resources strategy or plan, and strengthening the DG's broader organisational culture), and to the allocation of human resources (recommending the establishment of a structure / mechanism for identifying human resources needs in both Directorates-General), as well as one recommendation relating to sustainable people management are being followed up by DG HOME in accordance with the Action Plan which was considered satisfactory by the Internal Audit Service. Most of the actions will be implemented by the end of 2018. In accordance with DG JUST’s action plan, preparatory research has been carried out to seek corporate guidance and identify best practices. Furthermore, different possible data to provide objective criteria for assessing workloads have been considered and discussed with senior management (including overtime and sick-leave). Talent management initiatives have been studied and the first measure in the form of an internal expression of interest to change post within the DG has been launched. Further improvements are expected after full deployment of ATLAS, a centralised IT tool for human resources. 1.3. Audit on amendments of 2014-2020 OPs in Directorates-General REGIO, EMPL and MARE Audit objectives and scope The objective of the audit was to assess whether the design of the Directorates'-General internal control systems for approving requests for European Structural and Investment Fund (ESIF) Operational Programme Amendments (OPA) is adequate and is effectively implemented in a consistent and timely manner at this early stage of OP implementation. The Internal Audit Service addressed this objective by assessing whether the design of the OPA process is adequate in order to ensure an effective, timely, and consistent assessment and approval of the amendment requests submitted by Member States (MS), in compliance with the Common Provisions Regulation (CPR) and Fund-specific rules, and whether the implementation of the OPA process is effective, timely, and consistent. There were no observations/reservations in the 2016 Annual Activity Reports of the three Directorates-General that relate to the process audited. The fieldwork was finalised on 20 April 2017. All observations and recommendations relate to the situation as of that date, except in relation to the new procedure on issuing observations on OPAs. The inter service consultation relating to this new procedure closed after the Internal Audit Service had finalised the fieldwork (19 May 2017). Strengths The auditors recognised the ongoing efforts made by the audited Directorates-General to ensure a coordinated approach to processing OPA requests. During the audit, the Internal Audit Service identified the following strengths:

a) The guidance in place at the three Directorates-General was coordinated jointly between the ESIF Directorates-General by the Stock-Taking Group, which meets on a weekly basis to coordinate common positions between the ESIF Directorates-General. b) There is joint legal interpretation of the applicable regulations by ESIF Directorates-General. Answers on questions from MS and Desk Officers (DOs) on regulatory matters are available on Directorate-General REGIO's SharePoint ''Interpretation site'', and on the REGIO wiki. c) At Directorate-General EMPL, upstream work on the analysis of an OPA request is performed and documented prior to the official submission through SFC2014 (System for fund management for the 2014-2020 programming period). This is formalised and is part of the OPA process. d) Internal coordination meetings at the 3 Directorates-General: - At Directorate-General REGIO, the monthly "Implementation Network" is a forum for discussion among Geographical Units (GUs) and coordination and policy units, and Directorate-General REGIO's hierarchy on topics concerning fund programming and implementation. - At Directorate-General EMPL, ESF Coordination Support Group (CSG) meetings take place on a monthly basis. The CSG's mission is to provide guidance on ESF and policy related issues, and is a forum for discussion among the GUs and coordination and policy units, and Directorate-General EMPL hierarchy. - At Directorate-General MARE, the EMFF Coordination Group takes place twice per month, with the objective of enhancing efficiency and ensuring consistency across units in policy development and implementation. e) Existence of a strategy towards a more performance based culture, and evaluation strategy in Directorates-General REGIO and EMPL. Major audit findings The Internal Audit Service identified one very important issue: Consistency, effectiveness, and timeliness of the OPA process OP amendment requests submitted by the MS may require significant changes to the funding priorities of the OP and therefore need to be analysed thoroughly before adoption by the Commission. The deadlines prescribed by the regulation for issuing observations and adopting OP amendments means that the process is very time pressured, with little or no margins for delay on the part of the Commission. This time pressure has been further compounded by the Legal Service's opinion that observations on OP amendments need to be adopted by Commission Decision, which was not envisaged by the Directorates-General when proposing the 2014-2020 CPR. Directorate-General REGIO in particular has faced considerable delays in adopting OP amendments within the regulatory deadline of three months, whereas delays were less pronounced at Directorate-General EMPL and at Directorate-General MARE. To gain time, the Directorates-General made use of "technical observations" as a way of making observations on OP amendments (instead of by Commission Decision), even though these often involved substantive rather than routine issues. More recently, the Directorates-General adopted a new procedure of issuing observations by "service letter" signed by the Director-General. Recommendation The process of issuing observations should be strengthened, including their timing and monitoring by management, and putting in place a framework to guide the desk officers decision-making process when deciding at what level observations should be sent to MS (either as "technical observations", as a service level letter signed by the Director-General, or as a Commission Decision). In addition and looking forward to the preparation of the post 2020 programming period legislation, the Directorates-General need to propose realistic deadlines for making observations on OPAs and clarify the level at which these need to be approved (Commission Decision or service letter). Improvements are also needed for the coordination of multi-fund OPs and in formalising the upstream work done by desk officers in Directorate-General REGIO and Directorate-General MARE as part of the OP amendment procedure. Additional information provided by Directorates-General REGIO, EMPL and MARE on the measures defined and/or implemented following the Internal Audit Service audit Since the issuance of the corresponding final report by the Internal Audit Service, and according to the agreed Action Plan, actions have been carried out by Directorate-General REGIO in order to better define, strengthen and streamline the working arrangements related to the processing of Operational Programme Amendments so as to ensure the respect of the regulatory deadline for issuing observations and adopting the amendments. In this regard, among other measures, the upstream work by desk officers in processing Operational Programmes modifications requests has been formalised. As for internal methodology and horizontal aspects of the Operational Programme Amendment process, targeted efforts have been made to improve the related process workflow and guidance, as well as to harmonise them among the concerned DGs. In response to the Internal Audit Service recommendations, DG EMPL has undertaken the following actions: ·DG EMPL has set up a monitoring system in the Rural Development Information System. It has closely monitored the Operational Programme Amendments resulting from the Youth Employment Initiative increase and the Technical Adjustment and reported any risks and delays in the Dynamic Diversified Growth Funds Management Meeting (as well as in the Stock-taking group for the multi-fund Operational Programmes). As a result, despite the tight deadlines, all Operational Programme Amendments were adopted on time by the end of 2017.

·The Operational Programme Amendments report in the Rural Development Information System monitors the use of observations. In addition, the Operational Programme Amendment Roadmaps now include new guidance on use of observations. ·Geographical units assess the associated risks when making the Operational Programme Amendment analysis using the quality assessment checklist. ·DG EMPL's Roadmaps and Rural Development Information System instruct the units to specify the question they want to raise as well as their own preliminary assessment if they consider that there may be a particular issue. ·DG EMPL monitors the regulatory and internal process/task deadlines through the Rural Development Information System. The Rural Development Information System team is collecting a log of ’issues’ and how they were resolved/addressed. Based on the regular monitoring the coordination unit identifies the potential problematic elements/bottlenecks of the processes and follows them up with the Senior Management of DG EMPL, and with the Cabinet and Stock-taking group if needed. ·DG EMPL continue cooperating closely to ensure that IT systems are in line with the processes agreed in the Stock-taking group and internally. ·The coordination unit disseminates information and changes through regular 'info flash' emails to geographical units; in the monthly European Social Fund newsletter; and in the 6-weekly meetings with geographical units in the context of the Coordination Support Group. ·In addition, when there is a need, DG EMPL organises ad-hoc trainings. Since the Internal Audit Service audit, DG EMPL has organised two trainings of geographical units on Operational Programme Amendments resulting from the Youth Employment Initiative increase and the Technical adjustment. ·DG EMPL has set up a Rural Development Information System helpdesk and accepts direct calls, offering immediate support and assistance on this information system and the processes covered to DG EMPL geographical units. ·The dedicated Operational Programme Amendments space on the Intracomm is updated when necessary. ·DG EMPL has prepared the update of the Partnership Agreements amendment process to be put in place following the Omnibus Regulation’s adoption. The topic has been discussed with the other Directorates-General dealing with the European Structural and Investment Fund in the Stock-taking group. ·DG EMPL continues to cooperate with DG REGIO on updating and streamlining the Operational Programme Amendment process in the Stock-taking group and bilaterally. ·The Rural Development Information System Support Team updates the access to IT tool WAVE for DG EMPL staff dealing with multi-fund programmes. ·The instructions in the Rural Development Information System include the list of documents that are mandatory for each task as specified in the related roadmaps. ·The Commission has proposed realistic deadlines for making observations on amendments in the next post-2020 programming period - in Article 19(2) of the Proposal for a Regulation COM(2018) 375 the Commission proposes that the deadline for making observations on a programme amendment requested by a Member State is extended from 1 month to 3 months. ·The proposal also provides clarity on the level at which observations need to be approved (Commission Decision or service letter). Article 19 of the Proposal concerning amendment of programmes removes the obligation for the Commission to adopt an amendment ‘provided that any observations made by the Commission have been adequately taken into account’ (current Article 30(2) of Common Provisions Regulation). This means that observations will be sent by the Commission services, as the Commission itself is no longer bound by the observations to adopt the amendment. ·In addition, compared to the current Common Provisions Regulation, the scope of Article 3 of the Proposal on calculation of time limits for Commission actions is extended to cover not only Commission decisions but all Commission actions. Thus, it covers observations sent as service letters. Directorate-General MARE considers that the issues relating to 2014-2020 and pertaining to its remit have been implemented. Internal guidance has been updated and endorsed within MARE and training organised thereafter for desk officers. Directorate-General MARE considers that there is no impact on its internal control systems. The two recommendations were sent for review to the Internal Audit Service, which will follow-up once all DGs will have sent their recommendations for review as well. The implementation by Directorates-General REGIO, MARE and EMPL is ongoing and the related action plans for the recommendations will be completed in 2018.

1.4. Audit on the Commission's framework/arrangements for the estimation, assessment and reporting on the cost-effectiveness of controls (Directorates-General BUDG, NEAR, REGIO, RTD) Audit objectives and scope The objective of the audit was to assess whether the Commission has put in place an appropriate corporate framework that enables Authorising Officers by Delegation (AODs) to reliably estimate, assess and report annually in the Annual Activity Reports (AAR) on the cost-effectiveness of controls. Furthermore, it assessed if such an initiative met its objectives, as laid down in the draft guidance issued by the Directorate-General Budget, and if it adds value to the Commission's initiative on a budget focussed on results (BFOR). Given the distinct responsibilities at central and local level, the audit was planned around two pillars, as follows: ·At the corporate level the audit covered the Directorate-General Budget and assessed whether the current framework put in place for this process enables Authorising Officers by Delegation to reliably estimate, assess and report on the cost-effectiveness of controls in line with the Financial Regulation and use this information in making decisions (adjusting control systems, influencing Commission proposals for legislative initiatives); ·At the local level the audit covered a sample of Directorates-General (Directorates-General RTD, REGIO and NEAR), comprising all budget management modes (shared, indirect, direct). The audit assessed the actual implementation of the corporate framework on the estimation, assessment and reporting of the cost-effectiveness of controls in their Annual Activity Reports. There were no observations/reservations in the 2016 Annual Activity Reports of all the Directorates-General audited that relate to the area/process audited. The fieldwork was finalised on 22 June 2017. All observations and recommendations relate to the situation as of that date. Major audit findings The Internal Audit Service identified one very important issue: Achievement of the objectives of the framework The objectives initially set by the Directorate-General Budget for the exercise to estimate, assess and report on the cost-effectiveness of controls were, from the outset, very challenging with the result that, overall, most were only partly met in practice. Definition of the key concepts and implications for the methodology ·The definition of "controls" was very wide, which resulted in uncertainty and misinterpretation in the Directorates-General charged with actually applying the concept in practice. Furthermore, in principle, Directorates-General were required to report on the costs of controls in Member States (shared management) or at the level of entrusted entities (indirect management). However, there are practical limitations on how much they can do. In addition, the concept of "benefits" was mainly built on the understanding that the bodies responsible for exercising controls would be similar to "profit centres", whereby quantifiable benefits, such as financial corrections and recoveries, could be calculated. In practice, however, the objectives of a Directorate's-General control functions, such as those in Directorates-General NEAR, REGIO and RTD are more about providing assurance on whether the internal control systems of the bodies managing EU funds are working well or not and as such the extent to which any real benefits can be readily quantifiable is limited. Added value of the reporting on the cost-effectiveness of controls and link to other on-going initiatives ·The Directorates-General did not actually make significant use of the information generated through this process, either as a tool for management or to support policy development. Instead, they relied on existing tools and measures. Guidance and support for the reporting on cost-effectiveness of controls The Internal Audit Service also identified scope for providing strengthened guidance and support to the Directorates-General in order to arrive at a more consistent estimation of the cost of controls across the Commission. Recommendation The Directorate-General Budget should redesign the existing framework by better distinguishing between a narrower operational dimension on the one hand, and a wider policy dimension on the other (The 'policy dimension' refers to the phase of developing the legislation that sets the boundaries within which the Commission have to operate. The 'operational dimension' refers to the actual implementation phase.). For the operational dimension, the methodology for estimating the costs should be simplified by at least adopting a narrower and more realistic definition of the term "control", inspired by the Synergies and Efficiency Review initiative for financial management, and which should be the basis for the annual Annual Activity Report reporting exercise.

For the purpose of the policy dimension, the current (broader) definition of the term "control" could still be used, but it would also need to incorporate the Member States and entrusted entities, where it is feasible and cost-efficient, in order to provide policy makers with an estimate of the "cost to control EU spending" which could in turn be used as part of the legislative debate. For reporting on information on cost of controls at Member State level in shared management and entrusted entity level in the Annual Activity Report, where feasible and cost-efficient, the Directorate-General Budget should modify its guidance by either requesting that Directorates-General no longer report on them or, at least, in the interests of transparency, to present them separately from those of the Commission. The source of these figures and how they were estimated should be explained clearly. Furthermore, Directorate-General BUDG should initiate and facilitate a debate on a case-by-case basis on defining the way forward regarding the materiality threshold in the context of the specific legislative procedures. For both dimensions, and to complement any quantitative analysis, the Directorate-General Budget should steer Directorates-General by encouraging them to explain the benefits of controls and to assess whether costs can be lowered (i.e. by adopting a “cost centre” approach). The Directorate-General Budget should set achievable objectives for the exercise to estimate, assess and report on cost-effectiveness of controls and provide strengthened guidance to the Directorates-General. It should also take on a more active role in steering Directorates-General to apply the guidance in a more consistent way. Additional information provided by Directorate-General BUDG on the measures defined and/or implemented following the Internal Audit Service audit At this stage the recommendation has been partly implemented – a corporate guidance to calculate the cost-effectiveness of controls has been partially revised for the 2017 Annual Activity Report exercise, and to be completed for the 2018 Annual Activity Report exercise. 1.5. Audit on the Commission's supervision of the implementation of CEF financial instruments in Directorate-General ENER and Directorate-General MOVE Further to the note announcing the launch of the audit on the Commission's supervision of the implementation of Connecting Europe Facility (CEF) financial instruments, the Internal Audit Service conducted a preliminary survey with the aim of gaining a better understanding of the activities and the related risks and in order to define the objectives and scope of the engagement. The preliminary survey confirmed that the main risk in this area relates to the ineffectiveness of the supervisory activities that should be performed by Directorates-General ENER and MOVE on how the European Investment Bank (EIB) implements and manages CEF financial instruments. This corroborates the results of the Internal Audit Service risk assessment performed in 2015 and 2016 in the context of the preparation of the Internal Audit Service annual audit plans. However, during the preliminary survey it became clear that to date there had been a very low rate of implementation of financial instruments under CEF. Only one specific agreement with one subsequent transaction with a final beneficiary had been signed and one payment made to EIB in this respect (for EUR 37 500 000). Moreover, according to the latest work programmes of Directorates-General ENER and MOVE, the majority of the budget originally allocated to CEF financial instruments (EUR 2.43 billion) was re-allocated to CEF grants budget lines. Consequently, until 2020 only EUR 296 million will be available for CEF financial instruments. The low implementation (and the decision to reallocate to the grants budget lines) is partially due to the fact that as far as Directorates-General ENER and MOVE projects are concerned, the eligibility criteria of the CEF financial instruments and of the European Fund for Strategic Investments (EFSI) largely overlap and potential CEF eligible projects have in fact been financed by EFSI as it has greater political priority and a larger remit. Given the low implementation of CEF financial instruments to date, the effective exercise of the supervisory role of the Directorates-General cannot be satisfactorily audited. For this reason, the Internal Audit Service decided to close the audit after the preliminary survey. 1.6. Audit on the Commission’s governance/oversight arrangements concerning risk management, financial reporting and the ex-post verification/audit function (Secretariat-General and Directorate-General Budget) Audit objectives and scope The objective of the audit was to assess whether the Commission has put in place appropriate governance/oversight arrangements at corporate level on (1) risk management, (2) financial reporting and (3) ex-post verifications/audits, which enable the College to take its political responsibility for the management of the EU budget (by the Authorising Officers by Delegation - AOD). The scope of the audit covered the governance/oversight arrangements for the three areas indicated above. It also covered certain general aspects on the current 'Governance set-up' as regards the political responsibility for the management of the EU budget taken by the College through the adoption of the Annual Management and Performance Report (AMPR), the role of the Central Services, the working arrangements between the Commissioners and the Directorates-General and the role and functioning of key corporate bodies (i.e. two oversight bodies, namely: the Audit Progress Committee (APC) and the Corporate Management Board (CMB) and one corporate body with no oversight function, namely the Group of Resources Directors (GDR)). Governance and oversight arrangements referring to performance, ethics, better regulation and openness and transparency were out of the scope of this audit. There were no reservations that relate to the area/process audited in the 2016 Annual Activity Reports (AAR) of the Directorates-General under the scope of this audit (i.e. the Secretariat-General, the Directorate-General Budget and the operational Directorates-General AGRI, DEVCO, EMPL, REGIO and RTD). However, the Secretariat-General and the Directorate-General Budget reported on the European Court of Auditors' (ECA) observations included in the special report N° 27/2016 on 'Governance at the European Commission – best practice?'. The fieldwork was finalised on 14 July 2017. All observations and recommendations related to the situation as of that date with the exception of the revised Governance Statement, which was adopted on 11 October 2017 (i.e. after the end of the audit fieldwork) and was taken into consideration in the audit report.

Strengths The Internal Audit Service noted a number of strengths as regards the Commission's current governance arrangements. Decentralised model – accountability and assurance building process The Commission uses a decentralised model for financial management with clearly framed and well understood accountability instruments at the Directorate-General level through the Annual Activity Report and at the College level through the AMPR. It has a robust assurance building process, the cornerstone of which is the Authorising Officers' by Delegation Declarations of Assurance, which has developed over time into a very mature and well-understood process and demonstrates in a very transparent fashion the extent to which they are held accountable. Working arrangements Directorate-General – Commissioner' There is a clear and well established vertical reporting process, supported by working arrangements, whereby the Directorate-General informs on a timely basis its responsible Commissioner on matters which may call into question his/her responsibility or that of the College as a whole. EU consolidated accounts The process for preparing the EU consolidated accounts is mature and well established within the Commission under the lead of the Directorate-General Budget. In particular, the respective roles and responsibilities are well understood, the instructions and guidance provided by the Directorate-General Budget are clear, quality checks are carried out and there is a proper analysis of the various assurance sources, including certificates and Management Representation Letters provided by the consolidated entities. The European Court of Auditors has issued a clean opinion on the reliability of the accounts since 2007. Major audit findings The Internal Audit Service identified two very important issues: Risk management Effective risk management is about identifying and ensuring an appropriate response to issues which can threaten the Commission's ability to achieve its objectives and which could severely damage its reputation. This is the responsibility of management and constitutes an organisation's first line of defence (in the 'Three Lines of Defence' model ). A second line of defence aims to support or steer this process through the provision of frameworks and guidance. At the corporate level in the Commission, this role is exercised by the Central Services, the Secretariat-General and the Directorate-General Budget. As a third line of defence, the Internal Audit Service provides independent audit assurance and advice. While neither the second nor the third line of defence can or should dilute the primary responsibility of management (i.e. the first line of defence) to address adequately those risks, corporate or central oversight of these practices can improve their effectiveness and help to provide assurances to the College that those processes are well-managed in practice. This is particularly important given that, in recent years, Internal Audit Service audits of the Commission's risk management processes have found them to be still lacking in maturity. However, oversight on risk management is currently mainly embedded in the vertical reporting lines between individual Authorising Officers by Delegation and their respective Commissioners. The Corporate Management Board only takes note of the cross-cutting critical risks and coverage of risk management is not explicitly embedded in its mandate. The Central Services identify cross-cutting critical risks among the critical risks reported by the Directorates-General and bring them to the attention of the Corporate Management Board, but this does not include any risks identified by Directorates-General, which are not cross-cutting, but critical at Directorate-General level including those operational risks at Directorate-General level which are linked to individual actions contributing to the "Juncker priorities". As regards the Audit Progress Committee, its oversight on risk management is limited to the risks identified by the Internal Audit Service through its risk-based audit planning process and through the audit reports themselves. For the Audit Progress Committee, this means that currently it is not in a position to cross-check the Internal Audit Service’s audit risk assessment and audit plan to management's risk assessment. Consequently, it does not have an overall view on the extent to which the risks of the Commission (as assessed by management as well as by the Internal Audit Service) are being adequately addressed by management and/or through Internal Audit Service or European Court of Auditors audits in practice. From the central coordination perspective, the Secretariat-General and the Directorate-General Budget provide guidance and instructions to support the Directorates'-General risk management process. However, the Internal Audit Service has found that there is scope for improving the guidance and the process in key areas: the application of 'Risk Tolerance' and 'Materiality' concepts when reporting critical risks, the need for a more differentiated/risk-based approach when supporting Directorates-General and the role envisaged in Directorates-General for the 'Director in charge of risk management and internal control' as created under the revised Internal Control Framework. Governance set-up Corporate (oversight) bodies Apart from the College, which is the ultimate decision-making body within the Commission, currently there are three main corporate bodies for the areas within the scope of this audit: two oversight bodies, namely the Audit Progress Committee and the Corporate Management Board and one corporate body with no oversight functions, namely the Group of Resources Directors. While the Audit Progress Committee has no decision-making power it is a key oversight body in the Commission and provides valuable advice to the College. It has a unique composition with both internal and external, independent members and the Internal Audit Service welcomes the positive evolution as regards the functioning and composition of the APC. Currently, its mandate does not include risk management and neither does it include the EU consolidated accounts. The Internal Audit Service acknowledges that the Audit Progress Committee was never originally conceived to be a fully-fledged audit committee in the conventional sense. Its mandate was deliberately limited to ensuring, inter alia, the proper follow-up of the Internal Audit Service and ECA audit recommendations. This practice is in line with the new legal requirement, which has been introduced following the recent revision of the Financial Regulation. Recognised professional standards/frameworks allow certain flexibility. However, both areas (i.e. risk management and the EU consolidated accounts) would be typically covered by modern-day audit committees. Despite the Audit Progress Committee's limited role, the audit has found that implementing this can be challenging in practice within the current set-up. In particular, although the Audit Progress Committee mandate includes the follow-up of European Court of Auditors audit recommendations, European Court of Auditors reports were until recently only very rarely discussed and follow-up work was limited, mainly due to inadequate information on the state of play in implementing these recommendations. Also, it is clear that it is largely the agenda-setting and steering briefings prepared by the Audit Progress Committee secretariat under the supervision of the Audit Progress Committee Preparatory Group (PG) Chair as well as input of the external members which drive the discussions during the Audit Progress Committee Preparatory Group meetings. The internal Preparatory Group members, who come from the respective Cabinets, are often constrained by the time they can devote to preparing and attending meetings and their expertise in the areas covered by the Audit Progress Committee varies. There is also the inherent risk of potential conflicts of interest, although there are some mitigating measures in place to avoid this. In addition, there is an inherent potential conflict of interest in having the Audit Progress Committee secretariat administratively linked to the Internal Audit Service. Finally, despite the key roles of both the Audit Progress Committee and the Corporate Management Board in the Commission's governance structure, there is no systematic flow of information between both bodies. Although the Corporate Management Board is expected to play a central role in the corporate governance of the Commission as per the 2017 Commission's Governance Statement, its role and added value do not seem to be entirely clear for a number of the interviewees selected by the Internal Audit Service and as noted above, its oversight role on risk management is limited in practice to just the cross-cutting critical risks. Furthermore, its mandate has not been updated since 2007. Although Corporate Management Board documents are shared with all Cabinets, there is no systematic reporting from the Corporate Management Board to the College on the results of its work, which would be comparable to the reporting mechanisms of the Audit Progress Committee.

The Group of Resources Directors mandate has yet to be updated to reflect the results of the report on the 'Evolution of the Group of Resources Directors'. As indicated above, the Group of Resources Directors has no oversight function and has no decision making powers. It is mainly a platform to share information and knowledge amongst Resources Directorates. Members of the group have expressed concerns about the lack of formal reporting lines, insufficient use being made of its members' experience and instances when it was mainly a vehicle for sharing information on decisions already taken rather than actually contributing to those decisions in the first instance. This may be explained by a misperception about the role of the Group of Resources Directors, which calls for the need to clarify/update its mandate. Governance statement On 11 October 2017, the Commission adopted the Communication on Governance in the European Commission. The Internal Audit Service welcomes this positive step. Given the importance of this document, it is key to raise awareness within the Commission. Furthermore, the Governance Statement will need to be updated to reflect necessary changes resulting from implementing the accepted recommendations of this report (e.g. as regards the mandates of the Audit Progress Committee and/or the Corporate Management Board). Role of the Central Services in the Authorising Officer by Delegation decentralised model Following the 'Three Lines of Defence' model and bearing in mind the Commission's decentralised structure, the 2nd line of defence in the Commission exists both at the local Directorate-General level and the corporate level. The Central Services contribute to the 2nd line of defence from the corporate point of view by advising/supporting and monitoring the effective implementation of prescribed frameworks. It is a question of finding the right balance between taking a more hands-on, directional approach and a more hands-off, facilitating approach. Getting this balance is a perennial challenge, particularly in the Commission where the basic principle of decentralised Authorising Officer by Delegation responsibility is key, but also in terms of their role in helping the College to take its political responsibility. However, the audit found that whilst the Central Services are generally very much appreciated by the Directorates-General and Services, there is scope for strengthening their roles in key areas such as Risk Management. Recommendations Audit Recommendation on risk management 1.1 The Commission should strengthen its corporate oversight on risk management, including critical risks which are not cross-cutting. As suggested by professional reference frameworks, the corporate oversight role on risk management should be exercised by an Audit Committee or an equivalent body. In the Commission's environment, this role could be exercised either by the Audit Progress Committee alone ('Option A') or by the Corporate Management Board ('Option B'). Currently, the Commission's Audit Progress Committee has a limited mandate. An expansion of the Audit Progress Committee's mandate to include risk management ('Option A') would represent a considerable strengthening of its oversight role, particularly given that external members are independent from the Commission's management. However, the Audit Progress Committee already faces a number of challenges to exercising its existing mandate to the full within the limitations of the present set-up and resourcing, and an expanded mandate would only serve to compound these. Therefore, while this would be more in line with the reference frameworks, the success of an expanded mandate would require the Audit Progress Committee to be adequately equipped to deal with the increased responsibilities. With this in mind, the Internal Audit Service sets out in Recommendation no 4 proposals aimed at reinforcing the Audit Progress Committee function in order to strengthen the oversight exercised by the Audit Progress Committee. If this strengthened oversight role were to be exercised by the Corporate Management Board ('Option B'), this would require expanding the Corporate Management Board's current oversight on the cross-cutting critical risks to include also the (Directorate-General-specific) critical risks which are not cross-cutting. There would need to be clear procedures allowing the Board to invite the responsible Directorate-General for discussions on their response to critical risks while ensuring that the responsibility for managing the risk continues to lie with the specific Directorate-General and their responsibility is not shifted to the oversight body. For this alternative scenario to be effective, the Corporate Management Board should also provide the Audit Progress Committee with meaningful, consolidated information on the critical risks as assessed by management to allow the Audit Progress Committee to make a cross-check to the Internal Audit Service's audit risk assessment and in turn to the audit plan to identify possible gaps between the two sources. 1.2Central Services (Secretariat-General and Directorate-General BUDG) should reinforce their role on risk management. The Central Services should facilitate the sharing of best practices on risk management and provide support to those Directorates-General with less mature processes. More guidance should be provided to Directorates-General on cross-cutting risks and how to apply the concepts of 'risk tolerance' and 'materiality' when identifying and reporting critical risks, to guide Directorates-General on how to better link operational risks to the achievement of the Directorate's-General objectives and, in particular, where the latter are contributing to the Juncker priorities . In addition, there needs to be guidance to support the new role envisaged under the revised Internal Control Framework for the 'Director in charge of Risk Management and Internal Control'. The Central Services should establish a list of all critical risks. This list should be based on the critical risks reported by the individual Directorates-General and should be prepared in cooperation with the operational Directorates-General. The critical risks linked to the Juncker Priorities should be specifically identified. The resulting information should be reported to the Corporate Management Board and the Audit Progress Committee should have access to this information. It is essential that the reinforced role of the Central Services is not perceived by the Authorising Officer by Delegation as diluting the responsibility of the Directorate-General responsible for managing the risk. Therefore, the Central Services should build in the necessary safeguards to ensure this, for example, by drawing attention to this fact in meetings, guidelines and minutes. Audit Recommendation on Governance set-up 4.1 The APC should exercise greater oversight on the follow up of ECA audits, in line with its current mandate.

The Audit Progress Committee should exercise greater oversight on the follow up of European Court of Auditors audits, in line with its current mandate, but for this to happen the Directorate-General Budget should continue improving its reporting to the Audit Progress Committee on the follow-up of European Court of Auditors recommendations. The Internal Auditor takes note that the Audit Progress Committee has recently started to examine the follow-up of the European Court of Auditors recommendations. In this context, the Directorate-General Budget prepared for the Audit Progress Committee Preparatory Group meeting on 27 September 2017 a more refined report on the follow-up of European Court of Auditors recommendations. It was concluded that further actions will be decided by the Audit Progress Committee in due time. It should be noted that the Directorate’s-General Budget role is to provide the relevant overview reports to the Audit Progress Committee while the responsibility for the follow-up and implementation of the recommendations lies with the Directorates-General. 4.2 The APC function should be further reinforced in order to provide more effective oversight. To be more effective in its current advisory role and to be better prepared to accommodate any future changes, the Internal Audit Service recommends that the Audit Progress Committee function is further strengthened through either one or a combination of the following two options: Option 1: A reinforcement of the Audit Progress Committee Secretariat through the addition of technically skilled and experienced EU officials drawn from across the Commission services. A reinforced Secretariat would contribute to the quality and quantity of the oversight needed, provide a tailored support service for external members and Cabinet members of the Preparatory Group and Commissioners, whilst ensuring the support capacity needed to enable the Audit Progress Committee to both fulfil all the tasks in its Charter and take on the additional tasks referred to in this report. Option 2: A change in the basic structure of the Audit Progress Committee’s Preparatory Group, but at the same time retaining the current composition and Chair of the Audit Progress Committee itself in order to maintain the vital link to the College. As regards the composition of the Audit Progress Committee’s Preparatory Group, the secondment of a number of appropriately skilled, experienced Commission officials alongside externally-recruited experts to play a standing role as Preparatory Group members (the chair of the Audit Progress Committee’s Preparatory Group would be one of the seconded officials) should be considered. Cabinet members of Commissioners designated as Audit Progress Committee members would be debriefed after each Preparatory Group session to ensure transparency and to enable them to prepare their Commissioners for the meetings of the Audit Progress Committee. Beyond this, consideration could be given to increasing the number of external members from three to four, a measure, which would be in line with the existing Audit Progress Committee Charter. 4.3 The mandates of the corporate (oversight) bodies should be updated The respective mandates of the Audit Progress Committee (APC), the Corporate Management Board and the Group of Resources Directors (GDR) should be updated. For the Audit Progress Committee and the Corporate Management Board, this should be based on a decision of the College, in line with the Internal Audit Service recommendations. This should include clarifying the reporting mechanisms of the Corporate Management Board and the reporting lines of the Resource Directors Group. 4.4 The APC secretariat should be both administratively and functionally independent of the Internal Audit Service. To address the potential conflicts of interest in having the Audit Progress Committee’s secretariat located in the Internal Audit Service, the secretariat should be both administratively and functionally independent of the Internal Audit Service . 4.5 The Commission's 'Governance Statement' of October 2017 should be amended to reflect any changes resulting from implementing the accepted recommendations and communicated. The revised Governance Statement should be amended to reflect necessary changes resulting from implementing Internal Audit Service recommendations contained in this report. Once the 2017 'Governance Statement' is updated, Central Services should raise awareness within the Commission, including the College, on these governance arrangements. In parallel, the Directorate-General Budget should adapt the 'Implementation guide' of the new Internal Control Framework to clearly reflect in section II ("Roles and Responsibilities in the implementation of Internal Control Framework in the Commission") in the Chart as well as in the text that: - The 2nd line of defence in the Commission exists both at the local Directorate-General level and the central level - The Central Services contribute to the 2nd line of defence from the corporate point of view by advising/supporting and monitoring the effective implementation of prescribed frameworks. 4.6 SG, Directorate-General BUDG and Internal Audit Service should cooperate more effectively in sharing knowledge and identifying best practices, while respecting each other's roles and in particular the independence of the Internal Audit Service. Cooperation and coordination should, in particular, be further strengthened during the planning phase of the Internal Audit Service audit plan by sharing more actively knowledge on risks and during the Peer review exercise by coordinating more efficiently the comments on the Directorates'-General Annual Activity Reports.

Additional information provided by the Secretariat-General and the Directorate-General Budget, on the measures defined and/or implemented following the Internal Audit Service audit The Secretariat-General and the Directorate-General Budget accepted all recommendations and developed an action plan in response to this audit which was assessed as satisfactory by the Internal Audit Service. The action plan incorporated, where applicable, the advice the Audit Progress Committee provided when discussing the follow-up to those recommendations which directly touch on its role and work. Some actions will require the endorsement of the College of Commissioners. For several recommendations, follow-up action has already been taken or will be implemented shortly. Notably, as regards the very important recommendations: Risk management The central services (Secretariat-General and Directorate-General Budget) will continue to provide risk management guidance to the Directors in charge of risk management and internal control (‘RMIC’). This will include: 1) facilitating the share of best practices; 2) providing support to DGs with less mature risk management processes; and 3) updating, where needed, the Risk Management Implementation Guide (e.g. on the application of concepts such as ‘cross-cutting’ risks, ‘risk tolerance’ and ‘materiality’ of critical risks). The oversight and approach on risk management will be reinforced through the organisation of peer reviews to examine the critical risks identified by the Directorates-General. Where needed, meetings will be organised by families of DGs. In accordance with the decentralised governance structure of the Commission, Authorising Officers by Delegation will remain fully responsible for the identification and management of their critical risks. Also the oversight role of the Corporate Management Board will be strengthened. It will review the list of critical risks and decide on a case-by-case basis on the need to invite the responsible Directorates-General for discussions of their response to the critical risks identified. There will also be more extensive sharing of information on risk management with the Internal Audit Service and the Audit Progress Committee. The latter can use this information when assessing the audit plan of the Internal Auditor. Governance set-up The current Governance document was updated in the course of the audit in anticipation of this recommendation (C(2017)6915 of 11.10.2017). When appropriate, the Secretariat-General and the Directorate-General Budget will (1) propose future updates of the Governance document to the College and (2) raise awareness within the Commission on the Governance document. The Secretariat-General and the Directorate-General Budget will submit for adoption by the College in the coming months a revised Communication on the Commission’s governance arrangements, proposing to review and update the mandates of the Commission’s corporate governance bodies (for example the Corporate Management Board and Group of Resource Directors). As regards the Audit Progress Committee: An updated charter of the Audit Progress Committee will be submitted for approval by the College reflecting the improvements identified to address the IAS recommendations. - The Audit Progress Committee’s practice of examining the state of play of the implementation of the recommendations issued by the European Court of Auditors is expected to continue. The Directorate-General Budget will continue to make available for the Audit Progress Committee a report on the follow-up of the European Court of Auditors recommendations. - The Audit Progress Committee Secretariat will be appropriately reinforced with technically skilled and experienced staff to ensure the effectiveness of the Audit Progress Committee and reinforce its oversight in key areas, namely through the work on the follow up of the recommendations of the European Court of Auditors related to the reliability of the 'EU consolidated accounts'. - Adequate working arrangements will be put in place between the Internal Audit Service, the Audit Progress Committee Preparatory Group Chair and the Head of the Audit Progress Committee Secretariat, in cooperation with the Secretariat-General and the Directorate-General for Human Resources, to ensure that the identified risk of conflicts of interest is appropriately mitigated.

1.7.Audit on the production process and the quality of statistics not produced by Eurostat (ESTAT and Directorates-General ENER, FISMA, GROW and JUST) Audit objectives and scope The objective of the audit was to assess whether the Commission has in place an effective process to ensure the quality of statistics not produced by Eurostat (i.e. produced or acquired, and used, by Directorates-General and Services) to support its key policies. The audit assessed in particular (1) Eurostat coordination role and the provision of support, advice and guidance to the services; and (2) the designed and implementation of adequate processes at the level of individual Directorates-General/Services for the production/acquisition and dissemination of statistics. The audit was conducted in Eurostat (for it central role in the process) as well as in four operational Directorates-General ENER, FISMA, GROW and JUST. There were no observations/reservations in the 2016 Annual Activity Reports of the audited Directorates-General that relate to the area/process audited. The fieldwork was finalised on 18 December 2017. All observations and recommendations relate to the situation as of that date. Strengths (1)At corporate level (2)Eurostat has developed "Methodological Guidelines to Commission Directorates-General to produce reliable estimates from sample surveys outsourced to private companies" for Directorates-General/Services, which are available to the operational services together with the Inventory. (3)The need for Other Statistics are discussed between Eurostat and the operational Directorates-General in the context of the Annual Hearings; (4)Eurostat manages and monitors the use of the methodological framework contracts for outsourced statistical methodological support, which are then used by Eurostat and other Commission Directorates-General and services. (5)When requested by Directorates-General/Services, Eurostat provides methodological guidance and support (e.g. on the development of statistical surveys, for the preparation of the Terms of Reference for external acquisition of statistics and on data source issues). (6)A dedicated Task Force "Statistical Products and Services" was established in 2017 with the aim of creating a "Service Catalogue" listing the statistical services offered by Eurostat to the Commission. The Task force will develop a service delivery model (including monitoring and customer satisfaction evaluation) and establish a service management model (including governance and funding aspects). (7)In March 2017, Eurostat launched a new project on "Rationalisation of purchasing data from external sources", which is designed to achieve synergies in the Commission. (8)At operational Directorate-General level (9)The Internal Audit Service identified a number of good practices at the level of the operational Directorates-General audited, which could be adopted by other Directorates-General/Services to further improve the quality of the processes for planning, producing or acquiring, and disseminating statistics not produced by Eurostat. While those best practices are described for each of the Directorates-General audited in their respective Annex 4 of the Final Audit Report, the Internal Audit Service wishes to highlight the following: (10)Some operational Directorates-General have developed internal expertise in data analytics, which is used (to various degrees depending on the Directorate-General) when producing and acquiring statistics. In one case, experts from the Directorate-General regularly participated in the evaluation committees for tender procedures for provision of statistics launched by other Directorates-General. (11)One Directorate-General systematically included the following disclaimer statement when publishing statistics not produced by Eurostat: "This report (…) aims at enhancing public access to information […..]. Our goal is to keep this information timely and accurate. If errors are brought to our attention, we will try to correct them. However, the Commission accepts no responsibility or liability whatsoever with regard to the information contained in this publication."

(12)One Directorate-General included a footnote for each graph/chart with a description of the data source, as well as a reference to methodological notes used in its reports. Major audit findings The Internal Audit Service identified three very important issues at corporate level and one very important issue at operational Directorate-General (Directorate-General GROW) level: ESTAT Framework for statistical production in the Commission and Eurostat's coordination role in the development and production of statistics by other Commission services The current framework for statistical production in the Commission, as established by the 2012 Commission Decision, does not define a quality assurance framework for statistics not produced by Eurostat and does not provide a specific role for Eurostat in this respect. Furthermore it does not set clear obligations for the Directorates-General to inform Eurostat about their statistical production. Finally, Eurostat does not coordinate the development and production of the statistics in the Commission effectively. Completion of the Statistical Inventory and Masterplan The Statistical Inventory, maintained by Eurostat and updated by operational Directorates-General, does not provide a complete and reliable overview of the statistics that are produced or acquired and disseminated by the Commission Services. Since it is not complete and not always fully correct, Eurostat cannot effectively steer the planning and coordination of statistical activities as required by the 2012 Commission Decision. In addition, Eurostat had not implemented a Statistical Masterplan including the statistics produced by Eurostat as well as the Other Statistics. Referencing and use of a disclaimer when publishing Other Statistics Eurostat has not issued guidance or instructions to the Directorates-General on how to reference the statistics used in official publications and how to use a disclaimer when presenting statistics for which the Directorates-General cannot guarantee the accuracy. In addition, there were inconsistent practices at Directorate-General level in terms of referencing and use of a disclaimer. GROW Management of the statistical process by DG GROW Unit 01 of Directorate-General GROW has not been formally identified as a 'knowledge and competence centre' in statistical matters, responsible for coordinating and monitoring the statistical production and acquisition process at Directorate-General level as well as for the providing advice. Moreover, the Directorate-General has not issued specific guidance/instructions for the staff in the operational units which are involved in the collection of data, production and dissemination of statistics. Finally, there is no systematic use of the expertise available within Eurostat and no specific training path for developing the expertise of the staff in operational units. Recommendations Framework for statistical production in the Commission and Eurostat's coordination role in the development and production of statistics by other Commission services Eurostat should address the limitations of the 2012 Commission Decision and to take the necessary steps to coordinate effectively the development and production of statistics in the Commission and to prepare a quality framework for the statistics different from the European ones. Completion of the Statistical Inventory and Masterplan Eurostat should revise the structure of the database, establish a formal and effective review process and define the purpose and format of the Statistical Masterplan and its integration into Eurostat's planning process.

Referencing and use of a disclaimer when publishing Other Statistics Eurostat should prepare and provide guidance to the Directorates-General on how to clearly reference statistics and explain which disclaimer has to be used if the Directorates-General cannot guarantee the accuracy. Directorate-General GROW Directorate-General GROW should define a process for statistics management with clear central responsibility for coordinating the delivery of activities in this domain, provide guidelines/instruction to the units involved in the statistical production/ acquisition, ensure that the available expertise, in house or in Eurostat, is adequately exploited and promote attendance at specific training courses to increase the expertise of staff involved in the statistical production. Additional information provided by ESTAT and Directorate-General GROW on the measures defined and/or implemented following the Internal Audit Service audit Eurostat already established a portfolio of statistical services and published them in a transparent and easy-to-access online catalogue available to all Commission Directorates-General. Furthermore, Eurostat will establish a reference quality framework for other Directorates-General for "Other Statistics" that includes guidance and checklists on production and acquisition procedures, methodologies and characteristics of data produced /acquired. Eurostat will elaborate, in cooperation with the network of DGs statistical correspondents, a clear and easy-to-use definition of statistics, clear and detailed instructions on the types and nature of items to be included or excluded from the Statistical Inventory, including those related to future needs not yet covered by current production or acquisition. Furthermore, Eurostat will develop clear instructions on how to fill in the different fields of the statistical inventory, including those related to financial and contractual information and to the end year. Eurostat already started to develop guidance on referencing statistical data, coming from Eurostat or from other sources. Additionally Eurostat will develop guidance on types of disclaimer DGs could use for warning users about quality aspects of the statistical data presented. Directorate-General GROW will take by end 2018 the following actions: - Directorate-General GROW 01 will be reaffirmed in its role of the official liaison unit between Directorate-General GROW and Eurostat (a so called “mirror unit”). For that purpose, a note will be prepared by GROW 01 in which its role and responsibility will be explained with regard to different Eurostat related activities (Inventory, annual hearings, production of data, acquisition of data etc.). - Directorate-General GROW will prepare guidelines that will set out the methodological framework for assuring the quality of the statistics produced/acquired by Directorate-General GROW. These guidelines will include contact points within GROW and Eurostat and instructions on when specific expertise is needed from GROW.01 or Eurostat in the context of the procurement process or assessment of contractual deliverables. - GROW 01 will create a dedicated page on GROWNet for statistics where the above mentioned guidelines will be available as well as presentations on data/statistics and good practice examples will be shared - Directorate-General GROW will deliver twice a year a full day training course on Introduction to Statistics and Indicators. 2.Agriculture, natural resources and health 2.1.Audit on Directorate-General AGRI's management of agricultural market crises Audit objectives and scope The objective of the audit was to assess whether Directorate-General AGRI has put in place adequate processes for managing agricultural market crises. In particular, the audit assessed whether Directorate-General AGRI has developed systems to a) forecast and/or prevent agricultural market crises to the extent possible, b) be able to react effectively and in a timely manner to crises and c) monitor the effects of measures taken to address crises and draw lessons for the future. The audit covered Directorate-General AGRI's processes for managing agricultural market crises. As the legislator has not defined what an agricultural market crisis is in the Regulation establishing a common organisation of the markets in agricultural products, (Regulation (EU) 1308/2013), for the purpose of the audit, "agricultural market crisis" refers to severe market disturbances that have led but are not limited to the adoption of temporary "exceptional measures". This is in contrast to regular market management measures that are taken following normal market movements. It covered the following processes:

·Directorate-General AGRI's approach and internal processes for forecasting market crises and reacting on a timely basis (e.g. use of market monitoring tools, risk management process, rationale for proposing mitigating measures); ·Directorate-General AGRI's ability to adequately support the decision making process in the event of a crisis, in terms of procedures, availability of necessary staff, knowledge and budget. ·Directorate-General AGRI's arrangements following a crisis to move into the phasing-out period, monitor the markets and draw lessons for the future. Directorate-General AGRI's 2015 Annual Activity Report contains a reservation relating to temporary exceptional support measures in the fruit and vegetables sector and concerns Poland. The fieldwork was finalised on 4 April 2017. All observations and recommendations relate to the situation as of that date. Strengths The auditors acknowledged the efforts made by Directorate-General AGRI in responding to the agricultural market crises experienced since mid-2014. The audit identified the following strengths in particular: a) Responding to crises situations implies a certain pressure on Directorate-General AGRI's staff to react on time to tight deadlines and those involved in the management of the dairy, livestock and fruit and vegetable markets in particular have demonstrated high levels of commitment and have worked under considerable pressure for a long time, including working during the normal holiday periods. b) Directorate-General AGRI has put in place a variety of monitoring tools. These include dashboards presenting key data relating to particular agricultural markets, market observatories that gather together experts from the field and which disseminate market data and short-term analysis, including the minutes of the meetings of their various economic boards. This information is publicly available and regularly updated on the Europa website. c) During the period audited, Directorate-General AGRI prepared comprehensive information notes for the Commissioner, backed up by extensive analyses (including graphs and historical data) of available information for the sectors and measures concerned. These notes, together with the reports of the meetings held at cabinet level, are duly handled in accordance with document management rules. Major audit findings The Internal Audit Service identified one very important issue: Risk management and performance follow-up in the context of agricultural market crises To address crisis situations Directorate-General AGRI has used a range of instruments available under the Common Agricultural Policy (CAP). However, certain measures pose particular management and control risks as they do not sufficiently target the actual problem/product or because they allow very high levels of flexibility in defining the exact scope and design of the aid to their farmers. These measures can also have a knock-on effect on other sectors or policies. The Internal Audit Service acknowledged that the final design and adoption of the crisis packages is ultimately influenced by political decisions that are largely outside the control of Directorate-General AGRI. However, operational and management considerations can help to inform these political decisions. In this respect, the Internal Audit Service found that in practice Directorate-General AGRI has made only very limited analyses of the management implications of the various crisis packages implemented to date and that the related risks have not been adequately reflected in Directorate-General AGRI's risk management process. Moreover, the follow-up given to crisis measures has so far concentrated more on reporting the uptake of the measures involved and on the main sectors impacted, but is lacking in terms of the analysis on the potential broader impact including on other sectors/policies. Recommendation Directorate-General AGRI should ensure that risks stemming from the adopted measures for its management and control system are properly taken into account in its risk management process. In addition, in following up the implementation of crisis measures, it should analyse the role of all CAP tools used and their structural impact, including their impact on other farming sectors and policies. This should help Directorate-General AGRI to propose adjustments or to discontinue existing measures or even propose policy changes. Finally, it should undertake an evaluation of the prevention and management of crises aimed at assessing the appropriateness of the methods, tools and measures used as soon as possible. Additional information provided by Directorate-General AGRI on the measures defined and/or implemented following the Internal Audit Service audit In response to the Internal Audit Service recommendations, Directorate-General AGRI has undertaken several actions to enhance the coordination inside Directorate-General AGRI to better react to future crises including preparing a guide of procedures and setting up of a task force. A guide of procedures has been adopted at the end of 2017. It established (1) a taskforce ready-to-act in case of new agricultural market crises with large economic impact and (2) a periodical review mechanism (every six months) of the different exceptional measures in place for market reasons and of the main risk scenarios identified for agricultural markets. This periodical review mechanism will report to the RMIC of DG AGRI (who leads the above mentioned taskforce) and will feed the annual risk assessment exercise of DG AGRI In addition, a study on “improving crisis prevention and management criteria and strategies in the agricultural sector” is currently on-going. It aims at providing a critical review of all aspects related to the crisis prevention and management mechanisms in the Common Agricultural Policy. 2.2.Audit on Directorate-General AGRI's implementation of RDPs

Audit objectives and scope The objective of the audit was to assess whether Directorate-General AGRI's internal processes for monitoring the implementation of Rural Development Programmes (RDP) are well designed and consistently implemented, whether they ensure that weaknesses in RDP implementation are detected and addressed in time and whether they reduce (as much as possible) the risks of errors and/or poor performance. The audit covered Directorate-General AGRI's management processes for monitoring the implementation and performance of RDPs. The audit took place during the initial phase of the implementation period and focused on the processes Directorate-General AGRI has put in place to ensure its supervisory role for the implementation of the Rural Development (RD) policy under shared management. It did not cover the ex-post audit processes, which were included in the scope of a separate Internal Audit Service audit on the Directorate's-General control strategy. In Directorate-General AGRI's 2016 Annual Activity Report, a reservation was issued in respect of significant weaknesses in the underlying transactions (legality and regularity) of RD expenditure (ABB 04) for 20 Paying Agencies, comprising 19 Member States. The fieldwork was finalised on 28 November 2017. All observations and recommendations relate to the situation as of that date. Strengths The Internal Audit Service recognised the ongoing efforts made by Directorate-General AGRI to improve their internal processes for monitoring the implementation of RDPs. In particular, the audit identified the following strengths: a) Directorate-General AGRI has invested in knowledge management in RD policy and programming: The internal IT knowledge management tool, RD Wiki, which is accessible to all Directorate-General AGRI staff, has been subject to further development. It contains the applicable legislation as well as any related legal interpretations. Guidance documents and technical explanations are posted in RD Wiki to share knowledge and ensure a consistent approach. The Directorate-General also organises regular thematic training sessions on specific issues (“Q&A sessions”) for RD staff. Directorate-General AGRI has drafted guidance documents for Member States (MS) that are shared online. It also organises seminars and/or networking events on a regular basis that bring together MS representatives. b) Directorate-General AGRI has designed specific tools and mechanisms to strengthen its internal monitoring and supervision of the RDP implementation: The responsible geographical desk officer prepares a working document in English and/or French summarising the main points of an amendment, which in turn helps to facilitate the consultation process. Once the Annual Implementation Report have been received and analysed, annual overview meetings are held for each MS. They bring together the geographical units and the responsible director and are chaired by the Deputy Director-General responsible for rural development policy. They aim to take stock of the progress of RDP implementation to prepare the Annual Review Meetings (ARM) with the MS that take place every autumn. Major audit findings The Internal Audit Service did not identify any critical or very important issues. 2.3.Audit on Directorate-General AGRI's control strategy for the CAP 2014-2020 Audit objectives and scope The objective of the audit was to assess whether Directorate-General AGRI has adequately designed and implemented its control strategy to be able to provide assurance on the implementation of the Common Agricultural Policy (CAP) 2014-2020 budget in compliance with EU rules. The audit focused on the following processes:

·Processes for handling Member State (MS) reporting requirements related to their management and control system; ·Processes for managing conformity clearance audits/inquiries, as well as audits/inquiries in the context of the financial clearance procedure; ·Processes for following up deficiencies identified in the management and control system of the MS and ensuring remedial action (including financial corrections). The fieldwork was finalised on 13 October 2017. All observations and recommendations relate to the situation as of that date, except for some limited additional testing which was performed following Directorate-General AGRI's comments to the findings validation table. Strengths The Internal Audit Service recognised the efforts and commitment made by Directorate-General AGRI to design and implement a robust system for the control strategy for the CAP 2014-2020. The Internal Audit Service noted that the processes have significantly improved compared to what it had observed in its audits of Directorate-General AGRI's control strategy for the CAP 2007-2013. In particular, the Internal Audit Service identified the following strengths: a) Directorate-General AGRI has adopted an audit strategy for the CAP 2014-2020 which details the audit approach and sets objectives for the audit activities as well as indicators to follow-up their implementation. b) Directorate AGRI-H "Assurance and Audit" has developed detailed procedures for the implementation of the audit activities, which are set out in a comprehensive audit manual and regularly updated. In December 2015 it also put in place a quality assurance policy. c) Directorate AGRI-H'