EUROPEAN COMMISSION Brussels, 25.6.2019 SWD(2019) 300 final COMMISSION STAFF WORKING DOCUMENT Internal audit engagements finalised by the Internal Audit Service in 2018 Accompanying the document Report from the Commission to the European Parliament, the Council and the Court of Auditors



Annual report to the Discharge Authority on internal audits carried out in 2018

{COM(2019) 350 final}



Table of contents CONTENT OF THIS STAFF WORKING DOCUMENT Section 1 Final reports Horizontal audits 1.Audit on LIFE financial instruments: effectiveness and efficiency of the current framework in DGs CLIMA and ENV 2.Limited review on the reporting on the corrective capacity in DGs AGRI, BUDG, DEVCO, EMPL, REGIO, RTD and EASME 3.Audit on EC-EEAS coordination in DGs DEVCO and NEAR and FPI 4.Audit on business continuity in DG COMM (DGs COMM and DIGIT) 5.Audit on ‘synergies and efficiencies review’ in DGs BUDG, COMM, DIGIT, HR, JRC, OIB, SCIC and SG 6.Audit on dissemination and exploitation of Horizon 2020 results in DGs CNECT, RTD and CSC, REA and ERCEA 7.Consolidated report on Horizon 2020 project management and ex ante control audits in DGs RTD, DG CNECT, REA, ERCEA, INEA and EASME 8.Audit on Connecting Europe Facility telecom governance in DGs CNECT, DGT, DIGIT, EMPL, GROW, JUST and SANTE 9.Audit on the effectiveness and efficiency of the new Early Detection and Exclusion System in protecting the EU financial interests in DGs BUDG, DEVCO, REGIO and RTD 10.Audit on Intellectual Property Rights supporting activities in DGs COMM, DIGIT, GROW, JRC and OP Agriculture, natural resources and health 1.Limited review of the adjustment of the reported error rate by DG AGRI and the calculation of the amounts at risk at payment 2.Audit on the implementation of payments and corrections in DG AGRI (shared management) 3.Audit on the management of Instrument of Pre-Accession for Rural Development II in DG AGRI

4.Audit on the evaluation process in DG AGRI 5.Audit on closure of the 2007-2013 European Fisheries Fund Operational Programmes in DG MARE 6.Audit on TRACES in DG SANTE 7.Audit on monitoring and enforcement of EU health law in DG SANTE Cohesion 1.Audit on the evaluation process in DG EMPL and DG REGIO 2.Review of the annual assurance packages by DGs EMPL, MARE and REGIO Research, energy and transport 1.Audit on ex ante controls on Horizon 2020 grant payments in DG CNECT 2.Audit on legacy programmes in DG ENER - management of final payments and closure 3.Audit on H2020 grant management (phase II) in ERCEA 4.Audit on grants management phase II: project management and payments for H2020 in INEA 5.Audit on nuclear decommissioning and waste management programme implementation in JRC 6.Audit on HR management - recruitment of temporary scientific staff in Joint Research Centre 7.Audit on REA’s preparedness to deliver SEDIA-related services 8.Audit on H2020 grant management (phase II - project monitoring and ex ante controls) in REA 9.Audit on ex ante controls on H2020 grant payments in DG RTD External action 1.Audit on the Partnership Instrument in FPI 2.Audit on the Neighbourhood Investment Facility and the Western Balkans Investment Framework in DG NEAR

3.Audit on grant and procurement award process under European Neighbourhood Instrument direct management in DG NEAR 4.Audit on the assurance building process in headquarters in DG DEVCO Education and citizenship 1.Audit on DG EAC’s ex post financial audits, independent audit bodies’ opinions and controls on grant proposal evaluation for Erasmus+ actions implemented by national agencies 2.Audit on Erasmus+ and Creative Europe grant management Phase II (from project monitoring to payment) in EACEA 40 3.Audit on monitoring the implementation and performance of 2014-2020 national programmes by DG HOME 4.Audit on risk management in DG HOME 5.Audit on risk management in DG JUST 6.Audit on procurement in DG JUST Economic and financial affairs 1.Consulting engagement on document management in DG ECFIN 2.Audit on effectiveness and efficiency of DG FISMA’s performance management system 3.Audit on the adequacy of DG GROW’s preparation and supervision of the parts of the COSME work programmes delegated to EASME 4.Audit on supervision of project management and payment for Galileo in DG GROW 5.Audit on the supervision of the implementation of the Copernicus Programme in DG GROW - Phase II: management of the cooperation and coordination between the different implementing entities 6.Audit on DG TAXUD’s preparation of legislative initiatives 7.Audit on financial management of procurement contracts and grants in DG TRADE General services 1.Audit on financial management of grants in DG ESTAT 2.Audit on effectiveness of DG ESTAT’s cooperation with external stakeholders

3.Consulting engagement on accounting for JSIS direct billing in PMO 4.Audit on control strategy for the Joint Sickness and Insurance Scheme, including accidents insurance (design and implementation) in PMO Information technology audits 1.Audit on information technology project management in DG REGIO 2.Audit on information technology governance at DG DEVCO 3.Audit on IT security management for Common Support Centre H2020 grant lifecycle systems in DG RTD Section 2 Follow-up engagements (summarised) 1.Follow-up audit on the management of grants under the 2014-2020 consumer and health programmes in CHAFEA 2.Follow-up audit on CHAFEA’s management and control system for the implementation of the measures for the promotion of agricultural products 3.Follow-up audit on staff allocation and process management in response to staff reduction in DG ENV 4.Follow-up audit on early implementation of European Structural and Investment Funds control strategy 2014-2020 in DG MARE 5.Follow-up audit on amendments of 2014-2020 operational programmes in DGs REGIO, EMPL and MARE - DG EMPL 6.Follow-up audit on early implementation of European Structural and Investment Funds control strategy 2014-2020 in DG EMPL 7.Follow-up audit on amendments of 2014-2020 operational programmes in DGs REGIO, EMPL and MARE - DG REGIO 8.Follow-up audit on early implementation of European Structural and Investment Funds control strategy 2014-2020 in DG REGIO 9.Follow-up audit on major projects in DG REGIO 10.Follow-up audit on the supervision of ITER in DG ENER 11.Follow-up audit on the supervision of ITER in DG ENER 12.Follow-up audit on competitive activities in Joint Research Centre 13.Follow-up audit on the implementation of the FP7 ex post audit strategy by the Common Audit Service in DG RTD

14.Follow-up audit on the H2020 project management in DG RTD 15.Follow-up audit on the design and set-up of the internal control systems for Horizon 2020 in DG RTD 16.Follow-up audit on DG DEVCO payment deadlines 17.Follow-up audit on the management of the African Peace Facility in DG DEVCO 18.Follow-up audit on the performance management system in DG DEVCO 19.Follow-up audit on procurement under Instrument for Pre-Accession (direct management and indirect management with beneficiary countries) – Phase I – in DG NEAR 20.Follow-up audit on procurement under Instrument for Pre-Accession (direct management and indirect management with beneficiary countries) – Phase II – in DG NEAR 21.Follow-up audit on past Internal Audit Service audits in DG HOME 22.Follow-up audit on enforcement of the EU antitrust policy in DG COMP: cooperation with EU national competition authorities and national courts65 23.Follow-up audit on enforcement of the EU antitrust policy in DG COMP: cooperation with EU national competition authorities and national courts65 24.Follow-up audit on past Internal Audit Service audits in DG EAC: performance management systems in DG EAC, including the contributions of executive Agencies and national Agencies to the achievement of policy objectives66 25.Follow-up audit on Erasmus+ and Creative Europe – grant management phase I (from the call to the signature of contracts) in EACEA66 26.Follow-up audit on Erasmus+ and Creative Europe – grant management phase I (from the call to the signature of contracts) in EACEA ()66 27.Follow-up audit on past Internal Audit Service audits in DG ECFIN66 28.Follow-up audit on the setting of objectives and measurement of performances in DG GROW67 29.Follow-up audit on the performance of DG GROW’s supervision of ESA’s implementation of Galileo67 30.Follow-up audit on ethics in DG TRADE67 31.Follow-up audit on performance of Anti-Fraud activities in the own resource and taxation areas in DG BUDG68 32.Follow-up audit on performance of Anti-Fraud activities in the own resource and taxation areas in DG BUDG68 33.Follow-up audit on the procurement process in DG DIGIT68

34.Follow-up audit on performance of EUROSTAT’s support to the Europe 2020 strategy and the new Commission priorities68 35.Follow-up audit on former IAC and Internal Audit Service audits in OIB68 36.Follow-up audit on the procurement process in OIL68 37.Follow-up audit on the governance, planning, monitoring and implementation of the budget line of the OLAF Supervisory Committee68 38.Follow-up audit on the governance, planning, monitoring and implementation of the budget line of the OLAF Supervisory Committee69 39.Follow-up audit on performance and coordination of Anti-Fraud activities in the Traditional Own Resources areas in OLAF69 40.Follow-up audit on performance and coordination of Anti-Fraud activities in the Traditional Own Resources area in OLAF69 41.Follow-up audit on former IAC audits in PMO70 42.Follow-up audit on business continuity in DG COMM70 43.Follow-up audit on security of IT applications supporting nuclear accountancy and inspection processes in DG ENER70 44.Follow-up audit on security of IT applications supporting nuclear accountancy and inspection processes in DG ENER71 45.Follow-up audit on management of local IT in DG ESTAT71 46.Follow-up audit on IT governance and portfolio management in DG GROW71 47.Follow-up audit on the former IAC audit on the performance of the Anti-Fraud information system (AFIS) in OLAF71 48.Follow-up audit on IT logical security controls in OLAF71 49.Follow-up audit on business continuity management in Publications Office of the European Union72 50.Follow-up audit on business continuity management in Publications Office of the European Union72 51.Follow-up audit on HR IT corporate application – NAP in PMO72 52.Follow-up audit on supervision of outsourced IT operations in DG TAXUD73 List of follow-up audits performed in 2018 for which all recommendations have been closed after the follow-up74

CONTENT OF THIS STAFF WORKING DOCUMENT Section 1 of this document contains a summary of the internal audit engagements performed as part of the 2018 Internal Audit Service audit plan (reports issued in the period 1 February 2018 to 31 January 2019) and the principal recommendations (critical and very important recommendations (). The information contained in this document reflects the state of play when the audit engagements were finalised. Each audit followed the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation of the engagement. The enclosed summary of each engagement aims to provide a quick understanding of the audits and their main results and additional, up-to-date information is provided in specific sections by the auditees on the measures defined and/or already implemented after the finalisation of the internal audit engagements. Section 2 of this document contains a summary of the results of the Internal Audit Service follow-up engagements performed in the period from 1 February 2018 to 31 January 2019 ( ). Section 3 provides a summarised overview of the 18 long overdue very important recommendations as at 31 January 2019. Section 1

Final reports Horizontal audits 1.Audit on LIFE financial instruments: effectiveness and efficiency of the current framework in DGs CLIMA and ENV The objective of the audit was to assess the adequacy, efficiency and effectiveness of internal controls put in place by the Directorate-General for Climate Action and the Directorate-General for Environment to monitor and supervise the implementation and performance of the two financial instruments under the LIFE 2014-2020 Programme. No reservations regarding financial instruments under the LIFE Programme 2014-2020 were made in the 2017 annual activity reports of the Directorates-General for Climate Action and for Environment. The fieldwork was finalised on 21 September 2018. All recommendations relate to the situation as of that date. The Internal Audit Service recognises the ongoing efforts made by these two directorates-general to coordinate their monitoring activities and decisions towards the European Investment Bank. In addition, the Internal Audit Service acknowledges the good cooperation and exchange of best practices between the two directorates-general, such as the use of internally developed excel tools for monitoring the management of the funds for both instruments. The Internal Audit Service identified one issue concerning the visibility and promotion of the EU contribution to the financial instruments and formulated the following very important recommendation: The directorates-general should verify on a regular basis that the requirements of the delegation agreements are respected in practice and raise any issues with the European Investment Bank as appropriate. They should agree, together with the European Investment Bank, on a communication plan which builds on existing communication channels and which provides for a stronger role of the LIFE programme national contact points. This should be regularly monitored in the Steering Committee meetings and adjusted as necessary. Additional information provided by Directorates-General CLIMA and ENV on the measures defined and/or implemented following the Internal Audit Service audit The Directorate-General for Climate Action provided an action plan that was assessed as satisfactory by the Internal Audit Service to mitigate the risks identified. It has developed a communication plan for the promotion and visibility, which has been discussed in the Steering Committee meeting of November and will be further debated in the next Steering Committee. A task force group has been established in order to facilitate a more technical discussion with the European Investment Bank. The first meeting took place in March 2019. A new call for proposals was published on 21 December 2018, which has sparked interest in various Member States (Germany, Ireland, France, Latvia, Austria, Poland) (). The Directorate-General for Environment has submitted an action plan for the ‘Natural Capital Financing Facility’, the Financial Instrument it manages, but both the Directorates-General for Climate Action and for Environment provide the necessary funding, that the Internal Audit Service has assessed as satisfactory to mitigate the risks identified for the audited process.

The audit, the action plan and its implementation were discussed and agreed with the European Investment Bank in the Natural Capital Financing Facility Steering Committee on 12 February 2019. Visibility of the most recent operation was ensured through a signature event at the Biodiversity Conference on 23 May 2019 in Brussels and an accompanying press-release. An update of the communication plan is under preparation in view of agreement in the next Steering Committee. 2.Limited review on the reporting on the corrective capacity in DGs AGRI, BUDG, DEVCO, EMPL, REGIO, RTD and EASME

The objective of the limited review was to assess (i) the validity of the concept of the estimated amounts at risk at closure, (ii) how it is being applied and reported on by operational directorates-general/services in their respective annual activity reports, and, (iii) how it feeds into and is presented in the Annual Management and Performance Report. There are no observations/reservations in the 2016 annual activity reports of the directorates-general and services reviewed that relate to the area/process reviewed. The fieldwork was finalised on 1 December 2017. All recommendations relate to the situation as of that date. The Internal Audit Service identified one issue concerning the Implementation of the reporting on the corrective capacity and formulated the following very important recommendation: The Directorate-General for Budget should modify the corporate instructions and instruct the directorates-general and the services to consider more carefully whether historical data is a sound basis for estimating future recoveries and corrections. Furthermore, it should require the directorates-general and services to disclose the main underlying assumptions in their annual activity reports and refer to those in the Annual Management and Performance Report. The operational directorates-general should use more relevant data/information, where available, other than the historical averages to estimate future corrections or otherwise, use more recent data, which is likely to be more relevant for current programmes. Similarly, those directorates-general and services who faced historical data encoding issues, should use more recent data to ensure that the estimations are based on the most accurate data available. Additional information provided by Directorate-General BUDG on the measures defined and/or implemented following the Internal Audit Service audit The Directorate-General for Budget has further clarified the 2017 and 2018 corporate instructions and guidance for estimating the future corrective capacity in the annual activity reports. The estimated future corrections are to be based, to some extent, on the actual historical average recoveries and corrections, but these are to be adjusted or replaced in order to come to the best conservative estimate of the future ex post corrections relevant for the current programmes. The directorates-general duly disclose their main underlying assumptions of their estimate in their annual activity report. Those approaches are summarised in the Annual Management and Performance Report. The recommendation regarding adapting the methodology for estimating corrective capacity of the Directorate-General for Agriculture and Rural Development, and disclosure thereof has been adequately and effectively implemented. In line with the agreed action plan, in its 2017 annual activity report, the Directorate-General for Agriculture and Rural Development based its estimated future recoveries, corrections and amount at risk on the historic average of the executed recovery orders and financial corrections over the period 2013-2017 and adapted it by excluding factors from the past years which are no longer relevant for the current common agricultural policy measures.

One part of an important recommendation concerning ‘presentational issues in the annual activity report’ (for example to explain the main underlying assumptions having an impact on the estimated amounts at risk) was addressed to the Directorate-General for Employment, Social Affairs and Inclusion. These issues were implemented in the framework of the 2018 annual activity report and the Internal Audit Service subsequently closed the recommendation. 3.Audit on EC-EEAS coordination in DGs DEVCO and NEAR and FPI The objective of the audit was to assess the effectiveness and efficiency of coordination activities between the Commission services (specifically, the Directorate-General for International Cooperation and Development, the Directorate-General for Neighbourhood and Enlargement Negotiations and the Service for Foreign Policy Instruments) and the European External Action Service (EEAS) in areas relating to management of the EU delegations as well as programming and implementing external instruments. There are no observations/reservations in the 2017 annual activity reports of the audited directorates-general and services that relate to the area/process audited. The fieldwork was finalised on 10 April 2018 for the work performed in EU delegations and on 11 September 2018 for headquarters. All recommendations relate to the situation as of this date. The audit highlighted the following strengths: ·coordination in the management of EU delegations: The attendance and participation of all required services to the meetings of the EU delegations Committee and the comprehensive EU delegations minutes reflecting discussions held and positions expressed by all parties attending; the feedback provided by the Directorate-General for International Cooperation and Development, the Directorate-General for Neighbourhood and Enlargement Negotiations headquarters to the External Assistance Management Reports submitted by EU delegations; the enhanced coordination on EU economic diplomacy between Commission services and the European External Action Service; ·multiannual programming of the external assistance instruments: the practice put in place by the European External Action Service and the Directorate-General for Neighbourhood and Enlargement Negotiations to perform joint programming missions to the respective/eligible countries in the context of the update (mid-term review) of the multiannual programming for the European Neighbourhood Instrument; the practice put in place in the EU delegation Senegal to establish informal quality support groups / quality reviews of programming documents with the involvement and participation of both cooperation and political sections; ·risk management in general, and specifically on the budget support risk-management framework : the interaction in all sampled EU delegations (visited on the spot and analysed via desk review) of the cooperation and political section, with the latter being in charge for the assessment of the political risks, for the annual update of the Risk Management Framework; ·Service for Foreign Policy Instruments and Instrument contributing to Stability and Peace (IcSP) regional teams: the efforts undertaken by the Service for Foreign Policy Instruments regional teams to ensure efficient transfer of physical project files from EU delegations as well as the efficiency, despite the limited time since their set-up, in drafting authorising officer by sub-delegation (AOSD) reports (for Foreign Policy Instruments funding) and/or contributions to authorising officer by sub-delegation reports of Heads of Delegations; ·coordination and/or exchange of information regarding implementation of external assistance: the set-up of the budget support implementation modality in both the Directorate-General for Neighbourhood and Enlargement Negotiations and the Directorate-General for International Cooperation and Development: the involvement of the European External Action Service as well as the interaction between the European External Action Service, the EU delegations and the Commission is fully formalised and each party has a clear mandate in the Budget Support Steering/Financial Assistance Steering (BSSC/FAST) Committees, which is considered a best practice in terms of coordination; for Egypt, a Permanent country team has been put in place to identify how best to define a strategic relationship with Egypt. The Permanent Country Team is co-chaired by the Directorate-General for Neighbourhood and Enlargement Negotiations and the European External Action Service. The minutes, distribution list and agenda items are considered as a good practice.

The Internal Audit Service identified one issue concerning the country-level coordination between the Commission services and formulated the following very important recommendations: The Directorate-General for International Cooperation and Development and the Directorate-General for Neighbourhood and Enlargement Negotiations should: ·enhance/further develop the aid implementation dashboard in order to establish a consolidated portfolio of EU funded projects; ·undertake a feasibility study together (cost/benefit analysis) on the extension of the aid implementation dashboard towards areas of external cooperation; ·seek pragmatic solutions for the inclusion of funding from line directorates-general and/or other institutions such as the European Investment Bank; ·make good use of the aid implementation dashboard by: ·making EU delegations fully aware of the existence of the dashboard, its usage and related process requirements; ·setting a process through which line directorates-general have to share the information on their funded projects in third countries with EU delegations and/or headquarters. Additional information provided by Directorates-General DEVCO and NEAR on the measures defined and/or implemented following the Internal Audit Service audit Following the audit in the Directorate-General for International Cooperation and Development, the final audit report was published on 31 January 2019 and an action plan to address the recommendations was accepted by the Internal Audit Service. To improve country-level coordination with the European External Action Service, the directorate-general has undertaken a study to identify external cooperation financial flows beyond the Heading IV of the General Budget and to assess the feasibility of integrating them in the dashboard. If the conclusion of the study is positive, necessary processes for collecting information on funding from line directorates-general and European Investment Bank will be put in place. These flows will be integrated in the aid implementation dashboard. In parallel, a communication and awareness plan will be designed and implemented to maximise awareness and use of the Aid Implementation dashboard by the staff in EU delegations by the end of 2019. The Directorate-General for Neighbourhood and Enlargement Negotiations is working together with the Directorate-General for International Cooperation and Development and the European External Action Service on the implementation of the very important recommendation related to the country level coordination and improving aid implementation dashboards. Once the feasibility study is finalised, a new version of dashboard will be developed and the Directorate-General for Neighbourhood and Enlargement Negotiations will issue a note informing EU delegations about its existence, usage and related process requirements. The Directorate-General for Neighbourhood and Enlargement Negotiations will align with the process set up by the Directorate-General for International Cooperation and Development to identify line directorates-general who need to share information on their funded projects in third countries with EU delegations and/or headquarters. 4.Audit on business continuity in DG COMM (DGs COMM and DIGIT) The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the management and control systems put in place by the Directorate-General for Communication for its business continuity management. The aim of the audit was to help identify any possible weaknesses in Directorate-General for Communication business continuity processes and to recommend improvements where needed. There are no reservations in the 2016 annual activity report of the Directorate-General for Communication that relate to the area audited. According to this annual activity report, during 2016 the directorate-general gave particular priority to addressing former Internal Control Standard no. 10 (business continuity). The fieldwork was finalised on 11 December 2017. All recommendations relate to the situation as of that date. The Internal Audit Service recognises the efforts made by the Directorate-General for Communication to prepare for major disruptions and to mitigate the main inherent risks identified. In particular, the directorate-general put in place a number of key controls to improve its business continuity capability. ·ex post controls: as mentioned in the 2016 annual activity report, the Directorate-General for Communication performed ex post-controls on former internal control standard no. 10 (business continuity) in nine Representations and three Brussels-based units; ·knowledge of processes: the staff in the Directorate-General for Communication responsible for critical functions are very knowledgeable and experienced in its processes; ·useful leaflets with business continuity information: the Directorate-General for Communication has developed very useful information leaflets aimed at raising staff awareness of business continuity issues; ·training: the Directorate-General for Communication gave training on business continuity to critical staff in Representations and Headquarters; ·hand-over documentation: when a staff member changes post, it is mandatory for the colleague on mobility to draft hand-over documentation for the successor. The Internal Audit Service assessed two hand-over files and considered them adequate to facilitate a swift take-over of new tasks by a new staff member.

Moreover, the Internal Audit Service notes that during the course of the audit the Directorate-General for Communication reacted very promptly and constructively to the emerging issues identified and in a number of cases began to take corrective action either before the audit was finalised or very soon after. The Internal Audit Service identified one issue concerning Business Impact Analysis and formulated the following very important recommendation: The Directorate-General for Communication should finalise its update of the Business Impact Analysis, paying particular attention to ensuring that dependencies and resources for running critical and essential functions have been taken into account. The Directorate-General for Communication management should approve the Business Impact Analysis and ensure that it is kept up-to-date. The current overall Business Continuity Plan, tactical Business Continuity Plans and the relocation plans should be reviewed and aligned as necessary with the updated Business Impact Analysis. Additional information provided by Directorate-General COMM on the measures defined and/or implemented following the Internal Audit Service audit The very important Internal Audit Service recommendation related to business impact analysis was closed in 2018. A process for keeping the Business Impact Analysis up-to-date has been established. The Business Impact Analysis is presented for review and update to the ‘risk management group’ of the Directorate-General for Communication twice a year. In addition, updates are done on a systematic basis whenever new elements emerge, for instance, re-organisation of the directorate-general. The Business Continuity Plan has been revised following the establishment of the Business Impact Analysis. 5.Audit on ‘synergies and efficiencies review’ in DGs BUDG, COMM, DIGIT, HR, JRC, OIB, SCIC and SG The main objective of the audit was to assess whether the Commission has put in place a clear framework and methodology, as well as sound processes and controls to ensure that the objectives of the Synergies and Efficiencies Review Communication are met and to assess the state of play of the Synergies and Efficiencies Review Communication approximately 2 years after its adoption. The first target dates are set for 2019. Therefore it is key for such a wide ranging initiative, with high levels of expectation, to take stock of the progress made so far, confirm or otherwise that it is on track and highlight as early as possible any areas for possible improvement/corrective action. There are no observations/reservations in the 2017 annual activity reports of the Directorates-General for Budget, for Communication, for Informatics, for Human Resources and Security, the Joint Research Centre, the Office for Infrastructure and Logistics in Brussels, the Directorate-General for Interpretation and the Secretariat-General that relate to the area/process audited. The fieldwork was finalised in mid-June 2018. All recommendations relate to the situation as of that date. However, the situation was continuously evolving (as presented under key developments below) and various factors and new information have come to light since then. Where possible, these have been taken into account in finalising the audit engagement (the report was issued in January 2019) and include, for example, the impact of significant changes to the Commission corporate governance framework and the latest meetings of key corporate bodies ( ). The audit highlighted the following key developments and strengths: ·Coordination amongst actors and transparent reporting: under the lead of the Directorate-General for Human Resources and Security, domain leaders (DLs) meet regularly at operational and senior management levels to discuss issues related to the implementation of the synergies and efficiencies review and to help coordinate the work across the different domains through the domain leaders working group. The Directorate-General for Human Resources and Security, with help from the Directorates-General for Budget and the Secretariat-General, included a new synergies and efficiencies review annex to three Staff Allocation decisions published in 2017 and 2018 ( ). The annexes, prepared based on input and discussions with the domain leaders presented the progress made in each domain. Additionally, significant efforts have been made to improve the way in which synergies and efficiencies review related information is reported. The Corporate Management Board proposed to seize the College in February 2019 on the state of play of the implementation of the Synergies and Efficiencies Review Communication, including proposals on how to continue to deliver synergies and efficiencies with high quality services, minimal disruptions and taking account of the evolving context. While the Internal Audit Service considers that this process could be even further improved, it nevertheless represents a significant development in monitoring and reporting arrangements. Moreover, the recently enhanced oversight role of the Corporate Management Board as regards the implementation of the synergies and efficiencies review suggests that it could be best placed to further oversee the continuous modernisation of the Commission’s organisation and that a number of the components of the synergies and efficiencies review initiative could provide the key building blocks for this. The Internal Audit Service also notes the efforts to improve communication between the domain leaders and the individual/client directorates-general on the service provided. This is done through dedicated steering boards per project/domain ( ) and networks ( ) created and other tools adapted to each domain leader. ·Specific domain leaders developments: the Internal Audit Service acknowledged the progress made and achievements in each domain as regards the main actions listed in the Synergies and Efficiencies Review Communication ( ). The Internal Audit Service noted during the audit that domain leaders and central services are continuously taking measures in order to improve the processes, with lessons learnt taken on board in order to deliver, as much as possible, the objectives of the Synergies and Efficiencies Review Communication. The new human resources model has been rolled-out to all directorates-general in July 2017. This involved the transfer of around 400 human resource staff from directorates-general to Account Management Centres and the creation of a new Account Management Centres directorate in the Directorate-General for Human Resources and Security. The three information and communications technology projects selected in the Internal Audit Service audit are at different levels of maturity. In order to optimise the synergies between eGrants and eProcurement project, a new governance structure has been created in May 2017 ( ), involving a change in eProcurement’s system architecture and business owner ( ). As regards the local data centre centralisation (LDCC), as at July 2018, the Internal Audit Service notes that four directorates-general have been centralised ( ). The Corporate Communication Steering Committee was established on 4 April 2016 and the Communication Network, merging the work of the former External and Internal Communication Networks was created in July 2016. A Corporate Communication Contracts Team, has been set up early 2018 in the Directorate-General for Communication. The right of consent mechanism (whereby directorates-general should seek consent of the Directorate-General for Communication for external communication actions with a budget of EUR 1 million and above) was approved by the Corporate Communication Steering Committee in July 2016. By the end of 2018, 27 framework contracts were expected to be phased-out. The Commission's new external websites were launched in 2016 and are being gradually built up and custom information technology development has been further de-incentivised. The new logistics delivery model was rolled-out to all directorates-general in April 2017. 18 proximity teams, managed by the Office for Infrastructure and Logistics in Brussels and delivering logistics services to all Commission buildings (except for the Berlaymont building) were created in April 2017. The Directorate-General for Interpretation launched the steering board on events and meeting room management in September 2016. In 2017, the Directorate-General for Interpretation signed an inter-institutional framework contract on purchase, rent and maintenance of audio-visual equipment and services. In 2018 it finalised, with the cooperation of the Office for Infrastructure and Logistics in Brussels, the inventory of all meetings rooms in the Commission and presented its roll-out model for meeting room management to the Corporate Management Board in November 2018. Regarding conference organisation, the Directorate-General for Interpretation set up an event register at Commission level in January 2017 and launched the Conference Correspondents network, which acts as a forum for information, discussion and dissemination of best practice for the professionalization of the community. The call for tendering a framework contract on Event Management Services was published in December 2018 (its signature is expected for 2019). The Internal Audit Service identified two issues on improving monitoring arrangements and reliability of savings estimates and on embedding the Synergies and Efficiencies Review culture Commission-wide and issued the following two very important recommendations: Improving monitoring arrangements and reliability of savings estimates At the corporate level, the central services should define clear criteria for determining ‘savings’ and monitor closely the progress made towards achieving the target. Any significant change to the target should be presented quickly to the Corporate Management Board. Reported savings should be accompanied by the baseline figures and the date at which these were established. In addition, for certain domains for which the expected savings are highest, notably human resources and information and communications technology, the responsible domain leaders need respectively to demonstrate more clearly how those savings will be made to fill the gap between originally estimated targets in the synergies and efficiencies review and current revised ones.

Monitoring mechanisms should be put in place to ensure that the ‘saved’ resources are actually saved in practice, as resources which are declared as saved, but simply used in the same role outside the control of the domain leader concerned, are not really saved at all. The mechanisms for collecting posts and using research/operational budget lines should be clarified. Domain leaders should be invited to provide information on other (quantifiable) savings or (qualitative) benefits expected to be made when implementing the projects. Embedding the Synergies and Efficiencies Review culture Commission-wide a) Improving communication The Directorate-General for Human Resources and Security, with the support of the domain leaders, should develop a communication campaign to explain the synergies and efficiencies review objectives, the domain leadership culture and potential added-value for the Commission as a whole. The Directorates-General for Human Resources and Security and for Budget should communicate the link between the resources directorates-general contribute as part of the synergies and efficiencies review and the resources they receive for their own priorities. Furthermore, they should communicate the incentives that new/alternative ways of working can bring over and above the formal staff allocation process. Domain leaders should continue the feedback exercise, which can feed into the appraisal exercise. b) Providing assurances on quality of service/client satisfaction The domain leaders should set up appropriate quality mechanisms to demonstrate the level of quality of their services to the client directorates-general (which should include publication of service catalogues, agreeing on the minimum service levels, effective monitoring based on SMART key performance indicators, feedback and provision for corrective/remedial actions) and take remedial actions when necessary. Additional information provided by Directorates-General BUDG, COMM, DIGIT, HR, JRC OIB SCIC and SG on the measures defined and/or implemented following the Internal Audit Service audit Building on the audit and on request of the Corporate Management Board, the Directorate-General for Human Resources and Security and the Secretariat-General – with contributions from all other Domain Leaders and the Directorate-General for Budget – drafted a new Communication on ‘Synergies and Efficiencies initiative: stocktaking and way forward’, which was adopted on 26 March 2019. The Communication takes stock of what has been achieved so far in the synergies and efficiencies initiative, assesses the challenges encountered and proposes a way forward to further modernise the Commission’s organisational performance. In April 2019, the Internal Audit Service considered that the action plan implementing the three audit recommendations – coordinated by the Directorate-General for Human Resources and Security, with contributions from the Secretariat-General, the Directorate-General for Budget and the other Domain Leaders, was satisfactory to mitigate the identified risks. The Directorate-General for Human Resources and Security is coordinating, in close cooperation with the Secretariat-General and the Directorate-General for Budget, the implementation of the actions defined in the above mentioned Communication and action plan. A number of actions have already been implemented. The phased savings and investments per domain, per directorate-general and per year, following consultations with the directorates-general, have been agreed by the Corporate Management Board. Arrangements are being put in place – in close cooperation with the other concerned services – for objectives, key performance indicators and savings implementation. A user-centric communication campaign around all modernisation measures flowing from synergies and efficiencies is now in development.



The Secretariat-General is working with the Directorates-General for Human Resources and Security and with the Directorate-General for Budget to define the mechanism for and scope of the annual monitoring and reporting to the Corporate Management Board and the Group of Resource Directors on overall project progress. The Directorate-General for Communication is involved in the use of the new ATLAS tool to help services across the Commission identify jobs or activities that belong to the external communication domain. Further, the Directorate-General for Communication is also working on internal communication aspects of the initiative, both as contributor to the central campaign led by the Directorate-General for Human Resources and Security and within the communication domain itself, with the development of a new information portal to present its corporate services (ongoing). The Directorate-General for Informatics provided inputs for the action plan, mostly as a contributor under the lead of the Directorate-General for Human Resources and security, or for a few points as a leader for the information technology domain. Some actions, included in the Synergies and Efficiencies Review Communication and falling in the remit of the Directorate-General for Informatics, are already advanced (local date centre consolidation, e-procurement, building blocks), reducing the risks accordingly. Although the audit on ‘synergies and efficiencies review’ did not address the Joint Research Centre in its findings or recommendations, it was included in this review because it manages eProcurement, which is part of the Commission’s synergies and efficiencies’ processes. In the Office for Infrastructure and Logistics in Brussels, the audit scope was limited to the centralisation of local proximity teams. The audit on 'synergies and efficiencies review' did not address the Joint Research Centre in its findings or recommendations. The Joint Research Centre was included in this review because it manages eProcurement which is part of the Commission's synergies and efficiencies' processes. In the Directorate-General for Interpretation, there is a steering board on events and meeting room management since September 2016. In 2018 it finalised, with the cooperation of the Office for Infrastructure and Logistics in Brussels, the inventory of all meetings rooms in the Commission and presented its roll-out model for meeting room management to the Corporate Management Board in November 2018. The Directorate-General for Interpretation has renovated to-date over 50 meeting rooms in the Commission. The internal web-streaming capacity to provide life transmission from important events such as the State of the Union Speech has been significantly strengthened. Regarding conference organisation in the Directorate-General for Interpretation, an event register at Commission level is available since January 2017, which gives an overview of the conferences organised by the Commission services throughout the year as well as the volume of budgets involved. The Conference Correspondents network acts as a forum for information, discussion and dissemination of best practice for the professionalisation of the community. As part of its efforts to professionalise the conference organisers’ community in the Commission, the Directorate-General for Interpretation made available a range of web-based tools on conference organisation. An online participants’ registration software was developed for the corporate use. The call for tendering a framework contract on Event Management Services was published in December 2018 (its signature is expected for 2019). The Directorate-General for Interpretation, in collaboration with the Directorate-General for Human Resources and Security and the other domain leaders will continue actively working to implement the actions under its responsibility.



6.Audit on dissemination and exploitation of Horizon 2020 results in

DGs CNECT, RTD and CSC, REA and ERCEA The objective of the audit was to assess the design of the dissemination and exploitation framework by the Common Support Centre and its effective implementation by a sample of Horizon 2020 implementing bodies ( ). There are no observations/reservations in the 2017 annual activity reports of the directorates-general in the audit scope that relate to the area/process audited. The fieldwork was finalised on 7 December 2018. All recommendations relate to the situation as of that date.

The audit highlighted the following strengths: ·the processes for the evaluation of proposals and the monitoring of the dissemination and exploitation aspects in Horizon 2020 projects are supported by common information-technology tools designed by the Common Support Centre; ·the Common Support Centre set up the dissemination and exploitation practitioner’s platform for the first dissemination and exploitation strategy (2015-2017) to collect dissemination and exploitation specific guidance and good practices and the Dissemination and Exploitation Net to coordinate and execute the revised dissemination and exploitation strategy (2018-2020) and its action plan; ·central reporting on the mandatory key performance indicators for dissemination and exploitation via the Horizon 2020 dashboard. The Internal Audit Service identified one issue on monitoring compliance with the dissemination and exploitation contractual obligations and reporting requirements and formulated the following very important recommendation: The Common Support Centre should: ·enhance and adopt the vademecum on data and results for the dissemination and exploitation activities during and after project implementation; §collaborate with the Horizon 2020 implementing bodies to raise awareness amongst the project officers (POs) on their responsibility to monitor the dissemination and exploitation obligations and reporting requirements; §define an approach to follow-up the exploitation activities after the end of the project and include measures to encourage the beneficiaries to continue reporting on peer-reviewed publications and patents to the Commission after the end of the projects; ·clarify the possible actions available for breaches of dissemination and exploitation contractual obligations, including practical examples of those that could justify the use of one of the dissuasive measures (e.g. grant reduction). Additional information provided by Directorate-General of RTD on the measures defined and/or implemented following the Internal Audit Service audit The action plan has been submitted to the Internal Audit Service. The section of the Horizon 2020 Vademecum on Dissemination and Exploitation will be updated, together with the ‘Research and Innovation family’, to reflect the recommendations of the Internal Audit Service audit report. The guidance documents will also be updated

to reflect the updated section of the vademecum. An approach for following up the exploitation activities after the end of the project will be defined and included in the updated vademecum and guidance documents. Dedicated communication will be conducted for the project officers, clarifying the legal consequences and possible actions concerning the breaches of ‘Dissemination and Exploitation’ contractual obligations. The communication will describe the approach for following up exploitation activities after the end of the project and will refer to the updated vademecum and the guidance documents. Beneficiaries are legally obliged to report on their publications and patents. The Common Implementation Centre will do targeted communication to beneficiaries for promoting the use of the continuous reporting after the end of their projects and remind them on the residual obligations of their grant agreement as described in the online Horizon 2020 manual. The services will be supported by the updated sections of the Horizon 2020 vademecum on ‘Dissemination and Exploitation’ and the open access/visibility of EU funding. The obligations for open access, EU funding visibility, etc. will also be emphasised in the training and communication on ‘Dissemination and Exploitation’. 7.Consolidated report on Horizon 2020 project management and ex ante control audits in DGs RTD, DG CNECT, REA, ERCEA, INEA and EASME The objective of the series of audits on Horizon 2020 project management and ex ante controls was to assess whether the Commission (i.e. the Common Support Centre and the selected Horizon 2020 implementing bodies) has designed and implemented (i) an effective project management process (ensuring that projects are effectively implemented by the beneficiaries in line with the grant agreement) and (ii) effective ex ante controls on Horizon 2020 grant payments (contributing to the assurance concerning the legality, regularity and sound financial management of expenditure). The Internal Audit Service auditors identified the following good practices and strengths, some of which could serve as a basis for strengthening the grant management and ex ante controls processes across the Horizon 2020 implementing bodies: ·Common Support Centre: the Common Support Centre has provided central information-technology systems to support various processes, including project monitoring, ex ante controls and amendments for the whole research family. This facilitates the exchange of key documents (e.g. deliverables, periodic reports, amendment requests) between the Commission and the grant beneficiaries and the tracking of deadlines, which contributes to the overall efficiency of the process;

·Directorate-General for Communications Networks, Content and Technology, Executive Agency for Small and Medium-sized Enterprises: the responsible officers record in the common information technology system COMPASS detailed comments, justifications and additional checks related to the approval process for project amendments; ·Directorate-General for Communications Networks, Content and Technology, Research Executive Agency: the Directorate-General for Communications Networks, Content and Technology and the Research Executive Agency have established internal networks of project officers to ensure a coherent approach and overall coordination of the grant management process. In addition, the Directorate-General for Communications Networks, Content and Technology has appointed a single point of contact to actively collect good practices and know-how from the project officers and also to discuss with the Common Support Centre issues relating in particular to guidance and IT functionalities; ·Innovation and Networks Executive Agency: The Innovation and Networks Executive Agency has developed a Risk Assessment Document to support the project management process. It is filled in for each project following the grant agreement preparation phase. It includes a description of several risk factors (e.g. the number of partners, different funding ratios used). Based on this document, the Innovation and Networks Executive Agency decides on the type and intensity of monitoring activities proportionate to the project risk level/complexity. The document is updated at key milestones (e.g. end of the reporting periods, at handovers to other project officers). This enables the Agency to revise the initial risk level of the project and to adapt the monitoring strategy for the project accordingly. The Internal Audit Service did not formulate any critical or very important recommendations. 8.Audit on Connecting Europe Facility telecom governance in DGs CNECT, DGT, DIGIT, EMPL, GROW, JUST and SANTE The objective of the audit was to assess the adequacy of the design and the effectiveness of the implementation of the Commission's Connecting Europe Facility telecom governance arrangements within the Commission. There are no observations/reservations in the 2017 annual activity reports of the directorates-general in the audit scope that relate to the area/process audited. The fieldwork was finalised on 20 December 2018. All recommendations relate to the situation as of that date. The audit highlighted the following strengths: ·with an unchanged level of resources, and in an increasingly complex context given the growing number of Digital Service Infrastructures and implementing directorates-general, Unit CNECT.D1 has satisfactorily managed the annual Work Programmes preparation process; ·the governance arrangements between the Directorate-General for Communications Networks, Content and Technology and the Innovation and Networks Executive Agency, mandated with the implementation of Connecting Europe Facility telecom grants, are well established. The current written agreements between both provide a sound framework for the supervision of the Innovation and Networks Executive Agency by the Directorate-General for Communications Networks, Content and Technology; ·in 2015, the Directorate-General for Communications Networks, Content and Technology commissioned a study that provided an extensive and comprehensive analysis of the long-term sustainability of the Digital Service Infrastructures (which is an important element in the Connecting Europe Facility regulation); ·in 2017, the Connecting Europe Facility telecom communication strategy was harmonised at programme level, defining a communication action plan with targets and milestones. The Internal Audit Service identified one issue concerning the Connecting Europe Facility telecom performance framework and formulated the following very important recommendation: The Directorate-General for Communications Networks, Content and Technology, in cooperation with the other directorates-general implementing the Connecting Europe Facility telecom programme, should improve the current performance framework of the programme and duly monitor its progress and the results. In addition, the Directorate-General for Communications Networks, Content and Technology should exercise an oversight role and coordinate with the other Connecting Europe Facility telecom implementing directorates-general, so that each Digital Service Infrastructures has (as much as possible) SMART () objectives and associated RACER () indicators for results as well as for annual outcomes. Additional information provided by Directorate-General CNECT on the measures defined and/or implemented following the Internal Audit Service audit To address the recommendations, the Directorate-General for Communications Networks, Content and Technology together with the Directorate-General for Justice and Consumers, the Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs, the Directorate-General for Health and Food Safety, the

Directorate-General for Employment, Social Affairs and Inclusion, the Directorate-General for Informatics and the Directorate-General for Translation, envisages several actions including for example the preparation of a monitoring guidebook aimed to revise and improve the overall performance framework both at topic and programme level, the strengthening of the current internal governance arrangements by clarifying the distribution of roles and responsibilities between the different actors and existing structures, and implementation of a financial monitoring tool of the budget flexibility. The Directorate-General for Communications Networks, Content and Technology plans to implement all the actions needed for the implementation of all recommendations of the Connecting Europe Facility audit by Q4 2020. The Directorate-General for Employment, Social Affairs and Inclusion updated the mission statement and Unit Management Plan of Unit EMPL.F.5 and published it on the intranet; the job description of the Head of Unit EMPL.F.5 has also been updated. Finally, the Directorate-General for Employment, Social Affairs and Inclusion is in the process of defining Key Performance Indicators and related targets concerning Electronic Exchange of Social Security Information part funded by Connecting Europe Facility Telecom. The Memorandum of Understanding with the Directorate-General for Communications Networks, Content and Technology is under finalisation. 9.Audit on the effectiveness and efficiency of the new Early Detection and Exclusion System in protecting the EU financial interests in DGs BUDG, DEVCO, REGIO and RTD The objective of the audit was to assess whether the Commission has designed and implemented an effective and efficient control system for the management of the Early Detection and Exclusion System (EDES) aimed at protecting the EU budget, in line with the legal provisions.

There are no observations/reservations in the 2017 annual activity report of the Directorates-General for Budget, for International Cooperation and Development, for Regional and Urban Policy and for Research and Innovation and that relate to the area/process audited. The fieldwork was finalised on 10 October 2018. All recommendations relate to the situation as of that date. The audit highlighted the following strengths: ·using good practice from the World Bank suspension and debarment system: before designing and implementing the Early Detection and Exclusion System for the European Institutions, the Directorate-General for Budget performed an analysis of the suspension and debarment system in place at the World Bank Group. This enabled the Directorate-General for Budget to factor in the lessons learnt when setting up the Early Detection and Exclusion System. The system’s Panel is, to a certain extent, similar to the Office of Suspension and Debarment within the World Bank Group. Both bodies assess the evidence underpinning specific cases and issue recommendations concerning the sanctioning of the economic operator breaching the rules; ·composition of the Early Detection and Exclusion System Panel: a key component of the system is its Panel (), which is composed of an independent Chair, a Vice-Chair, two permanent members who are senior Commission officials, and the Authorising Officer responsible (AOR) representing the directorate-general bringing the case to the Panel. Subject to the approval of the Chair, observers may be present as well. The Commission was able to attract high-level individuals as Chair and Vice-Chair. Together with the internal standing members, this ensures that the Panel has the necessary expertise and experience to carry out its tasks effectively; ·integration of automatic Early Detection and Exclusion System checks into the Directorate-General for Research and Innovation IT system for grant management: the Directorate-General for Research and Innovation has integrated controls into the electronic workflow and grant management system COMPASS/SYGMA to check whether an economic operator receiving funds from Horizon 2020 programmes is registered for early detection or exclusion in the Early Detection and Exclusion System. The Directorate-General for Research and Innovation system automatically consults the Early Detection and Exclusion System database at several stages of the grant management process and therefore helps to provide an efficient and effective control during the workflow, mitigating the risk that an economic operator that represents a threat to the EU Budget may receive financial support from EU programmes. The Internal Audit Service identified two issues concerning guidelines and awareness raising and concerning applying EDES in practice and formulated the following very important recommendations: The absence of corporate guidelines and lack of awareness at operational level At the corporate level, the Directorate-General for Budget should issue corporate guidelines, in addition to running training sessions, for the Early Detection and Exclusion System process to ensure a more harmonised process and to ensure that it is used as widely and frequently as possible across the Commission. These guidelines and training sessions should be regularly revised to reflect the development of the process. The guidance and awareness raising should also focus on the particularities of the Early Detection and Exclusion System process in indirect and shared management, both from the Commission’s and external stakeholders’ point of view. At the local level, operational directorates-general should continue their effort to raise awareness about the Early Detection and Exclusion System process in general, including the specific requirements that apply to indirect and shared management, and remind staff of their obligation to use it. Furthermore, directorates-general should integrate Early Detection and Exclusion System related activities (such as awareness raising and training) into their Anti-Fraud Strategy. The application of EDES in practice The directorates-general should consider including steps in their internal control systems to cover the Early Detection and Exclusion System registration procedure (both exclusion and early detection). The directorates-general should finalise on a timely basis the assessment of their pending European Anti-Fraud Office cases and decide on the need to launch an Early Detection and Exclusion System exclusion procedure. In turn, the Directorate-General for Budget should, in cooperation with other central services (the Legal Service, the Secretariat-General and the European Anti-Fraud Office), actively monitor that directorates-general perform an adequate follow-up of the European Anti-Fraud Office cases and, where necessary, remind directorates-general of their responsibility to take prompt action. To assess the benefit of consulting the Irregularities Management System (IMS), the Directorate-General for Budget should clarify, following consultation with concerned directorates-general, the practical design of the checks in the Irregularities Management System and how and to what extent they should be performed, bearing in mind the cost-effectiveness and efficiency of using the information contained in the Irregularities Management System. The Directorate-General for Budget, together with the European Structural and Investment Funds directorates-general, should assess the cost and benefits of opening up ARACHNE for use in direct management and of implementing an exchange of information from the Early Detection and Exclusion System to ARACHNE on the publicly listed excluded entities. Finally, the Directorate-General for Budget should analyse the access logs of the Early Detection and Exclusion System database of the Member States’ authorities and share the results with the directorates-general in shared management in order to better target awareness raising efforts. Additional information provided by Directorates-General BUDG, DEVCO, REGIO and RTD on the measures defined and/or implemented following the Internal Audit Service audit The final audit report was published on 25 January 2019. In February 2019, the Directorate-General for Budget has agreed with the Internal Audit Service an action plan to implement the related recommendations. In particular, the Directorate-General for Budget has finalised the corporate guide based on the Early Detection and Exclusion System and updated it to the new Financial Regulation. A Communication Plan endorsed by the Corporate Management Board in March 2019 is implemented by the Directorate-General for Budget in order to increase awareness. Moreover, the possible use of ARACHNE will be considered but is conditioned by a cost/benefit analysis, the availability of related budget appropriations, and the need to

respect fundamental rights. Increasing cooperation with the European Anti-Fraud Office is under way at directors’ level and the follow-up of its reports is already addressed at the Corporate Management Board level, while particular attention is devoted to the follow-up of the Office’s financial recommendations. Finally, the length of the Panel procedure is monitored under its new Rules of Procedure. The Directorate-General for International Cooperation and Development services proposed an action plan to address the recommendations, which has been accepted by the Internal Audit Service. To improve guidelines on the Early Detection and Exclusion System, the Directorate-General for International Cooperation and Development Companion has updated chapter 13 on 28 May 2019 and will include guidance on the requirements of the system in indirect management in the future manual for the Contribution Agreement by the end of 2019. The Directorate-General for International Cooperation and Development will develop an awareness raising campaign in coordination with the Directorate-General for Budget, revise its existing training materials which provide information on the Early Detection and Exclusion System and conduct trainings for relevant staff. The Directorate-General for International Cooperation and Development will update its Anti-Fraud Strategy on the basis of the Commission’s Anti-Fraud Strategy revision in 2019. In parallel with the strategy revision, the Directorate-General for International Cooperation and Development will update its internal procedures related to fraud and relations with the European Anti-Fraud Office. The Directorate-General for International Cooperation and Development will also review its internal control systems and include steps to cover the Early Detection and Exclusion System registration procedure (covering both, exclusion and early detection). The recommendation has been accepted by the Directorate-General for Regional and Urban Policy and consequently an action plan has been submitted in February 2019 to the Internal Audit Service, without prejudice to the fact that in shared management transmission of information by Member States would require sector-specific rules. The Internal Audit Service has concluded that the action plan of the Directorate-General for Regional and Urban Policy is deemed to be satisfactory to mitigate the risks identified. Concerning the Directorate-General for Research and Innovation, the final audit report was issued on 25 January 2019. The action plan has been prepared and takes into account all the points of the recommendations. 10. Audit on Intellectual Property Rights supporting activities in DGs COMM, DIGIT, GROW, JRC and OP

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the governance, risk management and control processes put in place by the Commission to manage intellectual property rights (IPR). There are no observations/reservations in the 2017 annual activity reports of the audited directorates-general that relate to the area/process audited. The fieldwork was finalised in November 2018. All recommendations relate to the situation as of that date. The audit highlighted the following strengths: ·the Central IP Service of the Commission (created in Joint Research Centre) is staffed with a competent team composed of specialists in the field of Intellectual Property Rights; ·the enhanced coordination between certain IP-intensive directorates-general (such as the Directorate-General for Communication and the Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs) with the Central IP Service; ·the creation of an informative and updated webpage on the intranet site of the Commission (My Intracomm) where staff members of the Commission can obtain relevant information related to IP management; ·the Central IP Service offers numerous Intellectual Property Rights related training courses, which are open to all staff of the Commission. The courses are provided by specialised personnel and focus on specific issues such as procurement or social media. The Internal Audit Service identified two issues concerning corporate IPR management at the Commission and the corporate software policy and formulated the following very important recommendations: Corporate IPR management at the Commission Joint Research Centre should: a) finalise the development of the dynamic IP inventory (to ensure that all the Commission directorates-general are able to continuously identify, classify and monitor Intellectual Property Rights protected intangible assets), b) follow-up with directorates-general and services on their obligation to identify and communicate the IP assets acquired/developed and c) develop clear guidelines to include initial assessment criteria to enable a consistent evaluation of IP assets to be made by the Central IP Service and the Intellectual Property Rights Correspondents. Moreover, the Joint Research Centre should develop corporate risk management guidance for Intellectual Property Rights protected assets and ensure its dissemination and application by the Intellectual Property Rights Correspondents of the various directorates-general/services. Finally, in the process of updating Communication SEC(2001)1397 ( ), Joint Research Centre should discuss with the Secretariat-General and the Legal Service the cost-effectiveness of the existing decision making process when licensing or registering IP assets with a view to simplifying it. The IP delegation should be amended based on the outcome of this discussion. Software and IT solutions The Directorate-General for Informatics should update the ‘General Terms and Conditions for Information Technology Contracts’. In addition, The Directorate-General for Informatics and the Joint Research Centre should jointly develop a software policy for the Commission to regulate the dissemination of software owned by the Commission. Additional information provided by Directorates-General DIGIT and JRC on the measures defined and/or implemented following the Internal Audit Service audit On the intellectual property rights management, the Internal Audit Service recommended to the Joint Research Centre the completion of a dynamic Intellectual Property inventory which now stands at more than 50% completion (EURECA). The existing vademecum on intellectual property rights provides a scheme for intellectual property rights management, it will be replaced by a more dynamic tool, to incorporate various aspects of intellectual property rights assets. The Internal Audit Service also requested that the Joint Research Centre seek simplification of the decision-making process when licencing out or registering the intellectual property rights assets; during 2018 the Joint Research Centre already initiated the appropriate discussions with other directorates-general in this respect. On the intellectual property rights software and information technology solutions, the Joint Research Centre together with the Directorate-General for Informatics will elaborate appropriate guidelines for establishing a Commission policy for regulating the dissemination of EU-owned software. A complete action plan has been submitted and accepted by the Audit Service. As the Directorate-General for Informatics actions are closely related, the action plan submitted to the Internal Audit Service takes full account of the actions and implementation dates foreseen by the Joint Research Centre. As the first steps of implementation being planned for mid/end 2019, related risks are thus expected to decrease accordingly.



Agriculture, natural resources and health 1.Limited review of the adjustment of the reported error rate by DG AGRI and the calculation of the amounts at risk at payment

The objective of this limited review was to assess the adjustment made by the Directorate-General for Agriculture and Rural Development to the error rates reported by Member States, the calculation of the amounts at risk at payment and the adequacy of the directorates-general own guidance. In his 2016 annual activity report, the Director General of the Directorate-General for Agriculture and Rural Development qualified his declaration of assurance on the use of resources (implementation of the Common Agricultural Policy expenditure) by formulating three reservations: (1) for expenditure related to Market Measures, (2) for Direct Payments and (3) for Rural Development. The fieldwork was finalised on 2 February 2018. All recommendations relate to the situation as of that date. The audit highlighted the following strengths: ·following previous recommendations from the Internal Audit Service ( ), the Directorate-General for Agriculture and Rural Development developed methodological guidance for adjusting the error rates in line with the requirements of the central services. The Internal Audit Service also acknowledges that starting with financial year 2016, the majority ( ) of the control statistics/data are exclusively transmitted by the Member States to the Directorate-General for Agriculture and Rural Development via ‘Statel/eDamis’ ( ). This has improved the Directorate-General’s efficiency in analysing and treating the data; ·the Internal Audit Service notes that the Certification Bodies reports on year N become available only as of mid-February of year N+1 and their assessment is finalised in late March, while the annual activity report has to be finalised by 25 April ( ). Given these time constraints, the Internal Audit Service recognises the efforts and commitment shown by the Directorate-General for Agriculture and Rural Development staff to assess all the information available which might require adjustments to be made to the error rates; ·the Directorate-General for Agriculture and Rural Development has well-established planning and coordination arrangements in place to support the adjustment process. For the 2016 annual activity report exercise, directorate AGRI-H ‘Assurance and Audit’ (H.1) set out internal milestones for the different steps and deliverables, which helped to ensure the timely completion of both the error rate adjustment process and the drafting of the relevant parts of the annual activity report. The Internal Audit Service also acknowledges that the operational units were actively involved in this process and, where relevant, contributed to the assessment by providing updates on the latest state of play as regards Partnership Agreements (PAs) action plans; ·a good practice was noted as regards the comprehensive way Unit AGRI.H.4 ‘Assurance and audit - Rural Development’ documented its assessment of the applied adjustments. The Internal Audit Service did not formulate any critical or very important recommendations. 2.Audit on the implementation of payments and corrections in DG AGRI (shared management) The objective of the audit was to assess whether the Directorate-General for Agriculture and Rural Development internal controls and procedures are effective in ensuring the correct execution of European Agricultural and Guarantee Fund (EAGF) payments to Member States, notably in respect of applicable regulatory ceilings and payments deadlines and the correct implementation of reductions and suspensions and financial corrections, including instalments and deferrals. The fieldwork was finalised on 24 October 2018. All recommendations relate to the situation as of that date. The Internal Audit Service recognises the Directorate-General for Agriculture and Rural Development efforts to design, set up and operate a comprehensive system to control and manage the implementation of European Agricultural and Guarantee Fund payments and corrections, in particular in view of the complex legal framework governing this element of the Common Agricultural Policy. The auditors also acknowledge the efforts of the directorate-general to maintain relevant job descriptions and up-to-date back-up arrangements. The Internal Audit Service did not formulate any critical or very important recommendations. 3.Audit on the management of Instrument of Pre-Accession for Rural Development II in DG AGRI The objective of this audit was to assess whether the Directorate-General for Agriculture and Rural Development has put in place efficient and effective governance, risk management and internal control processes for implementing the Instrument of Pre-Accession for Rural Development II budget. The aim of these controls is to ensure that financial assistance to beneficiary countries is implemented on time, in a legal and regular way and delivers on the objectives stipulated in the programmes and in the Instrument of Pre-Accession for Rural Development II legal bases. No reservations regarding the management of Pre-Accession for Rural Development II were made in the 2017 annual activity report of the Directorate-General for Agriculture and Rural Development. The fieldwork was finalised on 23 November 2018. All recommendations relate to the situation as of that date. The auditors found that the Directorate-General for Agriculture and Rural Development has established knowledgeable and committed teams to work on Pre-Accession for Rural Development II in both the operational unit (pre-accession assistance unit) and in the pre-accession team (assurance and financial audit unit). The Internal Audit Service did not formulate any critical or very important recommendations. 4.Audit on the evaluation process in DG AGRI

The objective of the engagement was to assess the design and implementation of the controls put in place by the Directorate-General for Agriculture and Rural Development to ensure an effective management of the evaluation process. The Internal Audit Service noted that the controls put in place by the Directorate-General for Agriculture and Rural Development for the evaluation process were effectively designed and implemented at the time of the audit. The Internal Audit Service did not formulate any critical or very important recommendations. Given the positive outcome of the audit, no formal audit report, as envisaged in the Mutual Expectations Paper, was issued, but the results of the audit were communicated to the auditee in a closing note. 5.Audit on closure of the 2007-2013 European Fisheries Fund Operational Programmes in DG MARE The objective of the audit was to assess the design and implementation of the controls put in place by the Directorate-General for Maritime Affairs and Fisheries to ensure the effective closure of the 2007-2013 European Fisheries Fund Operational Programmes. The Internal Audit Service noted that the Directorate-General for Maritime Affairs and Fisheries’ strategy for the closure of the 2007-2013 European Fisheries Fund Operational Programmes was effectively designed and implemented. The Internal Audit Service did not formulate any critical or very important recommendations. Given the positive outcome of the audit, no formal audit report, as envisaged in the Mutual Expectations Paper, was issued but the results of the audit were communicated to the auditee in a closing note. 6.Audit on TRACES in DG SANTE The objective of the audit was to assess whether the TRAde Control and Expert System (TRACES) is adequately managed to provide and maintain over time, a reliable and efficient service supporting official controls and trade operations. There were no observations/reservations in the 2017 annual activity report of the Directorate-General for Health and Food Safety that relate to the area audited. The fieldwork was finalised at the beginning of January 2018. All recommendations relate to the situation as of that date. The auditors recognise the ongoing efforts made by the Directorate-General for Health and Food Safety to provide through TRACES a reliable and efficient service to support official controls and trade operations. In particular, the audit highlighted the following strengths: ·the information technology activities in the Directorate-General for Health and Food Safety are supported by a quality assurance and security team staffed by experts in the field, responsible for security assurance and performance test activities of new versions of software, risk assessments and security plans of IT systems. The team was reinforced with a team leader in September 2017; ·the Directorate-General for Health and Food Safety has launched the digitisation of the certificates workflow in the border clearance process for TRACES. The objective is for the digital document to become the original document and for there to be full paperless workflow. This Directorate-General has started pilot projects with non-EU countries for the use of an electronic signature in TRACES; ·the development team for TRACES projects works under Agile@EC, a set of project methods for incremental and iterative software development, adapted for business environments with changing priorities. For each development iteration since March 2016, Directorate-General for Health and Food Safety has produced a progress report before and after each software integration. It also formalised an iteration plan in March 2017, which describes how to plan, manage and execute TRACES iterative developments; ·the team of Directorate-General for Health and Food Safety working on TRACES comprises competent and committed colleagues with experience of managing situations of extreme pressure and which require extensive coordination with other stakeholders. The Internal Audit Service identified two issues concerning IT governance and TRACES security and formulated the following very important recommendations: IT governance To strengthen the information-technology governance structure, the Directorate-General for Health and Food Safety should: ·for each area of responsibility of the Directorate-General for Health and Food Safety - the ‘Health’ and the ‘Food safety’ pillars - organise regular meetings chaired by the respective competent Deputy Director-General or the Director-General on the definition, execution and prioritisation of information-technology activities; ·set up an ‘information system steering committee (TRACES steering committee)’ chaired by the Directorate-General for Health and Food Safety and involving all directorates-general using TRACES, as well as ‘information-technology project steering committees’ for each of the various TRACES projects per business domain;

·update and align the working arrangements with the participating directorates-general in TRACES and, in conjunction with these directorates-general, consider developing a model for TRACES cost sharing ·together with the participating directorates-general, the Directorate-General for Health and Food Safety should ensure that GovIS2 accurately reflects the ownership, modules, operations, projects and budget related to TRACES. TRACES security In order to strengthen TRACES security, the Directorate-General for Health and Food Safety should: ·perform an information security risk assessment and, in the event of high security risks, implement cost-effective mitigating measures; ·assess the feasibility of secure hosting for TRACES; ·improve controls related to the confidentiality and integrity of the information, such as access control and authentication, data masking and manual changes in the production environment; ·finalise and implement those procedures required to conform with the Commission’s security standards, notably in relation to the information-technology security plan, to the development of a policy for logging and monitoring for TRACES based on business needs, as well as to vulnerability assessment and performance testing; ·ensure that the Local Information Security Officer reports periodically on information-technology security matters to the Directorate-General for Health and Food Safety’s senior management and that he is involved on TRACES information-technology security-related advisory and monitoring activities. Additional information provided by Directorate-General SANTE on the measures defined and/or implemented following the Internal Audit Service audit The Directorate-General for Health and Food Safety accepted all recommendations and produced an action plan. Several actions are already on-going with deadlines in late 2019 or 2020 (). Concerning recommendation 1 on information technology governance, the Directorate-General for Health and Food Safety started implementing this recommendation on TRAde Control and Expert System governance; work is on-going as regards TRAde Control and Expert System steering committee and project steering committees. In addition, as regards food and feed safety, the Directorate-General for Health and Food Safety has set up a Working Group with the Member States to work on an implementing act on the functioning of the information management system for official controls (); this Working Group is actually the primary governance body for the certification implementation in TRAde Control and Expert System. With regard to information technology governance in general, the Directorate-General for Health and Food Safety’s policy pillar meetings, chaired by the Director-General, started to include more general and specific steer on information technology matters.

The Directorate-General for Health and Food Safety has taken actions without delay also on recommendation 2 on information technology security: the weaknesses identified by the Internal Audit Service are addressed mainly by developing an ‘Access Control and Authentication Management Plan’ and a ‘logging and monitoring policy document’; it is also reinforcing its code review procedure and seeing to the full implementation of the existing information technology security plan. The procedure of vulnerability assessment and performance testing, as applied since a few years, was formalised in late 2018. 7.Audit on monitoring and enforcement of EU health law in DG SANTE The objective of the audit was to assess whether the Directorate-General for Health and Food Safety has put in place internal control systems that ensure the effective and efficient monitoring and enforcement of EU health law. There are no reservations in the 2017 annual activity report of this Directorate-General that relate to the area/process audited. The fieldwork was finalised on 2 October 2018. All recommendations relate to the situation as of that date. The auditors recognise the ongoing efforts made by this Directorate-General regarding the enforcement of EU health law and identified the following strength in particular: The Directorate-General for Health and Food Safety performs a six-monthly internal ‘coherence’ exercise. This consists of an internal review covering infringements registered in NIF ( ), EU Pilot cases and complaints registered in CHAP ( ). This exercise is used to prepare its six-monthly prioritisation of the cases and facilitates supervision by senior management as well as political oversight on alleged breaches of EU law. The Internal Audit Service did not formulate any critical or very important recommendations.

Cohesion

1.Audit on the evaluation process in DG EMPL and DG REGIO The objective of the audit was to assess if Directorates-General for Employment, Social Affairs and Inclusion and for Regional and Urban Policy effectively plan, design, conduct, report and follow-up on evaluations in accordance with the legal framework and Better Regulation requirements, and if they provide adequate methodological support to the evaluation activities by the Member States and make proper use of their results. There are no observations/reservations in the 2017 annual activity reports of Directorates-General for Employment, Social Affairs and Inclusion and for Regional and Urban Policy that relate to the area/process audited. The fieldwork was finalised on 4 July 2018. All recommendations relate to the situation as of that date. The auditors recognised the ongoing efforts made by the Directorates-General for Employment, Social Affairs and Inclusion and for Regional and Urban Policy to continuously improve the evaluation process and strengthen the evaluation capacity in the Member States. More specifically, the audit highlighted the following strengths: ·the directorates-general provide regular methodological guidance and support to the Member States on monitoring and evaluation; ·in order to strengthen capacity building in the Member States, the directorates-general jointly set-up an Evaluation Helpdesk, which provides methodological support, training and advice to the Member States in the areas of monitoring and evaluation. In addition, it supports the directorates-general in summarising the findings of the evaluations carried out by the Member States, which underpin the their various reports (e.g. Summary Report, Strategic Report, Annual Activity Report, Annual Management and Performance Report, and Cohesion Report). Furthermore, it supports the directorates-general in performing an in-depth review of the Member States’ evaluation plans and carries out evaluation peer reviews; ·the directorates-general closely cooperate and coordinate their approaches regarding monitoring and evaluation systems (e.g. common guidance, consultation on each other’s evaluation strategies, joint analysis of the evaluation results for the multi-fund Operational Programmes, collaboration on the directorates-general ex post evaluations). ·the Directorate-General for Regional and Urban Policy has followed up on the ex post evaluation 2007-2013 by creating a comprehensive action plan including outstanding actions to be completed which was approved by the Board of Directors; ·the Joint Research Centre in collaboration with the directorates-general provides - through its Centre for Research and Impact Evaluations (CRIE) - methodological support to the Member States in carrying out counterfactual impact evaluations; ·communication of ex post evaluation results (e.g. dedicated communication package covering visual communication methods on ex post evaluation results, public consultation, evaluation conference); ·the directorates-general are strongly engaged with all stakeholders including beneficiaries and scientific experts. The Internal Audit Service did not formulate any critical or very important recommendations. 2.Review of the annual assurance packages by DGs EMPL, MARE and REGIO The objective of the audit was to assess whether the review of the annual assurance packages (APs) by Directorates-General for Employment, Social Affairs and Inclusion and, for Maritime Affairs and Fisheries and for Regional and Urban Policy is effective in supporting the declaration of assurance by the Directors-General in their annual activity reports and is performed in a timely manner. The Directorate-General for Regional and Urban Policy and the Directorate-General for Employment, Social Affairs and Inclusion and made the following reservations in their 2017 annual activity reports concerning the area/process under the scope of this audit engagement: The Directorate-General for Regional and Urban Policy: concerning deficiencies in the management and control systems for the 2014-2020 programming period (PP) in nine Member States and one European territorial cooperation programme; The Directorate-General for Employment, Social Affairs and Inclusion: concerning deficiencies in the management and control systems for the 2014-2020 programming period in six Member States. The Directorate-General for Maritime Affairs and Fisheries did not include any reservation in its 2017 annual activity report regarding the 2014-2020 programming period (PP) or the area/process audited. The fieldwork of this audit was finalised on 27 July 2018, except for the follow-up work on the compliance audit missions, which was finalised on 18 September 2018. All recommendations relate to the situation as of those dates. The Internal Audit Service acknowledges the efforts made by Directorates-General or Employment, Social Affairs and Inclusion, for Maritime Affairs and Fisheries and for Regional and Urban Policy to improve and further develop the process for the review of the assurance packages. The audit highlighted the following strengths: ·Reinforced accountability, control and assurance framework for the 2014-2020 programming period: the 2014-2020 programming period introduces the following major changes to the accountability provisions and the management and control systems (at Member State - Commission levels) compared to the previous programming period, which, from a design point of view, strengthen the accountability, control and assurance framework:

üa twelve-month (i.e. annual) accounting period running from 1 July to 30 June; üa retention of 10% from each EU interim payment to protect the EU budget from legality and regularity issues, with reimbursement/recovery of the annual balance only due following the acceptance of the accounts by the Commission; üThe Member States submitting to the Commission an annual assurance package containing five documents. Three of these documents are key elements for the Commission’s assurance building process: (1) certified accounts for expenditure declared to the Commission in relation to the accounting period, (2) an annual control report prepared by the Audit Authority which discloses a residual error rate after the Audit Authority’s verification of the financial corrections implemented by the Member States in the certified accounts, and (3) an audit opinion prepared by the authority on the accuracy of the accounts, the effective functioning of the system and the legality and regularity of the underlying transactions; üthe obligatory application of net financial corrections where the Commission or the European Court of Auditors detect irregularities demonstrating serious system deficiencies, unless the Member States already identified these irregularities in the assurance documents or other national audit reports submitted to the Commission or has taken remedial corrective measures by the time of detection by EU audits. ·Common/consistent approach for the review of the assurance packages: as stated in a previous Internal Audit Service audit report, the directorates-general have set up several mechanisms to improve consistency, increase synergies and use their available competences and expertise in an efficient manner. These mechanisms include, amongst others, the initiative of the Directorates-General for Employment, Social Affairs and Inclusion and for or Regional and Urban Policy to share and pool audit resources and activities for the 2014-2020 programming period and increased coordination between the three directorates-general through a network of auditors (i.e. ‘auditNET’). In particular, concerning the review of the directorates-general assurance packages, the three directorates-general have jointly developed: üIn May 2016, a common outline of the internal processes (including template letters and checklists) for the desk review of the assurance packages for the acceptance of accounts and the examination of legality and regularity aspects; üIn May 2017, a common methodology (i.e. Enquiry Planning Memorandum – EPM) for carrying out on the spot work on the assurance packages with two major risk based audit activities: (1) fact-finding missions and (2) compliance audits. While there are certain differences between the three directorates-general in the practical implementation of the desk review process of the assurance packages (e.g. timing of the review), they are taking a consistent overall approach for both control activities (i.e. desk review and on the spot audit work) that support their review of the assurance packages. ·Continuous support to the Audit Authorities as acknowledged by the Internal Audit Service in a previous audit report, the directorates-general have put in place mature arrangements with the Audit Authorities to help them be better prepared to exercise their reinforced role in the 2014-2020 programming period. These include two main mechanisms, namely: (1) guidance documents and (2) regular meetings including at least two technical group meetings per year, bilateral annual coordination meetings with the Audit Authority of each Member States and the annual ‘Homologues’ Group meeting. In the early stages of the 2014-2020 programming period, the directorates-general focussed their support to the Member States on setting up their management and control systems and the designation process, while now the focus has naturally shifted to supporting the Member States to prepare the assurance packages adequately. The Internal Audit Service did not formulate any critical or very important recommendations.



Research, energy and transport 1.Audit on ex ante controls on Horizon 2020 grant payments in DG CNECT The objective of the audit was to assess the effectiveness of the ex ante controls on Horizon 2020 grant payments in the Directorate-General for Communications Networks, Content and Technolo