EN 
  COMMISSION OF THE E UROPEAN COMMUNITIES 
Brussels, 5.8.2009 
SEC(2009) 1102 final 
COMMISSION STAFF WORKING DOCUMENT 
Accompanying the  
  
REPORT FROM THE COMMISSION 
TO THE EUROPEAN PARLIA MENT AND THE COUNCIL 
 
Annual Report  
to the Discharge Authority  
on Internal Audits Carried out in 2008 
 
(Article 86 (4) of the Financial Regulation) 
   
{COM(2009) 419}  
 TABLE OF CONTENTS 
Introduction................................................................................................................... ........................................ 4  
1. ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS......................................................................... 6  
1.1 ADMIN, INFSO, OIB, RTD, SG, TRADE: Ethics in  the Commission.......................................................... 6  
1.2 BUDG: Management letter on Ethics in th e Commi ssion........................................................................ .... 6 
1.3 AIDCO, BUDG, EAC, EACEA,  INFSO, LS: Recoveries............................................................................. .6 
1.4 Management Letter on IT Procurement and Service Delivery in the Commission ...................................... 7  
1.5 Follow-up on IAS Validati on of self-assessment of Inter nal Audit Capab ilities (IAC s)............................... 8  
1.6 ADMIN: Monitoring of Secur ity as managed by ADMIN-DS ...................................................................... 9  
1.7 DGT: Follow-up demand management ........................................................................................... ............. 9  
1.8 DIGIT: Corporate data networ k infrastructure s and services ................................................................. .. 10 
1.9 ECFIN: Implementation of select ed Internal Cont rol Standards............................................................... 11 
1.10 ECFIN: Follow-up on ECFIN local IT management ............................................................................. .. 12 
1.11 EPSO: Facilitated Self-Assessmen t of a Proposed Organigramme ......................................................... 12  
1.12 ESTAT: Follow-up local IT management...................................................................................... ........... 13  
1.13 Legal Service: Local IT ................................................................................................... ......................... 13  
1.14 OIB: Follow-up on evaluation of targeted Internal Control Standards................................................... 14  
1.15 OIB: Follow-up on manageme nt of procurem ent contracts..................................................................... 14 
1.16 OIL: Evaluation of target ed Internal Co ntrol St andards .................................................................... ..... 14  
1.17 OLAF: Anti-fraud info rmation system (AFIS)................................................................................ .......... 15  
1.18 OPOCE: Procurement ........................................................................................................ ..................... 16  
1.19 PMO: Follow-up on regularity of financial manag ement and implementation of  financial circuits ....... 17  
1.20 PMO: Missions............................................................................................................. ............................ 17  
1.21 SCIC: Follow-up financial management and procurement...................................................................... 18 
2. INTERNAL POLICI ES........................................................................................................... ....................... 19  
2.1 COMP: Follow-up on the effectiveness and efficiency of the strategic planning and programming cycle and 
activity-based management ...................................................................................................... ........................ 19  
2.2 COMP: Recovery of Fines .................................................................................................... ..................... 19  
2.3 EAC Second follow-up on the in-d epth audit ................................................................................. ............ 20  
2.4 EACEA: Grant management aw arding and co ntracting........................................................................... .2 0 
2.5 EACI: Follow-up on the Inte lligent Energy E xecutive Agency ................................................................. .2 1 
2.6 ENV: CITL Manage ment at DG ENV ............................................................................................. ........... 21  
2.7 INFSO: Management of rese arch informa tion syst ems.......................................................................... .... 22  
2.8 INFSO: Follow-up on ex-post Contro ls (2006)................................................................................ .......... 23  
2.9 JLS: Follow-up on IT management ............................................................................................ ................ 23  
2.10 JLS: Grants under shared manage ment of the Europe an Refugee Fund ................................................. 23  
2.11 JLS: IT procurement....................................................................................................... .......................... 24  
2.12 MARKT: Follow-up on lo cal IT manageme nt pro cess........................................................................... ... 25 
 - 3 - 2.13 PHEA: Public He alth Executive Agency...................................................................................... ............ 25  
2.14 RTD: Management of re search information systems ........................................................................... .... 26  
2.15 RTD, INFSO, TREN, ENTR: DIGIT: Management letter on the inter-FP 7 IT governance.................... 27  
2.16 RTD: Follow-up ex-post controls (2006) and fi nancial circuits and financial management (2007) ....... 27  
2.17 SANCO: Follow-up on effectiveness and efficiency of th e SPP/ABM Cycle ............................................ 28  
2.18 SANCO: Follow-up large IT systems ......................................................................................... .............. 28  
2.19 SANCO: Grant management in the food safety, ani mal health and welfare and  plant health activity .... 28  
2.20 TREN-TEN-T: Audit of th e TREN-TEN-T execu tive agenc y .................................................................... 29  
2.21 TREN: Follow-up on the eff ectiveness and efficiency of the implementation of SPP/ABM cycle ............ 30  
3. STRUCTURAL MEASURES AND COMMON AGRICULTURAL POLICY........................................ 31  
3.1 EMPL: Review on financial corrections an d recoveries in the Structural Funds Area ............................. 31  
3.2 EMPL: Internal control system for managing the new Structural Funds programming period - Phase I. 31  
3.3 REGIO: Review on financial corrections an d recoveries in the Structural Funds Area............................ 32  
3.4 REGIO: Internal control system for managing the new Structural Funds programming period - Phase I 33  
3.5 REGIO: Follow-up financial correct ions in Cohesion fund (2006) ........................................................... 34  
4. EXTERNAL POLICIES ........................................................................................................... ..................... 34  
4.1 AIDCO/ECHO: Follow-up on FAFA impl ementation ............................................................................... 34 
4.2 AIDCO: Second Follow-up on the in-depth audit .............................................................................. ........ 34  
4.3 AIDCO: Financial Management procedures of Di rectorate C related to its devolved delegations........... 35  
4.4 AIDCO: Financial Manageme nt of Regio nal Projects ........................................................................... ... 36 
4.5 AIDCO: Financial Management of main Programmes in Directorate В................................................... 37  
4.6 ELARG: Follow-up on ex-post contro l activ ities ............................................................................. .......... 38  
4.7 ELARG: Readiness assessment/phasing- in of delegations  in Balkans....................................................... 38  
4.8 RELEX: Follow-up on ex-post contro l activ ities............................................................................. ........... 39  
 INTRODUCTION  
This Annex is based on the original executive su mmaries (reflecting the state of play at the 
time when the audits were fi nalised) of audit engagement s finalised by the IAS in 20081. Each 
summary underwent the applicable standard professional validatio n and contradictory 
procedures between auditor and audi tee at the time of finalisation. 
This Annex also contains statistical information for the acceptance status and, where available, for the implementation status  (the latter as of 30 January 2009). 
 
List of finalised IAS reports 
 
DG/Service 
  
Engagement 
  
Issue date 
Administrative and other support systems  
ADMIN, OIB, INFSO, 
RTD, SG, TRADE Ethics in the Commission 12.12. 
BUDG Management letter on Ethics in the Commision 19.12. 
BUDG, LS, AIDCO, EAC, 
INFSO, EACEA Recoveries 7.10. 
SG, BUDG, ADMIN, 
DIGIT Management letter on IT procurement and service 
delivery in the Commission 19.12. 
ADMIN, AGRI, AIDCO, 
BUDG, COMM, COMP, 
DEV, EAC, ECFIN, ECHO, ELARG, EMPL, 
ENV, ESTAT, INFSO,  
JLS, JRC, LS, MARE, MARKT, OLAF, OPOCE,  
REGIO, RELEX, RTD, 
SANCO, SG, TAXUD, TRADE Follow-up on IAS validation of self-Assessment of the 
Internal Audit Capability various dates 
ADMIN Monitoring of Security as managed by ADMIN-DS 11.12. 
DGT Follow-up demand management 17.12. 
DIGIT Corporate data network infrastructures and services 17.10. 
ECFIN Implementation of selected Internal Control Standards in 
DG ECFIN* 11.4. 
ECFIN Follow-up on ECFIN local IT management* 27.6. 
EPSO Facilitated self-assessment of a proposed organigramme 9.4. 
ESTAT Follow-up local IT management* 26.2. 
LS Local IT 11.12. 
OIB Follow-up on evaluation of targeted internal control 
standards  22.1.09 
OIB Follow-up on management of procurement contracts 23.1.09 
OIL Evaluation of targeted inte rnal control standards  19.5. 
OLAF Anti-fraud information system (AFIS) 21.1.09 
OPOCE Procurement* 7.5. 
PMO Follow-up on regularity of financial management and 
implementation of financial circuits 22.12. 
PMO Missions 11.7. 
SCIC Follow-up financial management and procurement 3.12. 
                                                 
1 Some reports drafted in 2008, but finalised at the beginning of 2009 have been included in the scope. 
 - 5 - Internal policies  
COMP Follow-up on the effectiv eness and efficiency of the 
SPP/ABM cycle and activity-based management 29.5. 
COMP Recovery of fines 13.11. 
EAC 2nd follow-up on the in-depth audit 25.4. 
EACEA Grant management awarding and contracting 11.12. 
EACI Follow-up on the EACI 18.4. 
ENV CITL management at DG ENV* 10.7. 
INFSO Management of research information systems 31.3. 
INFSO Follow-up on ex-post controls (2006) 8.12. 
JLS Follow-up on IT management 14.7. 
JLS Grants under shared management of the European 
Refugee Fund 4.11. 
JLS IT procurement 17.11. 
MARKT Follow-up on local IT management process 17.6. 
PHEA Public Health Executive Agency 24.1. 
RTD Management of research information systems 22.4. 
RTD, INFSO, TREN, 
ENTR, DIGIT Management letter on the inter-DG FP7 IT governance 26.5. 
RTD Follow-up ex-post controls (2006) and financial circuits 
and financial management (2007) 11.12. 
SANCO Follow-up on the effectiv eness and efficiency of the 
SPP/ABM Cycle 1.4. 
SANCO Follow-up large IT systems 21.1.09 
SANCO Grant management in the food safety, animal health and 
welfare and plant health activity 30.1.09 
TREN-TEN-T Audit of the TREN-T EN-T executive agency 16.12. 
TREN Follow-up on the effectiv eness and efficiency of the 
SPP/ABM cycle 11.4. 
Structural Measures 
EMPL Review on financial corrections and recoveries in the 
Structural Funds area 14.11. 
EMPL Internal control system for managing the new Structural 
Funds programming period - Phase I 19.11. 
REGIO Review on financial corrections and recoveries in the 
Structural Funds area 14.11. 
REGIO Internal control system for managing the new Structural 
Funds programming period - Phase I 19.11. 
REGIO Follow-up financial corrections in Cohesion Fund 
(2006) 12.12. 
External Policies  
AIDCO and ECHO Follow-up on FAFA implementation 22.1.09 
AIDCO Second follow-up on the in-depth audit 20.6. 
AIDCO Financial management procedures of Directorate C 
related to its devolved delegations * 30.6. 
AIDCO Financial Management of Regional Projects  18.7. 
AIDCO Financial management of main programmes in 
directorate B 22.12. 
ELARG Follow-up of ex-post control activities 18.7. 
ELARG Readiness assessment/phasing-in of delegations in 
Balkans 17.12. 
RELEX Follow-up ex-post control activities 23.1.09 
* Joint audit/follow-up with the Internal Aud it Capability (IAC) of the service concerned. 
 - 6 - 1. ADMINISTRATIVE  AND  OTHER  SUPPORT  SYSTEMS 
1.1 ADMIN, INFSO, OIB, RTD, SG, T RADE: Ethics in the Commission2 
Objectives and Scope 
The objective of the audit was to assess the adequacy of the overall design of the ethics 
framework of the Commission; and to assess  whether the Commissi on's ethics framework 
has been implemented ef fectively in selected DGs. The scope covered key aspects of the 
design of the ethics framework, for which SG  and DG ADMIN are responsible: completeness, 
the extent to which it covered all staff, clarity of rule s, and the adequacy of guidance, 
monitoring, supervision and enforcement. The a pplication of these design aspects was also 
evaluated in selected operati onal DGs, i.e. INFSO, RTD, OIB, TRADE. As the ethics 
framework of the College of Commissioners was assessed in 2007, it was excluded from the 
scope of the audit. However, members of cabinet  were included in the scope of the audit, as 
they are subject to the Staff Regulati ons applicable to Commission staff. 
 
Total of all six ethics 
audits Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 15 15 100 0 0 
Important 7 7 100 0 0 
Total 22 22 100 0 0 
 
1.2 BUDG: Management letter on Ethics in the Commission 
Following the Audit on Ethics in the Commis sion, the IAS brought to the attention of DG 
BUDG two issues for cons ideration which were iden tified during the audit. 
The first issue concerns differences between the provisions of the Fi nancial Regulation and 
the Staff Regulations, with respect to the repor ting and management of conflicts of interest 
(art. 52 FR, art. 34 IR) and of in structions received from the superior that are considered 
irregular (art. 60.6 FR).  The second issue is about the Fi nancial Irregularities Panel. 
 
1.3 AIDCO, BUDG, EAC, EACEA,  INFSO, LS: Recoveries
3 
Objectives and Scope 
The overall objective of this audit was to provide an opinion on the management of the 
recovery of sums unduly paid in  the context of the centralis ed management of Community 
funds and of the recovery of conditionally  reimbursable loans (related to the MEDIA 
projects). In particular, this audit assessed the internal cont rol systems implemented locally 
(in the Operational DGs) or centrally (in DG B UDG and Legal Service) in order to identify 
                                                 
2 Six reports were issued, in the present Annex onl y the executive summary of the DG ADMIN report is 
included. 
3 A consolidated report was issued for the entire Recovery process.  It includes six annexes (one per DG) with 
the specific issues identified. 
 - 7 - unduly paid funds (Phase 1), issue the Recovery orders (Phase 2) and effectively recover or 
offset them (Phase 3) and to monitor the recovery process. The support provided by DG 
BUDG and LS was also assessed. 
The scope of the audit, conducted in a sample of Operational DGs/Executive Agencies and in 
two horizontal DGs (DG BUDG a nd LS), covered the activitie s performed by the actors 
involved in each of the three pha ses of the recovery process as  well as the monitoring/follow 
up activities implemented both in the Operationa l and in the horizontal DGs. The cooperation 
and communication among actors was also in cluded in the scope of the audit. 
 
All six audits on 
recoveries Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 32 32 100 0 0 
Important 30 30 100 0 0 
Desirable 6 6 100 0 0 
Total 68 68 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 32 32 37,50 0 0 
Important 30 30 63,64 0 0 
Desirable 6 6 100 0 0 
Total 68 68 59,10 0 0 
 
1.4 Management Letter on IT Procuremen t and Service Delivery in the Commission 
Objectives and Scope  
Following a risk assessment, the IT Procuremen t and Service Delivery process was identified 
by the IAS as a high-risk area and included in its 2007 - 2009 Strategic Plan, which was 
endorsed by the APC in February 2007. The IAS audited several DGs in 2007 and 2008 as 
follows: DIGIT (including IDABC previously part of DG ENTR), ESTAT, DG TAXUD, DG 
RTD and DG JLS, the latter recently finalised. 
The scope of the audits included the cont ract preparation process starting from the 
identification of the business needs to the sign ing of the contracts and the management and 
monitoring of these contracts with a greater focus on information systems development. 
The objective of these audits was to assess the adequacy and effective application of the 
internal control system (ICS), risk manageme nt and governance processes and, in particular, 
they assessed whether the internal control sy stems provide reasonable assurance regarding 
compliance with the Commission's rules and the effectiveness and efficiency of the 
procurement and service delivery processes. 
 - 8 - The purpose of this overview, following the co mpletion of the individual audits, is to 
summarise the main common issues identified, dr aw conclusions at th e Commission level and 
present issues for consideration to the central services concerned. In this overview, we have 
also taken into account the findings  in this area identified in se veral other IAS and IAC audits. 
 
1.5 Follow-up on IAS Validation of self-assessm ent of Internal Audit Capabilities (IACs)  
DG ADMIN4 
 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the IAS Validation of Self-Assessment of the 
Internal Audit Capability of DG ADM IN which was carried out in 2006. 
This follow-up does not result in an opini on on the lAC's compliance with the IIA 
Professional Practice Framework. Neither does it  lead to a re-assessment of the compliance 
with individual standards. 
The results of this follow-up exercise are li mited to assessing whether specific actions 
have been implemented and do not necess arily have a bearing on assessments of 
compliance undertaken as part of futu re external assessments/validations. Similarly, 
although it may be possible to conclude on whethe r specific actions have been implemented, it 
is not always possible to determin e their effective application at th is date, mainly as a result of 
the time needed for lACs to embed those actions. Future external reviews should provide a 
more concrete basis for this. 
Similarly, certain issues are impacted by central  initiatives such as the development of a 
common methodology for the audit of governance and ethics. Agai n, future external reviews 
should provide the basis for assessing whether thes e have been effectively applied in practice. 
Even where, as a result of the follow-up, the IAS has assessed that the agreed actions have 
been implemented as intended, this does not permit the IAC to use the phrase "Conducted in 
accordance with the Standards", as IIA Standard 1330 permits th is only when an external 
assessment has demonstrated that this is the case. As noted above, the present follow-up 
exercise does not result in a re-assessment of compliance.  
 
                                                 
4 Follow-ups on IAS Validation of self-assessment of Internal Audit Capabilities (IACs) were 
also carried out in the following DGs: AGRI,  AIDCO, BUDG, COMM, COMP, DEV, EAC, 
ECFIN, ECHO, ELARG, EMPL, ENV, ESTAT,  INFSO, JLS, JRC, LS, MARE, MARKT, 
OLAF, OPOCE, REGIO, RELEX, RTD, SANCO, SG, TAXUD, TRADE. As the objective, 
scope and methodology was the same for all foll ow-up reports on the validation of IAC self-
assessments this text is only shown once. 
 - 9 - 1.6 ADMIN: Monitoring of Security as managed by ADMIN-DS 
Objectives and Scope  
The objective of the audit was to assess the adequ acy and effective application of the Internal 
Control System (ICS) relating to the coordina tion, supervision and monitoring role of the 
Security Directorate (ADM IN-DS) in the Commission. 
The scope of the audit focused on the design and implementation of the monitoring system of 
security in the Commission under the main res ponsibility of the Security Directorate and 
other parties involved. The three main areas cove red were protection of staff, information and 
assets. 
Safety and hygiene matters and the security of the Regulat ory Agencies and Executive 
Agencies were excluded from the scope of this a udit. Whilst the specific issue of IT security 
has already been covered in other IAS audits, the broader issue of information security has 
been included. 
This audit is based on the current security architecture in the Comm ission and has not taken 
into account the potential impact in this area of the future creation of an External Action 
Service. 
There are no observations and/or reservati ons in the AAR 2007 related to the process 
audited. 
It should be noted that the effective impl ementation of some of the very important 
recommendations made in this report may re quire the cooperation of the operational DGs 
concerned. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 7 7 100 0 0 
Important 4 4 100 0 0 
Total 11 11 100 0 0 
 
1.7 DGT: Follow-up demand management 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit of the management of translation 
demand carried out from October 2006 to June 2007. 
This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 - 10 -  
1.8 DIGIT: Corporate data network infrastructures and services 
Objectives and Scope 
The Corporate Data Network Infrastructure and Services (S-Net) (hereinafter referred to as 
"corporate data network") have been identifie d as critical for the entire Commission in the 
context of the establishment of Business Continuity Plans. They  present an overall inherent 
reputation , business  and financial  risk to effectively and effi ciently support the current and 
future needs of the Commission's activities. 
In this context, the overall objective of the present audit was to analyse and evaluate the 
internal control systems put in place to provi de an adequate and effective corporate data 
network in the Commission. The scope of the audit included : 
1. the operation and management of the corporat e data network, including the monitoring of 
outsourced services; 
2. logical security arrangements, in particular the effectiveness of the external perimeter 
protection, the effectiveness of  intrusion prevention/detecti on capabilities and incident 
handling and the adequacy of corpor ate data network access procedures. 
The audit covered the activities, which are under the responsibility of DG DIGIT, and of the 
ADMIN/DS directorate; it did not cover the respons ibilities of the local informatics services. 
When assessing the Technology framework, th e audit approach did not evaluate the 
technological choices made nor the engineering work done by th e experts, but examined the 
process of using expertise to make pr oposals to be validated by management. 
The main actors playing an active role in this domain are DG DIGIT (and in particular 
Directorate C, responsible for all info rmation technology infrastructure and 
telecommunication services) and the Security  Directorate of DG  ADMIN (mainly Unit 
ADMIN/DS.5 responsible, among others, to pr ovide guidance in the field of IT and 
communication security). 
The audit was conducted using the CObIT fram ework, and specifically the processes 
belonging to the domains "Acquire & Install" (AI) and "Deliver & Support" (DS), as well as 
the Commission's regulatory framework applicable to this domain. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 5 5 100 0 0 
Important 9 9 100 0 0 
Total 14 14 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 5 5 100 0 0 
Important 9 9 100 0 0 
Total 14 14 100 0 0 
 - 11 -  
1.9 ECFIN: Implementation of sele cted Internal Control Standards 
Objectives and Scope  
The main purpose of this joint audit with the IAC of DG ECFIN is to assess the compliance, 
effectiveness and efficiency of the implementa tion of the revised Internal Control Standards 
(SEC 2007 1341) in those parts (uni ts/directorates) of DG ECFIN th at deal with activities of 
policy-making, i.e. directorates A, C, D,  E, F and G. This entails assessing: 
• Whether the DG complies with the respectiv e ICS requirements issued by DG BUDG, 
and with other relevant rules applicab le to DG ECFIN (compliance objective); 
• Whether the main measures taken to implemen t these standards are effective, efficient 
and adequate, taking into account the specifi cities of policy-making processes in DG 
ECFIN. 
Based on their relevance to policy-making activities and c onsidering the work already 
performed (or underway) both by DG ECFIN's Inte rnal Audit Capability (IAC) and by the 
IAS, the IAS fully covered the implementation of the following standa rds: Mission (ICS 1), 
Staff allocation and mobility (ICS 3), Objectiv es and performance indicators (ICS 5), Risk 
Management process (ICS 6), Processes and pr ocedures (ICS 8), Management Supervision 
(ICS 9), Evaluation of activitie s (ICS 14) and Assessment of Internal Control Systems (ICS 
15). 
The following standards were partially covered: 
• Ethical and organizational values (ICS 2), where the audit focused on staff awareness 
about sensitive information; 
• Operational Structure (ICS 7), focus on sensitive functions; 
• Business continuity (ICS 10), where busin ess continuity planning was excluded; 
• Document management (ICS 11), focus on handling of sensitive information; 
• Information and communication (ICS 12), focus on management information tools 
and quality and timeliness of in coming and outgoing information. 
The following standards were fully excluded from the scope: 
• Staff evaluation and development (ICS 4), as the evaluation process is not specifically 
relevant to policy-making and the DG's trai ning policy is currently being audited by 
the DG's IAC; 
• Accounting and Financial Reporting (ICS 13), as risks related to financial operations 
in DG ECFIN have been subject to past coverage by the IAC; 
• Internal Audit Capability (ICS 16), as the IAS has already carried out an IAC Quality 
Review in 2006. 
One of the residual risks and weaknesses disc losed in the DG's Annual Activity Report of 
2006 relates to the "shortage of human resour ces, which was already raised in previous 
Annual Activity Reports [and] has not been resolved in 2006". It is further mentioned that "as 
a result, the DG still encounters difficulties in mee ting its objectives, in particular as regards 
economic surveillance and policy co ordination." This weakness was considered not to have an 
impact on the declaration of assurance.  
 - 12 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 3 3 100 0 0 
Important 4 4 100 0 0 
Total 7 7 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 3 3 100 0 0 
Important 4 4 100 0 0 
Total 7 7 100 0 0 
 
1.10 ECFIN: Follow-up on ECFI N local IT management  
 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that re sulted from the audit of DG ECFIN local IT management 
carried out in 2005. This follow-up audit does not result in an assessment of the adequacy of controls as a whole but focuses on the speci fic recommendations in the original audit. 
 
1.11 EPSO: Facilitated Self-Assessme nt of a Proposed Organigramme 
Summary 
 
Participants identified the strengths and obstacl es associated with EPSO to date. The purpose 
of this exercise was to appreciate what work ed well and not to unintentionally undermine it 
but ensure future actions address the obstacles . The second part of the workshop focused on a 
proposed organigramme, participants voted on 22 assertions (positiv e statements grouped 
under three modules) registering th eir level of agreement on a scale of 1-7 where 1 indicated 
strong disagreement and 7 strong agreement. After voting on each module the participant discussed strengths and identifi ed conceras/obstacles, see the Averages of Votes by Criteria 
graph.  
Overall the participants reacted positively to  the new Organigramme, given this positive 
reaction the facilitators emphasi sed drawing out concerns so as  to provide input into the 
planning and implementation proce ss that will be part of manage ment's next steps. It was 
clear to all that the Organigramme is only one element of realising the mission and objectives 
of EPSO and that focus on processes and the pe ople-side of change will continue to be a 
critical part of the next steps. There was so me discussion of "what f unctions should be in 
which box". However, this will be pursued separately. 
 - 13 - 1.12 ESTAT: Follow-up local IT management 
Background  
During the period September to December 2006, the IAS and the IAC of DG Eurostat 
(ESTAT) conducted a risk analysis  of the local IT management , which focused on three major 
processes, namely: 
Planning & Organisation; Proj ect Management; Security. 
Given the nature of the engage ment, the final report (issued on 14/12/2006) included a list of 
observations and associated risks, but no recommendations. Accordingly, the IAS had not 
required an action plan from the auditee. 
However, given the significance of the identifi ed risks, the management of ESTAT planned a 
series of mitigating actions, whose implementation was mainly foreseen from February 2007 to January 2008 (with some actions planned for 2009 and beyond). 
Objectives and Scope  
The objectives of the follow-up audit engageme nt, performed jointly by  the IAS and the IAC 
of ESTAT, were 
a) to assess the progress made by ESTAT in impl ementing actions defined in response to 
accepted observations; 
b) to assess the level of residual risk in cas es where corrective actions were not fully 
implemented or were not planned. 
This follow-up engagement is not an assessment of  the adequacy of controls as a whole, but 
focuses on the observations made in the original engagement. 
1.13 Legal Service: Local IT 
Objectives and Scope  
The purpose of the engagement was to analyse a nd evaluate the internal control systems put 
in place by the Legal Service (hereafter referred to  as LS) to ensure an adequate and effective 
management of its local IT. 
The scope of the audit included the following processes: 
• Plan & Organise: IT architecture definition, organisation definition, risk management and 
IT project management activities; 
• Acquire & Implement: application softwa re development, change and release 
management; 
• Deliver & Support: logical and physical s ecurity, incident management, problem 
management, operations management and data management. 
The audit focused in particular on the activ ities performed by unit DDG.003 (Informatics). 
Other services (DDG.002 - Information and docum entation) and representatives of IT system 
users and owners were also consulted regarding their respective responsibil ities, in particular 
for the management of IT projects. 
 - 14 - There are no observations/reservations in the AAR that relate to th e processes audited. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 17 17 100 0 0 
Desirable 4 4 100 0 0 
Total 25 25 100 0 0 
 
1.14 OIB: Follow-up on evaluation of ta rgeted Internal Control Standards 
Objectives and Scope 
The objective of the follow-up engagement was to assess progress made in implementing the 
accepted recommendations that resulted from the a udit of Evaluation of targeted Internal 
Control Standards in OIB carried  out in June - October 2007. Th e final report was issued on 8 
October 2007. 
This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit related to the ICS 15 
"Documentation"; ICS 17 "Supervision" and IC S 24 "Annual review of internal control". 
 
1.15 OIB: Follow-up on management of procurement contracts 
Objectives and Scope  
The objective of the follow-up engagement was to assess progress made in implementing the 
accepted recommendations that resulted from  the audit "Management of Procurement 
Contracts in OIB" (Final Report issued on 03 April 2007). 
This follow-up audit does not result in an asse ssment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 
 
1.16 OIL: Evaluation of targeted Internal Control Standards 
Objectives and Scope  
The objective of the audit was to assess the adequacy and effectiveness of the 
implementation of selected Internal Control Standards ("ICS") in OIL. 
The basis for the audit are the Internal Control Standards that were in force until 31 
December 2007. Based on the preliminary survey, the following Internal Control Standards 
were selected for review: n0 15 (Documentation of procedur es), 16 (Segregation of duties), 
17 (Supervision), 18 (Recording exceptions), 21  (Audit reports) and 24 (Annual review of 
internal control). 
 - 15 - In view of the recent introduction of the revised Internal Control Standards , applicable as of 
1 January 2008, the audit also linked the former Internal Control Standards selected and 
relating findings to the revise d Internal Control Standards. 
 
Revised Internal Control Standards  Former Internal Control Standards  
8 - Processes and procedures 15 - Documentation of procedures 
16 - Segregation of duties 
18 - Recording of exceptions 
9 - Management supervision 17 - Supervision 
21 - Audit reports 
15 - Assessment of Internal Control Systems 24 - Annual review of internal control 
Although the audit covered both financial and op erational activities, its focus was mainly on 
operational activities. It did not focus on proce dures and control activiti es specifically linked 
to the procurement process, which has b een audited by the IAS (IAS-2006-OIL-001), IAC 
(negotiated procedures) and ECA during the last two years. The IAS procurement audit also 
covered the financial transactions concer ning commitments, payments and recoveries. 
There are no reservations in the AAR 2007 that  relate to the process audited. However, OIL 
reports that there are weaknesses concerning the documentation of procedures (former ICS 
15). The AMP 2008 indicated that OIL will focus on the improvement of revised ICS 4 (Staff 
competence), revised ICS 8 (Documentation of  procedures) and revised ICS 16 (Internal 
Audit Capability). 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 5 5 100 0 0 
Important 7 7 100 0 0 
Desirable 1 1 100 0 0 
Total 13 13 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 5 5 100 0 0 
Important 7 7 100 0 0 
Desirable 1 1 100 0 0 
Total 13 13 100 0 0 
 
1.17 OLAF: Anti-fraud information system (AFIS) 
Objectives and Scope  
The OBJECTIVE of the audit was to assess the governance, project management, change management 
and security of IT systems supporting the OLAF in terms of integrity and confidentiality.  
 - 16 - As a result of the Preliminary Survey and a Cobi T risk-based analysis performed by the IAS, the 
SCOPE of this audit engagement focused on the Anti-Fraud Information System (AFIS). Therefore, IT 
processes and procedures not directly linked to AF IS and to the audit objectives were not assessed.  
During the audit, no scope limitations were identified.  
There are no observations/reservations in the A nnual Activity Report 2007 that relate to the 
area/process audited.  
The fieldwork was finalised on 12 December 2008. All observations and recommendations relate to 
the situation as of that date.  
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 3 3 100 0 0 
Total 7 7 100 0 0 
 
1.18 OPOCE: Procurement 
 
Objectives and Scope  
 
The objective of this joint IAS and IAC-OPOCE a udit was to assess whether the internal control 
system provides reasonable assurance regarding:  
 
• the compliance (legality and regularity) with the Commission procurement rules, the Financial 
Regulation, its Implementing Rules and th e appropriate Commission Internal Control 
Standards; 
• the efficiency and effectiveness in terms of sound financial ma nagement (Art 27 of FR) and 
for procurement activities in general.  
 
The audit mainly focused on procurement pro cedures related to contracts managed by the 
Publications Office and still in force during the period 2006-2007, i.e. it did not cover framework 
contracts used by the Office where the procurem ent process was carried out by other Institutions 
and/or DGs. The CORDIS information system was excluded from the scope. 
A total of nine finalised calls for tender and seven teen related contracts were reviewed. Of these, 15 
contracts had starting dates between 2004 and 2007 and 2 started prior to 2004 (as they were linked to 
two of the 15 selected contracts). The sample test ed took into account value considerations and the 
non-homogenous nature of the contract population, to provide breadth and coverage over the main 
types of items linked directly to the publicati on activities across the three Directorates of OPOCE. 
Contracts that came into force as from 2004 were selected as the procedures related to the process 
prior to that year had already been audited ( 2003 IAC audit report on the procurement process). 
In conducting this joint audit, the results of the a udit performed by the Publications Office's IAC in 
2007 on "outsourced activities and the use of framework  contracts", have been  taken into account in 
order to avoid duplication of effort. The final report, dated 28 June 2007, contained 3 Critical, 11 
Very Important and 8 Important recommendations, all accepted by management, with action plans 
including target dates for implementation, with some  exceptions, by the end of 2007. According to the 
Publications Office, most of these recommendations have already been implemented. 
There are no observations/reservations in the 2007 AAR that relate to the process audited. 
 
 - 17 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 7 7 100 0 0 
Total 11 11 100 0 0 
 
 
1.19 PMO: Follow-up on regularity of financ ial management and implementation of 
financial circuits 
Objectives and Scope  
The objective of the follow-up engagement was to assess progress made in implementing the 
accepted recommendations that resulted from "T he Regularity of financial management and 
implementation of financial circuits in PMO" audit carried out in 2006 (date of the Final 
Report 8 December 2006). 
This follow-up audit does not result in an asse ssment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 
 
1.20 PMO: Missions 
Objectives and Scope  
The objective of the audit was to assess the adequ acy and effective applic ation of the internal 
control system and risk management with resp ect to the design and th e implementation of the 
financial circuits and procedur es related to authorisation an d payment of mission expenses. 
In particular, the audit assessed whether the internal control system provides reasonable 
assurance regarding: 
• compliance (legality and regular ity) with the Commission proc urement rules, the Financial 
Regulation, its Implementing Rules and the appropriate Commission Internal Control 
Standards; 
• efficiency and effectiveness in terms of s ound financial management (Art 27 of FR) and 
for procurement activities in general. 
The audit did not cover procedures related to the calculation and payment of experts' fees. 
Neither did it cover the functionality of the underlying IT system for processing the 
calculation and payment of mission expenses. 
The audit mainly focused on missions ma naged by PMO during 2007. Supporting documents 
were reviewed for a sample of 50 settlements of mission expenditure. 
There are no observations and/or reservations  in the AAR 2007 that relate to the process 
audited. 
 
 
 - 18 -  Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Important 6 6 100 0 0 
Total 8 8 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 2 2 100 0 0 
Important 6 6 100 0 0 
Total 8 8 100 0 0 
 
1.21 SCIC: Follow-up financial ma nagement and procurement 
Objectives and Scope  
The objective of this follow-up engagement was to assess progress made in implementing the 
accepted recommendations that resulted from th e IAS audit of Financial Management and 
Procurement in DG SCIC, carried out in 2006 (Final Report dated 22 September 2006). The 
follow-up had originally been planned to be co nducted within the normal period of one year 
following the final report, but in view of the fact the implementation of many of the 
recommendations would be dependent on th e re-negotiation of the Convention which 
underpins DG SCIC's procurement of interpretati on services and that th is only came into force 
in September 2008, it was neither practical nor useful to conduct it any earlier. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
 - 19 - 2. INTERNAL  POLICIES 
2.1 COMP: Follow-up on the effectiveness and e fficiency of the strategic planning and 
programming cycle and activity-based management 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit on the Effectiven ess and Efficiency of 
the Strategic Planning and Programming Cycl e and Activity-Based Management in DG 
COMP carried out on 25 July 2006. 
This follow-up audit does not result in an assess ment of the adequacy of  controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
2.2 COMP: Recovery of Fines 
Objectives and Scope 
The overall objective of the audit was to asse ss the effectiveness of the process of the 
recovery of fines imposed by DG COMP in conducting its mission of reinforcement of 
competition rules. 
The following detailed audit objectives  were defined: 
• Effectiveness of the operations; 
• Compliance with applicable rules and regulations; 
• Reliability and integrity of fina ncial and operational information. 
The scope  of the audit covered the activities pe rformed by DG COMP, DG BUDG and Legal 
Service in the field of recovery of fines from the Commission de cision, leading to the 
subsequent issuance of notifica tions by the Secretariat General and to its effective recovery. 
The audit included also the monitoring activitie s implemented by the different actors involved 
in this process. 
The Secretariat General was consulted in or der to obtain an understanding of the whole 
process and for gathering additional information. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Important 2 2 100 0 0 
Total 2 2 100 0 0 
 
 - 20 - 2.3 EAC Second follow-up on the in-depth audit 
 
Objectives and Scope 
 
The objective of this second follow-up enga gement is to assess progress made in 
implementing the accepted recommendations that resulted from the In-depth audit of DG 
EAC carried out in 2004 (final report date d 21 September 2004) and that were still 
outstanding as a result of the first follow-up audit conducted in 2005 (final report dated 22 
December 2005).  This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the 17 recommendations assessed as still being open at the time when the first 
follow-up audit was completed.  7 recommendations were confirmed as implemented (3 VI and 4 I), 6 remain in-progress (1 VI and 5 I) and are now more than one year pa st due from the original target date. Four 
recommendations (3 C and 1 VI) were closed a nd the residual actions are addressed in two 
new recommendations (VI) on an "Integrated Supe rvision Strategy" and "Validation of local 
systems by the Accounting Officer of the Commission".    
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Total 2 2 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 2 0 0 2 100 
Total 2 0 0 2 100 
 
2.4 EACEA: Grant management awarding and contracting 
Objectives and Scope 
The EACEA was established in 2006. Its mission is to implement a number of strands of 
certain Community programs in the fields of  education and training, culture, audiovisual, 
citizenship and youth. The Agency's mandate wa s extended to new act ions in 2007 and 2008. 
The management of grants constitutes one  of the main tasks of the Agency. 
The objective of this audit, which was jointly conducted by  IAS and EACEA IAC, was to 
assess if the controls provide reasonable assu rance on the compliance and effectiveness of the 
internal control system regarding the Agen cy's overall selection procedure for grant 
management, awarding and contracting. 
Based on the preliminary survey, the scope of the audit focused on Call for proposal: 
preparation, terms of reference and publi cation; selection proc edure of the grant 
 - 21 - beneficiaries; awarding of the grant beneficiaries; contracting with the grant beneficiaries; 
procedures and manuals; superv ision, monitoring and reporting. 
The audit also took into consid eration still open recommendations from a previous DG EAC 
IAC audit covering the selection proce dure before the Agency was set up. The 
recommendations covered the use of е-tools in the EACEA for the submission of the 
applications, the selection of experts, the co mmunication process, the archives and internal 
procedures. On the basis of the work done, thes e recommendations are either implemented or 
closed because the related current risks and the remaining actions are mainly related to some 
of the recommendations issued by the present IA S/IAC joint audit report. For further details 
please refer to the specific follow up report issued by the Agency's IAC. 
The programming managed directly by DGs, includi ng the Comitology, was out of the audit 
scope. Also, in order to avoid overlapping with other audits either co mpleted or planned by 
the IAS, the IAC or the ECA, the financial circuits, IT and human resources and Euridyce 
were out of the audit scope. 
There are no observations/reser vations in the 2007 AAR that re lates to the area/process 
audited. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 3 3 100 0 0 
Important 6 6 100 0 0 
Total 6 6 100 0 0 
 
 
2.5 EACI: Follow-up on the Intelligent Energy Executive Agency 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit of the Intelligent Energy Executive 
Agency carried out on 30 January 2007. 
This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 
 
2.6 ENV: CITL Management at DG ENV Objectives and Scope  
The objective of the audit was to assess the ad equacy and design of the internal control 
system put in place by DG ENV to ensure th e proper functioning of the CITL (Community 
Independent Transaction Log) IT system, rela ted to the Community greenhouse gas emission 
trading scheme (ETS). Specific key processes have  been selected based on the risk assessment 
completed during the preliminary survey. In addition, th e audit has assessed  the adequacy of 
the reporting to the management concerning th e performance and ava ilability of the CITL 
application. The engagement wa s carried out as a joint audit between the IAS and the IAC of 
DG ENV. 
 - 22 - Based on the results of the preliminary survey, it was decided to focus the audit on the 
following processes: 
• Quality management and quality assurance. 
• Change management and testing. 
• Management of third parties (contractors suppo rting the IT activities related to CITL). 
• Security, focusing on logical security and compliance with the relevant Commission 
legislation. 
Hosting of the system (outsourced to DIGI T), business continuity  planning and network 
security were not included in the scope of the audit. 
The audit methodology is based on the fourth edition of Control Objectives for Information 
and related Technology (COBIT), which is directly inspired by COSO and has increasingly 
become the standard for "Good IT Governance" at the international le vel. This framework 
identifies 34 basic processes and proposes more than 200 controls. 
There are no observations/reservations in the AAR 2007 that relate to the area/processes 
audited. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 3 3 100 0 0 
Total 7 7 100 0 0 
 
2.7 INFSO: Management of research information systems 
Objectives and Scope  
The IAS audit of "Research information systems" consists of three reports: two audit reports 
on the management of the local IT systems (DG RTD and DG INFSO) and one review report 
(primarily a consulting engagement) on the gove rnance and the project management at Inter-
DG level. 
Based on the results of the pre liminary survey' the IAS decided to assess the adequacy and the 
effectiveness of the internal control system put in place for the management of the local IT 
systems within DG INFSO. This audit scope consisted of the following domains: 
- Planning  and  Organisation  of the IT  function  (IT  governance):   addressing all 
information systems owned by DG INFSO whic h support the grant management process. 
- Project management of the following information systems:  
o the PHOENIX system which is used for ma naging research contracts and payments for 
the 6th and 7th Framework Programs (FP6 and FP7). 
 - 23 - o  the security module (APUS) for managing users access rights. 
- Security: focusing on the logical secu rity, continuity of opera tions and compliance with 
the relevant Commi ssion legislation. 
The audit methodology is based on the fourth edition of Control Objectives for Information 
and related Technology (COBIT), which is directly inspired by the COSO and has 
increasingly become the standard for "Good IT Governance" at the inte rnational level. This 
framework identifies 34 basi c processes and proposes more than 200 controls. 
There are no observations/reservations in th e AAR 2006 that relate  to the area/process 
audited. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 6 6 100 0 0 
Important 8 8 100 0 0 
Total 14 14 100 0 0 
 
2.8 INFSO: Follow-up on ex-post Controls (2006) 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit of Ex-Post Cont rols carried out in 
2006. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audits. 
2.9 JLS: Follow-up on IT management 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit on IT Management in DG JLS carried 
out on 8 June 2006. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
2.10 JLS: Grants under shared management of the European Refugee Fund 
Objectives and Scope  
The objective of the audit was to assess the adequ acy and effective applic ation of the internal 
control system (ICS), risk management and governance proce sses related to the Grants Under 
Shared Management of the European Refugee Fund (ERF) (II and III), managed by DG JLS. 
In particular, the audit assessed whether the ICS provided reasonable assurance regarding: 
 - 24 - compliance with legislation, effectiveness and efficiency of the processes and the reliability of 
financial information (with special focus on the eligibility of expenses and financial corrections). 
The scope of this audit focussed on the followi ng sub-processes: Prep aration, implementation, 
financial follow-up & closure; Ex-post audit; Suspension & fina ncial correction. The grants 
under direct management of the ERF were not part of the scope of this audit. 
The following observations/reservations have been made in the 2007 AAR concerning 
specifically the processes unde r the scope of this audit.  
1) Weaknesses in the management and contro l systems of the ERF in Italy for the 
programming periods 2000-2004 and 2005-2007. 
2) Limited guarantee on the operations put in force by 14 Member States for ERF II (2005-
2007). 
In 2008, DG JLS took appropriate actions, i.e. they launched the procedure for a financial 
correction of the grants paid for ERF I (2000 -2004) and the suspension of payments for ERF 
II (2005-2007) is in preparation; and the re maining monitoring visits for ERF II were 
outsourced in the first semester of 2008. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 7 7 100 0 0 
Important 8 8 100 0 0 
Desirable 1 1 100 0 0 
Total 16 16 100 0 0 
 
2.11 JLS: IT procurement 
Objectives and Scope 
The objective of this audit was to assess the ad equacy of the design an d effective application 
of the internal control system (ICS), risk mana gement and governance processes related to IT 
Procurement Preparation process by DG JLS. 
The scope of this audit focused on the IT contract preparation process, starting from the needs 
analysis and planning phase to the budgetary and legal commitment phase. It included all 
types of IT expenses (equipment and services). 
This audit forms part of a series of audits being carried out by the IAS, which will result in the 
issuance of a consolidated report on crosscuttin g issues on IT procurement at the Commission 
level in the 2nd half of 2008. 
There are no observations/reser vations found in the 2007 AAR th at relate to the process 
audited. 
 
 - 25 -  Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 3 3 100 0 0 
Important 2 2 100 0 0 
Desirable 1 1 100 0 0 
Total 6 6 100 0 0 
 
2.12 MARKT: Follow-up on local IT management process Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the DG MARKT Local IT Management process 
audit carried out in 2006. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
2.13 PHEA: Public Health Executive Agency 
Objectives and Scope  
The objective of this audit was to assess the adequacy and effective applicat ion of the internal 
control system (ICS) in the Pub lic Health Executive Agency (PHEA). In particular, the audit 
assessed whether the ICS provides for reasonable assurance regarding: 
• The compliance with the Financial Regulat ion regarding the accounting procedures 
related to the ad ministrative budget. 
• The reliability of financial and non-financial information related to the administrative 
budget. 
• The effectiveness and efficiency of opera tions related to the administrative budget. 
As a result of the contacts with the Director of the PHEA and to ad d greater value to the 
Agency before the first closure of the accounts, part of the audit normally to be performed in 
2009, was brought forward to the end of 2007. Theref ore, the scope of this audit engagement 
was limited to the following aspects regarding the internal control system of the PHEA: 
A. The Accounting Procedures related to the Administrative Budget, including the 
accounting organization, the accounting for fixed assets, salaries, purchases and 
the year-end closing procedures. 
B. Compliance with the rules for "data protection". No scope limitations were identified. The fieldwork was finalized on 30 November  2007. All observations and recommendations 
relate to the situation as of that date. 
 
 - 26 -  Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 3 3 100 0 0 
Important 5 5 100 0 0 
Total 8 8 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 3 0 0 3 100 
Important 5 0 0 5 100 
Total 8 0 0 8 100 
 
2.14 RTD: Management of res earch information systems 
Objectives and Scope  
 
The IAS audit of "Research information system s" is composed of tw o audit reports on the 
management of the local IT systems (DG RT D and DG INFSO) and on e management letter 
addressing the main issues regarding the govern ance and the project management at Inter-DG 
level. 
 
Based on the results of the prel iminary survey the IAS decided to assess the adequacy and the 
effectiveness of the internal control system put in place for the management of the local IT 
systems within DG RTD.  
 
This audit scope consisted of the following domains: 
- Planning  and  Organisation  of the  IT  function  (IT  governance):   addressing all 
information systems owned by DG RTD which support the grant management process. 
- Project management of the following information systems:  
o   the Contract and Project Management (CPM) system which is used for managing 
research contracts for the 6th  and 7th Framework Programs (FP6 and FP7).  
o   the security module (SECUNDA)  for managing users access rights. 
- Security: focusing on the logical security and co mpliance with the relevant Commission 
legislation. 
 
The audit methodology is based on the fourth edition of Control Objectives for Information 
and related Technology (COBIT), which is directly inspired by the COSO and has 
increasingly become the standard for "Good IT Governance" at the inte rnational level. This 
framework identifies 34 basi c processes and proposes more than 200 controls. 
 
 - 27 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 10 10 100 0 0 
Important 6 6 100 0 0 
Total 16 16 100 0 0 
 
 
2.15 RTD, INFSO, TREN, ENTR: DIGIT: Ma nagement letter on the inter-FP 7 IT 
governance 
INTRODUCTION  
 
As part of the audits on the Research In formation systems at DG RTD and DG INFSO, the 
IAS has identified several preliminary findings re garding the FP7 IT Governance structure at 
the inter-DG level that is progr essively being implemented.  
Taking into account the importance of the info rmation systems that will support the FP7, the 
IAS considered it useful to already present thes e preliminary findings in the research family 
as a "limited review", keeping in mind that the other two Research DGs namely DG TREN 
and DG ENTR were not included in the scope of  the Audit on the Management of Research 
Information Systems.  
 
OBJECTIVES AND SCOPE  
 
The main objective of the limited review consists  of assessing the desi gn of the IT governance 
structure.  In addition to the analysis of th e IT governance structure, the IAS reviewed the 
project management of the following information systems:  
- The system for the contract and grant pr eparation forms (CPF/GPF) in support of the 
negotiation process called NEF which is be ing developed jointly by DG INFSO and DG 
RTD;  
-  The unique registration facility module w hose main goal is to provide a unique 
registration service for grant beneficiaries in order to avoid re dundant requests for 
information and ensure that information is always up-to-date. This module is called URF-
PDM and is being developed by DG DIGIT.  
 
2.16 RTD: Follow-up ex-post controls (2006)  and financial circuits and financial 
management (2007) 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit of Ex-Post Cont rols carried out in 
2006 and the Follow-up Report on Fi nancial Circuits & Financial Management carried out in 
2007. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audits. 
 - 28 - 2.17 SANCO: Follow-up on effectiveness and efficiency of the SPP/ABM Cycle 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations th at resulted from the Audit on the Effectiveness and Efficiency of 
the SPP/ABM Cycle in DG SANCO carried out on 6 April 2006. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
2.18 SANCO: Follow-up large IT systems 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit on Large IT Systems at DG SANCO 
carried out in 2006 (Final Report dated 8 December 2006). 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
The fieldwork was finalised on 7 January 2009. Any mitigating actions taken by the auditee 
after this date were not included in the IAS evaluation and assessment of the adequacy and 
effectiveness of the actions taken. 
During the follow-up audit, no scope limitations were identified.  
2.19 SANCO: Grant management in  the food safety, animal health and welfare and 
plant health activity  
Objectives and Scope  
The objective of the audit was to assess the adequacy and effectiv e application of the 
internal control system (ICS), risk mana gement and governan ce processes in DG 
SANCO, regarding the Food Safety, Animal Health, Animal Welfar e and Plant Health 
activities, implemented through grants and cost reimbursements during the years 2007 
and 2008. In particular, the audit assesse d whether the ICS provided reasonable 
assurance regarding compliance with the relevant legislation, effectiveness and efficiency 
of the processes regarding cost reimbursements and grants management and the 
reliability of financial information. 
The scope of this audit focussed on the following sub-processes: 
• Preparation, implementation, fi nancial follow-up & closure; 
• Ex post audit; Suspension & financial correction. 
There are no observations/reservations in th e 2007 AAR that relate to the area/process 
audited. 
 - 29 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 5 5 100 0 0 
Important 5 5 100 0 0 
Total 10 10 100 0 0 
 
2.20 TREN-TEN-T: Audit of the TREN-TEN-T executive agency 
Objectives and Scope 
The objective of the audit was to assess the adequ acy and effective application of the internal 
control system (ICS), risk management and governance proc esses of the admi nistrative budget 
in the Trans-European Transport Network Executive Agency (TEN-TEA). In particular, the 
audit assessed whether the ICS provi ded reasonable assurance regarding compliance with 
legislation, effectiveness and efficiency of the processes and the reliability of financial and 
non-financial information. 
As the Executive Agency became autonomous in Ap ril 2008 and this will be  the first year in 
which the financial statements have to be presented, the scope of this audit focused on the readiness for the first closure of  the accounts. Therefore, the follo wing aspects of the ICS, risk 
management and governance processes regardin g the administrative budget were reviewed: 
1) The overall organisation of the Agen cy (including governance issues). 
2) The accounting system, includ ing the regularity of financial management and the 
implementation of financial circuits, the acc ounting organisation, the accounting for fixed 
assets, salaries, purchases and the year-end closing procedures. 
3) The treasury cycle in cluding the management of the bank account. 
4) The external relations of the Agency with other Commission se rvices (i.e. the service level 
agreements). 
No scope limitations were identified. As 2008 is the first year of the Agency's au tonomy, no Annual Activity Report is available 
yet. 
The fieldwork was finalised on 24 November  2008. All observations and recommendations 
relate to the situation as ofthat date. 
 - 30 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 6 6 100 0 0 
Total 10 10 100 0 0 
 
2.21 TREN: Follow-up on the effectiveness and efficiency of the implementation of 
SPP/ABM cycle 
Objectives and Scope  
 
The objective of the follow-up engagement is to assess progress made in implementing the accepted recommendations th at resulted from the Audit on the Effectiveness and Efficiency of 
implementation of SPP and ABM in DG TREN carried out on 10 April 2006. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
 - 31 - 3. STRUCTURAL  MEASURES  AND  COMMON  AGRICULTURAL  POLICY 
3.1 EMPL: Review on financial corrections a nd recoveries in the Structural Funds Area 
Objectives and Scope  
Following the ECA's recommendations in its 2006 Annual Report for improving the 
effectiveness of the Commission's supervisory role for structural actions, DG REGIO and DG 
EMPL drew up a joint acti on plan, COM 2008(97), dated 19th February 2008 to implement 
these recommendations, including actions designe d to ensure the complete, transparent, 
reliable and consistent reporting on financial corrections and recoveries. 
In response to a specific reque st by the APC and r ecognising that the imp lementation of the 
Action Plan is still very much an ongoing proc ess, the LAS has reviewed the progress made 
by DG EMPL on a number of key actions related to  the internal control systems for capturing 
and processing the information necessary to ensure the accurate reporting of financial 
corrections relating to Structural Actions. A separate review of the progress made by DG 
REGIO has been undertaken in parallel. 
Specifically, the IAS focused on actions 7.1 and 7.2 in relation to the Commission reporting 
processes, actions 1.3, 8.1 and 8.2 aimed at in creasing the impact of the Commission's audit 
activity and the setting up of timing benchmarks and actions 6.1 and 6.2 linked to the Member 
States reporting processes. The responsibility for the last two actions falls to DG REGIO as 
Chef de File and hence they ar e not addressed in the present dr aft review report. Nevertheless, 
related observations regarding these actions, which have been agreed with DG REGIO, are 
annexed to the present final report. 
The review did not cover directly Member St ates' systems and processes and did not cover 
figures prior to 2007, but concentrated on th e measures taken late 2007/2008 to improve 
consistency. In addition, the review did not re-examine the adequacy of the Commission DGs' 
audit processes giving rise to financial corrections/recoveries. 
There are no observations/reservations in the AAR that relate to the area/process audited. 
However, the 2007 AAR reservation issued by DG EMPL has an indirect impact on the 
suspension and financial corr ection procedures as noted in  DG EMPL note to ABM steering 
group for the follow-up of AAR 2007 reservation as at 7 October 2008. 
Given the ongoing nature of the Action Plan a nd the fact that the IAS has focused on the 
progress made, the main points ar e summarized below in terms of  observations and issues for 
consideration, rather than firm recommendations, which the DG is invited to take on board as 
it continues its process of implementation. Consequently, th ere is no audit opinion provided 
on the state of internal controls in this area. The IAS also wishes to point out that the DG has 
confirmed it has already been implementing several issues that were raised for consideration in the draft review report. 
3.2 EMPL: Internal control system for managing the new Structural Funds 
programming period - Phase I 
Objectives and Scope 
The objective of this audit was to assess the adequacy of the design of DG EMPL's 
supervisory controls for gaining assurance on the set up of Member States' management and 
 - 32 - control systems for the Structural Funds  new programming period 2007-2013. The audit 
constitutes the first phase of a wider IAS objective to assess DG EMPL's internal control system, with the current emphasis on the design re flecting the fact that it is still relatively 
early on in the new programming period. As part of a second phase, the IAS will consider the 
implementation of the current design. 
The audit included the DG's controls exercised at each of the key stag es leading up to the 
point at which payments to Member States are triggered, namely the National Strategic 
Reference Frameworks (NSRFs), Operationa l Programmes (OPs), checks on Compliance 
Assessment Reports and on Audit Strategies. It al so considered briefly the DG's preparations 
for checking Member States' obligations rega rding the need to establish Communication 
Plans. Given that certain of these elements ha ve already been finalised (NSRFs and OPs) and 
that at the date of this report, certain other elements are still in the process of being implemented (Communication Plans, Compliance Assessment Reports and Audit Strategies), 
this audit is forward looking to the extent it also considers possible im provements to the next 
programming period. 
It should be noted that in its 2007 AAR, DG EMPL made a number of reservations 
concerning the management and control systems of certain Member States and, although these 
relate to the previous programmi ng period, they are relevant to the extent that the scope of this 
audit specifically addresses the DG's preparatio ns to implement new regulations designed in 
part to improve assurances on management a nd control systems in those Member States. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Total 2 2 100 0 0 
 
3.3 REGIO: Review on financial corrections and recoveries in the Structural Funds 
Area 
Objectives and Scope 
Following the ECA's recommendations in its 2006 Annual Report for improving the 
effectiveness of the Commission's supervisory role for structural actions, DG REGIO and DG 
EMPL drew up a joint acti on plan, COM 2008(97), dated 19th February 2008 to implement 
these recommendations, including actions designed to ensure the complete, transparent, reliable and consistent reporting on financial corrections and recoveries. 
In response to a specific re quest by the APC and recognizing that the implementation of the 
Action Plan is still very much an ongoing proc ess, with a significant number of actions only 
due for implementation by 31 December 2008, the IAS has reviewed the progress made by 
DG REGIO on a number of key actions related to  the internal control systems for capturing 
and processing the information necessary to ensure the accurate reporting of financial 
corrections relating to Structural Actions. A separate review of the progress made by DG 
EMPL has been undertaken in parallel. 
 - 33 - Specifically, the IAS focused on actions 7.2 (due date, 30 September 2008), in relation to the 
Commission reporting processes, actions 1.3, 8.1  and 8.2 (due dates, 31 December 2008 for 
1.3 and 30 April 2008 for 8.1 and 8.2), aimed at increasing th e impact of the Commission's 
audit activity and the setting up of timing benc hmarks and actions 6.1 and 6.2 (due dates 30 
June and 31 December 2008 respectively), linked to the Member States reporting processes. 
The review did not cover directly Member St ates' systems and processes and did not cover 
figures prior to 2007, but concentrated on th e measures taken late 2007/2008 to improve 
consistency. In addition, the review did not re-examine the adequacy of the Commission DGs' 
audit processes giving rise to financial corr ections/recoveries, which has been audited in 
2006. 
There are no observations/reservations in the AAR that relate to the area/process audited. 
However, the 2007 AAR reservation issued by DG REGIO has an impact on the suspension and financial correction procedures as noted  in DG REGIO note to ABM steering group for 
the follow-up of AAR 2007 rese rvation as at 7 October 2008. 
Given the ongoing nature of the Action Plan a nd the fact that the IAS has focused on the 
progress made, the main points ar e summarized below in terms of  observations and issues for 
consideration, rather than firm recommendations, which the DG is invited to take on board as 
it continues its process of implementation. Consequently, th ere is no audit opinion provided 
on the state of internal controls in this area. 
3.4 REGIO: Internal control system fo r managing the new Structural Funds 
programming period - Phase I 
Objectives and Scope  
The objective of this audit was to assess the adequacy of the design of DG REGIO's 
supervisory controls for gaining assurance on the set up of Member States' management and 
control systems for the Structural Funds  new programming period 2007-2013. The audit 
constitutes the first phase of a wider IAS objective to assess DG REGIO's internal control 
system, with the current emphasis on the design re flecting the fact that it is still relatively 
early on in the new programming period. As part of a second phase, the IAS will consider the 
implementation of the current design. 
The audit included the DG's controls exercised at each of the key stag es leading up to the 
point at which payments to Member States are triggered, namely the National Strategic 
Reference Frameworks (NSRFs), Operationa l Programmes (OPs), checks on Compliance 
Assessment Reports and on Audit Strategies. It al so considered briefly the DG's preparations 
for checking Member States' obligations rega rding the need to establish Communication 
Plans. Given that certain of these elements ha ve already been finalised (NSRFs and OPs) and 
that at the date of this report, certain other elements are still in the process of being implemented (Communication Plans, Compliance Assessment Reports and Audit Strategies), 
this audit is forward looking to the extent it also considers possible im provements to the next 
programming period. 
It should be noted that in its 2007 AAR, DG REGIO made a number of reservations 
concerning the management and control systems of certain Member States and, although these 
relate to the previous programmi ng period, they are relevant to the extent that the scope of this 
audit specifically addresses the DG's preparatio ns to implement new regulations designed in 
part to improve assurances on management a nd control systems in those Member States. 
 - 34 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Total 2 2 100 0 0 
 
3.5 REGIO: Follow-up financial corrections in Cohesion fund (2006) 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit of Financial Corrections in Cohesion fund carried out from April to November 2006. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
4.
 EXTERNAL  POLICIES 
4.1 AIDCO/ECHO: Follow-up on FAFA implementation Objectives and Scope  
The objective of this follow-up engagement is to assess progress made in implementing the 
accepted recommendations that re sulted from the audit on the Implementation of the FAFA 
agreement with the UN by DGs AIDCO and ECHO ca rried out in 2006 (fin al report dated 28 
July 2006). 
This follow-up audit does not result in an assessment of the adequacy of controls as a whole, 
but focuses on the 8 recommendati ons made at the time of the original audit and accepted by 
DGs AIDCO and ECHO. 
Two recommendations were rejected at that time by the DGs and thus are excluded from the 
scope of this follow-up. The residual risk relate d to those two recommen dations rejected, i.e. 
indirect costs, was covere d by a special audit on the "Eligibility of Co sts under the Financial 
and Administrative Framework Agreement wi th the United Nati ons by DG AIDCO" carried 
out in 2007 (final re port dated 20 June 2007). As a resu lt of this audit, four new 
recommendations, accepted by DG AIDCO, were  issued to replace the 2 recommendations 
originally rejected. The follow up of the 4 ne w recommendations will be carried out in 2009 
and will include visits to selected Delegations to properly assess their effective implementation. 
4.2 AIDCO: Second Follow-up on the in-depth audit 
Objectives and Scope 
 
The objective of this second follow-up enga gement is to assess progress made in 
implementing the accepted recommendations resu lting from the In-depth audit of DG AIDCO 
carried out in 2004 (final report da ted 26 April 2004) and that were still outstanding as a result 
 - 35 - of the first follow-up audit conducted in 2006 (f inal report dated 22 February 2006), i.e. 22 
recommendations. This follow-up audit does not re sult in an assessment of the adequacy of 
controls as a whole but focu ses on these 22 recommendations. 
 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
4.3 AIDCO: Financial Management procedures of Directorate C rela ted to its devolved 
delegations 
 
The audit was conducted in co-opera tion with the IAS as part of a series of audits covering all 
of the AIDCO geographical Directorates.  Directorate C and its devolved Delegations are responsible fo r expenditure under the Budget 
and under the various EDFs.  The objective of the audit was to ensure that financial management and financial circuits in 
devolved Delegations was in compliance with in structions, together with the monitoring and 
supervision of Delegation activ ity, and reporting Duties, incl uding those of Headquarters. 
 The financial management of Directorate C is one of the critical systems of AIDCO because 
of the following risks: 
The magnitude of expenditure in relation to AIDCO's total expenditure.   Reputational risk in the face of other major Donors, working in critical areas of the 
developing world.   The changes in the procedures and systems that are occasioned by the migration of 
information held in the EDF financial syst em OLAS into the CRIS information system.
  The development of the 10
th EDF procedures 
 The audit worked on the standard that the proc edures should ensure financial management 
systems where accounting transactions were ma de and recorded in a complete, accurate, 
timely and transparent manner.  No recommendations classed as critical have  been made as a result of the audit work 
undertaken. Ten recommendations were made whic h have been classified as very important. 
These are listed at the end of this summary. Each of these recommendations is made to 
improve the internal controls systems in place, in  particular to ensure that there is adequate 
feed back to Headquarter units. It is important  that managers at HQ have assurance that the 
instructions and procedures that they have  issued have been carried out or properly 
implemented by Delegations. Similarly, during tim es of change, it is important that the 
performance of management systems is monitored, especially if they are used in a number of 
remote locations. In both cases information shoul d be available so that rapid and appropriate 
corrective action can be ta ken, should it be needed. 
 - 36 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 10 10 100 0 0 
Important 6 6 100 0 0 
Desirable 1 1 100 0 0 
Total 17 17 100 0 0 
 
4.4 AIDCO: Financial Management  of Regional Projects 
Objectives and Scope  
 
The objectives and scope of the present au dit on "Financial Management of Regional 
Programmes" are in line with IAS' audit strategy of providing management with an 
independent opinion on the current state of the Commissions control.  This audit focuses on Delegations' (DELs) and HQ activities in the management of Regional 
Programmes, understood as Multi Country Programmes, and covers the related monitoring and supervisory activities by HQ on DELs activ ities. The general audit objective was to 
assess the compliance, effectiveness of the co ordination and the division of responsibility 
between the various actors involved, the fina ncial and operational management and the 
monitoring and repor ting activities. 
 Programmes implemented through joint manage ment under F AFA were excluded from the 
scope of the present audit as they were cove red under a previous IAS audit. In addition, the 
IAS did not visit projects in the field or Project Management  Units and RAO as ECA covers 
these aspects. Rather, the present audit focused on control mechanisms set up by and available for the Commission. The IAS liaised with ECA on the project sample and on missions to 
Delegations and to avoid a duplication of effort . Consequently, the IAS limited its sample in 
the Intra-ACP programmes in  AIDCO HQ -Directorate C. 
 There are no observations/reser vations in DG AIDCO's 2007 AAR that relate to the area 
audited.  It should be noted that currently OLAF is investigating two cases concerning two 
organizations involved in the implementation of  a number of regional projects managed by 
AIDCO HQ. In the case of one of  these organisations, potential irregularities were reported in 
January 2007 to AIDCO's management by an exte rnal consultant recruited by a Member State 
and AIDCO's management informed OLAF. Mo reover, concerning this organisation, AIDCO 
has provided the IAS with draft audit reports issued by extern al auditors in February 2008 
identifying potential significant irregularitie s, currently being validated. Based on the 
Memorandum of Understanding between OLAF and the IAS, we have sought information 
from OLAF concerning the current status of th ese cases. However, given the nature of these 
investigations and the confidentiality requirements , as of the date of th is report, no additional 
information has been obtained from OLAF yet. 
 - 37 -  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 9 9 100 0 0 
Important 3 3 100 0 0 
Total 12 12 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 9 9 100 0 0 
Important 3 3 100 0 0 
Total 12 12 100 0 0 
 
4.5 AIDCO: Financial Management of  main Programmes in Directorate В 
Objectives and Scope 
The overall objective of this audit is to provide an  opinion on the compliance with the 
Commission rules and the effectiveness and effi ciency of devolved operations regarding: 
 
• The implementation of Financial Circuits and specific related as pects of financial 
management in Latin America (LA) Delegations; 
• The monitoring and support activities by HQ (i.e. Directorate B) of the LA 
Delegations' and 
• Directorate В and LA Delegations' reporting duties. 
This audit was selected based on the IAS Stra tegic audit plan for 2007-2009, which took into 
account a co-ordinated appro ach between the IAS and the IAC aiming at complementary 
coverage of the audit plans while targeting the highest risks. The scope was further defined in 
the IAS Risk assessment, conducted in the prelim inary phase of the audit. For details on the 
areas excluded from the scope of the audit, see section 2.1.2. 
The LA Delegations network belonging to AIDCO В consists of 17 Delegations. Applying 
the principle of representativeness, th e IAS selected four Delegations. Three other significant 
Delegations were initially shor tlisted but finally not selected  due to overlapping with other 
audit and control activities, lack of Delega tion's reply and problems of Delegations' staff 
availability, respectively. 
There are no observations/reservations in the AAR that relate to the area/process audited. 
The fieldwork cut off date when drafting this report was 31  October 2008. While requested 
by the IAS at the beginning of the fieldwor k phase (June 2008), DG AIDCO provided us six 
months later (1st December 2008) with supporting documen ts on the ex-ante assessment in the 
context to the FR Arti 64 due to filing pr oblems as explained by DG AIDCO. Although the 
cut-off date was exceeded, due to the impo rtance of the issue, the IAS analyzed, 
 - 38 - exceptionally, the additional documents to provide a complete picture of this issue at the date 
of the final report (see further details in section 2.2, observation 1, point 1). 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 9 9 100 0 0 
Important 7 7 100 0 0 
Total 16 16 100 0 0 
 
4.6 ELARG: Follow-up on ex-post control activities 
Objectives and Scope 
The objective of this first follo w-up engagement is to assess progress made in implementing 
the accepted recommendations th at resulted from the audit of ex-post activities in DG 
ELARG carried out in 2006 (final  report dated 20 December 2006). 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the 15 recommendations made at the time of the original audit. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 1 1 100 0 0 
Total 1 1 100 0 0 
 
4.7 ELARG: Readiness assessment/phasing -in of delegations in Balkans 
Objectives and Scope 
The overall objective of this engagement was to  assess the process of phasing-in the European 
Agency for Reconstruction (EAR) into DG ELARG  and the four Delegations (DELs) in the 
Balkans (fYROM, ECLO/Kosovo under UN 1244/99, Serbia and Montenegro) as a result of 
its closure by the end of 2008. This process was accompanied with the devolution of the 
activities of the EAR operational ce ntre's to the four Delegations. 
The engagement was planned in accordance wi th the 2008 IAS Audit plan and follows the 
IAS audit issued on 27 May 2008 on the "Planned Procedures for Winding Down the Operations of the EAR by the End of 2008". 
 - 39 - The objectives for the current engagement were twofold: 
- Short-term objective: to assess the readiness of the DELs to take over the contracts and to 
continue the implementation of the ongoi ng projects without major disruptions; 
- Medium-term objective: to assess the general assurance mechanisms and Internal Control 
Standards (ICS) put in place in the DELs in a new devolution context; changes in 
management system for the HQ; new financia l responsibilities for Delegations; post hand-
over and reporting mechanisms. 
The EAR was set up following a decision of th e European Council in Cologne, Germany, on 
4 June 1999. The decision of the Council to extend the mandate of the EAR until the end of 2008 was made in 2006. The phasing-out of the EAR and the phasing-in of the Delegations 
was designed as a gradual proces s in order to facilitate the continuation of activities. The 
number of ongoing contracts tr ansferred is estimated to be 676. The closing-down and 
phasing-in processes are the firs t exercises of this nature ev er conducted by the Commission. 
Taking into account the objectives of the engagement as descri bed above, the work covered 
DG ELARG HQ units (B2, C2 and C3 and E) i nvolved in the phasing-in of the DELs, the 
Task Force, and the four Delegati ons, of which three were visited. 
The fieldwork was finalized on 11 November  2008. All observations and recommendations 
relate to the situation as of that date. 
There are no observations/reservations in DG ELARG's AAR 2007 th at relate to the 
area/process audited. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 5 5 100 0 0 
Important 6 6 100 0 0 
Desirable 1 1 100 0 0 
Total 12 12 100 0 0 
 
4.8 RELEX: Follow-up on ex-p ost control activities 
Objectives and Scope  
The objective of the follow-up engagement was to assess the progress made in implementing 
the accepted recommendations that resulted from the audit of Ex-Post Control (EPC) 
activities in DG RELEX carried out in 2006 (final report dated 22 December 2006). 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the seven (IC, 4VI, 21) recommenda tions made at the time of the original 
audit.