EN    EN  COMMISSION OF THE E UROPEAN COMMUNITIES 
Brussels, 26.10.2004 
COM(2004) 740 final 
  
COMMUNICATION FROM THE COMMISSION 
Annual Report  
to the Discharge Authority  
on Internal Audits Carried out in 2003  
 
  
(Article 86(4) of the Financial Regulation)  
 
    
{SEC(2004) 1351} 
 
EN 2   EN CONTENTS 
1. Introduction................................................................................................................ ...3 
2. Overview of IAS Audit work in 2003 ............ ..............................................................3 
3. Summary of Systemic Findings and Recommendations ..............................................5 3.1. Accounting and Management Information Systems.....................................................5 3.2. Delegation Risk ........................................................................................................... .6 
3.3. Activity Based Management – ABM Tools .................................................................7 
3.4. Legacy Risks, Resource Allocation and Ri sk Management.........................................7 
3.5. Management Assuranc e and Control Activities ...........................................................8 
 
EN 3   EN 1. INTRODUCTION  
The aim of this summary report is to inform the Discharge Authority, in line with the 
requirements of the Financial Regulation under Article 86.4, of Internal Audit findings 
and recommendations in 2003 from the Internal  Audit Service (IAS) and to report on the 
follow-up.  
The report focuses on the number and type of findings and reco mmendations, which arise 
from the audits carried out by the IAS in 2003. The Commission Services Working 
Document submitted alongside with this report is structured by broad sector of activity 
and contains short descriptions and follow-up information on the individual audit engagements completed by the IAS in 2003. It also gives follow-up information for 
previous audits, mainly based on information provided by the audited departments. 
2. O
VERVIEW OF IAS  AUDIT WORK IN 2003 
Based on Action 87 of the Reform  White Paper, the IAS planned to carry out by 2003 a 
complete cycle of in-depth audits of al l DGs. The objective was to allocate enough 
resources to ‘high risk profile’ DGs to be able to carry out system audits, including 
substantive testing, and to limit the scope fo r the other DGs to the identification of their 
major risk areas.  
Some of the implementation of the 2003 audit programme was postponed into 2004 with 
the special request to the IAS concerning the review of contracts and grants managed by 
or with the involvement of ESTAT. In the resolution accompanying its decision of 8 
April 2003 to grant discharge to the Commission for the year 2001, the European 
Parliament requested that “the Commission’s Internal Audi t Service examines by summer 
2003 the legality and the regularity of all contracts concluded by Eurostat since 1999, 
and to include in its investigation those contracts concluded by other Commission 
services” . Consequently, the Commission decided on 11 June 2003 to instruct the IAS to 
undertake an examination, on an agreed upon procedures basis, of the legality and 
regularity of contracts and grants completed by ESTAT or by other DGs following 
ESTAT’s advice from 1999 to 2002. 
The IAS was able to finalise in 2003 nine Action 87 DG-specific audits, two thematic 
audits, two follow-up audits and the review of ESTAT contracts and grants at the request 
of the Commission. It has also included in this report one Action 87 audit for which the 
final report was issued early in 2004. 
The following table gives an overview of IAS audit engagements completed in 2003: 
 
EN 4   EN Overview of IAS Audit engagements completed in 2003: 
Audit Audit Planning 
Memorandum Draft Report Final Report 
(Transmission Date)  APC Discussion 
Cross-cutting Budgetary Management, Ac counting and Internal Control Systems 
BUDG – Accounting 
system 05-Apr-01 15-Oct-02 15-Apr-03 15-Sep-03 
BUDG – SINCOM2 23-Sep-02 10- Feb-03 21-May-03 15-Sep-03 
BUDG – Treasury 
management 30-Sep-02 10-Apr-03 22-May-03 15-Sep-03 
Internal Policies including Research 
RTD 21-May-03 31-Oct-03 02-Dec-03 16-Feb-04 
ESTAT contracts and 
grants 11-Jun-03 10-Oct-03 22-Oct-03 Discussed by 
Commission 
(APC 7-May-04) 
Structural Measures and Common Agricultural Policy 
REGIO 30-Sep-02 24-Jan- 03 26-Feb-03 28-Apr-03 
AGRI 20-Nov-02 06-Jun-03 13-Oct-03 10-Nov-03 
8-Dec-03 
19-Jan-04 
External Policies including Pre-accession Aid 
ELARG 18-Mar-03 13-Nov-03 22-Dec-03 15-Mar-04 
DEV 14-Feb-03 21-Nov-03 02-Feb-04 10-May-04 
EDF counterpart funds 
(Follow-up) 23-Mar-03 23-May-03 12-Jun-03 13-Oct-03 
RELEX 28-Feb-03 08-Sep-03 16-Oct-03 16-Feb-04 
Governance review in 
the RELEX field 
(Follow-up) 18-Mar-03 08-Apr-03 15-Apr-03 16-Jun-03 
Administrative and other Support Systems 
IT governance 15-Mar-02 21-Jan-03 23-May-03 15-Sep-03 
Training Update 24-Feb-03 19-Mar-03 22-Jul-03 13-Oct-03 
PRESS 17-Feb-03 08-Jul-03 12-Sep-03 13-Oct-03 
Recommendations made by the IAS have been widely accepted by auditees and are to a 
large extent, according to information from au ditees, either already implemented or in the 
course of being implemented.  
The following table gives an overview over the degree of acceptance of recommendations 
for the audits covered in the present report: 
 
EN 5   EN Acceptance of IAS audit recommendations: 
 Accepted Accepted with 
comments Partly 
rejected Rejected Outdated Total % 
Critical 33 27 11 3 3 77 12,16% 
Very 
imp. 152 70 16 23 1 262 41,39% 
Important 161 42 12 17 0 232 36,65% 
Desirable 31 16 4 11 0 62 9,79% 
Total 377 155 43 54 4 633 100,0% 
% 59,6% 24,5% 6,8% 8,5% 0,6% 100,0%   
Following the completion of its cycle of DG audits in 2004, the IAS will be able to 
present a consolidated picture of findings later this year, which should assist in gauging 
the relative importance of each of these. 
Little progress, other than general planning, has been made with the IAS new remit to 
audit 14 Agencies, a task required by Articl e 185 of the Financial Regulation and the 
Implementing Rules, which lead  to a reservation in the 2003 Annual Activity Report of 
the IAS.  
The IAS also carries out from time to time specific consultancy engagements and is 
frequently asked to contribute to or voluntee rs its professional advice on internal control 
issues, resource management and operati ons. The IAS undertakes such consulting 
activities in line with normal internal auditing practice and with its mandate under the 
Financial Regulation and the IAS Charter. 
3. SUMMARY OF CROSS -CUTTING FINDINGS AND RECOMMENDATIONS  
The following five chapters discuss the recommendations made by the IAS on cross-
cutting issues, derived from the findings of the audits presented in the attached 
Commission Services Working Paper and reinforcing in many cases similar findings 
made in earlier Annual Reports from the IAS. 
Delegation of responsibility, accountability and supervision, which are core objectives of 
the Reform, are at the heart of many of the findings and recommendations emerging in IAS reports and underlie most of the systemic issues raised. 
3.1. Accounting and Management  Information Systems 
The IAS considers that, parallel to financ ial management and accounting reform, the 
accounting function within DGs needs to be strengthened and professionalised so that 
within and across DGs the Commission and its management can have systemic assurance 
that the accounts are complete, accurate an d relevant. Systems must ensure that the 
accounts capture all relevant information and staff must be aware of the dangers of not 
 
EN 6   EN recording it. Management and external stake holders need to have assurance that the 
numbers represent reality, otherwise decisions will be ill-founded. For this reason, the 
IAS considers it preferable that the monito ring/recording function should have not only 
professionalism but also not fully depend on the authorising function. 
Based on these considerations, the IAS proposes  that functional reporting be formalised 
between those responsible for the accountin g/monitoring function in the DGs and the 
Accounting Officer. It is the view of the Co mmission, that the existing contacts in the 
network of financial units (RUF), the group of resources directors, the group of the DG 
internal control co-ordinators and the cr eation of the accounting correspondent and 
accounting system user network, together w ith the need to keep clear and unambiguous 
reporting lines to the Director-General means that it does not intend to formalise further 
relations between the accounting and the monitoring function at DG and at central levels. 
In order to comply with the provisions of the Financial Regulation regarding the role and 
function of the Accounting Officer (Art. 61), th e IAS considers that it is necessary for the 
Accounting Officer to assume, beyond a consolid ation function relying exclusively on the 
assurance given by delegated Authorising Officers as provided in Article 61(2), also systemic and overall product responsibility for the integrity of the accounts for the 
Institution as a whole. The IAS proposes to confirm or clarify, if necessary through a 
change to the Financial Regulation. Based on the provisions of the Financial Regulation, according to which it is the Authorising O fficers by delegation, and not the accountant, 
who is responsible for the underlying assu rance of legality and regularity of the 
transactions and for the reliability of th e related information, the Commission has 
confirmed the systemic responsibility of the A ccounting Officer. In application of Article 
61(1e) of the Financial Regulation, the Acc ounting Officer has launched in 2004 a survey 
to validate the DGs' information sy stems and accounting procedures.  
Given the impossibility to attribute major categories of overheads to activities, the IAS 
proposes an evaluation of the tools necessary for the pursuit of the implementation of 
ABM, with particular reference to the need for cost accounting of key overheads. The 
Commission will consider this recommendatio n in the event that further development of 
the existing SPP/ABM structure stemming from the administrative reform undertaken by the present Commission is deemed appropriate.  
3.2. Delegation Risk 
Progress has been made in acknowledging the delegation risk, which results from the 
Commission having final budget responsibility for all its expenditure but having to meet 
that responsibility also when EU funds are implemented in shared management with 
Member States. The IAS report renews the suggestion that this crucial issue be solved through a clear protocol as to the exact resp onsibility of Member States on the one hand 
and the Commission on the other, reinforced by a country disclosure and assurance 
statement. 
Accordingly, the IAS suggests that concrete  steps be taken now to ensure that the 
Structural Funds legislative framework for th e next programming period include ‘ex ante’ 
 
EN 7   EN Disclosure Statements by managing authoritie s with a clear legal authority for penalties 
affecting the overall funding of the Member State concerned, in case of inadequate 
disclosure. The Commission, in its recent proposals for the legal framework of the next 
Structural Funds programming period has introduced the requirement to present audit assurance statements by Member State audit bodies together with reinforced provisions 
on financial corrections. As far as agriculture is concerned, the legislative framework for 
the next programming period includes an assurance statement for the Paying Agencies which are in charge of the management and co ntrol in the Member States. This proposal 
concerns all agricultural expenditu re (2 funds: FEAGA and FEADER). 
The IAS proposes that a joint approach be  developed with the ECA on the way forward 
towards agreed acceptably qualified assura nce. The Commission welcomes the Court's 
new DAS approach and sees in that the basis for working towards an agreed statement, based on solid financial management information presented in the DG's Annual Activity 
Reports and the Commission's synthesis report.  
3.3. Activity Based Management – ABM Tools 
Audit findings have led the IAS to raise a numb er of issues in this area: Firstly and most 
basically, the definition of objectives can be to o global, which reveals itself in difficulties 
with resource allocation and risk analysis. Secondly, there is understandable difficulty in developing meaningful performance indicators. The IAS has proposed no 
recommendation on these observations at this stage since they may just be teething 
problems with the new ABM me chanisms. Thirdly, in some cases there is no clear link 
between the Annual Management Plan (AMP) for a DG and a comparable plan at the 
level of Directorates or Units. This would, however, lead to a clear and integrated single 
planning structure for a DG, the DG le vel AMP having more chance of being 
implemented if underpinned by Unit level plan s. Accordingly, the IAS advises to clarify 
the instructions to DGs regarding the necessary  coherence of AMPs at all levels of the 
organisation.  
The Commission recognises the need for Annu al Management Plans at unit level, but 
does not want to introduce mandatory standard s, as units' responsib ilities widely vary and 
decentralisation of management responsibiliti es towards DGs implies that they are best 
placed to organise their internal management, reporting locally and according to their 
own circumstances. 
3.4. Legacy Risks, Resource Allocation and Risk Management 
The Commission has inherited a number of serious legacy risks, some created by earlier 
under-resourcing, which, in the view of th e IAS, are either not gaining adequate 
recognition or are being managed at the expense of sound management of current 
programmes. The IAS considers that there should be explicit recognition of these 
situations and they should feature in an In stitution-wide management-led risk analysis. 
This should be the basis for resource allocation decisions, including as appropriate the 
use of executive agencies, and the ‘under-m anaged’ risks should be made known to the 
Budgetary Authority. 
 
EN 8   EN The IAS recommends that the Commission and its departments ensure that resources are 
made available for audit work to be carried out early enough in the lifetime of programmes to prevent the creation of future legacy problems. Such audits would be 
more effective in preventing the build up of new legacy exposures if they were combined 
with disclosure statements, as suggested. It also recommends that the correction of past 
errors should be carried out promptly on discovery and that corrective action be properly 
recorded and documented. The Commission ag rees with the recommendations from the 
IAS and will pay proper attention to these considerations, in the limits of what is 
possible, in resource allocation and planning. In particular, for the Structural Funds, for 
the current programming period, there will be increased cooperation with national authorities concerning system audits and ex post controls. The new ex-post controls 
network, a sub-group of the network of the DG internal control co-ordinators provides a 
forum for exchanging best practice and harmonising methodology and strategies. It will start its work in autumn, drawing up an inventory of ex-post control activities and 
methods existing in DGs. 
The IAS repeats its recommendation of last year, accepted by the Commission, that an 
institution-wide risk management be de veloped and that specifically the DGs’ 
management risk self-assessments be furt her shared and centrally analysed to 
complement the CFS overview of the state of internal controls. This consolidated picture 
should be completed by such material as the results of audits, the Court of Auditors' reports and the Discharge resolution to provide a risk picture for the Institution as a 
whole, with a view to the establishment of a management-led central capacity. The 
growth and potential of executive agencies as  a means to deal with staff shortage in 
programme management could usefully be directed and monitored through this same central capacity. 
The Commission had accepted this recommendation in its synthesis report for 2002 and 
confirmed in its 2003 synthesis report that "risk analysis should help in orienting resource 
allocation, alongside other elements such as policy priorities"
1. 
3.5. Management Assurance and Control Activities 
The DG assurance statement has gained recogni tion for its importance as a transparency 
and accountability tool and has gone through a second year. Since the February 2004 
decisions2, the DGs’ Resource Directors co-ordinat e internal control issues and sign off 
the relevant annexes to the Annual Activity Report, thereby strengthening the checks and 
balances at DG level. It rema ins Reform’s major change instrument, and, in the IAS' 
view, the Commission’s AAR Synthesis report and related Overview on Internal Control 
from the Central Financial Service (CFS)  should continue to be reinforced. 
                                                 
1 "Synthesis of Annual Activity Reports 2003 of DGs and Services", point 4. 
2 "Completing the Reform Mandate", COM(2004) 93 of 10 February 2004. 
 
EN 9   EN The IAS recommends that future Synthesis reports should focus on the AOD declarations 
which relate to the effectiveness of controls and that the CFS position statement should progressively give more prominence to the evaluation of effectiveness than to the degree 
of formal compliance with the internal control standards. The Commission agrees, 
stressing in its 2003 synthesis report th e "need for enhanced attention by DGs and 
services on the effectiveness of their internal control systems , also to ensure that they 
adequately support the assurance to be given yearly by them as authorising officers by 
delegation"
3. 
Controls on-the-spot are, in the opinion of the IAS, not frequent enough to provide a 
disincentive to over-claiming and/or do not form part of an overall control and audit 
strategy. In cases where internal management is fully decentralised, the managing unit 
should be carrying out all nece ssary controls under its own responsibility; this should 
include those on-the-spot checks designed to prevent over-claiming where grants are 
linked to real expenditure. Managing units ofte n do not have the necessary skills to do 
this and, if it is done at all, it is done by central control units in the DGs.  
Clarity is needed conceptually that, in such cases, the specialised units are providing 
assistance to the managing un its and not assuming its resp onsibilities; staff of managing 
units should participate in drawing up the audit strategy and risk analysis and should 
participate in the controls on-the-spot. There needs to be a clear distinction between this 
activity and internal audit (IAC) work intended  to verify the effectiveness of management 
systems as a whole. Against this background, the IAS proposes that the CFS assist in 
clarifying conceptually the activity of on-the-spot control in relation to the 
responsibilities of AODs and AOSDs and issu e appropriate instructions or amended 
internal control standards in order to ensure its proper implementation. The above-
mentioned ex-post control network, set up within the network of the DG's Control Co-
ordinators and chaired by the CFS, has, among others, the mandate of exchanging best 
practice and harmonising contro l activities and methods, taking  into account international 
standards. 
                                                 
3 "Synthesis of Annual Activity Reports 2003 of DGs and Services", point 7.