EUROPEAN COMMISSION Brussels, 8.6.2021 SWD(2021) 132 final COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS

Annual report to the Discharge Authority on internal audits carried out in 2020













































{COM(2021) 292 final}



Table of Contents Content of this staff working document PART 1: Final reports Horizontal audits 1.Audit on pillar assessment in the external action family (DG BUDG, DG ECHO, DG INTPA, DG NEAR, FPI) 2.Audit on the Commission’s strategy for data, information and knowledge management (DG BUDG, DG DIGIT, DG ESTAT, DG HR, JRC, SG) 3.Audit on the management of the European fund for strategic investments guarantee fund (DG BUDG, DG ECFIN) 4.Audit on WIFI4EU (DG CNECT, DG DIGIT, INEA) 5.Audit on the implementation of anti-fraud actions in research (DG CNECT, EASME, ERCEA, DG RTD, INEA, REA) 6.Audit on the management of experts in H2020 grants (DG CNECT, DG RTD, EASME, INEA, REA) 7.Audit on data protection (DG DIGIT, DG HR, JRC, LS, SG) 8.Audit on indirect management with entrusted entities (DG INTPA, DG NEAR) Agriculture, natural resources and health 1.Limited review of the management of State aid in the field of agriculture in DG AGRI 2.Audit on the financial management of the 2014-2020 European agriculture fund for rural development in DG AGRI 3.Audit on the design and implementation of CHAFEA control strategy 4.In-depth risk assessment of the innovation fund (DG CLIMA) Cohesion 1.Audit on the process for coordinating technical support to the Member States in DG REFORM (including the contribution of DG REGIO and DG EMPL to the coordination mechanism)

2.Audit on implementation of financial instruments under European Regional Development Fund/Cohesion Fund 2014-2020 in DG REGIO Research, energy and transport 1.Audit on the effectiveness of the design and of the implementation of the ex post control strategy for Connecting Europe Facility (CEF) by INEA 2.Audit on the JRC’s support to EU policy and knowledge management (selection of and delivery on Commission requests) 3.Audit on accounting of assets in JRC 4.Audit on Horizon 2020 grant management phase 3 in REA 5.Audit on the Horizon 2020 ex post audit strategy in DG RTD External actions 1.Audit on performance management in FPI 2.Consulting engagement on EU visitors’ programme in FPI Education and citizenship 1.Audit on effectiveness of the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes managed by DG EAC 2.Audit on grant management (phase 3) – ex post controls in EACEA 3.Audit on grant management of the 2014-2020 Justice and Rights, Equality and Citizenship programmes – implementation in DG JUST Economic and financial affairs 1.Limited review on the implementation of the new internal control framework in DG COMP 2.Audit on supervision of the implementation of the 2014-2020 programme for the European geostationary navigation overlay service in DG DEFIS 3.Audit on payments and accounting for tangible assets under the Galileo and Copernicus 2014-2020 programmes in DG DEFIS 4.Limited review on the implementation of the new internal control framework in DG FISMA 5.Audit on evaluation activities in DG TRADE

General services 1.Audit on human resources management in DG ESTAT 2.Audit on performance management in OLAF 3.Limited review on the implementation of the new internal control framework in OP Information technology audits 1.Audit on management of public cloud services (DG DIGIT, DG HR, SG) 2.Audit on information technology security management in DG GROW 3.Audit on information technology governance and project management in JRC PART 2: Follow-up engagements (summarised) 1.Follow-up audit in DG BUDG on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG RTD (2 follow-ups performed in 2020) 2.Follow-up audit in DG CLIMA on the LIFE financial instrument: effectiveness and efficiency of the current framework in DG CLIMA and DG ENV 3.Follow-up audit in DG EMPL on monitoring the implementation and performance of 2014-2020 operational programmes in DG EMPL, DG MARE and DG REGIO 4.Follow-up audit in DG ENV on the LIFE financial instrument: effectiveness and efficiency of the current framework in DG CLIMA and DG ENV 5.Follow-up audit in DG ESTAT on the production process and the quality of statistics not produced by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST) 6.Follow-up audit in DG GROW on the production process and the quality of statistics not produced by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST) 7.Follow-up audit in DG HOME on human resources management and staff allocation in DG HOME and DG JUST 8.Follow-up audit in DG HR on the effectiveness of the management of absenteeism in OIB, OIL and PMO 9.Follow-up audit in DG INTPA on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG RTD 10.Follow-up audit in DG JUST on the production process and the quality of statistics not produced by Eurostat in DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST 11.Follow-up audit in DG JUST on human resources management and staff allocation in DG HOME and DG JUST

12.Follow-up audit in JRC on intellectual property rights supporting activities in DG COMM, DG DIGIT, DG GROW, JRC and OP 13.Follow-up audit in DG MARE on monitoring the implementation and performance of 2014-2020 operational programmes in DG EMPL, DG MARE and DG REGIO 14.Follow-up audit in OIL on the effectiveness of the management of absenteeism in OIB, OIL and PMO 15.Follow-up audit in OP on intellectual property rights supporting activities in JRC, DG COMM, DG GROW, DIGIT and OP 16.Follow-up audit in PMO on the effectiveness of the management of absenteeism in OIB, OIL and PMO 17.Follow-up audit in DG REGIO on monitoring the implementation and performance of 2014-2020 operational programmes in DG EMPL, DG MARE and DG REGIO 18.Follow-up audit in DG REGIO on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG RTD 19.Follow-up audit in DG RTD on the effectiveness and efficiency of the new early detection and exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and RTD 20.Follow-up audit on the monitoring and enforcement of EU health law in DG SANTE 21.Follow-up audit on the management of the employment and social innovation programme (EaSI) with special emphasis on PROGRESS axis in DG EMPL (2 follow-up audits performed in 2020) 22.Follow-up audit on ex ante controls on Horizon 2020 grant payments in DG CNECT 23.Follow-up audit on human resources management – recruitment of temporary scientific staff in JRC 24.Follow-up audit on verification plans in DG INTPA (2 follow-up audits performed in 2020) 25.Follow-up audit on common foreign and security policy in FPI 26.Follow-up audit on partnership instrument in FPI 27.Follow-up audit on the Neighbourhood Investment Facility (NIF) and the Western Balkans investment framework (WBIF) in DG NEAR (2 follow-up audits performed in 2020) 28.Follow-up audit on DG HOME’s audit activity and clearance of accounts 29.Follow-up audit on procurement in DG JUST 30.Follow-up audit on anti-fraud information system in OLAF 31.Follow-up audit on supervision of outsourced IT operations in TAXUD

32.Follow-up audit on the procurement process in DIGIT 33.Follow-up audit on Eurostat’s quality management of statistical processes 34.Follow-up audit on effectiveness of Eurostat’s cooperation with external stakeholders 35.Follow-up audit on management of information technology security in DG DIGIT 36.Follow-up audit on information technology governance in DG INTPA 37.Follow-up audit on information technology security management in DG RTD (2 follow-up audits performed in 2020) List of audits for which all recommendations have been closed in 2020 after a follow-up audit Part 3: summary of long-outstanding recommendations – state of play as at 31 January 2021



List of abbreviations CHAFEA: Consumers, Health; Agriculture and Food Executive Agency DG AGRI: Directorate-General for Agriculture and Rural Development DG BUDG: Directorate-General for Budget DG CLIMA: Directorate-General for Climate Action DG CNECT: Directorate-General for Communications Networks, Content and Technology DG COMM: Directorate-General for Communication

DG COMP: Directorate-General for Competition DG DEFIS: Directorate-General for Defence Industry and Space DG DEVCO: Directorate-General for International Cooperation and Development DG DIGIT: Directorate-General for Informatics DG EAC: Directorate-General for Education, Youth, Sport and Culture DG ECFIN: Directorate-General for Economic and Financial Affairs DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion DG ENER: Directorate-General for Energy DG ENV: Directorate-General for Environment DG ESTAT: Eurostat DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union DG GROW: Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs DG HOME: Directorate-General for Migration and Home Affairs DG HR: Directorate-General for Human Resources and Security DG INTPA: Directorate-General for International Partnerships (former DG DEVCO) DG JUST: Directorate-General for Justice and Consumers DG MARE: Directorate-General for Maritime Affairs and Fisheries DG MOVE: Directorate-General for Mobility and Transport DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations

DG REFORM/SRSS: Directorate-General for Reform (former SRSS – Structural Reform Support Service) DG REGIO: Directorate-General for Regional and Urban Policy DG RTD: Directorate-General for Research and Innovation DG SANTE: Directorate-General for Health and Food Safety DG SCIC: Directorate-General for Interpretation DGT: Directorate-General for Translation DG TAXUD: Directorate-General for Taxation and Customs Union DG TRADE: Directorate-General for Trade EASME: Executive Agency for Small and Medium-sized Enterprises EACEA: Education, Audiovisual and Culture Executive Agency EPSO: European Personnel Selection Office ERCEA: European Research Council Executive Agency FPI: Service for Foreign Policy Instruments IAS: Internal Audit Service IDEA: Inspire, Debate, Engage and Accelerate Action INEA: Innovation and Networks Executive Agency JRC: Joint Research Centre OIB: Office for Infrastructure and Logistics in Brussels OIL: Office for Infrastructure and Logistics in Luxembourg OLAF: European Anti-Fraud Office

OP: Publications Office of the European Union PMO: Office for the Administration and Payment of Individual Entitlements REA: Research Executive Agency SG: Secretariat-General SG.RECOVER: Secretariat-General Recovery & Resilience Task Force SJ: Legal Service UKTF: Task Force for Relations with the United Kingdom Content of this staff working document Part 1 of this document contains: ·a summary of the internal audit engagements performed as part of the 2020 Internal Audit Service (IAS) audit plan (reports issued between 1 February 2020 and 31 January 2021); and ·the principal recommendations (critical and very important ) made. The information contained in this document reflects the state of play when the audit engagements were finalised. Each audit followed the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation of the engagement. The enclosed summary of each engagement aims to provide an overview of the audits and their main results. Additional, up-to-date information is provided in specific sections by the auditees on measures drawn up and already implemented after the internal audit engagements were finalised. Part 2 of this document contains a summary of the results of the Internal Audit Service’s follow-up engagements performed between 1 February 2020 and 31 January 2021 . Part 3 provides a summarised overview of the six long overdue very important recommendations as at 31 January 2021. PART 1: Final reports Horizontal audits 1.Audit on pillar assessment in the external action family (DG BUDG, DG ECHO, DG INTPA, DG NEAR, FPI) The objective of the audit was to assess the adequacy of the design, and the efficiency and effectiveness of the implementation of the pillar assessment process of entities to be entrusted with the implementation of Union funds in the external action domain and to assess if it enables the Commission to ensure a level of protection of the financial interests of the Union equivalent to the one that is provided when the Commission implements the budget directly. There are no observations / reservations in the 2019 Annual Activity Reports of the audited Directorates-General/Service that relate to the area/process audited. The fieldwork was finalised on 11 December 2020. All observations and recommendations relate to the situation as of that date.

The IAS acknowledged the coordination steps DG BUDG has taken so far, in particular the design of the planned central repository that, after improvements, will become a very useful tool to enhance consistency and efficiency of the pillar assessment process across the Commission. The IAS also acknowledged the coordination efforts (e.g. alignment of existing pillar assessments with the requirements of the current Financial Regulation) and support to other Commission services by the DG INTPA as the lead service for a high number of pillar assessed entities. The efficiency and documentation of the pillar assessment process have improved over time. The IAS identified two critical issues concerning: (1) pillar assessment of the United Nations Secretariat; and (2) agreements signed with pillar assessed entities. It also identified three very important issues concerning: (1) the corporate oversight role; (2) substantive changes in pillar assessed entities’ systems, rules and procedures; and (3) the Commission services’ involvement in the pillar assessment process. The IAS formulated four critical and fifteen very important recommendations: Pillar assessment of the United Nations Secretariat in DG INTPA (1 critical recommendation addressed to DG INTPA) DG INTPA should launch as soon as possible, and based on the support of all interested services, the pillar assessment for the United Nations Secretariat (covering both the procurement and grants pillars) and for the entities that cannot rely on it (covering all but the three new pillars introduced in 2019), and apply supervisory measures until the pillars are positively assessed. Furthermore, based on the outcome of the existing joint working group with the United Nations Secretariat, launch the assessment of the three new pillars introduced in 2019 and finalise it within the deadline set by the Interinstitutional Relations Group fiche of November 2020. Agreements signed with pillar assessed entities (3 critical recommendations addressed to DG INTPA, DG NEAR and DG ECHO respectively and 1 very important recommendation addressed to DG BUDG) DG BUDG should inform the services of the conditions for making a presumption of conformity, liaise with them to implement supervisory measures for pillars that are not fully compliant, and cooperate to verify the information regarding the scope of the assessment of the sub-delegation pillar. It should correct/record the scope and outcome of the pillar assessments in its inventory, when applicable. The operational services should follow the instructions of DG BUDG and provide the necessary information. As prescribed by the Financial Regulation, prior to signing a contribution agreement, they should verify that the agreement allows the entrusted entity to use only the pillars it complies with, or that adequate supervisory measures are applied if the entity is not fully compliant. Corporate oversight role (3 very important recommendations addressed to DG BUDG, 1 very important recommendations addressed to DG INTPA, 1 very important recommendation addressed to DG NEAR) DG BUDG should further develop its corporate oversight role by clearly defining the scope of this role and the mandatory or advisory nature of its instructions and guidance to ensure coordination and coherence in the pillar assessment process across the Commission. It should develop, in cooperation with the other services concerned and drawing from their experience, comprehensive corporate guidance including process description, templates and tools for pillar assessments applicable to all Commission services. It should also adopt a roadmap with milestones towards the establishment of the central repository / automated workflow tool and refine and complete the functional and technical requirements of the planned tool. Substantive changes (5 very important recommendations addressed to DG BUDG, DG INTPA, DG NEAR, DG ECHO and FPI respectively) DG BUDG should establish a mechanism enabling the lead services to verify compliance by the pillar assessed entities with the obligation to report substantive changes to their systems, rules and procedures. It should adopt a procedure and issue guidelines for assessing such changes, and specify which measures to apply if substantive changes reported by an entity undermine the positive result of the pillar assessment. Commission services’ involvement in the pillar assessment process (4 very important recommendations addressed to DG INTPA, DG NEAR, DG ECHO and FPI respectively) For ongoing and future pillar assessments, the operational Directorates-General / services should effectively use the possibilities at their disposal (e.g. participation in meetings, review of draft reports, their compliance with terms of reference, completeness, quality) to ensure that pillar assessments are of a good quality so that they can be relied on to take an informed decision on entrusting budget implementation tasks under indirect management. Moreover, they should adequately document the pillar assessment review process and communicate its outcome, including the supervisory measures, when applicable, correctly and in a timely manner; to the pillar assessed entity and the other Commission services. Finally, DG NEAR and DG ECHO should establish roadmaps for the implementation of recommendations, monitor their implementation and systematically review if the supervisory measures established are relevant and sufficient. Additional information provided by DG BUDG, DG INTPA, DG NEAR, DG ECHO and FPI on the measures defined and/or implemented following the Internal Audit Service audit The multi-DG audit on pillar assessment in the external action family resulted in five ‘very important’ recommendations for DG BUDG. They concerned (further) developing the corporate coordination and coherence of the pillar assessment process, the related guidance for the DGs, the central repository/automated workflow tool, the mechanism of reporting the substantial changes and the conditions for making a presumption of conformity. DG BUDG’s action plan was agreed with the IAS in April 2021. DG BUDG's action plan, agreed by the IAS, includes 22 measures related to these recommendations, some of which have already been delivered as planned (e.g. first training session held and further sessions are scheduled, general guidance on Indirect Management published, updated repository made available to other Services, model notes for lead DGs, updated FAQs, Budgweb pages on indirect management have been reshaped, DG BUDG expert group on pillar assessments has been established, organisation of the update of the repository on a monthly basis). The bulk (50%) of DG BUDG measures is expected to be implemented by the end of June 2021.



DG BUDG is also liaising, within its remit, with external action DGs with regard to the implementation of their respective action plans put forward to address the IAS recommendations (e.g. UNS supervisory measures, sub-delegation, repository of pillar-assessed entities, complementary assessments progress).

Since the reception of the audit report, DG INTPA has further assessed the IAS observations and, in cooperation with the IAS has put in place an action plan. Its implementation should be completed by end of December 2021. In particular, the following measures have already been implemented to address the two critical and three very important recommendations issued to DG INTPA: - On behalf of the Commission, DG INTPA has written to the UN Controller outlining the immediate consequences of the IAS report and the measures taken by the Commission and requesting the information needed to launch the missing pillar assessments of the UN Secretariat and some related entities (UNEP / UNODC). - The Director-General of DG INTPA issued an instruction note to all DG INTPA authorising officers and Heads of Delegation to suspend the signature of contribution agreements with the UN Secretariat and entities relying on its pillar assessment until the supervisory measures are put in place. - A separate letter with the list of applicable supervisory measures, pending the finalisation of the PA, was sent to the UN on 15 April, following agreement by DG BUDG and the Legal Service. These supervisory measures are detailed conditions for the entities to award procurement and grants while ensuring a level of protection of the EU funds equal to the level of protection assured by the Commission. Cooperation with the entities could therefore resume. However, the signature of agreements with supervisory measures is done on an exceptional basis and it is limited to actions that need to be urgently concluded before the completion of the pillar assessments. - On behalf of the Commission, DG INTPA has written to the UN Controller providing clarifications on the conduct of the complementary assessments of the three new pillars on exclusion from access to funding, publication of information on recipients of funds and protection of personal data and recalled the need for completing such assessments by 31 December 2021. - On 28 April 2021 DG INTPA signed the contract for the assessment of the grants and procurement pillars of the United Nations Secretariat (UNS). The announcement letter was sent to the UN on 30 April. The assignment starting date is mid May. - DG INTPA has carefully assessed all other building blocks supporting the assurance in relation to the operations affected by the findings (i.e. DG INTPA’s verification missions, RER study, ECA audits, management declarations, follow-up of audit results). The conclusion is that there is reasonable assurance as regards the accuracy of payments made and the legality and regularity of the underlying transactions. - DG INTPA has also analysed the potential impact of the risks reported by the IAS on the operations with the identified entities in the report in terms of relevant expenditure in 2020. DG INTPA has also verified whether further payments to entrusted entities in 2020 that were not identified in the IAS report could also be affected by missing or incomplete pillar assessments. This additional analysis covered operations with the 20 most important (by paid amounts) entrusted entities and 468 transactions were assessed. Relevant expenditure (i.e. total payments made minus pre-financing plus clearing of pre-financing) relating to contracts affected by the IAS findings amounts to EUR 55.4 million and the amount at risk corresponds to EUR 1.7 million. The conclusion is that the risk identified is under control while the financial impact is below the de minimis threshold. - DG INTPA liaised with and obtained information from relevant services so that complete information on the scope of the assessment of the sub-delegation pillar to be included in DG BUDG database. - DG INTPA replaced the databases on its Intranet with a link to the inventory compiled by the Directorate-General for Budget, after having liaised with DG BUDG on the needed corrections to be made.

It is also foreseen that the following measures are going to be implemented: - DG INTPA already included a reminder in the latest version of INTPA Companion published in February on the need for diligent verification prior to the signature of agreements that in the absence of full PA-compliance supervisory measures are needed. INTPA will also bring formally this to the attention of all services and add/update information on supervisory measures. - DG INTPA has already been strengthening the involvement of relevant services in the PA process by increasing participation in opening and closing meetings, encouraging Entities to submit draft reports, systematically sharing the draft reports with relevant colleagues in BUDG and line DGs and providing comments on the reports. Checklist(s) including the issues to be considered during the quality review process of the draft and pre-final PA reports will soon be introduced. - Following DG BUDG Instruction Note of 31 March on the discontinuation of the sub-delegation pillar and DG BUDG Note on ‘Complementary assessment of pillar 6 – Financial Instruments and Budgetary Guarantees’, DG INTPA will shortly send communications clarifying the need for certain entities to undergo complementary assessments of the grants pillar and relevant sections of the financial instruments pillar. For entities that were only assessed for sub-delegation - without the grant pillar being assessed - contractual (supervisory) measures will be needed to cover the gap pending the completion of the assessment of the grants pillar. In addition, if the complementary assessment for relevant sections of pillar 6 is still ongoing at the moment of entering into contractual arrangements for InvestEU and/or EFSD + guarantee agreements and equity, relevant contractual provisions will have to be included in the agreements. DG INTPA has started the drafting of such measures. DG NEAR adopted the action plan to address the IAS recommendations in March 2021, its implementation should be completed by October 2021. The actions to address the critical recommendation have been already implemented, more specifically: - DG NEAR has updated the relevant checklist and sent a note to the staff at Headquarters and in EU Delegations with a reminder that only those tasks, for which the pillars have been assessed, can be entrusted, and that the supervisory measures should be applied, when they are established. The other three very important recommendations have also been mostly implemented. They cover: - the update of the Manual of procedures (MAP), including indicating the assignments of responsibilities within DG NEAR; - a closer monitoring of possible substantive changes in the pillar assessed entities; - better substantiation of the decision to directly contract auditors, which from now on will be done with a note to the file signed by the Director-General;

- the usage of checklists for reviewing draft and pre-final reports and considering participation in the closing meetings; - setting the deadlines for communicating the results of the pillar assessments in MAP; - the quarterly follow-up of the implementation of the recommendations in the roadmaps; - bi-annual re-assessment of the the supervisory measures.



Some of the above listed points might need to be updated once DG BUDG issues their guidance in mid-2021. In addition, DG NEAR has carried out a thorough analysis of the payments made in 2020 to entrusted entities, including also entities not specifically identified by the IAS. The comprehensive checks conducted by DG NEAR resulted in the identification of errors equal to 0.21% of the payments made in 2020 to entrusted entities under indirect management, well below the materiality level (2%). DG ECHO has accepted the recommendations and an action plan has been agreed with the IAS. The recommendations should be implemented by 30 June 2021 and include the following actions: - An instruction note will be issued by the Director-General. It will set out the responsibilities within DG ECHO units to ensure that the outcome of the pillar assessment and the established supervisory measures are adequately recorded and applied. The instruction note will also identify the responsible unit in charge of the monitoring of the substantive changes communicated by the entities pillar assessed, the analysis of these changes and the identification of additional measures that can be needed following these changes. - Furthermore, a specific checklist will be developed for the review of the pillar assessment reports to ensure that the assessment process is adequately monitored and properly documented. - In addition, DG ECHO has included supervisory measures in its IT tool and will ensure that compliance is achieved on a permanent basis. - Concerning the critical audit finding for the pillar assessment of the UN Secretariat, DG ECHO noted that supervisory measures are in place and applied as necessary. DG ECHO performed similar checks to the ones described by DGs INTPA and NEAR and found that for 2020, 0.22% of its payments to pillar assessed entities were at risk. The estimated financial impact amounted to EUR 56 000 and was well below the de minimis threshold for raising a reservation in the annual activity report. According to DG ECHO, sufficient assurance could be obtained, and this analysis was performed in full cooperation with DG BUDG, the IAS and the other partners. It is foreseen that the two very important recommendations addressed to the FPI will be implemented by the drafting of a detailed internal FPI note due on 30 June 2021. The note will: - define the pillar assessment procedures; - clarify among others the process for dealing with substantive changes and FPI’s involvement in meetings and in drafting assessment report analysis; - set standards for the documentation of the pillar assessment review process. 2.Audit on the Commission’s strategy for data, information and knowledge management (DG BUDG, DG DIGIT, DG ESTAT, DG HR, JRC, SG) The objective of the audit was to assess the effectiveness of the Commission’s strategy on data, information and knowledge management (DIKM) in addressing the challenges and expectations in this domain. There are no observations / reservations in the 2019 Annual Activity Reports of the audited Directorates-General that relate to the area audited. The fieldwork was finalised in October 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised a number of strengths as regards the Commission’s framework for data, information and knowledge management, in particular:

·Governance structure: the Commission has set up a multi-layer governance structure for DIKM which is fully embedded in the overall Commission’s governance. The Information Management Steering Board (IMSB) reports to the Corporate Management Board and is chaired by the Chief Operating Officer of the Commission. It is supported by an Information Management Team (IMT), composed of experts from several Directorates-General. Its tasks are to develop policies and action plans and submit proposals to the IMSB. The IMSB has achieved the goal to set up very ambitious work programmes and to coordinate and support the efforts of many Commission services aiming to address the DIKM challenges in a collaborative and agile way. Its coordination efforts are welcomed by the services closely involved in the DIKM. The IMSB and the IMT operate in a very transparent and open way. The outcome of the meetings is well documented and there are dedicated webpages where all the relevant information is stored, including those related to the data strategy actions and the data ecosystem collaborative space. ·Communication and visibility actions: the Secretariat-General together with the JRC, DG DIGIT and DG HR have made particular efforts to promote the DIKM visibility activities. The knowledge weeks, organised in 2018 and 2019, were successful and well attended events and achieved to raise awareness of the DIKM projects and support the individual Directorates-General in implementing them. These events were also key in further supporting the cultural change within the Commission. Some of the DIKM actions, such as the one-stop-shop, the new corporate search and the opening of the ARES files, have been very successful in improving the information and knowledge sharing in the Commission. The IAS identified two very important issues on: (1) the design of the DIKM strategy; and (2) DIKM governance issues and formulated four very important recommendations: Design of the DIKM strategy (1 very important recommendation addressed to SG) The different elements of the DIKM strategy have to be reassessed and revised to strengthen their strategic orientation and coherence and better demonstrate how it contributes to the Commission’s priorities and activities. This has to be translated into SMART long-term strategic objectives giving the different departments involved in the implementation a common understanding of the strategic direction when designing and implementing the actions. These objectives have to be adequately reflected in the management plans of the services implementing the DIKM actions. DIKM governance issues (3 very important recommendations addressed to SG) The role of the IMSB regarding the monitoring of the human and financial resources deployed for implementing the DIKM corporate actions has to be clarified. The roles and tasks of the IMT have to be clarified and monitoring procedures have to be adopted. The Secretariat-General should implement tools to ensure effective coordination and sharing of information among action leaders and improve the exchange of information between the IMSB and the Information Technology and Cybersecurity Board. Additional information provided by SG on the measures defined and/or implemented following the Internal Audit Service audit The Secretariat-General coordinated the preparation of an action plan for the IAS audit on DIKM, which was accepted by the IAS on 25 March 2021. The action plan puts forward actions to address the audit’s recommendations, such as aligning of DIKM strategic documents and objectives, enhancing the monitoring and reporting of the strategy’s implementation, systematising the information exchange among the participating governance bodies, and developing operational guidance on data quality.



To address the audit’s very important recommendations, the Secretariat-General will coordinate the following actions, which will have been completed by January 2022: - assess the relevance and coherence of existing DIKM strategic objectives and will formulate a set of specific and measurable medium term objectives, aligned with the Commission’s political guidelines and priorities. The objectives will guide the IMSB’s next work programme; - verify that the DIKM strategic objectives are adequately reflected in the management plans of the services involved in their implementation; - update the mandate of the IMSB and other policy documents to clarify its responsibilities. The information management team’s (IMT) added value, key role, responsibilities and procedures, including monitoring and reporting, will also be reviewed; - improve further the systematic information exchange between the IMSB and the Information Technology and Cybersecurity Board, e.g. by sharing meeting minutes regularly and aligning the rolling agendas of the two Boards; - enhance further the systematic knowledge sharing among the action leaders, the IMT members and the local data correspondents, e.g. through the use of a common collaboration space using Microsoft Teams; - provide further guidance to the action leaders, including a common approach for referencing the corporate actions in their management plans and other planning documents; - continue providing progress information to the IMSB through the biannual monitoring reports, which document in their milestones and/or deliverables the progress of all relevant activities of an IMSB action, including IT projects;

- clarify to the action leaders that for the actions under their responsibility in the IMSB’s next work programme, they should: define result-orientated performance indicators, and set baseline values, targets and milestones. 3.Audit on the management of the European fund for strategic investments guarantee fund (DG BUDG, DG ECFIN) The audit objective was to assess the adequacy and effectiveness of the internal control systems related to the management of the European fund for strategic investments guarantee fund (including management of the European fund for strategic investments guarantee fund’s assets and calls on the EU guarantee) by DG BUDG and DG ECFIN, ensuring that the Commission is able to honour the calls on the EU guarantee. There are no observations/reservations in the 2019 Annual Activity Report of DG ECFIN that relate to the area/process audited (until the transfer of the main part of the audited activity to DG BUDG on 1 January 2020, DG ECFIN was exclusively performing these tasks). The fieldwork was finalised on 27 November 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the following strengths/good practices: ·The staff members managing the European fund for strategic investments guarantee fund and conducting the related financial operations have the required expertise. ·There is a strong collaboration and knowledge sharing between the different units in ECFIN.DDG2 and BUDG.E. The IAS did not formulate any critical or very important recommendations. 4.Audit on WIFI4EU (DG CNECT, DG DIGIT, INEA) The objective of the audit was to assess the effectiveness of the management of the WiFi4EU initiative by the DG CNECT and INEA, including the IT support provided by the DG DIGIT. There are no observations / reservations in the 2019 Annual Activity Reports of the Directorates-General and Executive Agency that relate to the area/process audited. The fieldwork was finalised on 16 October 2020. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the ongoing efforts made by DG CNECT, DG DIGIT and INEA to ensure the effective implementation of the WiFi4EU initiative and recognised the following strengths: ·The governance arrangements between the DG CNECT, DG DIGIT and INEA are overall well established. The current written agreements (memoranda of understanding between the two Directorates-General provide a sound framework for the supervision of the WiFi4EU initiative. ·WiFi4EU is implemented and supervised by knowledgeable and committed staff in DG CNECT, DG DIGIT and INEA. Furthermore, there is a good collaboration between these entities. ·In addition to the functionalities of the WiFi4EU portal, the INEA has set up: oclear guidelines and procedures for staff (including supporting checklists for 10 processes/sub-processes); oan effective control mechanism for processing payments and monitoring the execution of the initiative; oa mapping tool to check the geolocation data encoded in the installation reports. ·DG DIGIT provides effective support to the management of WiFi4EU with tools for monitoring the execution of the initiative. Moreover, it developed an IT security plan adapted to the specificities of the initiative. The IAS did not formulate any critical or very important recommendations.

5.Audit on the implementation of anti-fraud actions in research (DG CNECT, EASME, ERCEA, DG RTD, INEA, REA) The objective of the audit was to assess whether the anti-fraud framework in the research family is adequately designed and effectively implemented to ensure that: potential fraud cases can be prevented and timely detected; appropriate follow-up actions are taken when cases of serious suspicions are detected or for established fraud cases; anti-fraud activities are compliant with the applicable rules. There are no reservations in the 2019 Annual Activity Report of the audited Directorates-General or Executive Agencies that relate to the area/process audited. The fieldwork was finalised on 26 November 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the following strengths: ·The design and implementation of the research anti-fraud strategy is centrally coordinated via the Fraud and Irregularities in Research Committee, chaired by the Common Audit Service and attended by the Research and Innovation family. In addition, the Common Audit Service facilitates the coordination with OLAF for the whole family, which ensures a coherent approach regarding key elements of the anti-fraud framework such as the development of a common fraud awareness training. ·The ex ante controls in Horizon 2020 projects are supported by common information technology tools designed by the Common Implementation Centre. At the end of 2019, the Common Implementation Centre reinforced the anti-fraud controls before and after signature of the grant agreements by providing effective information technology support tools (ARIS and SIMBA) for the detection of double funding and plagiarism, which enable to check the content of deliverables against other documents already submitted to the Commission. The IAS did not formulate any critical or very important recommendations. 6.Audit on the management of experts in H2020 grants (DG CNECT, DG RTD, EASME, INEA, REA) The objective of the audit was to assess if the internal control system setup for the expert management process in the research family is adequately designed and effectively implemented to ensure that the experts selected adhere to the criteria defined for the fulfilment of their evaluation and monitoring tasks and ensures compliance with the applicable rules. There are no observations/reservations in the 2019 Annual Activity Report of the Directorates-General and Executive Agencies that relate to the areas/process audited. The fieldwork was finalised on 30 October 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the following strengths: ·The central role of Unit REA.C4 for Horizon 2020 evaluators ensures overall coordination and coherence in contracting with experts as well as processing payments in a timely manner. ·The business process owner for expert management organises and coordinates regular meetings of the Expert Management Steering Committee and Key Users Group to discuss major issues and developments regarding the expert management process. ·The operational units have made sustained efforts to ensure that selected experts adhere to the criteria defined for the fulfilment of their evaluation and monitoring tasks (experience, skills, knowledge, and independence). The IAS identified two very important issues concerning: (1) the monitoring of expert participation patterns and respect of rotation rules; and (2) compliance with personal data protection and formulated two very important recommendations: Monitoring of participation patterns of independent experts and respect of the rotation rules 1 very important recommendation addressed to DG RTD) The Common Implementation Centre should revise its guidance on monitoring participation patterns and respect of rotation rules, clearly allocate the responsibility for collecting the relevant data and request the Horizon 2020 implementing bodies to respect the guidance. The Common Implementation Centre should also determine for which experts the rotation rules were not respected when the pools from which to select experts were created and take the necessary corrective action. Processing of experts personal data (1 very important recommendation addressed to DG RTD) The Common Implementation Centre should develop a common policy at research family level on checking experts’ competence from social media and on the internet and processing personal data collected from these external sources in line with the applicable rules. Furthermore, the Common Implementation Centre should update the expert management record (updated legacy notification) and privacy statement to include this common policy.





Additional information provided by DG RTD on the measures defined and/or implemented following the Internal Audit Service audit The Common Implementation Centre, together with the Directorates-General and Executive Agencies concerned, drafted an action plan addressing the two very important recommendations. The action plan was presented to the IAS on 26 February 2021 and according to it the Common Implementation Centre will: - update and align the guidance on rotation and monitoring of participation rules for experts, in agreement with Horizon Europe and including the template of the call evaluation report; - provide instructions (to be included in the eExperts Vademecum) for services to communicate to the Business Process Owners, as part of the Steering Committee tasks, on the adequate number/gender balance of experts available for their specific needs; - develop guidance (to be included in the Vademecum) on the use of social media/internet and the processing of personal data of experts retrieved from external sources, including practical implementation aspects; - include in a single call for expression of interest a reference to social media (and a reference in the portal's privacy statement if required); - further enlarge the extended mandate of the Taskforce on Elimination and Retention Safeguadrs (TFERS) to manage the elimination of obsolete personal data of experts on shared drives; - create awareness on data protection via different channels such as trainings and the DG’s Intranet. The Business Process Owners will ensure that publication of personal data published on the Portal abides by the respective rules. 7.Audit on data protection (DG DIGIT, DG HR, JRC, LS, SG) The objective of the audit was to assess whether the Commission has put in place an effective and efficient control system enabling Directorates-General/services to demonstrate compliance with the provisions of Regulation (EU) 2018/1725. There are no observations/reservations in the 2019 Annual Activity Reports of the Directorates-General / services concerned that relate to the area/process audited. The fieldwork was finalised in mid-July 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the following strengths: With the entry into force of Regulation (EU) 2018/1725 (Internal Data Protection Regulation - IDPR), the Commission adopted an action plan with ambitious objectives and milestones for the implementation of the new rules in the Commission, thus giving the right tone at the top. The Data Protection Officer (DPO) has monitored and reported on the implementation of the action plan annually. The Commission has put in place a decentralised model aiming at ensuring an adequate level of responsibility and accountability across the organisation through key actors at corporate and at Directorate-General/service level (DPO and (delegated and operational) controllers), as well as a network of Data Protection Coordinators (DPC). While the IAS has identified the need to strengthen certain aspects, this decentralised model, as conceived, provides a proportionate balance between steer at corporate level and accountability at Directorate-General/service level and helps to ensure a good level of collaboration across the organisation. The DPO is appropriately positioned in the Commission’s governance structure. Although attached for administrative purposes to the Secretariat-General, he is functionally independent of the Secretariat-General and other Commission Directorates-General/Services. Hierarchically, the DPO and his team are placed under the supervision of the Chief Operating Officer (COO) and reports regularly to the Group of Resource Directors, a permanent sub-group of the Corporate Management Board (CMB), chaired by the COO. Overall, in the sampled Directorates-General / services, there is a good level of awareness of data protection aspects by the actors involved at the different stages of the process. The data protection process is supported by a dedicated IT system, i.e. Data Protection Records Management System (DPMS), managed by the DPO (i.e. the system owner). While the IAS has identified the need to develop certain features in this system to improve its efficiency, DPMS provides overall a good basis for the management of processing operations in compliance with the IDPR. The IAS identified three very important issues related to: (1) the general framework governing personal data protection; (2) the DPO role and actions; and (3) compliance with key provisions of the regulation and formulated eight very important recommendations:

General framework governing personal data protection aspects in the Commission (3 very important recommendations addressed to SG/DPO, 1 very important recommendation addressed to DG HR, 1 very important recommendation addressed to DG DIGIT) The IAS recommended that the DPO adopt additional guidance on the DPC function and, jointly with DG DIGIT, develop methodology and guidance for defining a minimum set of IT related controls to address the requirements of the IDPR when designing new IT systems or significantly updating existing IT systems. The IAS also recommended: (1) the DPO should provide guidance to ensure that the shared DPC function is based on harmonised arrangements that set out the roles and responsibilities of each party; and (2) DG HR should assess, jointly with the delegated controllers of the four Offices of the HR family, whether it is feasible to maintain a common DPC function and if so, to support the shared function with appropriate arrangements, including the allocation of the necessary resources and the clarification of key responsibilities. Data Protection Officer’s role and actions to support the data protection process across the Commission services (2 very important recommendations addressed to SG/DPO) The IAS recommended that the DPO strengthen its draft annual work programme 2020-2021 (including clearly defined objectives, timeliness for the planned actions, key performance indicators to monitor actions and the resources to be allocated) and adopt it on a timely basis. As part of this exercise, the DPO should analyse in particular the resources needed to carry out audits and/or inspections to monitor the internal application of the IDPR, while considering the work to be carried out by other assurance providers. The work programme should be presented to the CMB, which considering its oversight and advisory role on personal data protection matters, should decide on the actions to be taken as regards any resourcing issues. The DPO should issue an annual activity report on the activities performed, including on the implementation of the work programme. In addition, the IAS recommended that the DPO, as system owner of DPMS, issue comprehensive guidance as regards the existing records types (‘individual’, ‘corporate centralised’ and ‘corporate decentralised’) and revise the ‘DPMS record template’ to reflect the roles as defined in the implementing rules (delegated controller, operational controller). The DPO should also implement a module in DPMS for the management of personal data breaches across the Commission and include a feature to facilitate the regular review of the records of processing operations. Compliance with key provisions of the regulation on data protection across the Commission (1 very important recommendation addressed to SG/DPO) The IAS recommended that the DPO further raise awareness (in the Group of Resource Directors and the DPC Network) on the urgent need to keep a proper record of all the processing activities in line with the provisions of the IDPR and report to the CMB the exceptions so that appropriate action may be taken. The DPO should, in consultation with the DPC network, issue guidance on the handling of data subjects’ requests, implement a corporate solution to protect the data subjects’ rights and develop a training module aiming at building-up competencies on performing data protection impact assessments by operational controllers. The DPO should issue guidance on the internal arrangements to be concluded between Directorates-General and services where processing operations are carried out jointly. The DPO should, taking account of the EDPS’s recent order and planned guidance on international transfers of data, as well as the information received from the delegated controllers, analyse how compliance of the Commission’s processing operations with the IDPR can be ensured. In this context, the DPO should provide assistance to the delegated controllers and consult with the EDPS, when appropriate. Additional information provided by SG, DG DIGIT and DG HR on the measures defined and/or implemented following the Internal Audit Service audit The Secretariat-General had five very important recommendations from the Internal Audit Service addressed to the Data Protection Officer (DPO) on guidance and methodology. The action plan was approved by the Internal Audit Service and will be implemented in 2021 with the exception of a couple of actions that will be implemented in the first quarter of 2022 . The main actions for the implementation of these very important recommendations include the issuing of guidance, the creation in the ‘DPMS record template’ of the necessary fields to reflect the roles defined in the Implementing Rules, the implementation of certain changes to the DPMS, the development – in consultation with the data protection coordinators’ network – of a training module or workshop on performing a data protection impact assessment by operational controllers, the raising of awareness on the urgent need to keep a proper recording of all the processing activities and the issuance of a standalone annual activity report on the activities performed by the Data Protection Officer. On international transfers, taking account of the European Data Protection Supervisor’s recent order and planned guidance on international transfers of data, as well as the information received from the delegated controllers, the Data Protection Officer will analyse how compliance of the Commission’s processing operations with the IDPR can be ensured. This includes coordinating the Services’ completing and updating (where required) the Commission’s inventory of processing operations involving international transfers. In addition, the Data Protection Officer will provide assistance to the delegated controllers in order to help implement any forthcoming guidance on this matter by the European Data Protection Supervisor. Only one (very important) recommendation concerned DIGIT as associated DG, namely that the DPO should adopt jointly with DIGIT and in consultation with data controllers and the DPC network, a methodology and guidance for defining a minimum set of IT related controls to address the requirements of the IDPR when designing new IT systems or significantly updating existing IT systems. This recommendation is not due until the end of 2021. The recommendation addressed to DG HR consists in DG HR needing to review its centralised Data Protection Coordination (DPC) role for the DG HR family (OIB, OIL, EPSO and PMO). The decision has been taken to devolve the DPC role to the Offices. The decision is already being formally communicated to the Offices, a transition period is now entered in which DG HR assures the function for the time the Offices need to organise their own Data Protection Coordinator. The recommendation will be deemed implemented once the transition period is completed. 8.Audit on indirect management with entrusted entities (DG INTPA, DG NEAR) The objective of the audit was to assess if indirect management agreements are designed and implemented in an efficient and effective manner, in compliance with the regulatory framework. There are no observations / reservations in the 2019 Annual Activity Reports of the two Directorates-General that relate to the area / process audited. The fieldwork was finalised on 24 November 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the following strengths/good practices: ·The EU Delegation in Turkey documents comprehensively the calls for proposals, related evaluation and negotiation reports, in particular for actions implemented through the Facility for Refugees in Turkey. ·There is complete documentation in the Common Relex Information System of requests for derogations from contractual clauses (general conditions) and prior approvals. ·The external assistance management reports reviewed provide comprehensive information on the funding (commitments/payments) channelled through indirect management with entrusted entities and related challenges. The IAS did not formulate any critical or very important recommendations.

Agriculture, natural resources and health 1.Limited review of the management of State aid in the field of agriculture in DG AGRI In the context of the transfer of the State aid Unit from DG AGRI to DG COMP as from 1 January 2020, the objective of this limited review was to provide assurance on the effectiveness and efficiency of the controls implemented by DG AGRI for dealing with State aid in the agricultural sector. The 2017 and 2018 Annual Activity Reports contain no reservations concerning State aid. The fieldwork was finalised on 20 December 2019. All observations and recommendations relate to the situation as of that date. The IAS recognised the in-depth knowledge and experience of staff managing State aid in agriculture. This has been developed over a number of years and has helped the unit to meet all the required statutory deadlines. The IAS did not formulate any critical or very important recommendations. 2.Audit on the financial management of the 2014-2020 European agriculture fund for rural development in DG AGRI The objective of the audit was to assess the design and effective implementation of DG AGRI’s internal control processes for the financial management of the 2014-2020 European agricultural fund for rural development. The following observations/reservations were made in the 2019 Annual Activity Report concerning specifically the area/process under the scope of this audit engagement: - The reservation concerns the payments made on rural development in 2019 and it covered the amount of EUR 288.35 million, representing 2.03% of the total annual European agricultural fund for rural development expenditure of EUR 14 179.98 million. Reservations have been made concerning 21 paying agencies, comprising 18 Member States. The fieldwork was finalised on 18 June 2020. All observations and recommendations relate to the situation as of that date, except for finding one for which additional information was received and assessed following DG AGRI's comments to the draft audit report. The audit team noted the profound knowledge and extensive experience of the finance team in Unit AGRI.R.4. This, together with their availability to support the colleagues in the geographical units, was also clearly confirmed through the replies to the IAS survey of the geographical unit colleagues. The IAS did not formulate any critical or very important recommendations. 3.Audit on the design and implementation of CHAFEA control strategy The objective of the audit was to assess whether CHAFEA has designed an adequate control strategy and implements it effectively and efficiently to ensure the legality and regularity of the underlying transactions and sound financial management of its delegated programmes. There are no observations/reservations in the 2017 and 2018 Annual Activity Reports of CHAFEA that relate to the area audited. The fieldwork was finalised on 7 July 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the commitment and expertise of key staff in the ‘Corporate Support and Resources Management Unit’ and operational units of CHAFEA. The IAS did not formulate any critical or very important recommendations. 4.In-depth risk assessment of the innovation fund (DG CLIMA) The objective of this engagement was to identify, categorise and assess, in cooperation with DG CLIMA, the main inherent risks relating to the set-up and start of the innovation fund, with a view to enabling the Directorate-General to manage those risks adequately.

Originally, the IAS intended to undertake an audit in this area. However, at the time of engagement, the processes relating to the set-up of the fund were still very much under discussion. Furthermore, subsequent to the start of the engagement, the Commission decided to delegate the responsibility for the implementation of the fund to the Innovation and Networks Executive Agency. Consequently, the Internal Audit Service focussed, in cooperation with DG CLIMA, on the identification of the main inherent risks associated with the set-up of the fund, including the launch of the first call for proposals, from both the supervisory and implementation perspectives. As the engagement was a risk assessment, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration for the attention of management. Their effective implementation will not be formally followed up by the IAS. Cohesion 1.Audit on the process for coordinating technical support to the Member States in DG REFORM (including the contribution of DG REGIO and DG EMPL to the coordination mechanism) The objective of the audit was to assess whether or not DG REFORM’s processes for coordinating the provision of technical support to the Member States and for selecting projects under the Structural Reform Support Programme are adequately designed and functioning effectively. The audit also assessed whether DG REGIO and DG EMPL have put in place adequate procedures for contributing to the coordination mechanism on technical support established by DG REFORM and whether these are functioning effectively. There are no observations/reservations in the 2019 Annual Activity Report of DG REFORM that relate to the area/process audited. The fieldwork was finalised on 30 May 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the following strengths in the practices followed by DG REFORM: ·Clear instructions were provided by DG REFORM to Member State authorities on how to prepare requests of technical support for submission. In order to answer any additional questions the Member State had on the Structural Reform Support Programme process, DG REFORM organised meetings with the Member States' coordinating authorities in the form of videoconferences. ·The instructions on the Structural Reform Support Programme consultation for the assessment of Member State requests provided by DG REFORM to the participating Directorates-General were clear and adequate and have remained consistent during the audited period. In case the Directorates-General needed any further clarifications, these were provided to them through direct bilateral exchanges with DG REFORM. Also the topic of the Structural Reform Support Programme request consultation process has been included in the topics that are discussed during the technical support working group meetings. ·The tailor-made dashboards prepared by DG REFORM for each of the participating Directorates-General (showing the number of requests received from the Member State and the status of their project implementation) elicited a high satisfaction rate from the Directorates-General participating in the 2020 satisfaction survey. The IAS did not formulate any critical or very important recommendations. 2.Audit on implementation of financial instruments under European Regional Development Fund/Cohesion Fund 2014-2020 in DG REGIO The objective of the audit was to assess whether DG REGIO has put in place adequate controls for supporting Member States in the uptake and use of financial instruments under the 2014-2020 programming period for the European Regional Development Fund / Cohesion Fund and for monitoring their implementation. In its 2019 Annual Activity Report, DG REGIO did not issue a reservation specifically on financial instruments. Nevertheless, the Directorate-General made a reservation for the 2014-2020 programming period concerning weaknesses in management and control systems in 58 European Regional Development Fund / Cohesion Fund programmes in 13 Member States. The necessary preventive and corrective actions have been or are being requested from the Member States concerned. The fieldwork was finalised on 25 November 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the following strengths in the practices followed by DG REGIO in the audited area: ·Organisation and function of financial instruments matrix meetings: the financial instruments matrix enables sharing examples of good practices / successful use of different types of financial instruments among its members. ·Country responsibilities in Unit B3: a clear allocation of Unit B3 staff per Member States to provide support. Expert knowledge and support provided by the coordination unit is very well perceived by the implementation units. During the last two years Unit B3 made significant efforts to improve and facilitate the coordination and cooperation in the area of financial instruments implementation. ·DG REGIO developed a dedicated tool in SharePoint for monitoring the uptake of the Coronavirus Response Investment Initiative for each Member State, which covers also measures related to financial instruments. The IAS did not formulate any critical or very important recommendations. Research, energy and transport

1.Audit on the effectiveness of the design and of the implementation of the ex post control strategy for Connecting Europe Facility (CEF) by INEA The objective of the audit was to assess the effectiveness of the design and implementation by INEA of the ex post control strategy in order to obtain reasonable assurance on the legality and regularity of underlying transactions. There are no observations/reservations in the 2019 Annual Activity Report of INEA that relate to the area/process audited. The fieldwork was finalised on 9 September 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by INEA in the design and implementation of the ex post control strategy for the CEF programme and identified the following strengths / good practices: ·There is a good document archiving system thanks to which all the project information and audit files (paper and electronic data) are easily accessible to the INEA staff involved. ·There is a thorough supervision of the audits performed by the external contractor including monitoring and detailed quality review of their main deliverables. The supervision also includes performing joint missions once a year. ·There is an effective internal review process (audit follow-up process) on the implementation of audit results that is used by the ex post audit team to inform operational and financial colleagues of the outcome of an ex post audit and agree the implementation of financial recommendation. ·The ex post audit team succeeded in delivering the annual audit plans while not being fully staffed. The IAS identified one very important issue on the assessment of the legality and regularity of amendments to implementing contracts and formulated one very important recommendation: INEA should update its ex post audit methodology for the assessment of the legality and regularity of amendments or exceptions to the procurement procedures. Moreover, the Agency should prepare clear guidelines and checklists to enable consistent assessment of the legality and regularity of amendments to implementing contracts (for example the due diligence at tender phase) and to document all checks performed. Additionally, the Agency should raise awareness with the beneficiaries on the restrictive interpretation of the use of contract amendments without public tendering. Additional information provided by INEA on the measures defined and/or implemented following the Internal Audit Service audit The action plan with the measures to address this very important recommendation was defined and agreed with the Internal Audit Service. The measures included the revision of the public procurement checklist to provide improved guidance to auditors auditing public procurement procedures for the Agency. This checklist was validated by DG GROW and is applicable already as of the 2021 Ex-post Audit Plan. In addition, the Agency has paid particular attention to raising the awareness of its beneficiaries to the interpretation of the justifications of contract modifications both in ex-post audits and more widely. The measures addressing this very important recommendation were implemented by the Agency in the first quarter of 2021 and will be subject to a follow-up by the Internal Audit Service before being formally closed. 2.Audit on the JRC’s support to EU policy and knowledge management (selection of and delivery on Commission requests) The objective of the audit was to assess whether the processes put in place by the JRC to support policy (both policy making and policy implementation) and knowledge management are adequately designed and effectively and efficiently implemented. There are no observations/reservations in the 2019 Annual Activity Report of the JRC, which relate to the area/process audited. The fieldwork was finalised on 10 November 2019. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by the JRC to further improve the policy support delivered to the policy Directorates-General and to develop knowledge management in the Commission. The IAS recognised the following strengths: ·The preparation of the work programme is based on well-structured procedures with clear roles and responsibilities. ·The JRC has in place an effective change management procedure to update the work programme during its execution in order to address new requests expressed by the client services. ·Following the guidelines of its Strategy 2030 on managing knowledge and competences, the JRC has created six knowledge centres and seven competence centres which enable exploitation of the knowledge and competences of staff in the JRC and in the partner Directorates-General.

·Several good practices were identified in the knowledge and competence centres such as the organisation of knowledge weeks, workshops, trainings and exchanges in communities of practice, communication practices and tools, internal organisation of teams and registry of policy Directorates-General requests. ·To enhance the added value of knowledge management, the JRC internally reflected in a senior management roundtable held in May 2020 on the experience of knowledge management over the last four years and its possible evolution, including its mission, roles, tasks and responsibilities. In the survey carried out by the IAS, the policy Directorates-General provided positive feedback on: ·The quality of the JRC deliverables: 82% of respondents rated it good or very good. ·The cooperation with the JRC for the definition of the specifications of the work: 76% of participants rated it as good or very good. Moreover, the policy Directorates-General appreciate the possibility to co-design the work delivered by the JRC as well as the transparent communication by the JRC on the scientific support it can provide, the clarity of roles and responsibilities for policy support within the JRC, and progress and possible issues during the execution of the projects. The IAS identified one very important issue on the policy support: definition of priorities, identification of needs and assessment of the requests and formulated one very important recommendation: JRC should: (1) set up a regular coordination/consultation forum at Director-General level to coordinate priorities and needs for policy support; (2) include a formal consultation of the policy Directorates-General early in the process to prepare the work programme to obtain a reliable and up-to-date view on their needs; and (3) develop a mechanism/system in order to obtain a structured and systematic overview of requests made through different entry points to enable the JRC to better prioritise requests and track their responses. Additional information provided by JRC on the measures defined and/or implemented following the Internal Audit Service audit According to the action plan accepted by the IAS on 22 February 2021, the JRC will address the very important recommendation by continuing having meetings at DGs’ level to discuss future priorities. The JRC will revise the work programme processes (adoption of revision proposal and implementation are planned respectively by December 2021 and by March 2022). Better prioritisation and consultation of partner DGs on their priorities and needs will be addressed in the revision. A longer period for the formal ISCs has been already implemented (from 15 to 20 working days). Definition of priorities will also be discussed within the process of ‘Reset, Re-imagining and Re-energising for new challenges’, where the JRC will re-assess its priorities, align, and simplify its processes. By the end of 2021, a dedicated system to keep track of all requests from partner DGs and JRC responses will be set up. 3.Audit on accounting of assets in JRC The objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of the implementation of the fixed assets management accounting controls put in place by the JRC to report and present fairly the assets it owns in its accounts. There are no observations/reservations in the 2019 Annual Activity Report of JRC that relate to the area/process audited. The fieldwork was finalised on 17 December 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by the JRC to ensure the completeness of the assets registered in the accounts as well as the high level of professionalism and dedication of the staff involved, including the JRC asset accountant. In particular, the IAS identified the following positive elements: ·The establishment of an asset coordination group through which best practices and knowledge are exchanged. Thanks to this network, in 2018 Unit R.9 organised a training for the new asset manager of Karlsruhe in Ispra to introduce her to the specificities of the job. ·Unit R.9 organised accounting and JRC integrated processing system (JIPSY) trainings on a regular basis during the year and upon request. It also provides support to the JRC users of JIPSY and ABAC Assets for accounting and asset related issues. The IAS identified one very important issue concerning the asset accounting control related to process documentation, guidance and methodology and formulated one very important recommendation: JRC should complete the existing guidelines and manual with additional documentation describing the assets accounting control process, the methodology for performing the assets accounting controls and the calculation methods for the key performance indicators concerned. Additional information provided by JRC on the measures defined and/or implemented following the Internal Audit Service audit Based on the action plan accepted by the IAS on 4 March 2021, the JRC will address the identified very important issue within the end of 2021 as follows: the existing accounting guidelines and manual will be completed with additional documentation and instructions for staff in order to better describe the whole asset accounting control process (e.g. types of controls, methodology used, roles and responsibilities, reporting of information, process for annual closure). Reference will be added to the relevant DG BUDG guideline, where applicable. The calculation method for the KPIs concerned will also be described in a detailed document.

Moreover, the methodology for calculation of the error rate has been reviewed by March 2021, as scheduled, in response to an important issue identified by the auditors. The accounting error for year 2020, as included in the JRC AAR 2020, has been estimated following the revised approach. 4.Audit on Horizon 2020 grant management phase 3 in REA The objective of the audit was to assess: (1) the effectiveness of the ex ante controls on Horizon 2020 payments; (2) the compliance of the management of projects with EU restricted information with the applicable rules; and (3) the effectiveness of the process for the closure of REA’s H2020 projects. There are no observations/reservations in the 2019 Annual Activity Report of REA that relate to the processes audited. The fieldwork was finalised on 7 December 2020. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the ongoing efforts made by REA in ensuring effective implementation of ex ante controls on Horizon 2020 grant payments in the context of an increasing workload and recognised the following strengths: ·REA has a strong control environment, including systematic reviews of periodic reports by independent experts and financial verifications performed centrally by Unit C.2. This provides a solid basis for an effective implementation of ex ante controls on Horizon 2020 grant payments. ·The networks of project officers, financial officers, ethics correspondents and legal officers have regular meetings to discuss in particular the Horizon 2020 grant management process and to ensure a coherent approach and overall coordination of the process in REA. The IAS identified one very important issue concerning the management of projects with RESTREINT UE/EU RESTRICTED information and formulated one very important recommendation: REA should ensure the respect of the rules as regards the briefings for monitors and the organisation and documentation of the review meetings with RESTREINT UE / EU RESTRICTED deliverables, and align the internal REA guide to the provisions of Commission Decision No 2019/1962. Furthermore, the staff involved in managing projects with RESTREINT UE / EU RESTRICTED deliverables should attend the training courses on the RUE system and formally acknowledge their security obligations. Additional information provided by REA on the measures defined and/or implemented following the Internal Audit Service audit REA accepted the IAS recommendation and is addressing it by a dedicated action plan which includes the update of REA internal guidance, the development of specific briefing material for research consortia and experts, improved handling of review meetings involving EU restricted deliverables, and the increase of staff awareness about the security rules and their obligations while managing projects with classified information. The action plan should be fully implemented by end of January 2022, with a first set of actions completed by end of May 2021: the updated REA internal guidance and various briefing materials will be delivered according to the agreed timeline. The second part of the actions, relating to awareness raising actions and training of staff will be implemented in a subsequent step. Moreover, as REA parent DGs and other executive agencies expressed their interest in benefitting from the outcome of the action plan, a complementary action is being carried out so that the good practice can be shared in future in an efficient way. 5.Audit on the Horizon 2020 ex post audit strategy in DG RTD The objective of the audit was to assess the adequacy and effectiveness of the Horizon 2020 ex post audit strategy (‘the strategy’) in contributing to the assurance about the legality and regularity of the underlying transactions. There are no observations/reservations in the 2019 Annual Activity Reports of the Horizon 2020 implementing bodies that relate to the process audited. The fieldwork was finalised on 15 December 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts by the Common Audit Service (CAS) to design and implement the ex post audit strategy for the Horizon 2020 programme and identified the following strengths and good practices concerning the implementation of the strategy by the CAS, information technologies supporting the CAS processes, and the overall level of satisfaction with the services provided by the CAS: ·The CAS has addressed the weaknesses identified in the previous IAS audit on the ex post audit strategy for the seventh framework programme concerning the audit planning and staff allocation, the execution and documentation of audits, the supervision and quality control, and the monitoring and reporting on audit delivery, and has enhanced its internal organisation and procedures effectively. They have also made a significant effort to close individual audit files that were long overdue, including analysing and addressing the root causes of the delays. ·The audit process is supported by detailed manuals, standard procedures, and checklists. ·The audit process is supported by information technology (IT) systems COMPASS (offering fully integrated workflows for the management of internal and external audits) and AUDEX (ensuring storage of all information on the status, inputs and results of all audits).

·The recently released CAS dashboard enables the CAS and its stakeholders to easily and continuously monitor the various targets and key performance indicators set for the ex post audits (e.g. number of closed audited participations, direct coverage of the paid financial statements provided by the audits). ·Overall level of satisfaction with the services provided by the CAS: 68% of the stakeholders are overall satisfied with the services and deliverables provided by the CAS. The IAS identified one very important issue concerning the design of the strategy and formulated two very important recommendations: The Common Implementation Centre (CIC) should adjust the ex post audit strategy to allow the CAS to optimise to the extent possible the use of its resources by supplementing the common representative sample with audit samples covering the high risk areas (e.g. high risk beneficiaries or projects) for all implementing bodies, to strengthen the contribution of the ex post controls to the corrective mechanisms. It should also further develop the existing guidance on ad hoc requests for risk-based audits to clarify situations where they can be requested and to provide considerations and criteria to be used by the CAS when deciding to approve or reject the submitted requests. Furthermore, the CIC should define and implement a roadmap to complement the existing control strategy in view of progressively reducing the error rate, taking into consideration cost/benefit elements (including the impact on the business) and should ensure that the audit strategy contributes to the revised control strategy. Additional information provided by DG RTD on the measures defined and/or implemented following the Internal Audit Service audit According to the action plan, the CAS will regularly run corporate risk-based selections. For the future, the Horizon Europe ex-post audit strategy will be a risk based one.



The CIC will adapt its outreach campaign to Horizon 2020 beneficiaries to focus the content of the seminars on the cost category contributing by far the most to the error rate (personnel cost) and undertake active steps to ensure the participation of the categories of beneficiaries most vulnerable to errors (newcomers, SMEs, third country participants, one-time participants). It will analyse the possibility of enhanced in-depth ex-ante checks on a sampling basis to a number of risk-prone beneficiaries. The CAS will continue to provide information on the most common errors and feed the information presented to the officers responsible for ex-ante controls. It will also prepare an online training (webinar) that would be available to all certifying auditors upon taking up the assignment. The CIC will timely implement all the actions included in the action plan agreed via the High Level group between DG BUDG, RTD, IAS and the SG. External actions 1.Audit on performance management in FPI The objective of the audit was to assess whether FPI has put in place an adequate performance management framework to plan, monitor, manage and report on the achievement of its policy objectives. There are no observations/reservations in the past Annual Activity Reports of FPI that relate to the area/process audited. The fieldwork was finalised on 3 July 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by FPI to build its performance management framework and integrate it into its daily operations. In particular, the following strengths were observed: ·The development of an FPI manual has been a major step forward in setting a harmonised FPI-wide approach to project management, evaluation and other horizontal functions. ·The FPI results framework, included in the FPI manual, sets a solid foundation for a future FPI-wide system for monitoring the results of FPI’s instruments. ·The reporting in the Annual Activity Report and programme statements rigorously follows the objectives and indicators defined in the 2016-2020 Strategic Plan and the 2019 Management Plan. The IAS identified one very important issue concerning the fragmentation of the performance management framework and formulated the following very important recommendation:

FPI should increase the central coordination of its performance management framework, so that the framework covers all FPI’s activities coherently. Additional information provided by FPI on the measures defined and/or implemented following the Internal Audit Service audit The actions to be taken by FPI, agreed with the IAS, will be implemented progressively and include: - the setting up of a central coordination function for performance management; - further reinforcement of the coherence and steering of the Service’s performance management framework; in this context a revision of the Results Framework in conjunction with a revision of the FPI Manual is foreseen during 2021;



- establishment of the needs for outsourcing contracts from all operational units during N+1 by the end of the year N; based on the analysis of the needs communicated, FPI will advocate the added value in pooling contracts between relevant Units. This coordination exercise will be launched in 2021 (year N); - ensuring for the next Multiannual Indicative Programmes, that objectives and expected results are as specific as possible and indicators are aligned with the FPI Results Framework; - performing systematic review and annual assessment of objectives and indicators as proposed by FPI Operational Units; in this revision, attention will be given to ensure that objectives are SMART and indicators RACER; - performing a first results collection/reporting exercise in OPSYS by end 2021 where increased quality controls on indicators will be carried out; - as part of the roll out of OPSYS in 2021, FPI has and will further develop action-level indicators and Logical Framework for EOM and CFSP actions; - the appointment within each operational unit of a person responsible for quality control of the calculation of indicators; furthermore, each Unit will formalize the calculation method and introduce a double verification procedure; the central coordination function (FPI.6) will assure the coordination, relevant guidelines and homogeneous approach throughout the Service to the extent possible. The recommendation is expected to be fully implemented by the end of 2021. 2.Consulting engagement on EU visitors’ programme in FPI The objective of the consulting engagement was to provide advice to the FPI Head of Service on how to improve the cooperation of the Commission and the European Parliament on EU visitors’ programme. The scope of the engagement covered the functioning of the EU visitors’ programme, including governance and decision-making processes, the two institutions’ respective contributions to the programme, and monitoring and reporting on performance. The engagement did not assess the performance of the programme itself. As the assignment is a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS. Education and citizenship 1.Audit on effectiveness of the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes managed by DG EAC The objective of the audit was to assess whether DG EAC has put in place an effective and efficient control system for the protection of personal data of beneficiaries of and participants in the Erasmus+ and European Solidarity Corps programmes, in compliance with the key provisions of the internal data protection regulation (IDPR).

There are no observations/reservations in the 2019 Annual Activity Report of DG EAC that relate to the area/process audited. The fieldwork was finalised on 30 November 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised that DG EAC’s main actors are well aware of the IDPR, its content, importance and implications, and have already taken actions towards compliance. Notably, DG EAC is currently addressing challenges with regard to personal data protection in the context of the implementation of the new technological framework and a new information technology landscape which implements the principle of personal data ‘by design and by default’. This will enable to remove many of the inconveniences of the past architecture of DG EAC’s mature information technology environment related to the protection of personal data. The IAS identified one critical issue on transfer of personal data to third countries and four very important issues on: (1) information to all Erasmus+ participants during personal data collection; (2) supervision of processors’ compliance with the IDPR; (3) storage limitation principle; and (4) handling of personal data breaches. The IAS formulated one critical and four very important recommendations: Transfer of personal data to third countries (1 critical recommendation) DG EAC should analyse, with the support of the Data Protection Officer, how compliance of its programmes with the IDPR concerning international transfers of data can be ensured in the context of the order and the announced guidance of the European Data Protection Supervisor. Information to Erasmus+ participants during personal data collection (1 very important recommendation) DG EAC should ensure that all participants whose data are already stored in Mobility Tool+ are informed about the fact that the European Commission has their data and explain the way they can exercise their rights. For future data collection, DG EAC should inform all Erasmus+ participants before they provide any personal data about their rights as data subjects and the identity and contact details of the controller and the Data Protection Officer. Furthermore, the agreements signed by participants should be updated with a reference to the privacy statement. Supervision of processors’ compliance with the IDPR (1 very important recommendation) DG EAC should, after consulting the Data Protection Officer and the Legal Service, complete/complement the delegation agreements and grant agreements templates with: (1) National Agencies’/beneficiaries’ obligation to report to DG EAC about the data protection measures put in place for ensuring compliance with the IDPR; and (2) reinforce the existing concrete monitoring tools (e.g., checks, audits) to enable the European Commission to exercise its supervision/monitoring on how the National Agencies/beneficiaries handle personal data. Based on the reporting obligations for the National Agencies, independent audit bodies and beneficiaries, DG EAC should reinforce the existing monitoring mechanisms to effectively supervise the processes of handling of participants’ personal data by the national authorities and the beneficiaries of the Erasmus+ and European Solidarity Corps programmes. Storage limitation principle (1 very important recommendation) DG EAC should assesses the retention periods currently applied, align them with the closure of projects and calls and respect the principle of storage limitation, and ensure that after the expiry of the retention period data is effectively deleted or anonymised. Handling of personal data breaches (1 very important recommendation) DG EAC should adopt and implement a formal procedure for handling data breaches and ensure that action plans adopted to address weaknesses which led to data breaches are effectively implemented.



Additional information provided by DG EAC on the measures defined and/or implemented following the Internal Audit Service audit DG EAC has immediately taken extensive proactive measures in response to the findings and has prepared and begun implementing an action plan to address the recommendations. Four out of the six actions to mitigate the risks identified by the IAS are now substantially completed or launched. Two of the six recommendations require additional time due to the roll-out of the new programme and the process regarding third country transfers of contact data, respectively. Looking at the plan as a whole by sub-action, half of the sub-actions specified in the overall plan are now complete. On 25 March 2021, the IAS concluded a first follow-up of the audit on protection of personal data. Based on their review of the information and supporting documents provided, the IAS consider that DG EAC partially mitigated the risks related to observations on third country transfers of personal data (by improving the transparency about the level of protection of the data in the host countries) and the procedure on data breaches (a revised coherent procedure has been adopted). The IAS decided, on that basis, to downgrade the recommendations respectively from ‘critical’ to ‘very important’ and from ‘very important’ to ‘important’. 2.Audit on grant management (phase 3) – ex post controls in EACEA The objective of the audit was to assess the effectiveness of the design and implementation by EACEA of its ex post control strategy in order to obtain reasonable assurance on the legality and regularity of underlying transactions.

There are no observations/reservations in the 2019 Annual Activity Report of EACEA that relate to the area/process audited. The fieldwork was finalised on 18 June 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the efforts made by the agency in designing and implementing the ex post control strategy for the grant management of the programmes it implements and identified the following strengths and good practices: ·The internal review process on the quality and content of the audit reports and their findings, based on the four-eyes principle (from ex post controls and operational units) and two stages of review of the audit report (at the preliminary and the draft report). ·The effective collaboration among the operational units and the ex post team as well as early coordination with the anti-fraud sector which ensures an effective exchange of information, synergies in the decision making process and early treatment of potential fraud cases. The IAS did not formulate any critical or very important recommendations. 3.Audit on grant management of the 2014-2020 Justice and Rights, Equality and Citizenship programmes – implementation in DG JUST The objective of the audit was to assess whether DG JUST has put in place effective processes for: (1) managing the project implementation phase; and (2) implementing and reporting on ex post audit results. In the 2019 Annual Activity Report of DG JUST there is one reservation regarding the process audited for centralised direct management – grants (2007-2020 programmes) as the residual error rate at year-end exceeds 2% (equal to 2.65%). DG JUST assessed that the financial impact of the reservation on the assurance equals to 0.94% of the payments made by DG JUST in 2019 amounting to EUR 1.68 million. The fieldwork was finalised on 30 July 2020. All observations and recommendations relate to the situation as of that date. The audit identified the following strengths. ·DG JUST has provided extensive support to applicants and beneficiaries throughout the grant award and implementation phases. The client oriented culture together with constant contacts with beneficiaries and additional pedagogical efforts made by project officers on a daily basis to explain programme and the grant rules, technicalities of the information technology systems especially for first time applicants are good practices to be followed. ·The grant management sector of Unit JUST.04 has made effective use of the various reporting functionalities of the information technology system for grant management, including for example, the systematic use of the business activity monitoring reports and CORDA database. This enables robust monitoring and regular assessment of achievements against key indicators. The IAS did not formulate any critical or very important recommendations. Economic and financial affairs 1.Limited review on the implementation of the new internal control framework in DG COMP The objective of the limited review was to assess if the authorising officer by delegation of DG COMP had performed an adequate overall assessment of the presence and functioning of all internal control principles and components as laid down in the Communication on the revision of the internal control framework. There are no observations/reservations in the 2019 Annual Activity Report of DG COMP that relate to the area/process reviewed. The fieldwork was finalised on 21 August 2020. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by DG COMP to strengthen its internal control system. Notably, the following strengths were identified: ·DG COMP has developed an ‘Internal Control Strategy of DG Competition’ which sets out control environment, inherent risks, control framework and monitoring mechanisms for the internal control system. This demonstrates the Directorate-General’s commitment to set the right tone at the top. ·DG COMP has implemented a decentralised monitoring system for the internal control framework which involves all units. In particular, the units have to conduct the self-assessment and to monitor on an ongoing basis the controls under their responsibility. Representatives of the units and the Internal Control Officer participate in the Internal Control Network, which ensures coordination