EN    EN EN 
 
EN    EN  COMMISSION OF THE E UROPEAN COMMUNITIES 
Brussels, 30.7.2008 
SEC(2008) 2361 final 
  
COMMISSION STAFF WORKING DOCUMENT 
  
Annex to the  
 
 
COMMUNICATION FROM THE COMMISSION 
TO THE COUNCIL AND THE EUROPEAN PARLIAMENT 
Annual Report  
to the Discharge Authority  
on Internal Audits Carried out in 2007 
 
(Article 86 (4) of the Financial Regulation) 
 
 
 
{COM(2008)499 final} 
 
EN 2   EN TABLE OF CONTENTS 
Introduction ................................................................................................................... ............. 5 
1. ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS ................................. 8 
1.1. SG/BUDG/REGIO/EMPL/RTD/INFSO /JLS/AIDCO/ADMIN/DIGIT - AAR 
Assurance Process........................................................................................................ 8 
1.2. ADMIN - Follow-up of the Review of DG ADMIN Human Resources Management 
– Phase 1 ...................................................................................................................... 9 
1.3. BUDG - ABAC - Implementation of Accrual-Based Accounting............................... 9 1.4. BUDG – Comparative Analysis of the Accruals Based Accounting Systems and 
Financial Reporting as implemented by the European Commission and some 
Member States............................................................................................................ 11 
1.5. COMM – Examination of the purchase of office buildings in Cyprus...................... 12 
1.6. COMM – Special report on tendering pro cedures for transmission services in DG 
COMM ....................................................................................................................... 13 
1.7. DGT – The Management of Translation Demand ..................................................... 14 1.8. DGT – Follow-up of IAS validation of self-assessment of the IAC of DGT ............ 15 
1.9. DIGIT – IT procurement and se rvice delivery in DG DIGIT.................................... 15 
1.10. EPSO – Follow-up of the Limited Review  on the selection process as managed by 
EPSO.......................................................................................................................... 1 6 
1.11. ESTAT – 2
nd Follow-up Audit of the In-d epth Audit of ESTAT .............................. 17 
1.12. ESTAT – IT Procurement and Service Delivery in ESTAT...................................... 17 1.13. OIB –Management of procurement contracts in OIB................................................ 18 1.14. OIB –Management of buildings procurement contracts ............................................ 19 1.15. OIB – Follow-up on buildings infrastructu re managed by the European Commission20 
1.16. OIB – Follow-up on transaction testing..................................................................... 21 1.17. OIB – Evaluation of targeted Inte rnal Control Standards in OIB.............................. 21 
1.18. OIL – Management of Procur ement Contracts in OIL .............................................. 22 
1.19. PMO – Controls over Payment of Pensions............................................................... 23 1.20. SCIC – Follow-up of validation of self-assessment of the SCIC IAC....................... 25 
2. INTERNAL POLICIES ............................................................................................. 25 2.1. COMP - Follow-up report on th e Audit of IT Controls............................................. 25 
2.2. DG EAC – ABAC-Implementation of Accrua ls Based Accounting in DG EAC/2006 
Closing ....................................................................................................................... 2 5 
 
EN 3   EN 2.3. DG EAC – Follow-up Audit Report on the Implementation of ABAC in DG EAC. 27 
2.4. EACEA – Implementation of the Financial Circuits for Operational Budget of the 
Education, Audiovisual and Culture  Executive Agency (EACEA)........................... 27 
2.5. DG ENTR – Management Letter Ex-Post Controls (no report) ................................ 29 2.6. DG ENTR - Follow-up report on the financ ial management of the innovation relay 
centre (IRC) network.................................................................................................. 29 
2.7. DG ENTR - Follow-up Audit Report on the IAS Validation of Self-Assessment of 
Internal Audit Capability  (IAC) of DG ENTR .......................................................... 29 
2.8. DG ENV – Monitoring of the Implementation of EU Law ....................................... 30 2.9. DG ENV – Second Follow-up audit of  DG ENV's 2004 In-depth audit ................... 31 
2.10. DG ENV – Grant management und er the non-LIFE-programmes ............................ 31 
2.11. DG INFSO – Ex-Post Controls.................................................................................. 32 2.12. JRC – Second Follow-up of In-Depth Audit of JRC of 2004.................................... 33 2.13. DG MARKT - Financial Manageme nt and Financial Circuits .................................. 34 
2.14. DG RTD - Follow-up report on the in-depth  audit of DG RTD (2003) and the audit 
on financial circuits & financia l management in DG RTD (2005)............................ 34 
2.15. DG RTD - IT procurement and se rvice delivery in DG RTD.................................... 34 
2.16. DG TAXUD - IT procurement and se rvice delivery in DG TAXUD........................ 35 
2.17. DG TREN - Follow-up report on the audit of  financial management and financial 
circuits in DG TREN.................................................................................................. 36 
2.18. DG TREN - Follow-up Audit Report on "A udit de processus de gestion de 
l'informatique locale" ................................................................................................. 37 
2.19. TREN-IEEA - Audit of  the Intelligent Energy Executive Agency............................ 37 
2.20. DG TREN - Follow-up of validation of self-assessment of DG TREN IAC............. 39 
3. STRUCTURAL MEASURES AND COMMON AGRICULTURAL POLICY....... 39 
3.1. AGRI - Local IT systems of DG AGRI feeding into ABAC..................................... 39 
3.2. AGRI - Final Audit Report on DG AGRI – In terventions in Agricultural Markets.. 40 
3.3. AGRI - Follow-up Audit Report on Structural Funds – DG AGRI EAGGF-
GUIDANCE............................................................................................................... 41 
3.4. EMPL – Prevention and detection of  fraud in the Structural Funds.......................... 42 
3.5. EMPL – Implementation of Programmes in the New Member States ...................... 43 3.6. FISH – Follow-up Final Audit Report on Stru ctural Funds - Financial instrument for 
Fisheries Guidance (FIFG)......................................................................................... 44 
3.7. REGIO – Implementation of progra mmes in the new Member States ...................... 44 
 
EN 4   EN 3.8. REGIO – Follow-up Audit Report on the European Regional Development Fund 
(ERDF) – Audit of the Implementation of Article 38 of Council Regulation 
1260/1999 in DG REGIO........................................................................................... 45 
3.9. REGIO – Prevention and detection of  fraud in the Structural Funds ........................ 45 
4. EXTERNAL POLICIES ............................................................................................ 46 4.1. AIDCO - Eligibility of Costs under the Financial and Administrative Framework 
Agreement with the United Nations by DG AIDCO ................................................. 46 
4.2. AIDCO - Ex-Post Control Activities in DG AIDCO................................................. 48 4.3. AIDCO - Follow-up Audit Report on NGO funding in DG AIDCO ........................ 49 4.4. AIDCO - Financial management main  programmes in Directorate D ...................... 50 
4.5. ECHO - Follow-up audit of NGO funding in DG ECHO.......................................... 51 4.6. ECHO - Monitoring and superv ision tools in DG ECHO.......................................... 51 
4.7. ECHO, ADMIN – Management letter on s ecurity issues in DG ECHO (no report). 53 
4.8. ELARG - Follow-up Audit Report on th e In-depth Audit of DG ELARG ............... 53 
4.9. RELEX - First Follow-up audit of the A udit on Handling of classified information 
and communication among the De legations and DG RELEX................................... 53 
4.10. TRADE - Implementation of selected Inte rnal Control Standards in DG TRADE... 54 
 
 
EN 5   EN  
INTRODUCTION  
This Annex is based on the original executive summaries (reflecting the state of play at the 
time when the audits were finalised) of audit engagements finalised by the IAS in 2007. 
Each summary underwent the applicable standard  professional validati on and contradictory 
procedures between auditor and audi tee at the time of finalisation. 
The tables on implementation st atus contain both the auditees' view and the IAS view, where 
available. 
For 2007 audits, more detailed follow-up reporting will be covered in the Annual Report for 
2008. 
 
 
DG/Service 
  
Engagement 
  
Issue date 
Administrative and other support systems  
SG/BUDG/REGIO/EMPL
/RTD/INFSO/JLS/AIDCO
/ADMIN/DIGIT AAR Assurance Process 21 January 2008 
ADMIN  Follow-up human resources management phase I 13 December 
BUDG ABAC-implementation of accrual-based accounting 
(parts 1 and 2) 3 May 
BUDG Comparative Analysis of  the Accrual-Based Accounting 
Systems and Financial Reporting as Implemented by the 
European Commission and some Member States 26 April 
COMM Examination of the purchase of office buildings in 
Cyprus 14 September 
COMM Special report on tendering procedures for transmission 
services in DG COMM 14 December 
DGT The management of translation demand 13 June 
DGT Follow-up of IAS validation of self-assessment of the 
IAC of DGT 14 December 
DIGIT IT procurement and service delivery in DG DIGIT 5 December 
EPSO Follow-up of limited review of the selection process as 
managed by EPSO 18 December 
ESTAT Second follow-up audit of the in-depth audit of Eurostat 9 March 
ESTAT IT procurement and service delivery in ESTAT 20 November 
OIB Management of procurement contracts in OIB 3 April 
OIB Management of buildings procurement contracts by OIB 3 April 
OIB Follow-up on buildings infrastructure managed by the 
European Commission 8 February 
 
EN 6   EN OIB Follow-up on transaction testing 20 April 
OIB Evaluation of targeted ICS 4 October 
OIL Management of procurement contracts in OIL 3 April 
PMO Controls over payment of pensions 7 September 
SCIC Follow-up of validation of self-assessment of the SCIC 
IAC 29 November 
Internal policies  
COMP Follow-up report on the audit of IT controls in DG 
COMP 16 May 
EAC ABAC - implementation of accrual-based accounting in 
DG EAC/2006 closing 18 July 
EAC Follow-up report on the implementation of ABAC in 
DG EAC 18 July 
EACEA Implementation of the financial circuits for operational 
budget of the EA C executive agency 19 March 
ENTR Management letter on ex-post controls 20 April 
ENTR Follow-up report on the financial management of the 
Innovation Relay Centre (IRC) network 23 October 
ENTR Follow-up of validation of self-assessment of  DG 
ENTR IAC 18 December 
ENV Monitoring the implementation of EC law 22 January  
ENV Second follow-up audit of DG ENV's 2004 in-depth-
audit 29 March 
ENV Grant management of non-life-programmes 18 September 
INFSO Ex-post controls 20 February 
JRC Second follow-up of in-depth audit of the JRC of 2004 21 September 
MARKT Follow-up report on DG MARKT financial 
management and financial circuits 18 January 
RTD Follow-up report on the in-depth audit of DG RTD 
(2003) and the audit on financial circuits & financial 
management in DG RTD (2005) 16 March 
RTD IT procurement and service de livery in DG RTD 30 November 
TAXUD IT Procurement an d service delivery in DG TAXUD 18 October 
TREN Follow-up report on the audit of financial management 
and financial circuits in DG TREN 20 March 
TREN Follow-up report of "Audit de processus de gestion de 
l'informatique locale" 7 September 
TREN-IEEA TREN executive agency 30 January 
TREN Follow-up of validation of self-assessment of DG 
TREN IAC 20 December 
Structural Measures and Common Agricultural Policy  
AGRI Local IT systems of DG AGRI feeding into ABAC 25 May 
 
EN 7   EN AGRI Interventions in agricultural markets 23 November 
AGRI Follow-up report on structural funds - DG AGRI 
EAGGF GUIDANCE 22 November 
EMPL Prevention and detection of fraud in the Structural 
Funds 19 December 
EMPL  Implementation of programmes in the new Member 
States 12 December 
FISH Follow-up audit report on Structural Funds - financial 
instrument for fisheries guidance 20 July 
REGIO Implementation of programmes in the new Member 
States 13 November 
REGIO Follow-up on the ERDF - audit of the implementation 
of Article 38 of Council Regulation 1260/1999 14 December 
REGIO Prevention and detection of fraud in the Structural 
Funds 19 December 
External Policies  
AIDCO Eligibility of costs under DG AIDCO's financial and 
administrative framework agreement with the United Nations 19 June 
AIDCO Ex-post control activities in DG AIDCO 18 July 
AIDCO Follow-up audit on NGOs funding in DG AIDCO 31 July 
AIDCO Financial Management of Main Programmes in 
Directorate D 20 December 
ECHO Follow-up audit on NGOs funding in DG ECHO 6 June 
ECHO Monitoring and supervision tools in DG ECHO 23 November 
ECHO, ADMIN Management letter on secu rity issues in DG ECHO 29 November 
ELARG Follow-up audit report on the in-depth audit of DG 
ELARG 15 March 
RELEX Follow-up audit of the a udit on handling of classified 
information and communication among the delegations 
and DG RELEX 4  July 
TRADE Implementation of selected internal control standards in 
DG TRADE 13 June 
 
EN 8   EN  
1. ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS 
1.1. SG/BUDG/REGIO/EMPL/RTD/INFSO/J LS/AIDCO/ADMIN/DIGIT - AAR 
Assurance Process 
Objectives and Scope 
The main objective of the audit was to assess the effectiveness of the Annual Activity Report 
(AAR) assurance process as a w hole and, in particular, the exte nt to which it provides a sound 
basis to support the reasonable assurance gi ven by management to the Commission on the 
functioning of its internal control system s. These assurances from the Directors 
General/Heads of Services provide the basi s for the Synthesis Report of the Commission, 
which is its main accountability instrument in terms of taking political responsibility for the 
management of the Commission. These accounta bility instruments were introduced in 2000 
and are key components of the Commission's Reform. 
This audit engagement looked at the control sy stems and procedures set up in selected DGs 
and families of DGs, aimed at building the necessary assurances, together with a consideration of the central co-ordination and guidance roles exercised by both the Secretariat 
General and DG BUDG. The audit has focuse d only on the parts of the AAR process 
concerned with the specific management and control assurances pr ovided in the annual 
declaration, rather than on those linked to the achievement of political objectives defined in 
the AMP. Moreover, it has not covered the completeness and accuracy of the financial 
information (accounts) provided by DGs in their AARs. 
In the present engagement, the IAS has aimed at identifying possible improvements in the 
AAR assurance building processes, together with best practices amongst individual DGs 
and/or families of DGs. In this way, this engagement is also expected to contribute to the Commission objective leading up to a posit ive Declaration of Assurance (DAS). 
As defined in the IAS strategic audit pl an 2007-2009, endorsed by the APC on 2 February 
2007, the present engagement has covered for the reporting year 2006: 
• The Structural Funds "fam ily" (DG REGIO/DG EMPL), 
• The Research "family" (DG RTD/DG INFSO), 
• DG JLS, 
• SG & DG BUDG (in particular as co -ordinators of the AAR process). 
In order to help maximise the coverage and to  cover all management modes, AIDCO has also 
been included as part of the analysis. 
  
 
EN 9   EN 1.2. ADMIN - Follow-up of the Review of DG  ADMIN Human Resources Management 
– Phase 1 
Objectives and Scope 
The objective of this first follow-up engage ment is to assess the progress made in 
implementing the issues accepted for cons ideration that resulted from the Review of DG 
ADMIN Human Resources Management – Phase 1  – carried out in 2005 (date of the Final 
Report: 7 April 2006). 
In line with IAS follow-up policy, this follow-up  engagement does not result in an assessment 
of the adequacy of controls as a whole, but fo cuses on the specific issues for consideration in 
the original review. 
 
 
1.3. BUDG - ABAC - Implementation of Accrual-Based Accounting 
Objectives 
 
As from 1 January 2005, the general accounts of  the European Communities are maintained 
according to the principles of accruals based accounting. The new accounting system of the 
Commission, hereafter called ABAC , serves as the technical and operational platform for the 
new accounting framework. According to the Financial Regulation (FR), the Accounting 
Officer of the Commission in DG BUDG is res ponsible for the mainte nance of the overall 
accounting framework, including an effective system of accounting controls, while the 
authorising officers are responsible for impl ementing the budget in a ccordance with the 
principles of sound financial management and for ensuring compliance with the requirements 
of legality and regularity. The scope and nature of  those responsibilit ies can be found under 
different articles in the FR and its Implementing Rules (IR). 
The objective of the present audit was to assess th e current status of the systems and controls 
put in place centrally by DG BUDG in order to ensure the qualit y of the accounting data – in 
terms of their integrity, completeness and accur acy – and the financial information derived 
from such data.  
The term 'accounting data' means data entered into ABAC Workflow, either directly or 
through the local systems in the DGs and, therea fter, transferred via interface to the central 
accounting system (SAP), its Gene ral Ledger or any of the other modules that are part of it. 
Financial information means, primarily, the y ear-end accounts and financia l statements of the 
Commission.  
The present audit does not assess the quality of the accounting data pr ovided by the DGs via 
their local systems or manually encoded into ABAC Workflow. 
The present audit included a follow-up of one recommendation classified as very important 
and which was issued in 2005 as a result of an audit follow-up of thre e different IAS audits 
targeting DG BUDG and performed during 2002-2003. 
 
EN 10   EN  
Scope 
 
The scope of the audit consisted of three di fferent parts, namely Accountancy (Part 1), 
Supporting IT-systems (Part 2) and Compara tive analysis of the accounting systems as 
implemented by the European Commission and some Member States (Part 3). 
The present audit report include s the results in the form of an audit opinion, findings and 
recommendations related to Parts 1 and 2.  
The results of Part 3 are not included in this audit report and will be reported separately. This 
is due to the different nature of the exercise, which was to make a comparative analysis, at a 
general level, of the current status of accr uals based accounting and financial reporting 
between three Member States – United Kingdom,  Sweden and Finland – and the European 
Commission. 
 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 8 8 100 0 0 
Important 13 11 84,62 2 15,38 
Desirable 3 3 100 0 0 
Total 24 22 91,66 2 8,33 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 8 3 37,50 5 62,50 
Important 11 7 63,64 4 36,36 
Desirable 3 3 100 0 0 
Total 22 13 59,10 9 40,90 
 
 
EN 11   EN 1.4. BUDG – Comparative Analysis of the A ccruals Based Accounting Systems and 
Financial Reporting as implemented by  the European Commission and some 
Member States 
Purpose and Objective 
 
This comparative analysis was carried out as part  of an audit performed by the Internal Audit 
Service of the European Commission. The aud it targeted the new acc ounting system of the 
Commission, effective as from 1 January 2005 a nd based on the Interna tional Public Sector 
Accounting Standards (IPSAS). 
The purpose of the analysis was to make a co mparison between the ac cruals based accounting 
systems and related financial reporting as impl emented by four different actors, namely the 
European Commission and the Governments of  the United Kingdom, Sweden and Finland. 
Our choice of the three countries was based – apart from the fact that they are members of the 
European Union – on their record as forer unners among the public administrations which 
have made the transition into accruals  based accounting and financial reporting. 
The objective of the analysis was to gain unde rstanding, at a general level, of the current 
status of implementation of accruals based a ccounting and financial reporting in these three 
Member States as well as in the Commi ssion – including the principal developments 
preceding the transition – and to share these expe riences with the participants by means of an 
overview report. 
More specifically, our objective was to identif y both the similarities and differences in the 
approach taken by the four actors participating in  the review, which might in turn prove to be 
useful input for them as their respective system s evolve. The report does not seek to make any 
qualitative assessments on the respective approaches. Neither does it make any recommendations. 
 
Scope and Methodology 
 
Within the scope of our analysis we contacte d, and subsequently, me t with, eight different 
bodies representing the European  Commission and the three Me mber States, as follows: 
(1) European Commission / Direct orate-General for Budget  
(2) HM Treasury / UK 
(3) National Audit Office / UK 
(4) Ministry of Finance / Sweden 
(5) Swedish National Financial Management Authority / Sweden 
(6) National Audit Office / Sweden 
(7) Ministry of Finance / Finland 
(8) State Audit Office / Finland 
 
EN 12   EN The factual details underlying the observations c ontained in this report have been checked 
with the bodies concerned afte r our meetings with them.  
To support the review process both prior to and after the meetings/inter views, we reviewed a 
significant amount of documenta tion such as the legal basis underpinning the framework of 
accounting and financial reporting which has been set up by each of the four actors concerned 
and descriptions of systems and procedures. 
We also reviewed examples of annual reports and accompanyi ng financial statements of 
Government departments/agencies as well as re ports at a consolidated level. The aim of our 
review of this material was simply to gain a general understanding of the principles underlying the preparation of such reports, their contents and general presentation. 
 
1.5. COMM – Examination of the purchase of office buildings in Cyprus 
The annual Work Programme 2007 of the IA C of DG COMM included an audit on Asset 
Management. The objectives and scope were to: 
 
1. Review, test and evaluate the internal cont rols over the asset management within the 
Representations and in Headquarters units; 
2. Review and evaluate the impl ementation of ABAC Assets; 
3. Identify and analyse the processes with in DG COMM used for the (co)purchase of 
buildings, including those located in Member States' capital cities. 
In order to share the knowledge acquired by the IAS in previous audits in the area, the IAS 
was asked to participate in the audit mission to  Cyprus in June 2007 to  specifically cover (3) 
above in respect of the (co)purchase of the Co mmission's Representation building in Nicosia. 
The aim of the present note is to outline the main findings resulting from the IAS's 
examination, together with a list of recommendations on how to address the weaknesses 
identified. As was agreed, the IAS's findings w ill be incorporated into the overall reporting 
and validation process. The IAS will not issu e a separate report itsel f to DG COMM, but of 
course we are available, where necessary, to discuss the points raised with DG COMM. 
 
Objective and scope 
The objective was to identify and assess the controls put in plac e by DG COMM for the 
(co)purchase of the Commission's Represen tation building in Cyprus (Nicosia). 
 
 
 Acceptance 
Status Yes 
 No 
 
 
EN 13   EN Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Important 1 1 100 0 0 
Total 3 3 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 2 2 100 0 0 
Important 1 1 100 0 0 
Total 3 3 100 0 0 
 
1.6. COMM – Special report on tendering procedu res for transmission services in DG 
COMM 
Objectives and Scope 
 
The Audit on the Tendering Procedures fo r Transmission Services in DG COMM was 
performed at the request of the Director-General of DG COMM.  
The objective  of this audit was to a ssess whether the call for tenders PO/2006-26/C1 – as 
mentioned in the scope below – complied with the Financial Regulation (FR) and its Implementing Rules (IR) and with the "Public  Procurement Vade-Mecum", issued by DG 
BUDG and to review specific allega tions made concerning this contract. 
The scope  of this audit was the call for tender PO/2006-26/C1 concerning an open procedure 
for the supply of transmission services.
1 The call for tender cont ained the following lots: 
Lot I: Provision of the technical  infrastructure necessary for the transmission of television 
services via satellite. 
Lot II: Ad hoc provision of transmission bandwidth and supporting services for TV 
transmissions. 
Lot III: Permanent bidirectional video link between Luxembourg and Brussels. 
                                                 
1 See Contract Notice: 2006/S128-136072, published in the OJEU S128 on 08/07/2006. 
 
EN 14   EN In order to be able to interpret the tendering sp ecifications included in this call for tender, the 
previous contract – th e negotiated procedure PN/2001-41/B3 concerning the supply of 
satellite transmission services (and especially its lot I)2 – was also analysed. 
The following were not covered in this audit: 
• Commission policies (e.g. Europe by Satellite (EbS) objectives).  
• Data protection issues. 
• Document access issues. 
No scope limitations were identified. 
 
1.7. DGT – The Management of Translation Demand 
Objectives and Scope 
 
In accordance with the IAS audit plans 2006-2007, this audit covered the management of 
translation demand within DGT, from the pl anning to the deliver y of the requested 
translations. Some aspects of the translations  directly managed by other Commission Services 
with no or little involvement fr om DGT were also addressed. 
The scope did not include the management of web translation. The objectives of this audit were to assess th e adequacy, efficiency and effectiveness of 
internal control systems related to the ma nagement of transla tion demand within the 
Commission. 
There is no reservation in the AAR c oncerning the areas/processes audited. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very important 4 4 100 0 0 
Important 1 1 100 0 0 
Total 5 5 100 0 0 
 
                                                 
2 Negotiated Procedure PN/2001-41/B3 concerning the supply  of satellite transmission services, Lot I: Provision 
of the technical infrastructure necessa ry for the transmission of a television service via satellite; Lot II: Ad-hoc 
provision of transmission bandwidth and supporting services and equipment for TV transmissions to and from 
any part of the world, at short notice. 
 
EN 15   EN  Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 4 4 100 0 0 
Important 1 1 100 0 0 
Total 5 5 100 0 0 
 
1.8. DGT – Follow-up of IAS validation of self-assessment of the IAC of DGT 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted3 recommendations that resulted from the IAS Validation of Self-Assessment of the 
Internal Audit Capabili ty (IAC) of DGT, which was carried  out from February tol June 2006.  
1.9. DIGIT – IT procurement and service delivery in DG DIGIT 
Objectives and Scope 
This audit is part of a wider audit, the objective of which was to assess the adequacy and 
effective application of  the internal c ontrol system (ICS), risk management and governance 
processes related to IT procurement and the delivery of IT services to the European Commission. 
The purpose of the audit was to assess whet her the ICS provides reasonable assurance 
regarding: 
• Compliance  with the Commission rules on IT proc urement, the Financial Regulation and 
the appropriate Commission Internal Control St andards. The issue of compliance with the 
provisions of Regulation (E C) 45/2001 on the protection of  personal data was also 
considered. 
• Effectiveness and efficiency  of the procurement and servic e delivery processes. The IAS 
examined whether DIGIT is making the best use of all type of IT human resources and the 
way in which the follow-up and management of  IT activities provides assurance that the 
Commission is obtaining the right service at the right price. In  this respect, we also took 
into account the need to simplify internal administrative rules and procedures. 
The audit of DG DIGIT's IT procurement and serv ice delivery is part of the overall IAS audit 
objective to provide an audit opinion on IT procurement and service delivery in the 
Commission. After having audite d a sample of DGs, an overv iew report will be produced 
containing the consolidated results and conclu sions on the above-mentioned audits and on the 
crosscutting observations  and recommendations.  
                                                
 
3 The following recommendation was not accepted by DGT: IAS-2006-DGT-001: 8 standard 2410: criteria for 
communicating " The IAC should ensure the timely communication of action plans related to its audit 
engagements after having assessed their reasonableness" . 
 
EN 16   EN As a result of the desk review and the interviews in the preliminary survey  (which took into 
account the work already performed by the IAC, the European Court of Auditors and the IAS) 
the scope of the audit engagement in DG DI GIT focused on the following aspects of the 
internal control system, risk management and governance of IT procurement and service 
delivery: 
• Contract preparation  process, from the identification of the business needs to the signing 
of the contracts and specific contracts. This  can include all type s of IT expenditure 
(equipment and services). 
• Management and monitoring of these contracts with external contractors.  The audit 
included the monitoring of se rvices agreed to under "fixed -price" or "time-and-means" 
contracts, as well as the measures taken to en sure continuity of business on the expiry of 
the contracts. The management of certain se rvices and equipment wa s not included insofar 
as these are already covered by other IAS au dits (data centre, te lecommunications or  
ABAC ASSETS), However, information syst ems developed and maintained by external 
suppliers were included in the scope. 
 
DIGIT's 2006 Annual Activity Report  raised the following issue spec ifically in re lation to the 
area covered by the scope of this audit: 
"The lack of necessary staff (due to the abse nce of EUR-12 AD IT reserv e list) with technical 
ICT and project management competences has pu t DIGIT in difficulties to deliver foreseen 
outputs".  
No scope limitations were identified. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 8 8 100 0 0 
Desirable 2 2 100 0 0 
Total 11 11 100 0 0 
 
1.10. EPSO – Follow-up of the Limited Review on  the selection process as managed by 
EPSO 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
issues accepted for consideration that resulted  from "The Limited Review on the selection 
process as managed by EPSO" carried out in 200 5 (date of the Final Re port: 7 April 2006).  
 
EN 17   EN This follow-up does not result in an assessment of the adequacy of controls as a whole but 
focuses on the specific issues raised  in the original limited review. 
 
1.11. ESTAT – 2nd Follow-up Audit of the In-depth Audit of ESTAT 
Objectives and Scope 
 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from the in-depth audit of ESTAT carried out in 2003 
(final report dated 19 March 2003)  and that were outstanding at the time of the first follow-up 
audit conducted in 2005 (final report dated 5 October 2005). 
In line with IAS policy, this follow-up audit does not result in an assessment of the adequacy 
of controls as a whole but focuses on the 16 re commendations assessed as still being open at 
the time when the first follow-up audit was completed. 
 
1.12. ESTAT – IT Procurement and Service Delivery in ESTAT 
Objectives and Scope 
This audit forms part of a wider audit, the ob jective of which was to assess the adequacy and 
effective application of  the internal c ontrol system (ICS), risk management and governance 
processes related to IT procurement and the delivery of IT services to the European Commission. 
In particular, the audit assessed whether the ICS provides reasonable assurance as regards: 
 
y Compliance  with the Commission rules on IT proc urement, the Financial Regulation and 
the appropriate Commission Internal Control Standards. We also looked at compliance 
with the provisions of Regulation (EC)  45/2001 on the protection of personal data. 
y Effectiveness and efficiency  of the procurement and servic e delivery processes. The IAS 
examined whether ESTAT makes the best use of  all type of IT human resources and the 
way in which the follow-up and management of  IT activities provides assurance that it 
obtaining the right service at the right price. In  this respect, we also took into account the 
need to simplify internal admi nistrative rules and procedures. 
The audit of IT procurement and service delivery  of ESTAT is part of the overall IAS audit 
objective to provide an audit opinion on IT Procurement and Service Delivery in the Commission. After having audite d a sample of DGs, an overv iew report will be produced 
containing the consolidated results and conclu sions on the above-mentioned audits and on the 
crosscutting observations  and recommendations.  
 
EN 18   EN As a result of the desk review and the intervie ws in the preliminary survey (which took into 
account the work already performed by the IAC, the European Court of Auditors and the IAS) 
the scope of the audit engagement in ESTAT fo cused on the following aspects of the internal 
control system, risk management and governan ce processes of IT procurement and service 
delivery: 
 
y Contract preparation  process, from the identification of the business needs to the signing 
of the contracts and specific c ontracts. This process included  all types of IT expenses 
(equipment and services). 
y Management and monitoring of these c ontracts with external contractors . The audit 
included the monitoring of services agreed to as "fixed-price" or "time-and-means" as well 
as the measures taken to ensure business continuity on the expiry of contracts. 
There are no observations/reservations in the Annual Activity Report that  relate to the area 
audited.  
No scope limitations were identified. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 3 3 100 0 0 
Important 5 5 100 0 0 
Desirable 1 1 100 0 0 
Total 9 9 100 0 0 
 
 
1.13. OIB –Management of procurement contracts in OIB 
Objectives and Scope 
The objective of the audit was to assess the ad equacy and effectiveness of OIB's internal 
control system with respect to the "Re gularity of Financial Management" of the 
procurement process. The present report focu ses on OIB's procurement arrangements with 
respect to non-buildings  contracts. The audit focused pr incipally on procurement contracts 
completed during the period 2005-2006.  
 
EN 19   EN The audit includes the follow up of the form er audit engagement conducted in 2004 on 
transaction testing (IAS-2004-OIB-OOl Risk As sessment OIB - OIB Transaction Testing), 
which will be covered in a separate report. 
A reservation was made in the AAR 2005 in this area, due to the difficulties in keeping to 
the timetable of the calls for tenders and, as a consequence of this, the need to conclude 
negotiated procedures for exte nsions of the contracts. 
It should be noted that at pr esent four cases are currently under investigation by OLAF. On 
these cases, OLAF has been consulted. This has not resulted in any scope limitations in the 
context of this audit. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Critical 1 0 100 1 100 
Very Important 6 6 100 0 0 
Important 7 7 100 0 0 
Total 14 13 92,86 1 7,14 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 6 4 66,67 2 33,33 
Important 7 7 100 0 0 
Total 13 11 84,62 2 15,38 
 
1.14. OIB –Management of buildings procurement contracts 
Objectives and Scope 
The objective of the audit was to assess the ad equacy and effective application of OIB's 
internal control system with respect to the "R egularity of Financial Management". The present 
report focuses on buildings procurement contr acts and related issues, such as the policy 
development process, the governance structure,  the decision making process, portfolio 
management and long term planning of the build ings policy. OIB's procurement arrangements 
in respect of non-buildings contracts have b een examined separately and addressed in a 
separate report. The audit focused mainly on Buildings Procurement Projects completed during the period 2005-2006. 
 
EN 20   EN The results of the audit of in 2002 (IAS Task 01 /1B/01) on the buildings infrastructure were 
the subkect of a follow-up, which will be covered in a separate report. 
There are no observations/reserva tions in the AAR 2005 that relate  to the specific buildings 
procurement area audited, even though there is a general reservation rega rding "deficiency in 
OIB's contracts and procurement management". 
 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Critical 1 1 100 0 0 
Very Important 6 6 100 0 0 
Important 4 4 100 0 0 
Total 11 11 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Critical 1 1 100 0 0 
Very Important 6 6 100 0 0 
Important 4 2 50 2 50 
Total 11 9 81,82 2 18,18 
 
1.15. OIB – Follow-up on buildings infrastructure managed by the European 
Commission 
Objectives and Scope  
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the Audit of Buildings Infrastructure managed 
by the European Commission, carried out in 2002. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 
 
EN 21   EN  
1.16. OIB – Follow-up on transaction testing 
Objectives and Scope 
The objective of the follow-up engagement is to  assess the progress made in implementing the 
accepted recommendations that resulted from the Audit of Transaction testing carried out in 
2004. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
1.17. OIB – Evaluation of targeted Internal Control Standards in OIB 
Objectives and Scope 
The objective of the audit was to  assess the adequacy and effec tiveness of the implementation 
of Internal Control Standard s n°s 15 (Documentation of pro cedures), 16 (Segregation of 
duties), 17 (Supervision) and 24 (Annual review of  internal control) w ithin OIB. Previous 
IAS audits of OIB have indicated a need to  look at these specific standards in OIB and 
consider the scope for making improvements. 
The Internal Control Standards specify the requ irements, actions and expectations which are 
necessary to build an effective system of internal control and wh ich provide reasonable 
assurances as to the achievement of objectives. The Director of OIB (a s delegated authorising 
officer) is responsible for ensuring that th ese standards are met within his service. 
The audit focused on the opera tional and administrative opera tions and did not cover the 
financial operations. The latter were cove red by the IAS audits on the management of 
procurement contracts and by the follow-up of transaction testi ng and IAC's audit of financial 
circuits.  
It should be noted that the European Court of  Auditors covered 17 DGs (including OIB) and 
the ICS n°s 11, 12, 14, 17, 18, 20, 21 and 22 in it s DAS 2006 exercise; the IAC also reported 
on the ICS n°s 5, 11, 12, 18, 19, 20 in  its draft audit report  " Audit sur l'application d'une 
selection des standards de contrôle internes ". 
 
OIB did not express any reserv ations in the AAR 2006 that re late to the ICS 15,16, 17 and 24 
(see page 30 of the AAR 2006). 
In its Readiness Assessment 2006, OI B states that it is fully co mpliant with all the baseline 
requirements of the ICS 15, 16, 17 and 24, except fo r n°s 3 and 5 of  ICS 15 (n° 3: appropriate 
documentation of administrative and operational pr ocedure and n° 5 : review and update of all 
procedures in order to be compliant with rele vant regulations, the Financial Regulations and 
its implementing rules). 
 
EN 22   EN  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very important 2 2 100 0 0 
Important 1 1 100 0 0 
Total 3 3 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 2 2 100 0 0 
Important 1 1 100 0 0 
Total 3 3 100 0 0 
 
  
1.18. OIL – Management of Procurement Contracts in OIL 
Objectives and Scope 
The objective of the audit was to assess the ad equacy and effectiveness of OIL's internal 
control system with respect to the "Regularit y of Financial Management" of the Procurement 
Process. The present report focuses on OIL's pr ocurement arrangements with respect to non-
buildings contracts. The audit focused mainly  on Procurement Contract s completed during the 
period 2005-2006. 
 
 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 7 7 100 0 0 
Important 6 5 83,33 1 16,67 
Desirable 1 1 100 0 0 
 
EN 23   EN Total 14 13 92,86 1 7,14 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 7 4 57,14 3 42,86 
Important 5 2 40 3 60 
Desirable 1 0 0 1 100 
Total 13 6 46,15 7 53,85 
 
 
 
1.19. PMO – Controls over Payment of Pensions 
Objectives and Scope 
The objective of the audit was to assess the adequ acy and effective applic ation of the internal 
control system and risk management with resp ect to the design and th e implementation of the 
financial circuits and procedures relating to  the determination and payment of individual 
rights of retired Commission staff (post active). 
In particular, its objective was to assess whether the internal control system (ICS) provides 
reasonable assurance regarding: 
• compliance (legality and regularity) with th e FR and its IR, including the effective 
implementation of the financial circuits; 
• the safeguarding of assets; 
• the reliability of financial information; 
• the efficiency and effectiveness of financ ial processes ("sound fi nancial management", 
Art. 27 of the FR). 
The audit did not cover procedur es related to the determinati on and payment of sickness and 
accident insurance cover, the invalidity pensi ons/allowances, the current financing scheme for 
pensions or the transfers of  pensions from the Member States. Nor did it cover the 
functionality of the underlying system for pro cessing the payments of entitlements, known as 
"Nouvelle Application de Paie" (NAP). 
The scope of the audit has focused on the adeq uacy of the design and implementation of the 
procedures involved in the decision to grant a retirement pension; the evaluation and payment 
 
EN 24   EN of individual rights of re tired staff, as well as the biennial declarations (life certificate) and the 
procedure in case of pensioner death. All of the above are under the responsibility of PMO-4 
(Pensions, and transfers of pension rights). 
There are no reservations in the 2006 AAR that relate to the specific area audited. However, 
PMO made the following observations in  relation to its ov erall functioning: 
• The permanent number (stock) of files of transfer of pension rights remained at a very 
high level (6,255 files at the end of 2006), which is approximately twice as high as in the 
years preceding the reform of the Staff Re gulations. Also, despite a reduction in its 
personnel, PMO has seen a considerable increa se in its general workload. In 2005 some  
3,376 recalculations were made pursuant to Article 26 §§ 5 and 6 of  Annex XIII of the 
Staff Regulations (page No 5) 
• The reviews that were conducted internally, an d confirmed by the extern al audits, detected 
the same structural weaknesses:  
a) PMO does not have sufficient numbers of qualified staff; 
b) The computer system is too out of date to  be able to include automated controls. 
•  The Office is therefore heavily dependent on manual controls which, while they help to 
ensure the regularity and effectiveness of ope rations, are not always the most efficient 
(pages No 22 and 23). 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 5 5 100 0 0 
Important 5 5 100 0 0 
Desirable 2 2 100 0 0 
Total 12 12 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 5 5 100 0 0 
Important 5 5 100 0 0 
Desirable 2 2 100 0 0 
Total 12 12 100 0 0 
 
EN 25   EN  
1.20. SCIC – Follow-up of validation of self-assessment of the SCIC IAC 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the IAS Validation of Self-Assessment of the 
Internal Audit Capabi lity of DG SCIC ca rried out from February to June 2006.  
2. INTERNAL  POLICIES 
2.1. COMP - Follow-up report on the Audit of IT Controls 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted4 recommendations that resulted from the Audit of IT Controls of DG COMP IT 
carried out in 2003. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
2.2. DG EAC – ABAC-Implementation of Accru als Based Accounting in DG EAC/2006 
Closing 
Scope and objectives 
The audit covered the year-end 2006 closing of the accounts in Directorate-General Education 
and Culture (DG EAC) and the Executive Agency (EACEA). 
For 2006 "combined" financial statements we re issued by DG EA C and EACEA giving a 
comprehensive overview of the "Education an d Culture" activities managed jointly by both 
audited entities. This was due to the fact that the different financial data (pre-financing, invoices, etc.) had not been adequately alloca ted between the cost ce ntres of DG EAC and the 
Executive Agency.  
The objective of the audit was to obt ain a reasonable assurance that:  
• the accounting systems and procedures esta blished locally by DG EAC and by the 
Executive Agency in the context of the impl ementation of accrual accounting are effective 
in ensuring the reliability of the financial information (including compliance with the Commission's accounting rules), both local and,  following transmission of the year-end 
closing data to DG BUDG, consolidat ed at the level of the Commission. 
• the controls integrated into the accounting environment (including supporting IT systems) 
locally in DG EAC and in EACEA are adequa te and effective en ough to ensure the 
                                                
 
4 For the purpose of this report, all subsequent references to "accepted recommendations" include two 
recommendations which were originally rejected by DG COMP, but for which actions have been in fact 
implemented in practice 
 
EN 26   EN integrity of the financial information and the true and fair view of their financial position 
and their financial performance. 
The audit was performed in co-operation with the European Court of Auditors, which will use 
its results as part of the DAS audit of 2006. 
The audit consisted of three different parts, namely: 
- Follow-up of the implementation of the recommendations issued last year by the IAS (for 
which a separate follow-up audit report has been issued);  
- Review of the accounting pro cedures and the supporting IT systems, including systems 
and procedures to collect and consolidate acc ounting data for the year-end closing, cut-off 
and validation of opening balances; 
- Substantive testing of the closing balan ces (as of 31/12/2006) based on transaction 
samples of "pre-financing a nd related guarantees" and "invoices received but not yet 
settled".  
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 3 3 100 0 0 
Desirable 4 4 100 0 0 
Total 8 8 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 1 0 0 1 100 
Important 3 2 66,67 1 33,33 
Desirable 4 2 50 2 50 
Total 8 4 50 4 50 
 
 
 
EN 27   EN 2.3. DG EAC – Follow-up Audit Report on the Implementation of ABAC in DG EAC 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from th e audit of the "Implementation of ABAC in 
DG EAC" carried out in 2006. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
2.4. EACEA – Implementation of the Financial Circuits for Operational Budget of the 
Education, Audiovisual and Cult ure Executive Agency (EACEA) 
Objectives and Scope 
The overall objective  of this audit is to issue an opinion on the compliance with the 
Commission rules and on the effectiveness a nd efficiency of operations regarding the 
implementation of Financial Circuits set up by the Agency to support its operational budget, 
and the related aspects of the financial manage ment (i.e. management of financial roles; 
administration of sub-delegations; design of ex- post control structures; monitoring functions 
and internal reporting) and the Agen cy's reporting to its parent DGs.  
The scope  of the audit was further defined in the preliminary phase taking into account two 
fundamental aspects: First the Agency is to so me extent still in its start-up phase as its 
operational work began on 1 January 2006 a nd the Agency became administratively 
autonomous from 24 July 2006. Secondly, the a udit engagement reflects the co-ordinated 
approach between the IAS and the Agency's IA Cs aiming at complementary coverage of the 
audit plans while targeting the most stab le aspects of the Agency's activities. 
 Accordingly, the following areas were excluded  from the scope: 
 
• The administrative budget as the Agency only became administratively autonomous as of 
July 2006. 
• The accounting system and the Agency's financial reporting, including the IAS 
recommendations issued following the audit of  the implementation of ABAC in DG EAC
5 
. Due to the fact that the Ag ency's IT systems are the same as those used by DG EAC (i.e. 
APPFIN, Sincom2 and ABAC), the IAS findings are, in principle, applicable to the 
Agency. The IAS, in coordinati on with the Court of Auditors, will carry  out an audit in 
2007 on the closure of accounts process whic h will cover DG EAC and the consolidation 
process which will include the Agency's accounting for the operational budget.  
• Information Technology (IT) and Human Resources  (HR) as they will be covered by the 
Agency's IAC either directly (HR) or with  the assistance of external experts (IT).  
                                                 
5  Audit Report IAS-2006-EAC-002 dated 30/06/06. 
 
EN 28   EN • When the Agency was set up it inherited a b acklog of 183 ex-post audits from DG EAC 
all of which required detailed follow-up by the Agency6.  However the present audit did 
not include substantive tests on the implemen tation of these audits , as its scope was 
limited to the design of the new ex-post control function. 
• Finally, some (parts of) programmes managed by the Agency are not relevant to the audit 
scope (i.e. Procedure B of Leonardo Da Vinci7 and Non-closed proj ects corresponding to 
Media II-1996-20008). 
 
With regard to evolving aspects, such as ex- post control structures a nd the Agency's reporting 
to its Parent DGs, the aim of this audit is to identify potential areas of improvement for the 
near future. 
Following the transfer of part of DG EAC's and DG INFSO's activities to the Agency and 
owing to its impact on the Agency's financial management, this audit engagement also assesses the progress made in implementing eight  IAS recommendations (1 critical, 2 very 
important, 4 important and 1 desirable) which resulted from the IAS in-depth audit of DG 
EAC carried out in 20049 and followed up in 2005
10. The remaining IAS recommendations, 
in particular the aspects related to the abnormal RAL, were not part of the scope. 
In line with the project to amend the Commi ssion Decision setting up the Executive Agency, 
the Agency's mandate is very likely to be extended11. This extension would increase the 
Agency's operations with the next genera tion of programmes currently managed by the 
Agency (e.g. Life Long Learning) but also other new programmes (e .g. EU/USA cooperation 
in the field of higher education and vocational tr aining) or activities, fo llowing the takeover of 
the Eurydice European Unit. Therefore, th is audit may provide a good overview of the 
situation prior to this expansion, which will bo th be quantitative (i.e. in terms of both budget 
and staff) and qualitative (i.e. more diversit y in the type of activ ities under the Agency's 
responsibility). 
The Agency was set up in January 2005 and its first Agency Annual Activity Report (AAR), 
for the 2005 financial year, was adopted by th e Steering Committee in February 2006. As the 
Agency's activities did not really start until  January 2006, the AAR contained no reservations 
or Declaration of Assurance. 
 
                                                 
6 Source: EACEA audit database: State of play at 2006 y ear end: Out of the 183 inherited audits, 137 remain 
open: 90 have reached the reporting phase; 36 are awaiti ng the Draft report and 11 (6% of the total) have 
outstanding fieldwork. 
7 Management of procedure B is decentr alised to National Agencies and the Ag ency's task is only to coordinate 
the selection of beneficiaries which is carried out by outsourced experts. Those experts are paid not from the 
Agency's operational budget but from the administrative budget, which is excluded from the scope. 
8 Media II was created before the Comm ission's requirements on financial circuits were defined and applicable. 
9 Audit Report IAS-2004-EAC-001 dated 21/09/04. 
10 Follow-up audit report IAS-2004-EAC-001 dated 22/12/05. 
11 "Projet de Décision de la Commission modifiant la décision 2005/56/CE instituant l'Agence exécutive 
'Éducation, audiovisuel et culture' pour la gestion de l'ac tion communautaire dans las domaines de l'éducation, de 
l'audiovisuel et de la culture, en application du règlement (CE) n°58/2003 du Conseil" CISNet, consultation 
[EAC]D(2006)/R/11593. 
 
EN 29   EN  Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 10 10 100 0 0 
Total 14 14 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very important 4 4 100 0 0 
Important 10 5 50 5 50 
Total 14 9 64,29 5 35,71 
 
 
2.5. DG ENTR – Management Letter Ex-Post Controls (no report) 
2.6. DG ENTR - Follow-up report on the financ ial management of the innovation relay 
centre (IRC) network 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the joint IAS-IAC DG ENTR final audit report 
on the Financial Management of the Innovation Relay Centre (IRC) Network dated 6 April 
2006.  
This follow-up audit does not present an assessmen t of the adequacy of controls as a whole, 
but focuses more on the specific reco mmendations in the original audit. 
 
2.7. DG ENTR - Follow-up Audit Report on the IAS Validation of Self-Assessment of 
Internal Audit Capability (IAC) of DG ENTR 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from the IAS Validation of Self-Assessment of the 
Internal Audit Capabili ty of DG ENTR which was carried out from February until June 2006.  
 
 
EN 30   EN 2.8. DG ENV – Monitoring of the Implementation of EU Law  
Objectives and Scope 
 
Monitoring the application of EU law is one of the Co mmission's core activities laid down in the Treaty. 
It is a very broad and multi-faceted issue which covers a whole range of activities. The 
objective of the engagement is to provide an opinion on the management, efficiency and 
effectiveness of the pro-activ e and ex-post monitoring of EU law for the years 2003 – 2005, in 
particular relating to the tran sposition of directiv es and complaints and infringements. 
 
The scope of the audit includes:  
1) Assessing the efficiency and effectivene ss of DG ENV's processes for pro-active 
monitoring of the timely, correct and comp lete implementation of EU law (Treaty 
provisions and directives) - mainly for th e years 2003 to 2005 - against the (success) 
criteria/factors defined for the differe nt phases of propos ing, negotiating and 
transposing a directive and the measur es proposed in th e 2002 Communication on 
Better Monitoring . 
2) Assessing DG ENV's handling of complaints and infringements rela ted to directives, 
regulations and the Treaty, for the period 2003 to 2005, with respect to efficiency and 
effectiveness which includes, inter alia compliance with the Manual of Procedures12.  
3) Assessing the management of the EU law m onitoring function (pro-active as well as 
ex-post) during 2003 – 2005 against relevant Commission Internal Control Standard 
baseline requirements. 
4) Assessing potential areas for si mplification of procedures.  
5) Assessing compliance with the provisi ons of Regulation (EC) 45/2001 on the 
protection of personal data. 
As of 31 December 2005, there have been no observations/reservations in the AAR 
that relate to the area/process audited. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Critical 2 2 100 0 0 
Very important 7 7 100 0 0 
Important 2 2 100 0 0 
Total 11 11 100 0 0 
                                                 
12Manual of Procedures — SEC(2005)254/2 — Version of 13/12/2005: Monitoring the application of 
Community law: Manual of procedures . 
 
EN 31   EN  
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Critical 2 1 50 1 50 
Very important 7 1 14,29 6 85,71 
Important 2 0 0 2 100 
Total 11 2 18,18 9 81,82 
 
2.9. DG ENV – Second Follow-up audit of DG ENV's 2004 In-depth audit 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from th e in-depth audit report dated 19 September 
2004 and from the first follow-up audit report dated 9 February 2006.  
In line with the IAS follow-up policy, this follow-up audit does not result in an assessment of 
the adequacy of controls as  a whole, but focuses on the specific recommendations in the 
original audit. 
 
2.10. DG ENV – Grant management under the non-LIFE-programmes 
Objectives and Scope 
The audit of the grant management by DG ENV under the non-LIFE programmes is included 
in the 2007 work programme of the IAS. This fo llows an audit risk assessment carried out in 
2006 on DG ENV as part of the preparation of the IAS's Strategic Audit Plan for 2007-2009, 
which was endorsed by the Audit Progre ss Committee (APC) in February 2007. A new 
programme entitled LIFE+ will become the EU's single financial instrument on the environment from 2007. It will group together mo st of the current s upport programmes for the 
environment except for Civil Pr otection and Marine Pollution. 
The audit focused on the assessment of the adequ acy and effective functioning of the internal 
control systems in relation to DG ENV's gr ant management process under the non-LIFE 
programmes during the 2004 - 2006 period, as follows: 
– Programmes without a basic act : Development of New Initia tives and General call for 
proposals, 
– Programmes with a basic act: Civil Protection, NGOs and Forest Focus. 
 
EN 32   EN The audit assessed whether the internal control systems comply with the specific legal basis 
of the programmes selected and with the Fina ncial Regulation and its Implementing Rules, 
and the efficient and effective im plementation of the programmes. 
There are no reservations in the AAR that re late to the process audited. However, DG ENV 
has however associated itself with the rese rvation expressed by DG ENTR under centralised 
direct management relating to over-declarations of cost clai ms due to the problem of the 
eligibility of the costs incurred by European Standardisation Organisations, such as CEN and CENELEC, with whom the DG has a number of open action grants. 
Of necessity, audits are a "snaps hot" of the situation as it exists  within the time-frame covered 
by the audit. In some cases, audi tees have subsequently taken act ions or have plans for future 
actions which are designed to improve the control system. However, as these have not yet been audited, the efficacy of these changes will  be assessed as part of  the IAS follow-up audit 
work. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 9 9 100 0 0 
Desirable 1 1 100 0 0 
Total 14 14 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 4 2 50 2 50 
Important 9 5 55,56 4 44,44 
Desirable 1 0 0 1 100 
Total 14 7 50 7 50 
 
2.11. DG INFSO – Ex-Post Controls 
Objectives and Scope 
In accordance with its Audit Plan 2006, the IAS has assessed the effectiveness and efficiency 
of the ex post controls put in place by DG INFSO to obtain assurance on the legality and regularity of the transactions  covered by the Research Programmes and on sound financial 
management.  
 
EN 33   EN It should be noted that, from 2002 to 2004, DG IN FSO included in its AAR a reservation on 
the "correctness" or "frequency of errors" in "multi-annual cost declarations and payments".  
In 2005, the reservation related only to FP5 cost claims and payments. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Critical 1 1 100 0 0 
Very Important 7 7 100 0 0 
Important 3 3 100 0 0 
Total 11 11 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Critical 1 0 0 1 100 
Very Important 7 1 14,29 6 85,71 
Important 3 0 0 3 100 
Total 11 1 9,09 10 90,91 
 
2.12. JRC – Second Follow-up of In-Depth Audit of JRC of 2004 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the In-depth Audit of DG JRC, carried out from April to October 2004. 
A first follow-up audit was car ried out from October 2005 until February 2006. The Final 
Report on the Interi m Follow-up Audit of JRC, da ted 09/02/2006, considered ten 
recommendations as fully implemented and the other eleven as still in progress. 
This second follow-up audit does not result in an assessment of the adequacy of controls as a 
whole but focuses on the specific recommenda tions in the original audit, and more 
specifically on the eleven recommendations still open after the first follow-up audit. 
 
 
EN 34   EN 2.13. DG MARKT - Financial Manageme nt and Financial Circuits 
Objectives and Scope 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from  DG MARKT's Financial Management and 
Financial Circuits. The final re port was issued on 21 December 2005.  
This follow-up audit does not result in an assessment of the adequacy of controls as a whole, 
but focuses on the specific recomme ndations in the original audit. 
 
2.14. DG RTD - Follow-up report on the in-depth  audit of DG RTD (2003) and the audit 
on financial circuits & financia l management in DG RTD (2005) 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the In-depth Audit of DG RTD, carried out 
from April to November 2003, and the Audit on Financial Circuits / Financial Management 
of DG RTD, carried out from  April to October 2005.  
This follow-up audit does not result  in an assessment of the ade quacy of controls  as a whole, 
but focuses on the specific recomme ndations in the original audit. 
 
2.15. DG RTD - IT procurement and service delivery in DG RTD 
Objectives and Scope 
This audit of IT procurement is part of a wide r audit, the objective of which was to assess the 
adequacy and effective application of the intern al control system (ICS), risk management and 
governance processes related to IT procuremen t and the delivery of IT services to the 
European Commission. 
The purpose of the audit was to assess whet her the ICS provides reasonable assurance 
regarding: 
• Compliance  with the Commission rules on IT proc urement, the Financial Regulation and 
the Commission Internal Control Standard s. Compliance with the provisions of 
Regulation (EC) 45/2001 on the protection of personal data was also taken account of; 
• Effectiveness and efficiency  of the procurement and servic e delivery processes. The IAS 
examined whether the Commission makes the best  use of all type of IT human resources 
and how the follow-up and management of IT  activities ensures that the Commission 
obtains the right service at the right price. In this respect, the need for simplifying internal administrative rules and procedur es was also taken account of. 
The audit of the IT procurement and service deli very process in DG RTD is part of the overall 
IAS objective to provide an audi t opinion on the IT procurement and service delivery cycle in 
the Commission. Once our audit work is comple ted in a sample of DGs , an overview report 
 
EN 35   EN will be produced containing the consolidated resu lts and conclusions of these audits, as well 
as crosscutting observations and recommendations. 
As a result of the desk review and the interviews in the Preliminary Survey, the scope of this 
audit engagement in DG RTD focused on the follo wing aspect of the internal control system, 
risk management and governance processes of IT procurement and service delivery: 
• Management and monitoring of cont racts with external contractors.  The audit included 
the monitoring of services agr eed to on a "fixed-price" or "time-and-means" basis as well 
as the measures taken to ensure continuity of business once the work contracted has been completed.  
The IAS decided not to include the tendering phas e of the procurement process in this audit, 
as RTD mainly uses the IT framework contract s of DG DIGIT. Aspects closely linked to the 
project management of IT systems are cove red by the IAS audit on IT systems in the 
Research family, and therefore these are also ex cluded from the scope of the present audit.  
There are no observations/reservations in the 2006 AAR that relate to the area audited.  
No scope limitations were identified. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
2.16. DG TAXUD - IT procurement and service delivery in DG TAXUD 
Objectives and Scope 
This audit is part of a wider audit, the objective of which was to assess the adequacy and 
effective application of  the internal c ontrol system (ICS), risk management and governance 
processes related to IT procurement and the delivery of IT services to the European Commission. 
The purpose of the audit was to assess whether the ICS provides for reasonable assurance 
regarding the following: 
• Compliance  with the Commission rules on IT proc urement, the Financial Regulation and 
the Commission Internal Cont rol Standards. The complianc e with the provisions of 
Regulation (EC) 45/2001 on the protection of personal data was also taken account of; 
• Effectiveness and efficiency  of the procurement and servic e delivery processes. The IAS 
examined whether the Commission makes the best  use of all type of IT human resources 
and how the follow-up and management of IT  activities ensures that the Commission 
 
EN 36   EN obtains the right service at the right price. In this respect, the need for simplifying internal 
administrative rules and procedur es was also taken account of. 
The audit of the IT procurement and service delivery process in DG TAXUD is part of the 
overall IAS objective to provide an audit opini on on the IT procurement and service delivery 
cycle in the Commission. After a sa mple of DGs has been audited, an overview report will be 
produced, containing the consolidated results and conclusions on the above-mentioned audits 
and on the crosscutting observations and recommendations. 
As a result of the desk review and the intervie ws in the Preliminary Survey (which took into 
account the work already done by the IAC, the Eu ropean Court of Auditors and the IAS), the 
scope of this audit engagement in DG TA XUD focused on the following aspects of the 
internal control system, risk management and governance processes of  IT procurement and 
service delivery: 
• Management and monitoring of cont racts with external contractors.  The audit included 
the monitoring of services agreed  to as "fixed-price" or "tim e-and-means" as well as the 
measures taken to ensure business conti nuity at the expiry of contracts.  
There are no observations/reservations in the 2006 AAR that relate to the area audited.  
No scope limitations were identified. 
 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Important 2 2 100 0 0 
Desirable 1 1 100 0 0 
Total 3 3 100 0 0 
 
 
2.17. DG TREN - Follow-up report on the audit of financial management and financial 
circuits in DG TREN 
Objectives and Scope 
 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations resulting from the Au dit of Financial Management and Financial 
Circuits in DG TREN carri ed out on 22 July 2005. 
In line with IAS policy, this follow-up audit does not result in an assessment of the adequacy 
of controls as a whole but focuses on the spec ific recommendations in the original audit. 
 
EN 37   EN  
2.18. DG TREN - Follow-up Audit Report on  "Audit de processus de gestion de 
l'informatique locale" 
Objectives and Scope 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the " Audit de processus de gestion de 
l'informatique locale – DG TRE N" carried out on 10 May 2005.  
This follow-up audit does not result in an assessment of the adequacy of controls as a whole, 
but focuses on the specific recomme ndations in the original audit. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 3 3 100 0 0 
Total 3 3 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 3 3 100 0 0 
Total 3 3 100 0 0 
 
The recommendations shown in the tables are new recommendati ons issued in the 
framework of the follow-up audit. 
 
2.19. TREN-IEEA - Audit of the Intel ligent Energy Executive Agency 
Objectives and Scope 
The objective of this audit was to  survey the adequacy and effec tive application of the internal 
control system (ICS), risk mana gement and governance processes in the IEEA. In particular 
the audit assessed whether the ICS provide s for reasonable assu rance regarding: 
• Compliance with the Commission rules regarding the executive agencies, the Financial 
Regulation and the Commission In ternal Control Standards. 
 
EN 38   EN • The reliability of financial and non-financial information. 
• The effectiveness and efficiency of operations.  
As a result of the desk review in the preliminary survey, which took into account the work 
already done by the IAC of the Ag ency, the scope of this audit engagement was limited to the 
following aspects regarding the internal cont rol system, risk management and governance 
processes within the IEEA:  
A. The overall organisation of the agency (including governance issues, data protection and 
the performance of the IAC). 
B. The regularity of financial management and th e implementation of financial circuits (with 
the emphasis on grant management and procurement). 
C. The accounting system (with the emphasis on the administrative budget), including the 
accounting organisation, accounting for fixed a ssets, salaries, purchases and the closing 
procedures. 
D. The relations between the agency and other Commission services (focusing on the service 
level agreements) and with external service providers. 
E. Monitoring by DG TREN as parent DG. 
In November 2006, the European C ourt of Auditors (ECA) started a performance audit that is 
complementary to this audit. The Court's aud it has two main planks: (1) performance audit 
(i.e. the effectiveness and efficiency) of the Intelligent Energy Programme itself, and (2) the management implementation structure, includ ing the cost/benefit of the Agency and the 
programme; the management information for th e programme with special attention on the 
indicators. These aspects have been taken into account in establishing the scope of this audit. 
Thus, once the ECA has completed its audit, the main aspects of the Agency's business will have been audited. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Critical 1 1 100 0 0 
Very Important 3 3 100 0 0 
Important 10 10 100 0 0 
Desirable 2 2 100 0 0 
Total 16 16 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Critical 1 0 0 1 100 
Very Important 3 0 0 3 100 
 
EN 39   EN Important 10 1 10 9 90 
Desirable 2 0 0 2 100 
Total 16 1 6,25 15 93,75 
 
2.20. DG TREN - Follow-up of validation of  self-assessment of DG TREN IAC 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from the IAS Validation of Self-Assessment of the 
Internal Audit Capability of DG TREN wh ich took place from February to April 2006. 
3. STRUCTURAL  MEASURES  AND  COMMON  AGRICULTURAL  POLICY 
3.1. AGRI - Local IT systems of DG AGRI feeding into ABAC 
Objectives 
 
The objective of the present audit was to assess the adequacy of the systems and controls put 
in place by DG AGRI to ensure the integrity of  the accounting-related data as processed by 
the local IT systems. 
Accounting-related data can be defined as the data entered into ABAC  Workflow through the 
local systems of DG AGRI and, th ereafter, transferred to th e central accounting system 
(SAP), its General Ledger or any of th e other modules that form part of it. 
Scope  
 
Based on a preliminary risk analysis, the two ma jor local IT systems, which processed € 55.7 
billion of payments in 2006 - we re chosen for the audit scope: 
− AGREX2, which provides data for the de tailed budgetary follow-up related to the 
implementation of the Common Agricultural Polic y in respect of measures financed by 
the Guarantee section of the European Agricultural Guidance and Guarantee Fund 
(EAGGF); 
− GFO, which is used to manage the financ ial data of the EAGGF Guidance section, 
SAPARD and the new Rural Development Fi nancial Instrument for the EU 10. Although 
this system is hosted in DG AGRI, DG EMPL is  the system supplier an d is responsible for 
development and maintenance (it is a copy of their SEA system). 
This audit also covers the management of ABAC Workflow  local users, which is sub-
delegated by DG BUDG to DG AGRI. 
The IAS adopted a three-step approach: 
 
EN 40   EN 1. Assess general controls ensuring the integr ity of the IT systems (e.g. user access 
management, change management, completeness  and regular analysis of audit trails…); 
2. Assess application controls: the monitoring controls applied manually and controls 
performed automatically by AGREX2 and GFO; 
3. Assess the integrity of the data transmitte d from AGREX2 and GFO to ABAC Workflow. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Important 12 12 100 0 0 
Total 14 14 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 2 1 50 1 50 
Important 12 12 100 0 0 
Total 14 13 92,86 1 7,14 
 
3.2. AGRI - Final Audit Report on DG AGRI – Interventions in Agricultural Markets 
Objectives and Scope 
The audit focused on Market Intervention Meas ures, and in particul ar Export Refunds and 
Import Tariff Quota. The objective of the audit wa s to assess the adequacy and effectiveness 
of the control systems in place to ensure the legality and regul arity of operations in the area, 
while having due regard to effec tiveness and efficiency. In order to assess the adequacy of the 
systems in place, two sectors were selected for further scrutiny, namely the Cereals sector and 
the Meat sector. 
The audit included the impact of IT-systems on operations, but did not include an assessment 
of reliability, completeness and integrity of the data  in these systems, as this is included in the 
IT-audit currently being carried  out by the IAC of DG AGRI. 
Wherever possible, in order to avoid waste of scarce audit resources, use was made of 
previous audits conducted by either the IAC of DG AGRI or by the European Court of 
Auditors. 
There are no observations/reservations in the AAR that relate to the area/process audited. 
 
EN 41   EN  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 8 8 100 0 0 
Total 9 9 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 8 8 100 0 0 
Total 9 9 100 0 0 
 
 
3.3. AGRI - Follow-up Audit Report on St ructural Funds – DG AGRI EAGGF-
GUIDANCE 
Objectives and Scope 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from th e audit of the Structural Funds - DG AGRI 
EAGGF-Guidance - in 2005 (date of  the Final Report: 5 December 2005). 
This follow-up audit does not produce an assessment  of the adequacy of controls as a whole 
but focuses on the specific recomm endations in the original audit.   
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
 
EN 42   EN  Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
 
3.4. EMPL – Prevention and detection of  fraud in the Structural Funds 
Objectives and Scope 
In accordance with its Audit Plan 2007, the IA S has examined the measures taken by DG 
EMPL on the prevention and detection of fraud in the European Social Fund. 
The main objective of the audit is to assess whether the policy and procedures implemented 
by DG EMPL contribute effectively to the fight against fraud in the field of  Structural Funds, 
in accordance with the competencies of the Commission, as defined by Article 280 of the 
Treaty, and the definition of responsibilities set out in  Commission Decision SEC(1995) 
249/1 concerning the fight agai nst fraud, and Regulation (EC) N° 1073/1999 of the European 
Parliament and of the Council concerning inve stigations conducted by the European Anti-
Fraud Office (OLAF), as well as Counc il Regulation (EC) N° 1260/1999 laying down 
general provisions on the Structural Funds. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 5 5 100 0 0 
Total 5 5 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 5 5 100 0 0 
Total 5 5 100 0 0 
 
 
 
EN 43   EN 3.5. EMPL – Implementation of Programmes in the New Member States 
Objectives and Scope 
In accordance with the IAS strategic aud it plan 2007-2009, this audit covered the 
implementation by the Commission of the ES F programmes in the New Member States 
(namely the EU-10 countries that acceded on 1 May 2004: Czech Republic, Cyprus, Estonia, 
Hungary, Latvia, Lithuania, Malta , Poland, Slovakia and Slovenia). 
The scope did not include the Community initiative, EQUAL, or Innovative Measures under 
Article 6, as these are subject to different procedures. The focus was on ESF mainstream 
programmes. 
The objectives of this audit were to assess how some risks related to the implementation of 
programmes in the New Member St ates identified in a manage ment letter by the IAS (2003), 
and other risk assessments conducted by, in part icular, DG EMPL, have been mitigated by 
management, and whether new risks are emergi ng that the management should be aware of. 
There is a reservation in the AAR 2006 related to  the areas/processes a udited concerning the 
management and control systems of the ESF in Latvia, Slovenia and Slovakia. The reservation concerns deficiencies in the mana gement and control systems, most notably the 
segregation of duties (Art. 4 of  Reg 438/2001), selection of projects, first level verifications 
(Art. 4), audit trail (Art. 7), and certification process (Art . 9 of Regulation 438/2001). In 
addition, DG EMPL has assessed that 16 programme s in the EU-10 countries (in total 64% of 
the total number of the EU- 10 programmes) "work well, but need improvements" according 
to the audit results. The main problems with these programmes have been related to the 
checks under Art. 4, Art. 7 and Art. 9, the lack of  a sufficient audit trail and (in the case of 
Poland) the IT system. However, as far as the latter category is concerned, these deficiencies 
have not resulted in a reservation in the AAR  2006, because DG EMPL has determined that 
the weaknesses are under control and has agre ed action plans with the Member States to 
implement the Commission's recommendations. 
Considering the above mentioned reservation and qualified opinions, a nd in order to avoid 
unnecessary duplication of effort in line with the single audit approach, the IAS has decided 
to focus on additional aspects related to the effective and efficient implementation of the 
2004-2006 programmes in the new Member States.  
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Total 2 2 100 0 0 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
 
EN 44   EN Total 2 2 100 0 0 
 
3.6. FISH – Follow-up Final Audit Report on Structural Funds - Financial instrument 
for Fisheries Guidance (FIFG) 
Objectives and Scope 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from the Structural Funds - Financial instrument for 
Fisheries Guidance (FIFG) audit carried out in 2005 (date of the Final Report: 10 November 
2005). 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit.  
 
3.7. REGIO – Implementation of progr ammes in the new Member States 
Objectives and Scope 
In accordance with the IAS strategic audit plan 2007-2009 this audit covered the 
implementation by the Commission of the ERDF  programmes in the New Member States 
(EU-10 countries with the accession date of  1/5/2004: Czech Republic , Cyprus, Estonia, 
Hungary, Latvia, Lithuania, Ma lta, Poland, Slovakia, Slovenia). 
The scope did not include Community initia tives (INTERREG) nor interventions by the 
Cohesion Fund as these are subject to different  procedures. The focus was on the mainstream 
programmes. 
The objectives of this audit we re to assess how some risks related to implementation of 
programmes in the New Member States identified in a management letter by the IAS (2003) and other risk assessments by, in partic ular, DG REGIO, have been mitigated by 
management, and whether new risks are emer ging which management should be aware of. 
There are no reservations in the AAR related to the areas/processes audited. However, the 
AAR 2006 does mention that "the opinion was qualif ied in relation to ma terial deficiencies 
affecting key elements of the system" for the following EU-10 countries: Czech Republic, 
Latvia, Lithuania and Slovakia.  For Slovenia, the opinion was qualified due a lim itation of the 
scope. Finally, in the case of Poland, the opi nion was adverse for one programme (SOP 
Competitiveness), qualified for two programmes (IROP and SOP Transport) and there was no 
opinion on one programme (Techni cal Assistance). The above opini ons have not resulted in 
reservations in REGIO's 2006 AAR, taking into account the fact that "the arrangements in 
place for the performance of DG Regional Polic y's supervisory role under the system of 
shared management provide for actions to be  taken in a timely way in response to the 
detection of deficiencies in ma nagement and control systems". 
Considering the abovementioned qualified and/ or adverse opinions on six of the ten new 
Member States, and in order to avoid unnecessary duplication of effort in line with the single 
 
EN 45   EN audit approach, the IAS has decided to focus on additional aspects related to the effective and 
efficient implementation of the 2004-2006 pr ogrammes in the new Members States. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 2 2 100 0 0 
Total 2 2 100 0 0 
 
 
3.8. REGIO – Follow-up Audit Report on the European Regional Development Fund 
(ERDF) – Audit of the Implementation of  Article 38 of Council Regulation 
1260/1999 in DG REGIO 
Objectives and Scope 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations resulting from the following audit carried out in 2005 at DG 
REGIO: "European Regional Development Fund - Audit of the implementation of Article 38 
of Council Regulation 1260/1999". 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
3.9. REGIO – Prevention and detection of  fraud in the Structural Funds 
Objectives and Scope 
In accordance with its Audit Plan 2007, the IA S has examined the measures taken by DG 
REGIO to prevent and detect fraud in the European Regional Development Fund. 
The main objective of the audit is to assess whether the policy and procedures implemented 
by DG REGIO effectively contribute to fighting fr aud in the field of th e Structural Funds, in 
accordance with the competencies of the Co mmission, as defined by Article 280 of the 
Treaty and the definition of responsibiliti es set out by Commission Decision SEC (1995) 
249/1 concerning the fight agai nst fraud, and Regulation (EC) N° 1073/1999 of the European 
Parliament and of the Council concerning inve stigations conducted by the European Anti-
Fraud Office (OLAF) and Council Regula tion (EC) N° 1260/1999 laying down general 
provisions on the Structural Funds. 
 
 Acceptance 
Status Yes 
 No 
 
 
EN 46   EN Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 1 1 100 0 0 
Total 5 5 100 0 0 
 
4. EXTERNAL  POLICIES 
 
4.1. AIDCO - Eligibility of Costs under the Fi nancial and Administrative Framework 
Agreement with the United Nations by DG AIDCO 
Objectives and Scope 
 
On 28 July 2006, the IAS issued its final audit report13 on: "The Implementation of the 
Financial and Administrative Framework Ag reement with the United Nations by DGs 
AIDCO & ECHO". This report was presented to  the Audit Progress Committee (APC) at its 
meeting of 5 October 2006. 
As noted in the minutes of that meeting, "the  APC considers that th e audit findings did not 
sufficiently substantiate the IAS' unsatis factory opinion. The APC further notes the 
clarification from the IAS that the opinion is  not contrary to the DGs declarations of 
assurance. With regard to indirect costs, th e APC considers that th e audit process did not 
enable it to assess the materiality of reco mmendations N°4 and N°5. The APC therefore 
invited the IAS, in its follow-up audit, to as sess the materiality of the residual risks with 
regard to indirect costs in part icular, associated with the overall  controls on EC-UN funding in 
the framework of the Financial and Administ rative Framework Agreement (FAFA) and the 
UN financial control system". 
In response to this APC request, the IAS ad apted its 2006 audit plan  to "supplement the up-
coming DG AIDCO audit with work on the control system for verifying the eligibility of 
costs including the testing of transactions". This plan wa s communicated to the APC on 19 
October 2006.  
Regarding the eligibility of direct costs and indirect costs, DGs AIDCO and ECHO 
commented on the July 2006 IA S report13 stating that:  
"Although the report concludes that there is a "lack  of control of indirect costs", the report 
does not address the way costs are actually  controlled by DGs AIDCO and ECHO according 
to the system put in place under Articles 3 a nd 4 of the FAFA. The principle in the EC 
financial rules is that the only costs that are inter alia: 
                                                 
13IAS 2005 - AIDCO/ECHO – 001 dated 28 July 2006. 
 
EN 47   EN • Necessary to carry out the action an d mentioned in the grant agreement 
• In compliance with the principles of sound financial management (including value for 
money and cost effectiveness) 
• Actually incurred in the implementation period 
• Recorded in the accounts 
• Identifiable, backed by originals of  supporting documents and verifiable  
will be considered as being eligible for suppor t by the Commission ("di rect costs tests").  
In addition to this, the Commi ssion, when negotiating the FAFA, ag reed that it would add up 
to 7% to cover any indirect costs that could have been attributed to the action but are 
administratively difficult and costly to identi fy. The 7% figure was based on past experience 
and on the advice of the Financia l Controller. This is also re flected in Article 181 of the 
Implementing Rules."  
The approach of the IAS audit work, as presen ted in the July 2006 repor t, consisted primarily 
of a systems review with walkthrough testing. The audit work containe d in this present IAS 
report focuses more specifically on the eligibility of the direct costs and related control 
activities, and thus addresses both DG AIDCO' s concern and the APC request as described 
above. In this context, the IAS: 
• Reviewed 35 contracts (299,9 Mio EUR) out of the total population of 286 contracts 
(1540 Mio EUR) as reported by DG AIDCO on 19 October 2005 as being signed by the UN bodies under the FAFA. The primary focus was on payments and controls performed 
by AIDCO. This sample represented 12.2% of the total number of contracts and 19.4% of 
the total amount of the population. 
• Reviewed the reports of the verifica tion missions performed in 2005-2006; and 
• Analysed the survey conducted by AIDCO in October 2006 on the explicit application of 
Article 4.5
14 FAFA. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Total 4 4 100 0 0 
 
                                                 
14 Article 4.5: "Where the rates applied in accordance with United Nations' governing bodies decisions exceed 
7%, the United Nations may recover the balance as direct eligible costs, subject to the provisions governing 
direct eligible costs referred to in Article 3 being fulfilled". 
 
EN 48   EN  Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 4 2 50 2 50 
Total 4 2 50 2 50 
 
4.2. AIDCO - Ex-Post Control Activities in DG AIDCO 
Objectives and Scope 
 
This engagement is part of a series of aud its that the IAS conducted on the Ex-Post Control 
(EPC) activities in the RELEX  Family - i.e. in DG AI DCO, DG ELARG and DG RELEX.  
The main purpose is to assess the effectivenes s and efficiency of EPC and their contribution 
to the overall assurance on the legality and regularity of th e transactions and on sound 
financial management. The period covered in  the present audit was 2005 and 2006. EPC 
activities are a complementary and an additional layer of control activities, and this audit did not attempt to analyse or call into question the other control layers. It  should be noted that 
verification missions related to joint management  (in particular on the implementation of the 
FAFA agreement with the UN) were included in  the scope of prior IAS audit work and are 
therefore not included in the scope of the present audit. Moreover, not all the verification missions related to FAFA were EPC activities. 
In conducting this audit, the IAS covers the control components linked to the EPC, mainly 
"Control Environment" (organisational stru cture, staff, etc.) and "Information & 
Communication"; and the two main EP C processes in DG AIDCO,  i.e.: 
• Transactional Ex-Post Controls
, which are centralised controls that focus on the 
effectiveness of the controls performed by DG AIDCO's staff in the payment control 
chains; 
• Financial Audits , which are financial an d financial/system audits managed by DG AIDCO 
and are included in their Annual Audit Plan. They cover projects and are performed on the 
spot in the premises of th e Beneficiaries/Contractors. 
There are no observations/reservations in the 2006 AAR of DG AIDCO for these two EPC 
processes. 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
 
EN 49   EN Important 4 4 100 0 0 
Desirable 1 1 100 0 0 
Total 9 9 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 4 4 100 0 0 
Important 4 4 100 0 0 
Desirable 1 1 100 0 0 
Total 9 9 100 0 0 
 
 
4.3. AIDCO - Follow-up Audit Report on NGO funding in DG AIDCO 
Objectives and Scope 
 
The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from th e audit of NGOs' funding carried out in DG 
AIDCO in 2005 (final report dated 6/07/2005). 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
 
EN 50   EN Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
4.4. AIDCO - Financial management ma in programmes in Directorate D 
Objectives and Scope 
The overall objective  of this audit is to provide an  opinion on compliance with Commission 
rules and on effectiveness and efficien cy of devolved operations regarding: 
• The implementation of Financial Circuits and specific related aspects of financial 
management (i.e. management of financial ro les and administration of sub-delegations) in 
Asian Delegations; 
• Monitoring and supervisory activities by HQ (i.e . Directorate D) of the Asian Delegations 
and 
• Directorate D and Asian De legations' reports (SDAO repor t and Delegations' EAMRs). 
This audit was selected on the basis of the IAS Strategic audit plan for 2007-2009 which took 
into account a co-ordinated approach between the IAS and the IAC aimed at ensuring 
complementary coverage of the audit plan s while targeting the highest risks. The scope  was 
further defined in the IAS risk assessment, c onducted in the preliminary phase of the audit. 
For details on the areas excluded from the scope of the a udit see section 2.1.2. 
The Asian Delegation network belonging to AI DCO D consists of 12 Delegations. AIDCO D 
plans to carry out four accompanying missions (a review of the internal control systems of 
AIDCO-related activities in the Delegations) of which two were finalised at the time the IAS 
fieldwork was completed. Applying the principle of  representativeness, the IAS selected three 
from the remaining population, i.e. seven Dele gations. These three Delegations represent a 
coverage of 32% and 34% respectively of open contracts and commitments as at April 2007. 
Taking the results of the two comple ted AIDCO D accompanying missions into 
consideration, the overall coverage amounts to 60% and 45%. 
Although the scope of the IAS a udit did not include all Delega tions, the IAS believes the 
findings for the three Delegations could be a pplicable to the remaining Delegations. As 
Delegations are not homogeneous, there may well be risks that are specific to particular 
Delegations which are not covere d in the IAS sample. However,  the analysis of the EAMRs 
of the 12 Delegations by the IAS did not iden tify any additional issue not disclosed in the 
present report. 
There are no observations/reservations in the AAR that relate to the area/process audited. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
 
EN 51   EN Very Important 7 7 100 0 0 
Important 11 11 100 0 0 
Total 18 18 100 0 0 
 
 
4.5. ECHO - Follow-up audit of NGO funding in DG ECHO 
Objectives and Scope 
 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the audit of NGOs funding in DG ECHO 
conducted in 2005 (final report dated 5/10/2005). 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Total 1 1 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 1 0 0 1 100 
Total 1 0 0 1 100 
 
 
4.6. ECHO - Monitoring and supervision tools in DG ECHO 
Objectives and Scope 
 
 
EN 52   EN In past audit engagements in DG ECHO, the IAS followed a "partners' approach" 
successively auditing the main types of partne rs/beneficiaries, i.e. NGOs and the UN, who 
absorb approximately 95% of DG ECHO's budget. 
In addition, recent IAC engagements have covere d important functional aspects such as the 
management of ECHO offices, fi nancial circuits and IT systems. Finally, the ECA recently 
examined "supervisory and control systems of  ECHO" in the context of the DAS 2006 as 
reported in its Annual Report for 2006; this work  focused on DG ECHO's system for auditing 
its NGO partners.  
The IAS' prior audit work result ed in a high level of coverage in terms of ECHO operations 
and budget. Subsequently, the IAS determined  that in terms of coverage and risk 
considerations resulti ng from the IAS strategic plan 2007- 2009, the remaini ng major area to 
be audited should be DG ECHO's monitoring tools.  However, it should be noted that the IAS 
audit plans are based on annually updated risk assessments and th at additional audit work will 
be considered if the new risks emerge. The ma in purpose of this audit was to assess the 
effectiveness and efficiency of the Monito ring Tools and their contribution to DG ECHO's 
overall management assurance. 
There are no observations/reservations in the AAR that relate to the area/process audited. 
Nevertheless, the AAR clearly outlines the main f eatures of the internal control structure and 
process, as well as the main risks inherent to humanitarian operations. 
 
 Acceptance 
Status Yes 
 No 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 5 5 100 0 0 
Desirable 1 1 100 0 0 
Total 7 7 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 5 3 60 2 40 
Desirable 1 1 100 0 0 
Total 7 5 71,43 2 28,57 
 
 
EN 53   EN  
4.7. ECHO, ADMIN – Management letter on secu rity issues in DG ECHO (no report) 
4.8. ELARG - Follow-up Audit Report on the In-depth Audit of DG ELARG 
Objectives and Scope 
 
The objective of the follow-up engagement is to assess progress made in implementing the 
accepted15 recommendations that resulted from the "In-depth audit" of DG ELARG carried 
out in 2003 (final report dated 22/12/2003). The "In-depth audit"  focused on financial control 
activities related to pre-accession assistance und er the Decentralised Implementation System 
(DIS), Financial Circuits and Management Reporting Systems. 
An interim follow-up audit conducted at the e nd of 2004 (final repo rt dated 14/01/2005) 
validated the implementation of four recomme ndations (out of 23). This second follow-up 
was carried out because, in 2006, DG ELARG re ported that all recommendations were now 
implemented. 
This follow-up audit does not result in an assessme nt of the adequacy of controls as a whole 
but focuses on the specific recomme ndations in the original audit. 
 
4.9. RELEX - First Follow-up audit of the Audi t on Handling of classified information 
and communication among the Delegations and DG RELEX 
Objectives and Scope 
 
The objective of the follow-up engagement is to assess progress made in implementing the 
recommendations that resulted from the "Aud it on handling of classified information and 
communication among the Delegations and DG RELEX" carried out in 2005.  
In line with IAS follow-up policy, this follow-up audit does not result in an assessment of the 
adequacy of controls as a whole but focuses on the specific recommendations in the original 
audit. In July 2006, the IAS performed a desk re view at the request of the APC to assess 
progress made by DG RELEX in implementing the action plan. This 2006 desk review 
confirmed the implementation of two of the 15  recommendations in the Action Plan. Thus, 
the scope of the present IAS follow-up engage ment focused on the 13 recommendations that 
were "Not Implemented" as of July 2006. Of  the 13 recommendations, two recommendations 
(one Critical and one Very Important) had impl ementation dates that were not yet due. These 
were included in the scope of this follow-up audit, as they represent a high risk and in order to see whether the deadlines are likely to be met. 
                                                
 
15The scope of this follow-up audit also  includes recommendations  which had been formally rejected (13 and 23) 
or partly rejected (8, 11 and 14), but which nevertheless have been followed-up entirely (8 and 11) or partly 
(14), as reflected in the Issue- Track database and for which implementation had been reported. 
 
EN 54   EN  
4.10. TRADE - Implementation of selected In ternal Control Standards in DG TRADE 
Objectives and Scope 
 
The main purpose of the audit is to assess the effective implementation of the selected Internal 
Control Standards ('ICS') by DG TRADE, i.e. 
• whether the DG complies with the respectiv e baseline requirements issued by DG BUDG 
and with other relevant rules applicable to DG TRADE (compliance objective); 
• whether the main measures taken to implemen t these standards are effective, efficient 
and adequate in terms of the specifi c mission of DG TRADE (efficiency and 
effectiveness objective) and, in doing this,  
• to identify good practices and ar eas for potential simplification. 
 
Considering the work already done (or curr ently being done) both by DG TRADE's Internal 
Audit Capability (IAC) and by the IAS, the IA S chose to focus on the implementation of the 
ICS linked to: 
• Risk Management (4 standards: 11, 19, 20, 24),  
• the DG's Management Information Systems ('MIS') and 
• selected standards linked to "internal communi cation and control" (fiv e standards: 12 to 
15 and 17). 
 
The ICS linked to the following were not part of the scope: 
• the programming cycle (ICS 2, and 7 to 10, al ready included in the scope of a completed 
IAS engagement at Commission level); 
• Human Resources management (ICS 1 to 6 an d 10, partly covered by the IAC audit of 
Directorate B, final re port dated 11/12/2006); 
• ICS 16 - segregation of duties, wh ich was audited by the IAC in 2004; 
• the IAS validation of the self assessment of  the IAC of DG TRAD E (final report dated 
17/05/2006), which covered ICS 21 and 22; 
• ICS 18 "Recording Exceptions", currently covered by the IAC's Audit of DG TRADE's 
Financial Transactions Circuit.  Therefore, the IAS does not express an audit opinion on 
the implementation of this particular standard. 
 
There are no observations or reservations in the Annual Ac tivity Report 2005 of DG TRADE 
that relate to the area/process audited. 
 
 Acceptance 
Status Yes 
 No 
 
 
EN 55   EN Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 6 6 100 0 0 
Desirable 1 1 100 0 0 
Total 8 8 100 0 0 
 
 Auditee's 
Assessment In Progress 
 Completed 
 
Priority # # % Total # % Total 
Very Important 1 1 100 0 0 
Important 6 5 83,33 1 16,67 
Desirable 1 1 100 0 0 
Total 8 7 87,5 1 12,5