EUROPEAN COMMISSION Brussels, 15.9.2015 SWD(2015) 170 final COMMISSION STAFF WORKING DOCUMENT Summary of Executive summaries



Internal audit engagements finalised by the IAS in 2014 Accompanying the document Report from the Commission to the European Parliament and the Council Annual report to the Discharge Authority on Internal audits carried out in 2014 (Art 99(5) of the Financial Regulation) {COM(2015) 441 final}



Content of this Staff working document (SWD) 1. Statistical data 1.1.Implementation of the 2014 audit plan 1.2.Statistical data on IAS recommendations 2. Horizontal audits 2.1.Audit on efficiency and effectiveness of the planning stage of the selection process - Multi DG (EPSO, DG HR, DG CNECT, DG SANCO – now DG SANTE, DG TAXUD) 2.2.Horizontal IT audit : Audit of management and supervision of outsourced IT services (contract management) – Multi DG (DG BUDG, DG DIGIT, DG HOME, OP, DG SANCO – now DG SANTE) 2.3.Audit on the administrative processes supporting the European Semester – Multi DG (SG, SJ, DG COMM, DG COMP, DG ECFIN, DG EMPL, DG MARKT, DG TAXUD) 3. Agriculture, natural resources and health 3.1.Gap Analysis Review of 2014-2020 Regulations for the Common Agricultural Policy, Phase 1 - DG AGRI 4. Cohesion 4.1.Gap Analysis Review of Regulation 2014-2020 for European Structural and Investment Funds (ESI funds) Phase 1 – Multi DG (DG AGRI, DG EMPL, DG MARE, DG REGIO) 4.2.Gap analysis of new legislation/design of 2014-20 Programming Period of European Structural and Investment Funds' (ESI funds) Phase 2 – Multi DG (DG EMPL, DG REGIO) 4.3.Audit on preparations for use of Financial Instruments in DG EMPL 2014-20 4.4.Audit on preparations for use of Financial Instruments in DG REGIO 2014-20 4.5.Limited Review of the calculation and the underlying methodology of DG REGIO's residual error rates for the 2013 Reporting Year 5. Research, energy and transport 5.1.Gap Analysis Review of the legislation regarding Horizon 2020 – Multi DG (DG CNECT, DG ENER, DG MOVE, DG RTD) 5.2.Audit on the implementation of FP7 control systems (including Supervision of External Bodies) in DG CNECT

5.3.Audit on the implementation of FP7 control systems (including Supervision of External Bodies) in DG RTD 5.4.Audit on the implementation of FP7 control systems in ERCEA 5.5.Audit on procurement management in DG JRC 5.6.Limited Review of the calculation and the underlying methodology of DG CNECT's residual error rate for the 2013 reporting year 6. Economic and financial affairs 6.1.Audit on risk management and planning processes in DG ECFIN in the New Economic Governance context 6.2.Audit on DG MARKT's cooperation with the three Supervisory Bodies on Financial Services 6.3.Audit on performance measurement system in DG TAXUD Customs Activities 7. External aid, development and enlargement 7.1.Audit on contribution agreements with UN bodies and other International Organisations – DG DEVCO 7.2.Audit on contribution agreements with international organisations - DG ECHO 7.3.Audit on the assurance building process in EU Delegations – DG DEVCO 7.4.Audit on budget support in DG DEVCO 7.5.Audit on the control strategy in FPI 8. IT audits 8.1.Audit on management of local IT in DG AGRI 8.2.Audit on IT governance in DG BUDG 8.3.Audit on the management of logical access to systems (ECAS/LDAP/windows) in DG DIGIT 8.4.Audit on the management of the IT projects in DG EAC (E4ALink and EVE) 8.5.Joint IAS/ IAC audit on the management of local IT in DG MARE

8.6.IT risk assessment in ERCEA 9. Management letter 9.1.Management letter on common features of performance measurement systems 10. Follow-up engagements (summarised) 10.1.2nd Follow-up audit on risk management – Multi DG (SG, DG BUDG, FPI) 10.2.Follow-up audit on the AAR process in the Commission - Multi DG (SG, DG BUDG) 10.3.Follow-up audit on the charge-back process in the Commission - Multi DG (DG BUDG, DG DIGIT) 10.4.2nd Follow-up audit on compliance with payment deadlines - Multi DG (DG ECHO, DG DEVCO) 10.5.Follow-up audit on the management and monitoring of staff allocation in the Commission services– Multi DG (SG, DG BUDG, DG HR, DG AGRI, DG COMP, DG DGT, DG RTD) 10.6.1st and 2nd Follow-up audit on the Overview Report on Executive Agencies – Multi DG (SG, DG BUDG, DG DIGIT, DG HR) 10.7.Follow-up audit on the Commission-wide audit on strategy and coordination of statistical data production, development and dissemination – Multi DG (DG AGRI, DG ESTAT, DG JRC, DG MARE, DG RTD) 10.8.Follow-up audit of the internal control system for managing the Instrument for Pre-accession Assistance for Rural Development (IPARD) in DG AGRI 10.9.Follow-up audit on the control strategy implementation (Pillar 1 and 2) in DG AGRI 10.10.1st and 2nd Follow-up audit on the residual error rate calculations (Pillar 1 & 2) in DG AGRI 10.11.Follow-up audit on fraud prevention and detection in DG AGRI 10.12.Follow-up audit on the design and monitoring of DG AGRI Dir. J control strategy (Pillar 1 and 2) 10.13.IAS Follow-up audit on SAM project management in DG BUDG 10.14.IAS Follow-up audit on risk management in DG COMM 10.15.1st and 2nd Follow-up audit on management of local IT in DG DEVCO 10.16.Follow-up audit on the limited review of the calculation of the residual error rate in DG DEVCO

10.17.2nd Follow-up audit on EDF grants in DG DEVCO 10.18.IAS Follow-up audit on long overdue recommendations from IAS audits on data centre operation and security (2006) and on corporate data network infrastructures and services (2008) in DG DIGIT 10.19.2nd Follow-up audit on business continuity management in DG DIGIT 10.20.Follow-up audit on the lifelong learning programme in EACEA / DG EAC 10.21.Follow-up audit on the control strategy in EACI (now EASME) 10.22.Follow-up audit on IT governance and performance in EAHC (now CHAFEA) 10.23.2nd Follow-up audit on the joint audit (IAC-IAS) on the implementation by the EIF of the competitiveness and innovation framework programme in DG ECFIN 10.24.Follow-up audit on off-budget operations: EFSM in DG ECFIN 10.25.Follow-up audit on performance of operational activities in DG ECHO 10.26.2nd Follow-up audit on IPA procurement in DG ELARG (now NEAR) 10.27.2nd Follow-up audit on the management of local IT in DG EMPL 10.28.Follow-up audit on the closure of the ESF 2000-2006 programming period in DG EMPL 10.29.Follow-up audit on the implementation of the ESF 2007-2013 programming period in DG EMPL 10.30.2nd Follow-up audit on the control strategy in DG EMPL 10.31.3th Follow-up audit on local IT systems supporting financial management in DG ENER 10.32.Follow-up audit of the European Energy Programme for Recovery (EEPR) in DG ENER 10.33.Follow-up audit on the control strategy in DG ENTR (now GROW) 10.34.1st and 2nd Follow-up audit of DG ESTAT's preparedness to fulfil its role in the economic governance framework 10.35.Follow-up of audit on the control strategy in shared management in DG HOME 10.36.2nd Follow-up audit on HR security in DG HR

10.37.Follow-up audit on the monitoring of EU law implementation in DG JUST 10.38.2nd Follow-up audit on management of procurement in OIB 10.39.2nd Follow-up audit on fraud prevention and detection in OLAF 10.40.Follow-up audit of the joint Sickness Insurance Scheme managed by the PMO 10.41.Follow-up audit on the implementation of FP7 control systems in REA 10.42.Follow-up audit on the closure of Cohesion Fund projects 2000-2006 in DG REGIO 10.43.Follow-up audit on DG REGIO implementation of the 2007-2013 programming period 10.44.Follow-up audit of the limited review on residual error rate in DG RTD 10.45.Follow-up audit on IT governance and performance in DG SANCO (now SANTE) 10.46.Follow-up audit on the control strategy in DG SANCO (now SANTE) 10.47.Follow-up audit on the handling of sensitive information in SJ 10.48.IAS/IAC joint Follow-up audit on monitoring the implementation of EU law in DG TAXUD 10.49.Follow-up audit on the management of local IT in DG TRADE 11. List of acronyms

Content of this Staff working document (SWD) This SWD contains the introduction, the objectives and scopes, the strengths and the critical and very important recommendations of the original executive summaries reflecting the state of play when the audit engagements were finalised (cut-off date for the exercise 31/01/2015). Each executive summary underwent the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation. It aims to provide a quick understanding of the audit and its main results. 1.Statistical data

1.1.Implementation of the 2014 audit plan By the cut-off date of 31 January 2015, the IAS.B had implemented 100% of its planned engagements (target 100%). One hundred and five reports (including audits, follow-ups, limited reviews, risk assessments and one management letter) were finalised, broken down as follows: 2014 2013 2012 Engagements Reports Engagements Reports Engagements Reports Audit 25 31 22 23 29 49 Follow-up 53 67 48 59 32 37 (Limited) Review 5 5 4 4 1 1 Management Letter 1 1 1 1 1 1 IT Risk Assessment 1 1 0 0 0 0 Consulting 0 0 0 0 1 1 Total 85 105 75 87 64 89 In order to ensure an efficient and effective implementation of the audit plan, the IAS plans its audit work on the basis of a risk assessment and a capacity analysis. The implementation is then regularly monitored and adjustments are made as necessary. 1.2.Statistical data on IAS recommendations The IAS issued the following number of recommendations (including their acceptance rate) in 2014: New recommendations Accepted recommendations Non-accepted recommendations Priority % % Critical 0 0 N.A. 0 N.A. Very Important 50 50 100% 0 0% Important 77 75 97% 2 3% Desirable 0 0 N.A. 0 N.A. Total 127 125 98% 2 2% For all accepted recommendations, the auditees drafted action plans, which were submitted to and assessed as satisfactory by the IAS. The implementation of the accepted recommendations made during the period 2010-2014, as assessed by auditees, as at 31 January 2015 was as follows: Year Priority Total Implemented In progress (by number of months overdue) No. % No. % No delay 0 - 6 6 - 12 12+ 2010 Critical 2 2 0 0 0 0 0 Very Important 120 112 8 0 0 0 8 Important 151 148 3 0 0 0 3 Desirable 10 10 0 0 0 0 0 2010 Total 283 272 96,1% 11 3,9% 0 0 0 11 2011 Critical 0 0 0 0 0 0 0 Very Important 47 47 0 0 0 0 0 Important 101 98 3 0 0 0 3 Desirable 10 10 0 0 0 0 0 2011 Total 158 155 98,1% 3 1,9% 0 0 0 3 2012 Critical 0 0 0 0 0 0 0 Very Important 71 59 12 3 2 2 5 Important 120 105 15 5 1 2 7 Desirable 0 0 0 0 0 0 0 2012 Total 191 164 85,9% 27 14,1% 8 3 4 12 2013 Critical 0 0 0 0 0 0 0 Very Important 53 34 19 13 4 2 0 Important 68 44 24 6 13 5 0 Desirable 6 6 0 0 0 0 0 2013 Total 127 84 66,1% 43 33,9% 19 17 7 0 2014 Critical 0 0 0 0 0 0 0 Very Important 50 2 48 44 4 0 0 Important 75 12 63 56 7 0 0 Desirable 0 0 0 0 0 0 0 2014 Total 125 14 11,2% 111 88,8% 100 11 0 0 TOTAL 2010-2014 884 689 77,9% 195 22,1% 127 31 11 26 Thereof Critical or Very Important 343 256 74,6% 87 25,4% 60 10 4 13 Out of all recommendations rated 'very important' or 'critical' and issued in the period 2010-2014, 17 very important recommendations (2%) were overdue by more than six months with respect to the deadline set in the initial action plan . No critical recommendation is outstanding. The Audit Progress Committee (APC) was regularly informed of critical or very important recommendations overdue for more than six months. The total number of accepted recommendations issued during 2010-2014 and for which the IAS had conducted follow-up audits by the end of 2014, amounts to 640 (72%). The follow-up work carried out by the IAS confirmed that overall recommendations are being implemented in a satisfactory way thus contributing to the improvement of the control systems in the audited services. The IAS closed 95% of the recommendations followed-up during this period. 2.Horizontal audits 2.1.Audit on efficiency and effectiveness of the planning stage of the selection process - Multi DG (EPSO, DG HR, DG CNECT, DG SANCO – now DG SANTE, DG TAXUD) Background

The human resources selection process is defined as the process of differentiating between applicants in order to identify those with greater likelihood of success in the job. Within the European Institutions (EU Institutions), the selection process should allow the recruitment of candidates with "the highest standard of ability, efficiency and integrity ". Two key players intervene in the EU Institutions' staff selection process, notably: (a)the European Personnel Selection Office (EPSO), that since 2003 "organises open competitions with a view to securing the services of officials on optimal professional and financial terms for the institutions of the European Communities " and manages the reserve lists; (b)the EU Institutions, which are responsible for defining their staff needs and for recruiting staff from the pool of candidates placed by EPSO on reserve lists. Audit Objectives and scope The overall objective of the audit was to assess the effectiveness and efficiency of the current planning stage of the selection process in replying to the EU Institutions' needs of new staff. The audit covered the planning processes in place in EPSO and in the European Commission. In particular, it focused on: At EPSO level: the review of the requests transmitted by the EU Institutions, the monitoring of the reserve lists and the planning for new competitions, as well as the coordination of the whole exercise; At European Commission's level: –DG HR's coordination and monitoring activities, the identification of the Commission's needs based on the Workforce Simulator (WFS), the reliability of the data and criteria used for the assessment of needs; –Operational DGs'/Services' methods to determine their needs of new staff, the reliability of data used and the adequacy of the local HR tools available. Concerning the operational DGs/Services, the present audit analysed the procedures in place in DG CNECT, DG SANCO and DG TAXUD. The results of other IAS audits related to HR topics , performed in 2012-2013, have been taken into account where relevant, in order to provide an overview of the situation at Commission level. There are no observations/reservations in the AAR of the DGs/Services covered by this engagement that relate to the area/process audited. The fieldwork was finalised on 30/01/2014. All observations and recommendations relate to the situation as of that date. Strengths a) At EPSO level implementation of a three-year rolling plan and strategic annual planning exercise to predict and agree staffing needs with the EU Institutions; introduction of a regular cycle of competitions for the main generalist profiles, organised according to a fixed timetable;

regular monitoring of the recruitment rate from the reserve lists and feedback provided to the EU Institutions on the subject, during the monthly meetings of the EPSO Working Group. b) At Commission level implementation of the automated Workforce Simulator tool (WFS) to estimate the number and profiles of officials leaving the Commission in the coming years; close monitoring of the recruitment requests from DGs and of the use of reserve lists. Major Audit Findings The IAS has identified the following two very important issues: EPSO planning exercise (report finding N° 1) EPSO did not provide guidelines and instructions to foster a common understanding of the requirements which should result in a common method for assessing the need for laureates across the EU Institutions, and did not ask the Institutions to provide sufficient details on the criteria taken into account in the assessment of their requests for laureates with a view to preparing the draft planning of competitions based on comparable information. In addition, in the last three years most EU Institutions have been late in contributing to the annual planning exercise, delaying the launch of open competitions. Planning exercise at Commission level – Role of the DGs (report finding N° 3) DGs/Services do not implement and use HR management (HRM) tools (strategic planning, unit management plan, task mapping, workload assessment) consistently to assess their current and future staff needs. Recommendations To address these issues, the IAS formulated the following recommendations: EPSO planning exercise: EPSO should provide guidelines and instructions to the EU Institutions to increase the coherence and comparability of their requests for laureates and should ask them to provide sufficient details on the criteria taken into account with a view to correctly prioritising the requests and aligning the competitions to be organised with the Institutions' real needs and recruiting capacities. Better scheduling of the exercise, in agreement with the Institutions, should also help EPSO reduce delays and finalise its plan in a timely manner. Planning exercise at Commission level – Role of the DGs: DGs/Services should implement HRM tools (e.g. strategic planning, unit management plans, workload assessment, competence/task mapping) consistently and use their output in the analysis of future recruitment needs. The audited services have established action plans which the IAS considers satisfactory to address the recommendations. 2.2.Horizontal IT audit : Audit of management and supervision of outsourced IT services (contract management) – Multi DG (DG BUDG, DG DIGIT, DG HOME, OP, DG SANCO – now DG SANTE) Background

The European Commission is continuously increasing the use of IT in most of its fields of activity. It therefore has to ensure that it is getting the best value for money from its investments in IT, which has consistently grown over the last years. A significant part of the IT expenditure of the Commission is devoted to the outsourcing of IT services to internal or external providers. The benefits of outsourcing include quality improvements, flexibility, better risk management and freeing up internal resources to focus on core, value-adding activities. Outsourcing should be viewed not just as a procurement management exercise (i.e. purchase of services) but also as a strategic management decision whereby third parties participate in the value chain through the provision of a service. Therefore, a key factor is that by outsourcing an IT service, an organisation transfers the operational responsibility to the supplier, but remains accountable and hence has to ensure that the risks are being managed and there is continued delivery of value from the service provider. If the outsourcing entity does not retain accountability for the outsourced IT services, its needs may not be clearly defined and/or not clearly communicated to the supplier or the contractors' underperformance may not be timely detected or not adequately addressed. These may negatively affect the activities and the targets of the outsourcing entity and lead to ineffective use of financial resources. Consequently, the DGs/Services have to implement an appropriate structure (roles, responsibilities, procedures and controls) enabling a proper management and supervision of the outsourced IT services to ensure that the service providers deliver value for money. In the Commission, the responsibilities are set up at the corporate and local level. At the corporate level DG DIGIT and DG Budget provide guidance, instructions and templates, develop training and manage framework contracts. These contribute to the environment facilitating the management of IT contracts by the operational DGs. At the local (operational) level, DGs/Services are responsible for defining needs, implementing individual contracts and ensuring that the services provided meet their requirements in quality, quantity and timeliness. This can be achieved through an effective contract management which includes a correct definition of the needs, a clear communication of the needs to the IT service provider and a continuous monitoring of the provider’s performance. Audit Objectives and Scope The overall objective of the audit was to assess the effectiveness and efficiency of Commission's processes in place for the management and supervision of contracts for outsourced IT services with a view to ensuring that value for money is obtained. The scope of the audit covered the environment created by the Central Services to facilitate the monitoring and supervision of IT contracts and the actions taken by the operational Services for managing and supervising the IT contracts. The audit included DG DIGIT (in its central and operational roles), DG Budget (in its central role) and a sample of operational Services (DG SANCO, DG HOME and the Publications Office). There were no observations/reservations in the AAR of the DGs covered by the engagement that relate to the area/process audited. The fieldwork was finalised in mid-November. All observations and recommendations relate to the situation as of that date. Strengths Commission-level DG Budget has developed detailed guidelines on procurement and templates of contracts for IT services that are available for all the operational Services of the Commission; For the calls for tender for Commission-wide framework contracts, DG DIGIT prepares "Orientation documents" to take stock of the lessons learnt from previous contracts and to identify the risks that could materialise during the procurement process and the related mitigating measures. It also involves the potential users in the DGs/Services in the definition of the needs; DG DIGIT provides a comprehensive set of tools (i.e. e-Request, e-Ordering and e-Invoicing) facilitating the management of contracts for IT services and the relationship between the users in DGs and the contractors; The main framework contracts recently concluded foresee explicit provisions for checking, before the signature of the specific contract, the education and professional experience of "intra muros" consultants; All DG DIGIT framework contracts foresee the use of pre-defined KPIs to measure and monitor the performance of the contractors. Operational Services Some good practices were identified, in particular as regards:

Clear procedure for the upstream phase (i.e. before launching a call for tender) enabling the proper identification of needs and of issues from previous contracts; DG's policy on type of working mode (i.e. time and means, quoted time and means, fixed price) for outsourced IT services; The use of an IT system for the management of intra muros staff; The use of contractual clauses that allow immediate action in case of contractor underperformance. Major Audit Findings for DG DIGIT The IAS has identified the following three very important issues: Estimation of needs before establishing a framework contract (report finding N° 1) At Commission level, DG DIGIT's approach to estimate the needs is not consistent across the different framework contracts it manages, in particular regarding the timing of the collection of the needs, the level of detail requested from the DGs/Services and the metrics used to define the needs (euro, man-days, man-year). In addition, DG DIGIT does not propose criteria to operational Services to estimate their needs so as to ensure comparability of data. The lack of detailed statistics on the use of framework contracts does not allow DG DIGIT to assess adequately the reasonableness of the needs at Commission level. At the operational level, some DGs/Services do not have a structured process to estimate the needs for their own framework contracts encompassing the definition of criteria that should be considered and identifying potential issues and/or lessons learnt from past contracts that should be addressed in the tender specifications. In some cases, this process in not sufficiently documented to allow a quality review of the tender documentation (e.g. by the actors involved in the validation of the tender documents, such as the authorising officer). Quality management of services outsourced on a time and means basis (report finding N° 2) Although they had the possibility, none of the DGs/Services using IT consultants working on a time and means basis (i.e. intra muros) asked for supporting evidence of the education and working experience of the intra muros consultants, relying on the contractors' reliability for the information provided in the CVs. The KPIs for measuring the contractors' performance under the Commission-wide framework contracts differ in terms of content and the way they have to be calculated. In addition, they do not allow capturing the performances of the contractors at the operational DG level and are not always reported to the end-users in the operational Services. The mechanism to apply liquidated damages in case of contractor underperformance is not the same for all framework contracts and appears to be too complex. As a result, it is rarely used. For their own framework contracts, the operational Services have different levels of maturity for defining and using KPIs. In some contracts no KPIs are defined, in others KPIs are pre-defined by the DGs. In one case, the DG also includes the possibility for the contractor to provide additional KPIs. Guideline on the choice of type of outsourcing (report finding N° 3) At Commission level, there is no guidance on how the operational Services should assess their needs for intra or extra muros consultants and what criteria they should consider when choosing between different types of outsourcing, in order to have a coherent approach among Services. In addition, there is no analysis aiming at identifying the key factors that drive the choice of the operational Services, the advantages, disadvantages and the risks of each working mode. The operational Services do not base their choice on the result of a cost-benefit analysis but on operational reasons. This decision is normally not re-assessed based on experience with past contracts. The sampled DGs show a high degree of heterogeneity for similar tasks, with some using exclusively intra muros consultants and others using extra muros consultants with an exceptional use of intra muros ones. Recommendations To address these issues, the IAS formulated recommendations which can be summarised as follows: Estimation of needs before establishing a framework contract DG DIGIT should strengthen the process to assess the needs of calls for tender for which it is "chef de file" by harmonising the surveys used, providing a minimum set of instructions to ensure DGs use similar estimation criteria and by using meaningful statistics to assess the reasonableness of the consolidated needs at Commission level.

DGs should implement a structured and traceable process based on pre-defined criteria, analysis of past issues and identification of risks related to the tender procedure. Quality management of work outsourced on a time and means basis DG DIGIT, in its central role, should harmonise and enhance the performance monitoring mechanism and how it is translated in the contractual arrangements. The DGs should take stock of the good practices implemented at corporate level and improve the performance measurement system for their own framework contracts. Guideline on the choice of type of outsourcing DG DIGIT, in its central role should identify the factors that drive the choice of the DGs/Services, the advantages, disadvantages and the risks of each type of outsourcing and issue guidance to help the operational DGs/Services choose the most appropriate working mode. At the operational level, the choice should be based on a cost-benefit analysis taking into consideration the particularities and constraints of the outsourced services. Major Audit Findings for DG SANCO The IAS has identified the following two very important issues: Quality of tender documentation for DG SANCO's own framework contracts (report finding No.1-SANCO) Weaknesses were identified in three aspects of the DG's tender documentation for an in-house IT framework contract: a) validation of tender documents: a lack of guidance for ex-ante financial verifiers has resulted in inconsistencies in tender documents; b) internal guidance on procurement: there is currently no consolidated version of the DG's guidance on procurement and there is no flowchart covering the entire procurement procedure and the role of the actors intervening, including the responsibilities of the Public Procurement Committee; c) contractual provisions defining the acceptable level of service: DG SANCO's framework contracts do not define indicators and targets to accurately measure and monitor the overall performance of the contractor. In addition, the provisions for applying liquidated damages in cases of underperformance are not linked to an objective measurement of the contractor's performance. DG SANCO's outsourcing strategy (report finding No.2-SANCO) Contrary to DG BUDG's guidance on using extra muros services as a rule and intra muros services as an exception, DG SANCO has opted for the opposite solution. The choice of working exclusively with Time & Means orders (i.e. intra muros services) is not based on a cost-benefit analysis (either at the DG level, or on a case by case basis, for each project) or on analysis of historical data, but mainly on the operational advantages of working with intra muros staff (e.g. adaptive planning, flexible and rapid response to changes). It should also be noted that an accurate cost-benefit analysis should factor in the use of Commission resources by intra muros staff. For these reasons, the claimed savings quantified by DG SANCO in its IT Master Plan, resulting from using intra muros rather than extra muros development, are not justified and hence their correctness cannot be assessed. Recommendations To address these issues the IAS has formulated recommendations which can be summarised as follows: Quality of tender documentation for DG SANCO's own framework contracts In order to improve effectiveness of ex-ante controls and the quality of tender specifications DG SANCO should improve communication on tender content and context between operational and Finance and Control units and develop checklists for the process of validating tender documents. To clarify the roles and responsibilities of the different actors involved in the procurement procedure, including the Public Procurement Committee, DG SANCO should consolidate all procurement guidance in one document. To monitor and obtain assurance that the services provided by contractors meet the expected level, DG SANCO should include a minimum set of performance indicators in the tender specifications of its future IT related calls for tender. DG SANCO's outsourcing strategy DG SANCO should include in the Business Case of its IT projects an ex-ante cost benefit analysis of the various outsourcing options (Time and Means, Quoted Time and Means, Fixed Price) to identify the best solution for each particular project. In addition, during the lifetime of an IT project, the need to continue working with Time and Means orders should be reassessed at key points, e.g. when passing from the development to the maintenance phase, to ensure the best value for money when choosing the type of contract. Major Audit Findings for the Office of Publications (OP) The IAS has identified the following two very important issues: Evaluation of OP's own call for tenders prior to publication (report finding No.1-OP)

Weaknesses were detected in the ex-ante evaluation procedure for OP calls for tender, in particular the use of an overly-complex questionnaire for evaluators. This has led in some cases to an incorrect estimation of needs. Consequently, the OP had to increase the maximum budgetary ceiling of the contract, where possible, or to launch a new call for tender earlier than foreseen, thus incurring additional costs for the Office. Provisions in the tender specifications of OP's own calls for tender (report finding No.2-OP) The Service Level Agreements (SLAs) incorporated into OP's own calls for tender are not currently implemented as stated in the tender specifications, either in terms of their function or content. A separate issue was identified at the evaluation stage of OP calls for tender: contrary to DG BUDG guidance, pre-defined KPIs are used as technical award criteria. There are also inconsistencies in evaluators' assessments of the additional KPIs submitted in tenderers' offers. Recommendations To address these issues the IAS has formulated recommendations which can be summarised as follows: Evaluation of OP's own call for tenders prior to publication To improve the quality of the evaluations of tenders and their added value for future tender procedures, OP should review the current ex-ante evaluation questionnaire to streamline and focus it on the most important points, e.g. needs estimation and lessons learned from previous contracts. Staff awareness of the importance of the evaluation process should also be raised, to improve the quality of information provided by evaluators. Provisions in the tender specifications of OP's own calls for tender To address the SLA issue, the OP should assess for each call for tender if an accompanying SLA is necessary and draft the tender specifications accordingly. In cases where an SLA is considered necessary for the execution of the contract, the tender specifications should clearly define its content and it should be signed together with the contract. On the issue of KPIs, the OP should follow the guidance of DG BUDG on both pre-defined and additional KPIs: pre-defined KPIs should no longer be used as a criterion for the qualitative assessment of offers as tenderers have to comply with them; optional elements such as additional KPIs should not be foreseen in the tender specifications. The audited services have established action plans which the IAS considers satisfactory to address the recommendations. 2.3.Audit on the administrative processes supporting the European Semester – Multi DG (SG, SJ, DG COMM, DG COMP, DG ECFIN, DG EMPL, DG MARKT, DG TAXUD) Background The IAS audit on the European Semester (ES) process was scheduled in the IAS audit work programme for 2014. The ES has been designed to ensure that the Member States (MSs) discuss and coordinate their budgetary, macro-economic and structural reform plans with the EU institutions and other MSs at specific times throughout the year. Several deliverables are produced by the Commission, which involves a high level of coordination and cooperation between the DGs and Services. The ES process is relatively new as it was introduced in 2010 and executed for the first time in 2011. Audit Objectives The overall objective of this performance audit was to address the following question: Are the administrative processes supporting the European Semester effective and efficient across the Commission? The audit assessed the adequacy of the internal control system regarding the production and communication of the various ES deliverables. Audit Scope The audit focussed on the following main areas and addressed the corresponding sub-questions: Has the Commission put in place effective and efficient processes and procedures for the organisation and management of the ES?

Has the Commission put in place effective and efficient processes and procedures for the planning, implementation and monitoring of the ES? Have the DGs put in place an effective and efficient resource management? Have the DGs set up an effective and efficient quality assurance/management programme to follow-up on the continuous improvement of the ES process in all its aspects? Are communication/information channels effective and efficient? Have the DGs put in place an effective and efficient document management system to ensure the security, including confidentiality and integrity of ES deliverables? The following DGs were selected for this audit: SG, DG ECFIN, DG EMPL, DG TAXUD, DG COMM, DG COMP, DG MARKT and the Legal Service. There were no observations in the relevant DGs' Annual Activity Reports (AARs) that relate to the process audited. The fieldwork was finalised on 29/10/2014. All findings and recommendations relate to the situation as of that date. Strengths The European Semester (ES) coordinates a number of deliverables with different purposes emanating from the complex underlying legislation of the Stability and Growth Pact and the Macro-economic Imbalance Procedure. The scope of the ES covers the full range of the Europe 2020 strategy, leading to the involvement of several DGs and many people across the Commission. The ES calendar is constrained by dates fixed in the legal basis, the MS budgetary cycles, and requirements of the Council committees. Taking into account that the first cycle of the ES started in 2011 and that it had to evolve over time, the auditors recognise the good results that the DGs involved have already achieved and that the Commission has consistently delivered its ES objectives under extremely tight deadlines. The following major strengths in the ES process were identified. In general, efficient internal DG coordination and timely delivery of inputs in a very tight ES timetable. In each DG involved in the ES process, a well-structured and strong Central Coordination unit has been created. The professionalism and dedication of the staff involved, including working overtime, also contributed significantly to the achievement of the ES objectives. Creation of cross DGs Country Teams, coordinated by SG's Country Team Leaders. Creation of European Semester Officers (ESOs) in the Representations in the Member States and backup persons. In the course of the ES, several meetings are held to coordinate between DGs and to inform each other (e.g. meetings with Europe 2020 coordinators in DGs, country team leaders, ESOs, and Country Team meetings, Core group meetings and Council committee meetings). Good communication, exchange of information and implementing a no surprise approach with the MSs via bilateral meetings. Internal coordination of the preparation is very efficient for most key deliverables. Guidelines and templates exist in the SG and DG ECFIN and, in general, sufficient guidance is given for the units involved in the process. Guidance is also given in the periodic Country Team meetings, coordinated by the SG. After the closing of the ES, post-mortem exercises are held in several DGs involved in the ES cycle, which shows their willingness to continuously improve the whole process and working methods every year.

Good quality training organised on the ES process open to Commission staff. Major Audit Findings The audit in the SG and the sampled DGs did not identify any issues that gave rise to critical or very important recommendations. Overall, the audit showed that the administrative processes in the SG and the sampled DGs support the implementation of the European Semester across the Commission in an effective and efficient way. 3.Agriculture, natural resources and health 3.1.Gap Analysis Review of 2014-2020 Regulations for the Common Agricultural Policy, Phase 1 - DG AGRI Background The Multi-annual Financial Framework provides for the new CAP period 2014-2020 for the preservation and management of natural resources a total of € 373 179 m, representing some 38% of the total Commission expenditure for the period. Of this, € 277 851 m relates to Pillar 1, which includes market related expenditure and direct payments. The management of the European Structural and Investment Funds (ESI Funds), which, like CAP expenditure, is shared between the Member States (MS) and the Commission, involves overall commitment appropriations of € 325 146 million in 2014-20 under heading 1b, with € 84 936 million for the CAP - Pillar 2 under heading 2. As part of the IAS Strategic Audit Plan 2013-2015, the IAS is carrying out a gap analysis review of the 2014-2020 Regulation for the CAP in 2014-2015. This is being conducted in two phases. Phase 1 consists of a review of the Common Provisions Regulation (CPR), the four basic regulations for the CAP - Direct Payments (Pillar 1), Single Common Market Organisation (Pillar 1), Rural Development (Pillar 2) and Horizontal Regulation for financing, managing and monitoring the CAP - and any relevant Delegated and Implementing Acts (DAs and IAs), to the extent they are available at the time of the audit. Phase 2 will be a more in depth examination of the design and preparations being made by DG AGRI for dealing with the new programming period. There are six layers of rules: common provisions, general provisions, fund-specific provisions, DAs, IAs and Commission guidelines. The CPR was established to improve coordination and harmonised implementation of the Funds providing support under Cohesion Policy (ERDF, ESF and CF), with the Funds for Rural Development (EAFRD) and for the Maritime and Fisheries Sector (EMFF), together the five ESI Funds. Part II sets out common rules for the ESI Funds. For the AGRI area, the general rules on financing, management and monitoring have been set up in the regulation on the financing, management and monitoring of the Common Agricultural Policy (the "Horizontal Regulation"), covering the two funds. Specific rules applicable to each main area (Rural development, Market measures and Direct payments) were specified in separate regulations. The CAP regulations empowers the Commission to adopt Delegated Acts with supplementary rules to cover certain non-essential elements and also Implementing Acts, which give effect to the rules which have already been laid down for the situations in which there is no need to establish any new rules or norms compared to the basic acts. The legislative package, comprising the CPR, the Horizontal Regulation for the CAP and the specific regulation for Cohesion and AGRI, was adopted on 17/12/2013 and for the EMFF on 20/05/2014. Objectives The main objective of the Phase 1 review was to highlight, for the most important areas, the additional risks the Commission is facing as a result of the new CAP regulations, taking account of the need to have an appropriate balance between reducing the administrative burden, but at the same time maintaining the necessary level of control for exercising its supervisory responsibilities under shared management. Scope The review covered to a limited extent the CPR (part II applicable to Rural Development), the associated secondary legislation where appropriate, the Horizontal Regulation for the CAP and the fund-specific regulations for Direct Payments, Common Market Measures and Rural Development respectively. There were no reservations relating to the new CAP period 2014-2020. However, the following reservations were made in the 2013 AAR related to the previous period: Reservation 1: ABB02 – Expenditure on Market Measures: 7 aid schemes in 9 Member States (11 elements of reservation): Austria, the Czech Republic, France, Italy, Netherlands, Poland, Spain, Sweden and the United Kingdom. Reservation 2: ABB03 – Direct payments: 20 paying agencies, comprising 6 Member States: Spain (15 paying agencies), France, UK (RPA- England), Greece, Hungary and Portugal. Reservation 3: ABB04 – Rural development expenditure: 31 paying agencies, comprising 19 Member States: Belgium, Bulgaria, Cyprus, Germany (2 paying agencies), Denmark, Spain (6 paying agencies), Finland, France (2 paying agencies), UK (2 paying agencies), Greece, Ireland, Italy (5 paying agencies), Luxembourg, Netherlands, Poland, Portugal, Romania and Sweden.

The fieldwork was finalised on 15/10/2014. All observations and recommendations relate to the situation as of that date. Major Audit Findings This engagement constituted a very specific review of the legislation underpinning the new period 2014-2020 and it was only the first phase of a wider examination of the DG's preparations for 2014-20. The CPR and the CAP Horizontal Regulation bring together a number of key improvements aimed at harmonising and simplifying the arrangements governing the Structural Funds and the two pillars of the Agriculture area. The IAS acknowledges the efforts made by the Commission's services during the negotiation phase to protect the Commission's interests in its supervisory role, particularly in the face of very strong external political pressures. However, the final adopted legislation has resulted in significant additional risks, which will need to be addressed as part of the DG AGRI’s preparations for the design and implementation of controls in the new period. The main theme emerging as a result of this assessment, and which recurs across most of the findings is the sheer complexity and volume of the changes brought about by the legislative process. Across the board, but notably in key areas such as 'greening', a number of new measures were introduced, together with a large number of derogations, exceptions and supplementary rules which have offered greater flexibility to MS. With so many changes, the rules become complicated and therefore difficult to understand and apply in practice. The IAS notes the efforts made by DG AGRI, particularly towards and since the end of the IAS fieldwork, to address these concerns, for example the preparation of vade-mecums and detailed guidelines to be adopted by the Commission. Nevertheless, the scope for interpretation on the part of MS has been significantly increased, which in turn can have an equally significantly impact on the error rates. Responsibility of Managing Authorities, Paying Agencies and Certifying Bodies and Accreditation Process The number of PAs will remain the same (82) for the new period, which represents a missed opportunity to strengthen the underlying systems by streamlining the organisation and having a narrower span of control. This could in turn mean that the existing control problems will persist in the new programming period. Suspensions of payments The CAP Horizontal Regulation introduces a new legal framework for reducing/suspending payments and defines the conditions necessary for the identification of serious deficiencies in the control system which are not remedied by the MS concerned in accordance with an action plan. It also imposes a limit (2 years) on the time the Commission can suspend payments in the case of systemic errors. The effect of this time limit could be that payments are resumed even before remedial actions to address the reason for suspension are fully implemented. Also, although payments can be suspended if MS submit control statistics late, there is no penalty if the data is of poor quality and the Commission's powers were further reduced by limiting the amounts which can be suspended. As a consequence, MS have little incentive to submit accurate data. This is another missed opportunity to tackle the long-standing problems as regards the reliability of information submitted by MS. Financial Corrections & Recovery of Irregular Payments An opportunity was missed to align more closely financial correction processes between CAP and Cohesion area. Under the CAP, this is expected to take twice as long compared to the Cohesion area - due to the additional conciliation step envisaged in the Horizontal Regulation. Furthermore, the Delegated Act defines or categorizes in a very generic manner the key/ancillary controls which still needs to be complemented by more detailed guidelines. These controls are essential for assessing national systems, in order to decide on the seriousness of control weaknesses giving rise to corrections. As is the case with Cohesion area, the Commission can increase the level of flat rate corrections in the case of persistent deficiencies under the CAP. However, the conditions for doing this are much less explicitly stated in the Delegated Act supplementing the Horizontal Regulation than they are for the Cohesion area legislation and will therefore need to be supported by concrete guidance in order to be effectively applied in practice. Although the Commission can suspend/reduce payments if MS are not diligent in recovering irregular payments, the financial consequence of non-recovery has to be shared between both the MS and the Commission (so called "fifty-fifty rule"), as was the case previously and contrary to the Commission's proposal. This was a missed opportunity to incentivise MS to improve their recovery systems and simplify its management. Monitoring performance (performance framework) The performance framework set out in the CPR is key to the results based focus of the ESI Funds in the 2014-2020 programming period and is complemented in the CAP area by the Horizontal Regulation, which sets out monitoring arrangements covering both pillars. However, the legislative process has resulted in a number of exceptions and conditions to the rules being accepted which could effectively prevent the use of suspensions/financial corrections even where the priorities fail to achieve milestones or targets. This could in turn weaken the ultimate impact of the performance framework. The long-standing problems as regards the reliability of MS data may also impact on the ability of DGs to effectively assess progress and performance and there is also an inherent risk that MS will set unambitious milestones and targets to avoid risking the performance reserve. Eligibility Rules – First Pillar Eligibility rules have become significantly more complex overall. The legislative process has opened up a wide range of options and different possibilities for MS which can only serve to increase the risk of misinterpretation and ultimately non-compliance. In addition, it will inevitably place significant additional pressure on the Commission's resources in assisting and supporting the MS, ensuring consistency and controlling different practices across them. The introduction of Ecological Focus Areas (EFA) is one of the key new measures. However, the definition is now even wider than originally planned and MS have considerable flexibility in choosing what elements to include, some of which are likely to be more difficult or costly to control3. Also, a significant number of exemptions were introduced which again will complicate arrangements even further. The co-legislators also introduced a transitional period to allow MS ensure that the Land Parcel Identification System (LPIS) can cope with EFAs. The LPIS is a key part of the control system and if not updated on time and/or the underlying data is not of good quality then it could have a significant impact on the error rate. During this transitional period, there is a higher risk of errors as it will not be possible to cross check between the EFA declared and the LPIS. Since the completion of the audit fieldwork DG AGRI has since told the IAS that it plans to mitigate this risk through increased on-the-spot checks and recording the EFA declared by the beneficiaries in the LPIS, after verification and before payment. As regards the Common Organisation of Markets (CMO), new measures such as the promotion of wine mean a greater overlap between the two Pillars, which could in turn increase the risk of double funding. In addition, the CAP now allows the Commission to take measures in crisis situations. However, as to what constitutes such a crisis and/or the underlying criteria which need to be met before triggering such measures, this has yet to be defined. This could present a reputational risk in so far as it could lead, through for example political pressure, to measures which distort normal price movements and impact adversely on the financial possibilities to deal with genuine cases of emergency/crisis. Basic Payment Scheme and other direct payment schemes

A number of new measures were introduced aimed at greening the CAP and ensuring a more equitable distribution of resources between and within MS. The most important of these was the Basic Payment Scheme (BPS), but a range of other measures was also introduced, such as the young farmers scheme and also new voluntary measures such as redistributive payments, small farmers scheme and payments for areas with natural constraints and voluntary coupled support. These were all subject to significant changes during the negotiations aimed at essentially providing more flexibility to MS, but which at the time results in more complicated rules and greater scope for interpretation. As regards the BPS, the Commission originally proposed a uniform payment per hectare by 2019, but a significant number of exceptions and derogations were introduced during the negotiations relating to, for example, the allocation of payment entitlements, internal convergence rules and the possibility to maintain payment entitlements under the Single Payment Scheme, etc. These derogations and options could ultimately lead to a wrong allocation of payment entitlements with multi-annual implications. Greening 'Greening' is probably the single most important change to the CAP, representing some 30% of the national envelope for direct payments. It also constitutes one of the biggest overall risks, particularly given the scale of amendments, options and derogations introduced during the negotiations, which will make the rules very complicated and the measures difficult to control in practice. Greening is implemented through three main measures: crop diversification, maintaining of existing grassland and introduction of an ecological focus area (EFA). However, under the 'equivalent practices' initiative, MS can replace these measures with measures which yield equal or greater environmental and climate benefits. These can be covered by agri-environmental climate measures under rural development programs or by national certification schemes, in which case MS can define the certification arrangements. In addition to being inherently very complex schemes and prone to error, the possibility to deliver these measures under rural development programs means there is also the risk of double funding. Greening will also present a major challenge for the Integrated Administrative and Control System (IACS), particularly as regards to the verification of crop diversification, the EFA, permanent grassland and equivalent practices. The complexity of the measures involved will mean that the IACS will need to be significantly adapted to cope with the new rules and certain requirements can be checked only on-the-spot. In addition, the sanctions system for non-compliance with greening requirements is likely to have a lower deterrent effect than the normal sanctions system under IACS, particularly during the early years. The Commission proposed that penalties would apply from the first year of application (2015), but the co-legislators reduced the deterrent effect by deciding that these should apply only on a gradual basis. Recommendations Reflecting the fact that this is only Phase 1 of the gap assessment, only recommendations of a general nature have been formulated, which should be taken into account going forward in preparing for the 2014-20 Programming Period, but which do not require specific action plans as such. Where appropriate, these recommendations will be made more concrete, based on the detailed findings that will arise from the IAS Phase 2 work: DG AGRI should finalise any new requirements embedded in the CPR, the Horizontal Regulation for the CAP and the 3 other specific regulations as soon as possible through Delegated/Implementing Acts (if empowered in the legal acts) and clarify the rules through detailed guidance to the MS. DG AGRI should formalise the risk assessment of the new schemes to support, assess and adapt their control and audit strategies accordingly to properly address the risks arising from the new legislation and the choices made by each MS. This should also help DG AGRI management to monitor and supervise the required actions. In view of the new elements introduced by the CPR and the CAP four basic regulations, appropriate training should be given to staff so as to ensure consistent application of the rules, both between and within DGs. 4.Cohesion 4.1.Gap Analysis Review of Regulation 2014-2020 for European Structural and Investment Funds (ESI funds) Phase 1 – Multi DG (DG AGRI, DG EMPL, DG MARE, DG REGIO) Background The management of the European Structural and Investment Funds (ESI Funds), which is shared between the Member States (MSs) and the Commission, involves commitment appropriations of EUR 325 146 million in 2014-20, representing some 45% of the total Commission expenditure for the period. As part of the IAS Strategic Audit Plan 2013-2015 the IAS is carrying out a gap analysis review of the 2014-2020 Regulation for ESI Funds in 2014-2015. This is being conducted in two phases. Phase 1 consisted of a review of the Common Provisions Regulation (CPR), fund-specific regulation and any relevant Delegated and Implementing Acts (DAs and IAs), to the extent they are available at the time of the audit. Phase 2 is a more in depth examination of the design and preparations being made by the specific Directorates-General (DGs) concerned for dealing with the new programming period. There are six layers of rules: common provisions, general provisions, fund-specific provisions, DAs, IAs and Commission guidelines. The CPR was established to improve coordination and harmonised implementation of the Funds providing support under Cohesion Policy (ERDF, ESF and CF), with the Funds for Rural Development (EAFRD) and for the Maritime and Fisheries Sector (EMFF), together the five ESI Funds. Part II sets out common rules for the ESI Funds. In addition, it contains in Part III general provisions which apply to the ERDF, ESF and CF (called "Funds"). Part IV contains general provisions applicable to the Funds and the EMFF. The general provisions (part III and IV) as laid down in the CPR do not apply to the EAFRD. For the AGRI area, the general rules on financing, management and monitoring have been set up in the Common Agricultural Policy (CAP) regulation, which apply to both EAFRD and EAGF. The CPR empowers the Commission to adopt DAs of general application to supplement or amend certain non-essential elements of the legislative act and IAs, which lay down uniform conditions for implementing legally binding Union acts. The first wave of DAs and IAs necessary for the programming phase has been adopted by the Commission and parts of the second wave necessary for programme implementation are close to adoption. In addition, some 70 draft guidance notes have been produced under the lead of DG REGIO and coordinated with the other DGs. Reflecting the specificities of the ESI Funds, specific rules applicable to each fund and to the European Territorial Cooperation under the ERDF were set out in separate regulations. The legislative package, comprising the CPR and the fund-specific regulation for Cohesion and AGRI, was adopted on 17/12/2013 and for the EMFF on 20/05/2014. Objectives The main objective of the Phase 1 review was to highlight, for the most important areas, the additional risks the Commission is facing as a result of the co-legislative process for the CPR, taking account of the need to have an appropriate balance between reducing the administrative burden, but at the same time maintaining the necessary level of control for exercising its supervisory responsibilities under shared management.

Scope The review covered the CPR and associated secondary legislation where appropriate. It covered the ESI Funds and the DGs responsible (DG REGIO, DG EMPL and DG MARE). Recognising that only part of the CPR applies to EAFRD, as managed by DG AGRI and that there is a separate horizontal CAP regulation, together with the specific regulations for Direct Payments, Common Market Measures and Rural Development respectively, the findings relating specifically to DG AGRI were consolidated and communicated separately. There were no observations/reservations in the respective AARs that relate to the area/processes reviewed. The fieldwork was finalised on 9/07/2014. All observations and recommendations relate to the situation as of that date. Major Audit Findings This engagement constituted a very specific review of the legislation underpinning the new Programming Period and it was only the first phase of a wider examination of the DGs’ preparations for 2014-20. The CPR brings together under one heading a number of key improvements aimed at harmonising and simplifying the arrangements governing the Structural Funds. The IAS welcomes this approach and acknowledges the efforts made by the Commission's services during the negotiation phase to protect the Commission's interests in its supervisory role, particularly in the face of very strong external political pressures. However, when compared to the Commission’s original proposals, the final adopted legislation has resulted in significant additional challenges which will need to be addressed as part of the DGs’ preparations for the design and implementation of controls in the new Programming Period. Legislation architecture and the need to harmonise/simplify The adopted CPR now constitutes one overarching set of rules for the European Structural and Investment Funds (ESI Funds). However, when taken together with all the associated secondary legislation, it constitutes a complex and voluminous overall package, which is not always readily understandable. In practice, harmonisation seems more geared to the beneficiaries rather than towards the national bodies charged with implementing the rules. The CPR was subject to a very heavy legislative process and the co-legislators introduced many changes. Although the legally binding secondary legislation can provide a safeguard in so far as it allows the Commission to impose more detailed mandatory requirements on Member States, it has been very extensive in nature. The associated definitions as to what should constitute derogations, supplementary rules or non-essential elements were not necessarily applied by the co-legislators in a coherent manner to the cohesion policy legislative package as a whole, which meant in some cases that different types of acts were adopted for essentially the same areas. Taken together, this could lead to problems of interpretation on the part of Member States, which in turn could ultimately increase the risk of errors. Member State Management and Control Systems (roles of Managing Authorities, Certifying Authorities and Audit Authorities) The Commission originally proposed that national bodies would be accredited by an accrediting body set up at the ministerial level, but following the legislative process this was changed to a designation process, in line with the provisions of the Financial Regulation which was adopted by the co-legislator shortly before. Furthermore, whereas in the previous programming period the Commission systematically reviewed at a second stage the compliance assessment of Member State systems, the Commission will now review the designation process on a risk basis only. This change was already included in the Commission's proposal and was adopted by the co-legislators. The 2014-20 legislation prevents the Commission from interrupting payments simply for the reason that a management body is put under probation and/or its designation is ended. However, the IAS notes that it can use Art 83 of CPR to interrupt payments where there is evidence to suggest significant deficiencies in the management and control systems based on the results of national audit work. The Commission originally proposed that the Audit Authority (AA) could not be part of the same public body as the Managing Authority (MA) for high value OPs, but following the legislation process this was allowed, provided that either the Commission took an Art 73 decision during the previous programming period (i.e. could formally rely on the AA) or where it is satisfied concerning the independence and reliability of the audit authority based on past experience. The DGs’ view is that designation risks are mitigated to the extent that in many cases the management and control systems will be similar to those under the previous period and that they have a detailed knowledge of these built up over many years. As regards the Audit Authorities, the Commission originally proposed that sampling should be appropriately based, without specifying whether this should be statistical or nonstatistical. However, the final CPR allows the use of non-statistical sampling where

appropriately justified, while still indicating that the general rule is that statistical sampling should be used. Also, despite challenging the Council's proposals to reduce the audit coverage parameters, it was the Council’s proposals which were finally adopted, with a clear requirement in case of non-statistical sampling that "the size of the sample shall be sufficient to enable the AA to draw up a valid audit opinion". However, in a separate statement related to Art 127 of the CPR, the Commission highlights the risk that reducing the size of the sample of operations could make it insufficiently representative, which would in turn weaken the audit assurance. Concerning the single audit approach, the legislators went further than the Commission’s proposals to reduce controls where it can rely on the AA or the national systems by specifically precluding Commission audits on-the-spot if the Commission has agreed so with the AA, unless there was evidence of deficiencies. Also, there were changes (reductions) to the Commission's original proposals as regards the retention of documents which in turn places additional pressures on both the Audit Authorities and the Commission's own auditors, as it reduces in practical terms the time window for audits, particularly where systemic errors are involved which require more work to estimate the population affected. In addition, the impact on resources could also be very important in so far as audits on the 2014-2020 period will overlap with those on the closure of the previous period. Although the DGs expect to rely more and more on the work of the AAs under the new programing period, Commission audits will continue to play an important role as part of the overall control strategy but audit resources are scarce and require very careful planning and scheduling. Any knock-on impact on the Commission's audit coverage could leave it open to challenge in the case where there are financial corrections involved. Suspensions of payments and Financial Corrections The application of financial corrections was intensively discussed during the legislative process and subject to many modifications from the co-legislators before being finally adopted. These were aimed at seeking to restrict the circumstances and conditions under which net corrections would be systematically applied. The introduction of obligatory net financial corrections strengthens arrangements compared to the previous period and the Commission originally proposed that net corrections would apply from the date at which the Member States submit their accounts. However, the final CPR is less strict in so far as it allows MSs to continue to detect, report and correct irregularities and replace expenditure up to the date at which EU audits, either by the Commission or by ECA, detect a serious deficiency not previously detected nor corrected by the MS. The final outcome, compared with the original Commission proposal, could lead to a reduced incentive on MS to correct irregular expenditure at an early stage of the process and could thus in turn delay the correction process overall. The new legislation also provides for the suspensions of payments and financial corrections linked to the performance of the OPs themselves, for example, where there are weaknesses regarding the reliability of performance information, ex-ante conditionalities and the achievement of milestones. In the previous programming period, the Commission was responsible for deciding on suspensions and for 2014-2020 its original proposal was to keep the whole suspension process in Commission hands. However, the final legislation allows the Commission to propose to the Council the suspension of part or all of the payments under Art. 23 of the CPR which is linked to sound economic governance. Performance Framework The introduction of the performance framework is key to the results based focus of the ESI Funds in the 2014-2020 programming period and overall, constitutes a positive step the move towards ensuring more effective policy delivery in practice. However, the legislative process resulted in agreement of a number of exceptions and conditions to the rules, which could mean that non-performance may not actually be extensively penalised, which could in turn weaken the ultimate impact of the framework. Inherent reliability problems with MS data may have a knock-on impact on the ability of DGs to effectively assess the progress of OPs. There is also an inherent risk that Member States will set unambitious milestones and targets to avoid risking the performance reserve. From the DGs' perspective, this needs very careful monitoring and for staff to be appropriately trained and guided on what to look for. The risk could be compounded by the short timescale available for assessing OPs. However, the IAS notes that the units in charge of evaluation are also involved in the negotiation phase for the OPs and that this partially addresses the risk. Eligibility Rules Reflecting the complex and extensive overall legislative package, the eligibility rules for the ESI Funds are equally complex and multi-layered in nature. They include the CPR, the Fund-specific regulations, two DAs and national level rules. Consequently, this may pose a challenge for both Commission and Member State bodies in terms of verification and control. There are still significant differences between the individual funds and as far as the "investments in infrastructure" or "productive investments" are concerned. Unclear legislative provisions can increase the risk of irregularities/ineligible expenditure. Recommendations Reflecting the fact that this is only Phase 1 of the gap assessment, only recommendations of a general nature have been formulated, which should be taken into account going forward in preparing for the 2014-20 Programming Period, but which do not require specific action plans as such. Where appropriate, these recommendations will be made more concrete, based on the detailed findings that will arise from the IAS Phase 2 work: The DGs should finalise any new requirements embedded in the CPR and the fund specific regulation as soon as possible through Delegated/Implementing Acts (if empowered in the legal acts) and clarify the rules through detailed guidance to the MSs. The DGs should assess and adapt their control and audit strategies accordingly to properly address the risks arising from the new legislation. In view of the new elements introduced by the CPR, appropriate training should be given to staff so as to ensure consistent application of the rules, both between and within DGs. The IAS notes however that knowledge is shared between the DGs through the Sharepoint site on "interpretation", the common use of the workflow IT tool WAVE and common trainings courses delivered by DG REGIO to the other DGs' staff. 4.2.Gap analysis of new legislation/design of 2014-20 Programming Period of European Structural and Investment Funds' (ESI funds) Phase 2 – Multi DG (DG EMPL, DG REGIO) Background As part of the IAS Strategic Audit Plan 2013-2015, the IAS planned to carry out a gap analysis of the new legislation and design of the 2014-20 programming period of European Structural and Investment Funds (ESI Funds) to be conducted in two phases in 2014.

Phase 1 reviewed the adopted legislation in order to assess the extent to which it reflects the Commission's original proposals/objectives to have an appropriate balance between reducing the administrative burden, but at the same time maintaining the necessary level of control to exercise its supervisory responsibilities under shared management. This engagement concerned DG REGIO, DG EMPL, DG AGRI and DG MARE. Audit Objectives Phase 2 is a more in depth examination of the design of the systems for the management of the 2014-20 programming period of the ESI funds by DG REGIO (ERDF/CF) and DG EMPL (ESF), and to the extent possible in this early phase of the programming period, the implementation of these in practice. The outcome of the work on Phase 1 was taken into account for Phase 2. In conducting phase 2, the IAS clearly recognises that the development of the control architecture is very much an on-going process. Therefore, this is reflected in the audit results, in so far as these present a snapshot at a particular point in time. It should also be emphasized that the early nature of the audit was designed to be able to capture the approval process for Operational Programmes. Audit Scope The audit focused on the DGs' processes for: the negotiation, assessment and adoption of the Operational Programmes (OP), guiding and supervising the set-up of the Member States' (MS) Management and Control Systems (MCS). Particular emphasis was given to new elements of MCS as compared to the 2007-2013 programming period as well as aspects related to the results orientation of the 2014-2020 programming period. There were no observations/reservations in the AAR that relate to the area/process audited. The fieldwork was finalised on 30/09/2014. All observations and recommendations relate to the situation as of that date. Strengths The auditors recognise the ongoing efforts made by DGs REGIO and EMPL to put in place a solid basis for the new 2014-2020 programming period's operational programmes and management and control systems. During the audit, the auditors identified the following strengths: (a)Negotiation and adoption of OPs Overall, the processes for the negotiation and adoption of OPs for the 2014-20 programming period were well prepared. The process started on time, mid-2012 with the preparation of the Position Papers and the informal dialogue phase. Detailed guidance was prepared jointly by the ESIF DGs for their staff and for the MS. The negotiation phase is well supervised by senior management in both DGs. There is pro-active cooperation between the ESIF DGs (e.g. bi-lateral monthly meetings of the Directors-General, Stock Taking Group, Ex ante Conditionality Suspension Committee). DG EMPL has in-house policy expertise on the main thematic objectives for which it is responsible and the role of the Geographical Units (GU) typically comprises both monitoring of policy and ESF programme management. DG REGIO has introduced Competence Centres (CC) to provide expertise on the thematic objectives to the GU. (b)Supervising Member State management and control systems The requirements for the MS' MCS largely build on the 2007-2013 programming period, but with important new elements, to further strengthen systems, such as a management declaration and annual accounts. DGs REGIO and EMPL have worked hard to develop a common approach to supervising the MS' management and control systems and the development of common guidance to the MS is well advanced. The joint effort includes as well the development of a single audit strategy for the ESIF DGs and a common audit plan, including also joint audits, based on a common risk assessment. Furthermore common Engagement Planning Memoranda (EPM) and checklists are being developed. Common IT systems support the audit (MAPAR) and data mining (ARACHNE) processes. The DGs have organised anti-fraud/anti-corruption seminars attended by all MS, complemented by seminars for the most risky MS and targeted training to managing and audit authorities on management and control systems are on-going. Major Audit Findings The IAS has identified the following four very important issues: Supervising MS management and control systems (report finding N° 1)

It is still relatively early in the programming period and the outline single audit strategy will still be updated, but as it stands, certain elements are not clear and will need to be addressed as the strategy matures. Currently, there is little explanation as to how the DGs will obtain assurance on the reliability of the Audit Authorities (AA), including their new tasks, even though their work will continue to be the main source of assurance. The IAS acknowledges the move towards a more annual focus in the 2014-20 programming period, notably the review of the annual assurance package and that therefore the DGs' audit strategy focuses mainly on the assurance driven by this annual review (as from February 2016 on the year 2015). However, the strategy does not specify how the DGs will in addition build up assurance on a multi-annual basis and how to ensure that any errors can be detected during the beneficiaries' retention period for documents . Few early preventive system audits are initially scheduled/budgeted, although these are the only way in which the Commission can legally implement corrective measures in the early phases of the programming period. However, the IAS notes that given the delays in the adoption of programmes no expenditure has been declared by MS for the moment. OP negotiation and adoption process (report finding N° 2) There are significant delays in the adoption of OPs in comparison to the initial forecasts. Whereas DG EMPL did not have a specific forecast in terms of number of OPs to be adopted, DG REGIO aimed to adopt all mainstream programmes before the end of October 2014. As of December 2nd, the forecast is that about half of the OPs for which REGIO and EMPL are chef de file, will be adopted by the end of the year. At that moment, only 30 OPs for which REGIO is chef de file and 24 OPs for EMPL had actually been adopted. These delays are largely due to the timing and lack of quality of documents submitted by the MS. The quality issues concern most of the OPs submitted by the MS, but these were appropriately identified by the DGs and resulted in a high number of observations communicated to the MS. However, the OP assessment/adoption process was documented in varying ways. Most Desk Officers (DO) did not actually document their own analysis of the OP and some checks did not encompass all stages of the process. Also, the follow up of observations communicated to MS varied considerably in practice. The Ex-Ante Conditionalities (EAC) assessment is mostly documented at the MS level, while only in some cases the checklist was filled-out for each OP. This is in particular true for general EAC No.7 "Statistical systems and result indicators", which has to be assessed mainly at the OP level, but this was not always done or documented, even when observations were already sent to the MS. Results orientation and performance framework (report finding N° 3) Although the observations sent to MS include remarks on targets/milestones and, in some cases, such issues were discussed between the DO and the MS or the evaluation unit, there is limited concrete evidence of DOs actually trying to assess pro-actively their plausibility in order to address possible unambitious targets set by MS and any assessment made by them is generally not documented. IT systems supporting the management of the PP 2014-2020 processes (report finding N° 4) During the first months of the operation of WAVE, a high number of incidents/defects and last-minute change requests occurred, which, at times, have delayed the operational processes for managing the adoption of Partnership Agreements (PA) and OPs. This led DG EMPL to temporarily suspend the use of WAVE, while DG REGIO continued to use it. There have also been considerable delays in the development and implementation of WAVE. These are due to a combination of reasons, including changes in priorities agreed by the Steering Committee, a lack of stability in the business processes, the priority attached to bug fixing, a lack of skilled IT developers, resource constraints in the IT unit and non-optimal working methods for development and defects resolution. As a result, the initial project planning was unreliable and, according to DG REGIO, the cumulative budget consumption in 2014 for the project was some 27% higher than forecasted. The IAS notes that, in view of the problems experienced in implementing WAVE, DG EMPL is currently examining the possibility of switching to an alternative system. Recommendations To address these issues, the IAS formulated recommendations which can be summarised as follows: Supervising MS management and control systems: The IAS recognises that the audit strategy is in the process of being updated and it is still relatively early in the programming period. However, the gaps identified as regards the audit strategy need to be addressed in good time, to ensure sound assurance building processes for the DGs from the start. DGs REGIO and EMPL should therefore further develop/clarify their audit strategy with respect to how they will obtain assurance on the reliability of the Audit Authority (AA), including on the new tasks of the AA. The annual focus of the audit strategy should be complemented with a multi-annual assurance building approach and audits planned in such a way as to optimise the use of the retention period for documents. The DGs should plan more early preventive system audits to be able to legally implement corrective actions in the early phases of the programming period. OP negotiation and adoption process: The adoption of OPs may be further delayed and not all observations sufficiently addressed in a consistent manner before adoption of the OP. There may also be inconsistencies and a lack of transparency in the assessment of EACs. DGs REGIO and EMPL should therefore carefully monitor the final phases before OP adoption, including the follow-up given to the Commission's observations. The DGs should also clarify the minimum requirements for documenting the DO's work and ensure that DOs assess and document the EAC at the OP level where relevant. Results orientation and performance framework: DGs REGIO and EMPL should ensure that DOs actually question the plausibility of milestones/targets, including through their own research and estimation work, and document this assessment to allow consistency checks to be made and provide a basis for assessing the reasonableness of future OP modifications and the achievement of milestones and targets. IT systems supporting the management of the PP 2014-2020 processes: Additional delays in the delivery of stable WAVE functionalities could increasingly impact on the ESIF DGs' management of the 2014-20 programming period. DGs REGIO and EMPL should ensure that business processes are defined and agreed in time for the development, ensure a stable project team including the necessary development capacity, develop a reliable project planning and monitoring and improve IT development methods and defect resolution in order to ensure a stable platform. The audited service has established an action plan which the IAS considers satisfactory to address the recommendations.

4.3.Audit on preparations for use of Financial Instruments in DG EMPL 2014-20 Background The legal framework for the 2014-20 programming period significantly expands the scope for using financial instruments in the Cohesion area in comparison to the 2007-13 period. Consequently, an audit on the preparations being made by DG EMPL for their use in 2014-20 was included in the 2013-2015 Strategic Audit Plan of the IAS. Audit Objectives The main objective of the audit was to assess the readiness of DG EMPL to monitor and supervise the financial instruments under the new legal framework and to highlight in advance any weaknesses in the DG's control system, which could jeopardise the achievement of objectives of the increased use of financial instruments in the new Multiannual Financial Framework (MFF). Audit Scope The audit was limited to the financial instruments set up under the European Structural and Investment Funds (ESIF). However, as the new legal basis foresees the possibility that ESIF Operational Programmes (OPs) may contribute to EU level financial instruments, the advantages and limitations of this option were also reviewed by IAS. The fieldwork was finalised on 21/03/2014. All observations and recommendations relate to the situation as of that date. There were no reservations in the 2013 AAR of DG EMPL that relate to the area/process audited. Strengths The IAS recognises the joint efforts made by ESIF DGs in strengthening the legal framework for managing financial instruments in the 2014-20 programming period, particularly as regards the introduction of compulsory ex-ante assessments before setting-up a financial instrument and a phased payments system . Also, a strengthening of the provisions for management costs and fees together with improved reporting requirements. Major Audit Findings The IAS has identified the following very important issue: Building financial instruments related capacity (report finding N°1) The complexity of financial instruments requires extensive capacity building both at the level of the Commission and at that of Member States (MS). The capacity problem was recognised as a key factor for the low take-up/incorrect use of financial instruments in the previous programming period and for 2014-20 the financial instruments technical advisory platform (FI-TAP) is expected to play a key role in this regard. However, following the late adoption of the legislative framework, and the delays in the negotiation of a Financial and Administrative Framework Agreement (FAFA) between the Commission and the EIB, this has been significantly delayed and there are continuing doubts as to the likely take-up under ESF. In addition, there is a need to significantly improve the awareness raising effort. Recommendation To address this issue, the IAS formulated the following recommendation. DG EMPL should: Given the delay to the launch of the FI-TAP, contribute to the preparation of technical fiches necessary for effective monitoring and control over the implementation of financial instruments, taking into account ESF specificities. Provide training for both geographical desk officers and auditors, either on an in-house basis and/or by informing about trainings offered by DG REGIO.

Ensure that ESF needs are addressed by the final FI-TAP work programme, e.g. ESF-specific awareness raising activities to be included in the FI-TAP work programme in order to ensure timely and effective communication with various stakeholders. Depending on the take up in the 2014-20 period, further develop in-house knowledge and/or cooperation arrangements with DG REGIO staff to ensure appropriate audit and control coverage. The audited service has established an action plan which the IAS considers satisfactory to address the recommendation. 4.4.Audit on preparations for use of Financial Instruments in DG REGIO 2014-20 Background The legal framework for the 2014-20 programming period significantly expands the scope for using financial instruments in the Cohesion area in comparison to the 2007-13 period. Consequently, an audit on the preparations being made by DG REGIO for their use in 2014-20 was included in IAS Strategic Audit Plan 2013-2015. Audit Objectives The main objective of the audit was to assess the readiness of DG REGIO to monitor and supervise financial instruments under the new legal framework and to highlight in advance any weaknesses in the DG's control systems which could jeopardise the achievement of objectives of the increased use of financial instruments in the new Multiannual Financial Framework (MFF). Audit Scope The audit was limited to the financial instruments set up under the European Structural and Investment Funds (ESIF). However, as the new legal basis foresees the possibility that ESIF Operational Programmes (OPs) may also contribute to EU level financial instruments, the advantages and limitations of this option were also reviewed by IAS. The fieldwork was finalised on 21/03/2014. All observations and recommendations relate to the situation as of that date. Two reservations were made in the 2013 AAR of DG REGIO concerning, inter alia, the financial instruments. One of them is a full reputational reservation related to non-eligibility of expenditure of the financial instrument (CZ OP 2007CZ161PO004) and the other one is a partial reservation due to deficiencies related to financial instrument (ES OP 2007ES16UPO001). Strengths The IAS notes that DG REGIO has a lead DG role as regards financial instruments under all ESIF and has developed a key competence in administering this complex and technically challenging form of assistance. Furthermore, the IAS recognises the efforts made by the DG in strengthening the legal framework for managing financial instruments in the 2014-20 programming period, particularly as regards the introduction of compulsory ex-ante assessments before setting-up a financial instrument and a phased payments system . Also, a strengthening of the provisions for management costs and fees together with improved reporting requirements. Major Audit Findings The IAS has identified the following two very important issues: Legal framework for financial instruments in 2014-20 (report finding N° 1): The IAS identified the following issues arising from the new legal provisions, which are open to interpretation and which can pose risks to their practical implementation: Within the limitations foreseen by Article 37(4) of the CPR, support to enterprises may include, inter alia, financing of working capital, but as regards the general activities of an enterprise and/or realisation of new projects this could be misinterpreted by Member States (MS), which could in turn raise the question as to whether financial instruments will actually generate real investment as opposed to acting simply as a quick disbursement tool. The leverage definition as per the Financial Regulation (FR), to which the Common Provisions Regulation (CPR) refers, does not take into account the specificities of ESIF (i.e. the MS co-financing element which is generally applicable for any cohesion policy action). This means that the additional funding attributable to financial instruments would not be specifically assessed and reported. However, although the data submitted by MS in their Annual Implementation Reports (AIRs) could allow the net (i.e. excluding MS co-financing) leverage effect to be assessed, DG REGIO currently has no plans to make this assessment and report the results.

Preferential treatment for private investors might be needed in order to attract private investors to invest in areas of market failure, which is important for the achievement of public policy objectives and this should in turn be properly justified at the ex-ante assessment stage. However, although the Commission has a supervisory role, it does not actually approve these assessments and therefore has limited opportunity at this stage to address the associated risks. Despite setting stronger rules overall and defining maximum thresholds for management costs and fees, the Delegated Act (C(2014) 1207) allows an exception, for example where competitive tender arrangements apply. In addition, there are clear differences between the arrangements for ESIF and EU-Level financial instruments, which could have a bearing on the market for financial intermediaries. Building financial instruments related capacity (report finding N° 2): The complexity of financial instruments requires extensive capacity building both at the level of the Commission and at that of MS. A key element to this is the financial instruments technical advisory platform (FI-TAP). However, following late adoption of the legislative framework and the delays in the negotiation of a Financial and Administrative Framework Agreement (FAFA) between the Commission and the EIB, this has been significantly delayed. Although certain capacity building measures have been undertaken, actions such as training and guidance still need to be further developed. Recommendations To address these issues, the IAS formulated recommendations which can be summarised as follows: Ensure that the risks related to issues identified in the legal framework are adequately mitigated and properly reflected in its guidance to DG REGIO staff and MS as well as its audit and control strategy, adapted for the 2014-2020 programming period. Specifically, it should develop guidance internally and to MS on the eligibility of working capital and preferential treatment of private investors and ensure that its staff clearly understand the key elements of the ex-ante assessment reports used to justify the set-up of financial instruments with ESIF funding. It should also issue guidance to help ensure that the leverage effect is properly measured and reported in the summary reports to the Parliament and the Council. Closely monitor the work and the timeliness of preparatory works to speed up the launching of the FI-TAP. It should ensure that the FI-TAP work programme is sufficiently flexible to meet all stakeholders' needs. Pending its launch, it should develop a schedule for the drafting of technical fiches and further develop training opportunities for both geographical desk officers and auditors. The audited service has established an action plan which the IAS considers satisfactory to address the recommendations. 4.5.Limited Review of the calculation and the underlying methodology of DG REGIO's residual error rates for the 2013 Reporting Year Background The Mutual Expectation Paper on the AAR Peer Review Process foresees that the IAS may undertake limited reviews of the calculations and underlying methodologies of residual error rates of up to three DGs each year selected on a risk basis. These limited reviews take place, and are reported on to the DGs concerned, before the AARs are finalised. The IAS strategic audit plan for 2013-2015 includes for 2014 a limited review on the residual error rates reported by DG REGIO for the 2013 reporting year. A similar review was conducted in 2014 for DG CNECT. Objectives The objective was to review the calculation and underlying methodology of the Cumulative Residual Risk/Error Rate (CRR) reported by DG REGIO in its (draft) AAR 2013 and so contribute to help mitigate the discharge risk enabling DG REGIO to take appropriate actions, if any, before their disclosure in the final AAR and Synthesis report. Scope The review covered the following aspects: methodology for the calculation of the CRRs for the ERDF/CF operational programmes (OPs) based on the error rates reported by the Audit Authorities (AAs) and statements of withdrawals and recoveries reported by the Certifying Authorities (CAs) (including reliability of the data reported by the MS); testing of the calculated CRRs; presentation of the CRRs in the draft AAR (including compliance with the Standing Instructions for the AAR 2013). The IAS reviewed the draft AAR transmitted to the central services (SG/BUDG) on 28/02/2014 and the preliminary CRR calculations up to that date. As REGIO's CRR calculation tables were updated on an on-going basis until the AAR was finalised, all data reported in the draft AAR and reviewed by the IAS were provisional at the time.

In its 2012 AAR and in the draft AAR 2013, DG REGIO included a reservation for the 2007-2013 programming period on significant issues regarding the effective functioning of management and control systems for ERDF/Cohesion Fund/IPA on a number of programmes in several member states. The reservations were based on a range of factors, including the individual CRR figures for the OPs concerned. The audit fieldwork was finalised on 7/03/2014. All observations and recommendations relate to the situation as of that date, but certain figures included in the report have been updated to reflect the final AAR. Strengths The IAS recognises the on-going efforts made by DG REGIO to strengthen the assurances obtained from the AAs’ work and to demonstrate through the CRR the multi-annual corrective capacity of the management and control systems put in place by Member States (MSs) and the Commission. The IAS found no significant errors in the CRR calculation process and adequate supporting evidence was provided for all data and changes to data used for the calculation process. The IAS notes in particular that the process for reviewing the Annual Control Reports (ACRs) and assessing the reliability of AA error rates is mature, well documented and supported by internal guidance and guidance to MS. This process, which has to take place within a very narrow timeframe, is planned well in advance and monitored very closely. In general, the IAS found that procedures were applied as intended. It also notes more generally the importance of DG REGIO’s overall audit and control strategy in the decision making process for reservations. The assessment of MS management and control systems is a complex mix of assurance building blocks and is the key driver in the process. Major Audit Findings The review made findings related to the way in which DG REGIO presents key information in its AAR on reservations and the amounts at risk (Very Important), the reliability of validated error rates (Very Important), the reliability of MS figures for withdrawals and recoveries (Very Important) and the calculation of the CRR (Very Important). However, given that DG REGIO implemented most of the recommendations concerning the reservations and amounts at risk before finalising its AAR 2013, this recommendation is downgraded from Very Important to Important only. The IAS also made a finding relating to the underlying business process (Important). Recommendations To address these issues, the IAS formulated recommendations which can be summarised as follows: Reliability of validated error rates: For 2014 onwards, DG REGIO should: take the necessary measures with AAs to ensure that the additional instructions provided in its note of December 2013 are applied in practice; clarify the requirement for AAs to report detailed error rate calculation tables, including a minimum level of information on the results of all audits of operations, currently included in the draft implementing acts for the 2014 period, for example by presenting the data in a standard template. Reliability of withdrawals and recoveries: Going forward, the DG needs to carry out more systematic checks on the MS figures and ensure that its audit work delivers the necessary coverage. In particular, REGIO should address the risk of double-counting corrections both taken into account in the estimation of the amount at risk and in the reported withdrawals and recoveries. Also going forward, REGIO should assess how long it takes to effect pending recoveries and the amounts which are actually cashed in practice, before taking them into account for the calculation. In addition, the DG should assess whether formal agreements are actually deducted from the next payment claim in practice in order to confirm whether it is prudent to take them into account or whether to consider them simply as relevant information for the reservation making process. Finally, REGIO should exercise caution in taking account of MS reports on withdrawals and recoveries submitted in advance of the 31 March deadline, unless it has obtained reasonable assurance on the reliability of the data. The DG should ensure that the implementing acts for the 2014-20 programming period address the need t