EUROPEAN COMMISSION Brussels, 24.6.2020 SWD(2020) 117 final COMMISSION STAFF WORKING DOCUMENT Annual report to the Discharge Authority on internal audits carried out in 2019 Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2019 {COM(2020) 268 final}



Table of Contents Content of this STAFF WORKING DOCUMENT PART 1: Final reports Horizontal audits 1.Audit on evaluations and studies in DGs CLIMA and ENV 2.Audit on monitoring the implementation and performance of 2014-2020 operational programmes by DGs REGIO, EMPL and MARE 3.Audit on management of recovery orders for competition fines (including guarantees for competition fines) and for recovery orders in the context of the Commission’s 'corrective capacity' – phase 2 (DGs BUDG and COMP) 4.Consulting engagement on the governance and supervision of executive agencies addressed to SG and DGs BUDG and HR Agriculture, natural resources and health 1.Audit on the management of the fruit and vegetables regime in DG AGRI 2.Audit on international activities in DG ENV 3.Audit on the efficiency and effectiveness of the Health and Food Audits and Analysis Directorate of DG SANTE 4.Audit on the management of food and feed programmes, including emergency measures in DG SANTE Cohesion 1.Audit on management of the employment and social innovation programme, with special emphasis on the PROGRESS axis in DG EMPL Research, energy and transport 1.Audit on implementation of the better regulation principles in the preparation of digital single market policy proposals in DG CONNECT 2.Audit on the implementation of DG ENER’s control strategy for delegated bodies implementing the nuclear decommissioning assistance programme 3.Audit on the governance structure in ERCEA

4.Audit on site management infrastructure support services in the JRC 5.Audit on European Union Finance for Innovators (InnovFin) in DG RTD 6.Consulting engagement on policy feedback from research and innovation projects delegated to executive agencies and joint undertakings in DG RTD 7.Audit on supervision of autonomous EU entities by DG MOVE External actions 1.Audit on annual audit and verification plans in DG DEVCO 2.Audit on the control strategy for humanitarian aid actions in DG ECHO 3.Audit on common foreign and security policy in FPI 4.Audit on annual audit plans in DG NEAR 5.Audit on ex ante control on payments under the European neighbourhood instrument and the European neighbourhood and partnership instrument in DG NEAR Education and citizenship 1.Audit on DG HOME’s audit activity and clearance of accounts 2.Audit on impact assessment in DG JUST Economic and financial affairs 1.Audit on EASME’s project management (project monitoring, payments and amendments) under the programme for the environment and climate action covering the period from 1 January 2014 to 31 December 2020 (the LIFE programme) 2.Audit on effectiveness and efficiency of DG ECFIN's performance-management system 3.Audit on monitoring of EU law implementation in DG TAXUD 4.Audit on human resources management in DG TAXUD 5.Audit on human resources management in DG TRADE General services

1.Limited review on the effective implementation of the internal control framework in DG COMM 2.Limited review on the implementation of the new internal control framework in DGT 3.Limited review on the implementation of the new internal control framework in EPSO 4.Limited review on the implementation of the new internal control framework in OIB 5.Limited review on the implementation of the new internal control framework in OIL 6.Limited review on the implementation of the new internal control framework in DG SCIC 7.Audit on DG ESTAT’s quality management of statistical processes 8.Audit on OLAF’s human resources strategy Information-technology audits 1.Audit on information-technology project management practices in OLAF 2.Audit on information-technology project management practices for multi-Directorate-General projects in DG DIGIT 3.Audit on information-technology governance and project management in OP 4.Audit on information-technology governance and project management in DG EAC PART 2: Follow-up engagements (summarised) 39 1.Follow-up audit on DG AGRI’s control strategy for the 2014-2020 common agricultural policy39 2.Follow-up audit in DG AGRI on the process for managing and sharing data on agri-environmental climate issues in DG AGRI, DG CLIMA and DG ENV39 3.Follow-up audit in DG CLIMA on the process for managing and sharing data on agri-environmental climate issues in DG AGRI, DG CLIMA and DG ENV40 4.Follow-up audit in DG ENV on the process for managing and sharing data on agri-environmental climate issues in DG AGRI, DG CLIMA and DG ENV40 5.Follow-up audit on early implementation of the ESIF control strategy 2014-2020 in DG MARE (based on two follow-up audits performed in 2019)41 6.Follow-up audit on early implementation of the ESIF control strategy 2014-2020 in DG EMPL (based on two follow-up audits performed in 2019)41

7.Follow-up audit on early implementation of the ESIF control strategy 2014-2020 in DG REGIO (based on two follow-up audits performed in 2019)41 8.Follow-up audit on major projects in DG REGIO41 9.Follow-up audit on the management of recovery orders for competition fines and recovery orders in the context of the Commission’s corrective capacity – Phase 1 in DG CONNECT (based on two follow-up audits performed in 2019)41 10.Follow-up audit on the production process and the quality of statistics not produced by Eurostat in DG ENER (based on two follow-up audits performed in 2019)42 11.Follow-up audit on legacy programmes in DG ENER42 12.Follow-up audit on activities in the JRC to support intellectual-property rights42 13.Follow-up audit on human-resources management in the JRC42 14.Follow-up audit on past audits in DG RTD43 15.Follow-up audit on direct management of grants in DG DEVCO43 16.Follow-up audit on the assurance-building process in DG DEVCO’s Headquarters43 17.Follow-up audit on the management of investment facilities (financial instruments) in DG DEVCO44 18.Follow-up audit on the performance-management system in DG DEVCO44 19.Follow-up audit on the instrument contributing to stability and peace in FPI46 20.Follow-up audit on Erasmus+ and Creative Europe – grant-management phase 2 (from project monitoring to payment) in EACEA47 21.Follow-up audit on monitoring the implementation and performance of 2014-2020 national programmes by DG HOME49 22.Follow-up audit on activities in DG DEFIS to support intellectual-property rights49 23.Follow-up audit on evaluation in DG ECFIN49 24.Follow-up audit on the effectiveness and efficiency of the performance-management system in DG FISMA49 25.Follow-up audit on the production process and the quality of statistics not produced by Eurostat in DG FISMA50 26.Follow-up audit on the production process and the quality of statistics not produced by Eurostat in DG GROW50

27.Follow-up audit on the supervision of outsourced information-technology operations in DG TAXUD50 28.Follow-up audit on past audits in DG TRADE50 29.Follow-up audit on the effectiveness and efficiency of the new early-detection and exclusion system in protecting the EU’s financial interests – DG BUDG50 30.Follow-up audit on the procurement process in DG DIGIT51 31.Follow-up audit on the statistical production process and the quality of statistics not produced by Eurostat in DG ESTAT51 32.Follow-up audit on management of intra-muros contractors in DG HR51 33.Follow-up audit on ethics in OLAF52 34.Follow-up audit on the charge-back process in PMO52 35.Follow-up audit on former Internal Audit Capability (IAC) audits in PMO53 36.Follow-up audit on information-technology governance in DG DEVCO54 37.Follow-up audit on the security of information-technology applications supporting nuclear accountancy and nuclear-inspection processes in DG ENER54 38.Follow-up audit on information-technology governance and portfolio management in DG GROW55 39.Follow-up audit on information-technology security in the information-and-communications-technology (ICT) systems of the JRC55 40.Follow-up audit on supervision of outsourced information-technology operations in DG TAXUD55 List of follow-up audits performed in 2019 for which all recommendations have been closed after the follow-up56 Part 3: summary of long-outstanding recommendations – state of play as at 31 January 2020 59



List of abbreviations SG: Secretariat-General

SJ: Legal Service DG COMM: Directorate-General for Communication DG ECFIN: Directorate-General for Economic and Financial Affairs DG GROW: Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs DG COMP: Directorate-General for Competition DG DEFIS: Directorate-General for Defence Industry and Space DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion DG AGRI: Directorate-General for Agriculture and Rural Development DG ENER: Directorate-General for Energy DG MOVE: Directorate-General for Mobility and Transport DG CLIMA: Directorate-General for Climate Action DG ENV: Directorate-General for Environment DG RTD: Directorate-General for Research and Innovation JRC: Joint Research Centre DG CNECT: Directorate-General for Communications Networks, Content and Technology DG MARE: Directorate-General for Maritime Affairs and Fisheries DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union DG REGIO: Directorate-General for Regional and Urban Policy DG REFORM/SRSS: Directorate-General for Reform (former SRSS - Structural Reform Support Service) DG TAXUD: Directorate-General for Taxation and Customs Union

DG EAC: Directorate-General for Education, Youth, Sport and Culture DG SANTE: Directorate-General for Health and Food Safety DG HOME: Directorate-General for Migration and Home Affairs DG JUST: Directorate-General for Justice and Consumers FPI: Service for Foreign Policy Instruments DG TRADE: Directorate-General for Trade DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations DG DEVCO: Directorate-General for International Cooperation and Development DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations DG ESTAT: Eurostat DG HR: Directorate-General for Human Resources and Security DG DIGIT: Directorate-General for Informatics DG BUDG: Directorate-General for Budget IAS: Internal Audit Service OLAF: European Anti-Fraud Office DG SCIC: Directorate-General for Interpretation DGT: Directorate-General for Translation OP: Publications Office of the European Union OIB: Office for Infrastructure and Logistics in Brussels PMO: Office for the Administration and Payment of Individual Entitlements

OIL: Office for Infrastructure and Logistics in Luxembourg EPSO: European Personnel Selection Office EASME: Executive Agency for Small and Medium-sized Enterprises EACEA: Education, Audiovisual and Culture Executive Agency CHAFEA: Consumers, Health, Agriculture and Food Executive Agency INEA: Innovation and Networks Executive Agency ERCEA: European Research Council Executive Agency REA: Research Executive Agency Content of this STAFF WORKING DOCUMENT Part 1 of this document contains: ·a summary of the internal audit engagements performed as part of the 2019 Internal Audit Service (IAS) audit plan (reports issued between 1 February 2019 and 31 January 2020); and ·the principal recommendations (critical and very important) ( ) made. The information contained in this document reflects the state of play when the audit engagements were finalised. Each audit followed the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation of the engagement. The enclosed summary of each engagement aims to provide an overview of the audits and their main results. Additional, up-to-date information is provided in specific sections by the auditees on measures drawn up and already implemented after the internal audit engagements were finalised. Part 2 of this document contains a summary of the results of the Internal Audit Service’s follow-up engagements performed between 1 February 2019 and 31 January 2020 ( ). Part 3 provides a summarised overview of the six long-overdue very important recommendations as at 31 January 2020. PART 1: Final reports Horizontal audits 1.Audit on evaluations and studies in DGs CLIMA and ENV

The objective of the audit was to assess whether studies in the Directorate-General for Climate Action (DG CLIMA) and the Directorate-General for Environment (DG ENV) are managed effectively, efficiently and in accordance with the applicable legislation and corporate guidance. No reservations were made in the 2018 annual activity reports for the two Directorates-General that relate to the area audited. The fieldwork was finalised on 30 September 2019. All recommendations relate to the situation as of that date. The Internal Audit Service recognised the commitment and expertise of key staff in the financial and operational units of both the Directorate-General for Climate Action and the Directorate-General for Environment. The Internal Audit Service identified one issue concerning procurement in the Directorate-General for Environment and formulated the following very important recommendation: The Directorate-General for Environment should ensure that non-compliance events are properly recorded, in line with the applicable corporate guidance. Written guidance should be applied on a more consistent basis. It should also strengthen its monitoring of the implementation of the external contractors’ work, in particular by performing technical evaluations of all reports/deliverables linked to payments. In addition, it should streamline its document management system and access to procurement files and finally it should improve the supervision and quality review of procurement documents. Additional information provided by DGs CLIMA and ENV on the measures drawn up and/or implemented following the Internal Audit Service audit The audit of the Directorate-General for Climate Action did not identify any critical or very important issues, but there is room for improvement in the planning and design of evaluations and studies and on some specific procurement procedures. The Directorate-General provided an action plan to mitigate the risks identified. In the Directorate-General for Environment, the auditors found a number of individual weaknesses in the internal control system underpinning the procurement process. While some of these shortcomings have been addressed immediately, further measures will be taken to ensure that the recommendations from this audit are fully addressed in 2020. To mitigate the risks identified by the Internal Audit Service in this recommendation, the Directorate-General for Environment envisaged the following actions: It strengthened monitoring of the implementation of external contractors’ work by performing technical evaluations for all reports/deliverables linked to payment. This was achieved by including additional checks for all payments (interims and final), including intellectual-property-rights checks and monitoring of planned publication of studies, if applicable. The public procurement management tool (PPMT) is used by the Directorate-General for Environment for all procedures above EUR 15 000 except specific contracts under the framework contract agreements. The tool: (i) ensures consistent application of all procurement procedures; (ii) streamlines document management; (iii) allows for access arrangements for the Directorate-General’s advisory committee members; and (iv) makes it impossible to omit procedural steps. Guidelines how to apply PPMT are available on the Directorate-General’s intranet. Revisions of other procurement guidance and associated templates following the Directorate-General for Budget’s instructions are updated on the intranet of the Directorate-General for Environment on a regular

basis. To improve supervision throughout the internal management plan and quality review of procurement documents, the financial fiche templates have been modified; they will be used for the next management plan (2021). In addition, a studies-tracking system from management-plan request to publication by the Publications Office of the European Union, has been established and will be introduced in the next management plan. The Directorate-General for Environment envisaged the following further actions in the course of the year: (i) reminders about the importance of reporting non-compliance events, through training for financial officers in all units of the Directorate-General; (ii) awareness raising for all Authorising Officers by Sub-delegation in the Directorate-General; (iii) specific internal training on filing of procurement files in the ARES IT tool; and (iv) guidance on intellectual-property rights. 2.Audit on monitoring the implementation and performance of 2014-2020 operational programmes by DGs REGIO, EMPL and MARE The objective of the audit was to assess whether the Directorate-Generals for Regional and Urban Policy, for Employment, Social Affairs and Inclusion and for Maritime Affairs and Fisheries effectively monitor the implementation and performance of their 2014-2020 operational programmes and whether they were well prepared for the 2019 performance review. No reservations were made in the 2018 annual activity report concerning the implementation and performance of the programmes. However reservations were made by both the Directorate-General for Regional and Urban Policy and the Directorate-General for Employment, Social Affairs and Inclusion for deficiencies in the management and control systems of a number of programmes ( ), which affect the legality and regularity of the payments concerned. The fieldwork was finalised on 30 September 2019. All recommendations relate to the situation as of that date. The Directorate-General for Regional and Urban Policy and the Directorate-General for Employment, Social Affairs and Inclusion each adopted a strategy for performance-based culture ( ). These strategies provide a comprehensive overview of the objectives of monitoring activities. The Directorates-General’s strategies are translated into clear procedures, which results in staff focusing on performance of programmes in their monitoring activities. There are detailed operational guidelines in all three Directorates-General and comprehensive manuals on monitoring activities at the Directorates-General for Regional and Urban Policy and for Maritime Affairs and Fisheries. Furthermore, the Internal Audit Service found a number of good practices that the Directorates-General apply in their monitoring activities. Some examples of these practices are set out below. ·The ‘Stock-taking Group’ and its regular meetings provide an effective platform for coordinating procedures and sharing knowledge among the Directorates-General responsible for the European Structural and Investment Fund.

·The management of the Directorate-General for Regional and Urban Policy regularly monitors the implementation of the programmes using a number of internal reporting tools (in particular the implementation reports). This includes close monitoring of programmes ‘in difficulty’, which are identified based on a risk assessment. ·The use of information-technology tools (such as monitoring scorecards) to support desk officers’ plausibility and consistency checks of the data reported in the annual implementation reports. ·Following its assessment of the audit authorities’ work reported in the 2019 annual control reports, the Directorate-General for Employment, Social Affairs and Inclusion plans to perform additional audit work to close assurance gaps related to performance data reliability. The Internal Audit Service identified two issues, one concerning assessing programme performance, identifying and following up on implementation weaknesses and one on performance data reliability, and formulated the following very important recommendations: Assessing programme performance, identifying and following up on implementation weaknesses The Directorate-General for Regional and Urban Policy, the Directorate-General for Employment, Social Affairs and Inclusion and the Directorate-General for Maritime Affairs and Fisheries should improve the review process of the annual implementation reports by clarifying the scope of the assessment of implementation issues and providing guidance on how to formulate a clear overall assessment on the performance of programmes. Their Article 50(8) letters should communicate clearly on all serious implementation issues identified following their own assessment of operational programme implementation and their expectations about the elements that the managing authorities should include in their replies to facilitate follow-up. Finally, apart from enhanced monitoring by the Directorate-General for Regional and Urban Policy of the implementation of ‘programmes in difficulty’, the Directorates-General should strengthen their follow-up on issues that significantly affect programme implementation. They should therefore critically review the corrective actions communicated by Member States, and follow-up on and keep track of the effective implementation of these corrective actions in a more structured manner through the various monitoring activities. Performance data reliability The Directorate-General for Regional and Urban Policy and the Directorate-General for Employment, Social Affairs and Inclusion should align their strategies for a performance-based culture to ensure a consistent approach on how to build up assurance on the reliability of performance data. They should conclude on the level of assurance that can be drawn from the work of the audit authorities on performance data reliability during the review of the assurance packages. If the level of assurance is not sufficient, they should apply mitigating measures for closing assurance gaps. Finally, the Directorates-General should give additional clear instructions to the audit authorities on reporting and concluding on their work on performance data in the annual control reports in the years prior to closure and in the annual control report of the last accounting year Additional information provided by DGs REGIO, EMPL and MARE on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Regional and Urban Policy’s action plan was agreed with the Internal Audit Service and sent in February 2020. The Directorate-General has plans in place to implement three (out of three) recommendations concerning assessment of programme performance, performance data reliability and reporting on implementation. Most of these are expected to be implemented by mid-2020. As regards the Directorate-General for Employment, Social Affairs and Inclusion, the action plan was agreed with the Internal Audit Service and sent on 14 February 2020, and the Directorate-General plans to implement all three recommendations in the first half of 2020. The Directorate-General for Maritime Affairs and Fisheries is affected by two out of three recommendations relating to assessing programme performance and following up on implementation weaknesses (very important). The Directorate-General has drafted its related consolidated action plan and communicated to the Internal Audit Service on time; the actions will be implemented jointly with the Directorates-General for Regional and Urban Policy and for Employment, Social Affairs and Inclusion. 3.Audit on management of recovery orders for competition fines (including guarantees for competition fines) and for recovery orders in the context of the Commission’s 'corrective capacity' – phase 2 (DGs BUDG and COMP) The audit was conducted in a phased approach. This involved first assessing the management of the recovery orders at operational level in a number of selected Directorates-General (focus in phase 1) and then doing the same at central level (focus in phase 2). The audit’s overall objective (phase 1 and phase 2) was to assess whether the Commission has put in place an effective and efficient control system to manage: (i) recovery orders for competition fines (including guarantees for competition fines), and (ii) recovery orders in the context of the Commission's 'corrective capacity', both at central and operational level. Phase 1 of the audit, which was finalised in September 2017, assessed the efficiency and effectiveness of the system put in place to manage recovery orders in a sample of three services: the Directorate-General for Communications Networks, Content and Technology, the Directorate-General for Energy and the Education, Audiovisual and Culture Executive Agency. It also assessed the timeliness and efficiency of the enforced recovery process performed by the Legal Service, as well as the support and guidance offered by that service to Authorising Officers by Delegation. The Internal Audit Service issued a separate audit report to each of the auditees, as well as a management letter to the Directorate-General for Budget. The objective of phase 2 of this audit was to assess whether: ·at central level, the Directorate-General for Budget has put in place an effective and efficient control system to: (i) manage recovery orders for competition fines (including guarantees for competition fines); and (ii) manage recovery orders in the context of the Commission's 'corrective capacity'; ·at operational level, the Directorate-General for Competition has put in place efficient and effective control systems to manage recovery orders for competition fines. There were no reservations in the 2018 annual activity reports of the Directorate-General for Budget or the Directorate-General for Competition that relate to the area/process audited. The fieldwork was finalised in June 2019. All recommendations relate to the situation as of that date.

The auditors recognised the Directorate-General for Budget’s ongoing efforts to develop and improve the recovery process. In particular, the auditors identified the following strengths: ·the clarity of the roles and responsibilities between the actors involved in the recovery process (i.e. the Directorate-General for Budget, Authorising Officers by Delegation and the Legal Service); ·the good quality of the instructions and guidance provided by the Directorate-General for Budget to the Directorates-General and Agencies, enabling them to take informed decisions on recoveries; ·the quarterly information provided by the Accounting Officer to the relevant Resources Directors on any outstanding issues observed at Authorising Officers by Delegation level in order to speed up the recovery process and ensure that it is effective; ·the new requirement for the Resources Directors to sign a note on the quality of the financial data; this formalises the Authorising Officers’ responsibility to guarantee the reliability of the information (including on recoveries) used to produce the annual accounts of the Commission. The Internal Audit Service identified two issues, one on dealing with insolvencies and bankruptcies and one concerning the offsetting process by the Accounting Officer, and formulated the following very important recommendations: Dealing with insolvencies and bankruptcies The Directorate-General for Budget should instruct the Authorising Officers by Delegation to ensure that the information on insolvent and bankrupt legal entities is accurately and timely reported in the relevant databases. It should also put in place preventive and detective risk-based controls to review regularly the financial and legal situation of economic operators with pending recovery orders. Finally, the Directorate-General for Budget should invite the Commission’s Corporate Management Board to decide on the set-up of a comprehensive and reliable set of tools at Commission level, enabling the Authorising Officers and ultimately the Accounting Officer to be informed and alerted in a timely manner about the financial and legal situation of contractors and beneficiaries and take remedial action when necessary. The offsetting process by the Accounting Officer The Directorate-General for Budget should clarify with the Legal Service whether its approach/criteria for not offsetting payments complies with the legal basis and take the necessary actions following the Legal Service’s advice. Furthermore, it should improve the information flows between units, maintain and update the ELC ( ) database in a more efficient way and consider in the long term integrating the ELC database into SUMMA ( ). Additional information provided by DG BUDG on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Budget accepted the recommendations and submitted to the Internal Audit Service an action plan on 10 January 2020. According to this action plan the two very important recommendations will be implemented as follows: Concerning the recommendation on dealing with insolvencies and bankruptcies, actions will be implemented between Q1 2020 and Q2 2021. As for the recommendation on the offsetting process by the Accounting Officer, the action to ‘Provide the staff member(s) responsible to update the ELC database with access to the Orbis database to obtain reliable information on the legal entities’ structure’ had already been implemented when the action plan was submitted to the Internal Audit Service. The action on the interpretation of Article 102 of the Financial Regulation is under development. The rest of the actions will be implemented by end-2020. 4.Consulting engagement on the governance and supervision of executive agencies addressed to SG and DGs BUDG and HR As set out in the terms of reference agreed between the Internal Audit Service and the central services (the Secretariat-General, Directorates-General for Budget and for Human Resources and Security), the objectives of this engagement were to: ·define the scope of the supervision; ·examine the roles and responsibilities in order to identify possible overlaps; ·assess if the existing legal base is fit for purpose;

·identify good practices to replicate across the Commission. As this was a consulting engagement, no audit recommendations were formulated. Agriculture, natural resources and health 1.Audit on the management of the fruit and vegetables regime in DG AGRI The objective of the audit was to assess whether the Directorate-General for Agriculture and Rural Development has put in place adequately designed, efficient and effective internal control processes to manage and supervise the fruit and vegetables regime, thus ensuring that its policy objectives are achieved. The 2017 annual activity report included a reservation related to expenditure on market measures for fruit and vegetables operational programmes for producer organisations in Spain and Italy, as well as a general reservation on expenditure on market measures managed by the French paying agency Agrimer( ). The 2018 annual activity report included a similar reservation for Spain, the United Kingdom, Italy and Portugal, and a general reservation on expenditure managed by the French paying agency Agrimer ( ). The fieldwork was finalised on 24 June 2019. All recommendations relate to the situation as of that date. The auditors recognised the in-depth knowledge, expertise and commitment of staff managing the fruit and vegetables regime. The Internal Audit Service identified two issues, one concerning the instructions provided to Member States for implementing (and controlling) the fruit and vegetables regime and one on the monitoring and evaluation of the fruit and vegetables regime, and formulated the following very important recommendations: Instructions to Member States The Directorate-General for Agriculture and Rural Development should analyse the root causes of detected weaknesses and develop appropriate targeted actions with Member States to address these issues. Monitoring and evaluation of the fruit and vegetables regime The Directorate-General for Agriculture and Rural Development should develop guidance for Member States on the expected content of the quality assessment section of the annual reports. In addition, the roles and duties of each official, as laid out in the job descriptions, should be summarised in a procedure manual or workflow. Additional information provided by DG AGRI on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Agriculture and Rural Development has properly addressed this issue in the corresponding action plan and has been implementing all planned measures according to the agreed timeline. In relation to improving guidance to Member States for implementing (and controlling) the fruit and vegetables regime, the Directorate-General for Agriculture and Rural Development has resolved the backlog of legal interpretations. As of 2020, the Directorate-General uploads letters of interest of all Member States to CIRCABC (an IT secure platform for sharing information with Member State administrations) when the letters are sent out. It has also updated the Europa website concerning the current fruit and vegetables regime. The analysis of the root causes of the main weaknesses identified regarding the fruit and vegetables regime emanating from audits, the exercise of clarification to Member States was finalised in April 2020 with a note on ‘technical issues following audit findings’ to the delegates of the fruits and vegatables management committee.The Directorate-General for Agriculture and Rural Development will soon finalise internal working tools and instructions to review the draft amended National Framework for Environmental actions to ensure that the reviews are consistent and complete. As regards monitoring and evaluation of the fruit and vegetables regime, the Directorate-General finalised a guidance note enabling Member States to evalute in 2020 progress towards the overall objectives of their national strategies. The note was finalised

after discussion with the Member States in the September and November 2019 Agricultural Management Committee meetings (i.e. of the Committee for common organisation of agricultural markets). Dashboards on fruit and vegetables are published on the Agri-food data portal. Staff were also briefed on how to make better use of the data and information provided by Member States as part of the monitoring and evaluation of the common agricultural policy. 2.Audit on international activities in DG ENV The objective of the audit was to assess the extent to which the Directorate-General for Environment effectively and efficiently manages its international activities (strategy, internal organisation and operational processes, priority setting and spending). There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 19 June 2019. All recommendations relate to the situation as of that date. The Internal Audit Service identified one issue concerning coordination with the Directorate-General for International Cooperation and Development as regards voluntary partnership agreements and formulated the following very important recommendation:

The Directorate-General for Environment should establish in writing the responsibility for various voluntary partnership agreements with the Directorate-General for International Cooperation and Development. It should also prepare and agree with the Directorate-General for International Cooperation and Development working arrangements regarding voluntary partnership agreements, including coordination and reporting mechanisms. These arrangements should be regularly reviewed. Additional information provided by DG ENV on the measures drawn up and/or implemented following the Internal Audit Service audit To mitigate the risks identified by the Internal Audit Service in this recommendation, the Directorate-General for Environment has envisaged: (i) establishing in writing the responsibility for the various voluntary partnership agreements between itself and the Directorate-General for International Cooperation and Development; and (ii) preparing and agreeing with the Directorate-General for International Cooperation and Development working arrangements for the voluntary partnership agreements, including coordination and reporting mechanisms. These arrangements should be regularly reviewed. The implementation of these actions is under way. 3.Audit on the efficiency and effectiveness of the Health and Food Audits and Analysis Directorate of DG SANTE The objective of the audit was to assess whether the Directorate-General for Health and Food Safety has put in place controls and processes that enable its Audits and Analysis Directorate to contribute effectively and efficiently to the correct implementation of EU legislation on food and health. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area audited. The fieldwork was finalised on 17 September 2019. All recommendations relate to the situation as of that date. The auditors recognise the ongoing efforts made by the Audits and Analysis Directorate to implement its audit and analysis work programme, in particular: ·the high technical expertise of the auditors of the Audits and Analysis Directorate, as recognised by a large number of colleagues who responded to the IAS online survey ( ); ·the excellent cooperation with staff of the Directorate-General for Health and Food Safety based in Brussels, with the Directorate-General for Agriculture and Rural Development and with the Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs, as evidenced by the IAS online survey ( ). The Internal Audit Service identified two issues, one concerning the staffing of activities and one on time reporting and performance monitoring, and formulated the following very important recommendations: Staffing of activities The Directorate-General for Health and Food Safety should firstly carry out a comprehensive analysis of the impact of its remote location, but also of the recruitment needs per area on a medium to long-term basis. This should serve as a basis for developing a human-resources strategy, covering in particular recruitment and training. It should also assess the scope for discontinuing part or all policy-based activities of the Audits and Analysis Directorate in order to free up resources for core audit activities. Finally, for audit work performed on behalf of other Directorates-General, the Directorate-General for Health and Food Safety should, in cooperation with those services, re-assess the audit and resource needs in the medium-to-long term on the basis of an assessment of the risks and legal obligations. Where relevant, the Directorate-General for Health and Food Safety should propose amendments to the existing working arrangements. Time reporting and performance monitoring The Directorate-General for Health and Food Safety should assess the scope for introducing a time recording system in the Audits and Analysis Directorate and take the first steps (e.g. test it in a pilot phase) towards its deployment. It should also systematically collect and analyse performance information relating to the Audits and Analysis Directorate’s activities in order to improve monitoring. Lastly, it should finalise the development of the coverage of its audit universe by establishing risk-based audit frequencies per audit area and re-assess these on a regular basis. Additional information provided by DG SANTE on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Health and Food Safety accepted the recommendations and produced an action plan in November 2019. Most of the actions are ongoing and expected to be fully implemented by June 2020, although some will have to be delayed, as normal audits have not taken place since mid-March 2020 due to the COVID-19 pandemic. Concerning the recommendation on the staffing of activities, the Directorate-General for Health and Food Safety has already taken actions and will continue its analysis during the exercise to draft the 2020 management plan. A process has been set up with the Directorate-General for Agriculture and Rural Development to re-assess the audit and resources needed, based on an assessment of risks and legal obligations. Under the new Commission, the policy responsibility for medical devices has been transferred from the Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs to the Directorate-General for Health and Food Safety. Therefore, the assessment of legal obligations and risks will be carried out in-house. In cooperation with the Directorate-General for Human Resources and Security, the Directorate-General for Health and Food Safety will assess the impact of the Audits and Analysis Directorate’s location on recruitment and develop a human resources strategy for the medium and long term.

With regard to the recommendation on time reporting and performance monitoring, the Directorate-General for Health and Food Safety has taken the first steps to introduce a pilot time recording system in early 2020. However, as this coincided with the COVID-19, crisis the data collected will not be representative; the exercise will have to be relaunched when stability returns. This will feed into a guidance document for the Directorate-General’s management to enhance its performance monitoring of audit work. The documentation of the audits universe and risk-based frequencies is being developed further during the preparations for the 2021 audit work programme.

4.Audit on the management of food and feed programmes, including emergency measures in DG SANTE The objective of the audit was to assess the effectiveness and efficiency of the Directorate-General for Health and Food Safety’s management of food and feed programmes. There were no reservations in the 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 22 October 2019. All recommendations relate to the situation as of that date. The auditors identified the following strengths: ·commitment and technical expertise of staff involved in the management of veterinary and plant programmes and emergency measures. ·regular comitology meetings with Member States’ representatives within the Standing Committee on Plant, Animal, Food and Feed, with agendas, meeting minutes and presentations publically available on the Europa.eu website. The Internal Audit Service identified one issue concerning the unit costs methodology used by Member States to finance veterinary and plant health programmes and emergency measures and formulated the following very important recommendation: The Directorate-General for Health and Food Safety should involve all relevant actors within the Directorate-General and consult, as appropriate, other Commission services and use their expertise on the basis of clearly defined working modalities. It should also inform Member States well in advance of the financial impact of any change in the methodology and of the resulting actual amounts of unit costs, lump sums and/or ceilings. Additional information provided by DG SANTE on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Health and Food Safety accepted the recommendation and produced an action plan in late February 2020. Its actions are already under way. Most importantly, in February 2020, the Directorate-General for Health and Food Safety and the Joint Research Centre signed an administrative arrangement which includes the objective to improve the unit cost methodology and inform Member States well in advance of the financial impact of any change in the methodology. The whole project runs for 3 years until February 2023. Work is well advanced and first results are expected in June 2020: a new methodology for reimbursement of activities related to animal health programmes and emergency measures is ready to be tested, as is a proposed methodology for Member States’ sampling activities related to plant health.

Cohesion 1.Audit on management of the employment and social innovation programme, with special emphasis on the PROGRESS axis in DG EMPL The objective of the audit was to assess the adequacy of: (i) the programming process (for all three axes of the employment and social innovation programme); and (ii) the adequacy of the design and the effectiveness of controls in the Directorate-General for Employment, Social Affairs and Inclusion for the operational management of grants under the PROGRESS axis. There were no reservations in the Directorate-General’s 2016, 2017 and 2018 annual activity reports relating to the employment and social innovation programme. The fieldwork was finalised on 30 May 2019. All recommendations relate to the situation as of that date. The auditors recognised the ongoing efforts by the Directorate-General to improve its control systems for the employment and social innovation programme and the PROGRESS axis. The following strengths were identified in the audited processes and controls: Concerning the employment and social innovation programme: ·timely collection of contributions from policy units and comments/suggestions from the Employment and Social Innovation Committee in view of the preparation of the employment and social innovation programme’s annual work programmes; ·the annual work programmes include sufficient information about the priorities for the year, the objectives to be achieved and the target outcomes with the appropriations authorised for the financial year;

·the chosen funding areas are in line with the Directorate-General’s needs and priorities, contributing to the Juncker’s political priorities, the Europe 2020 strategy and the European pillar of social rights. Concerning the PROGRESS axis: ·internal guidance provided by horizontal Units F3 and F4 and the operational units, which includes workflows for calls for proposals, presentations and training of staff members dealing with calls for proposals and implementation of grant agreements; ·the exclusion and award criteria, weightings and technical specifications are properly defined in the calls for proposals, in conformance with the applicable regulatory framework; ·regular meetings are held between the operational initiating agents and the call owners on the progress of ongoing calls and to address any questions on the implementation of ongoing projects; ·sufficient and timely information is transferred to the members of the Employment and Social Innovation Committee (composed of representatives of the Member States and chaired by a representative of the Commission) on the planned actions to be funded by the employment and social innovation programme and on the PROGRESS calls for proposals included in the annual work programmes. The Internal Audit Service did not formulate any critical or very important recommendations.

Research, energy and transport 1.Audit on implementation of the better regulation principles in the preparation of digital single market policy proposals in DG CONNECT The objective of the audit was to assess whether the Directorate-General for Communications Networks, Content and Technology has put in place an internal control system for the preparation of digital single market policy proposals - within the remit of this Directorate-General - that is adequately designed and effectively implemented, in line with the better regulation principles. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 19 June 2019. All recommendations relate to the situation as of that date. The Internal Audit Service acknowledged the Directorate-General’s ongoing efforts to ensure effective implementation of the better regulation principles in the preparation of digital single market policy proposals. In particular, the Internal Audit Service highlighted the following strengths: ·the Directorate-General has set up a dedicated better regulation sector in its Unit D2 that assists the operational units in the key steps of the policy-making process; this has brought significant improvements to working procedures and workflows; ·the Directorate-General has set up clear procedural guidance, complementing the corporate guidance, for the application of the better regulation requirements; ·the Directorate-General has developed and applied innovative and good practices for the implementation of the better regulation requirements, namely: ·development of an information-technology tool (DORIS) for reporting on the results of stakeholders’ consultations; ·systematic use of SharePoint as working spaces for each major policy proposal, in particular when different units inside the Directorate-General or different Commission departments are involved in their preparation; ·upstream preparation of meetings with the Regulatory Scrutiny Board, including mock-up meetings organised by Unit D2. The Internal Audit Service did not formulate any critical or very important recommendations.

2.Audit on the implementation of DG ENER’s control strategy for delegated bodies implementing the nuclear decommissioning assistance programme The objective of the audit was to assess the effective implementation of the Directorate-General for Energy’s control strategy for the activities of the delegated bodies implementing the nuclear decommissioning assistance programme and the level of assurance the Directorate-General derives from it. There were no reservations in the Directorate-General’s 2018 annual activity report related to the area/process audited. The fieldwork was finalised on 3 October 2019. All recommendations relate to the situation as of that date. The auditors recognised the Directorate-General’s ongoing efforts to implement its control strategy for the delegated bodies implementing the nuclear decommissioning assistance programme, in particular: ·the systematic and well-documented risk review process set out in the risk-management plan for the programmes, with identified key risks recorded in a programme-specific risk register; ·the expertise and skills of the programme officers in charge of the three decommissioning programmes, which are appropriate for monitoring effectively the programmes’ implementation and performing the necessary checks; ·close involvement of the Authorising Officer by Sub-delegation in the monitoring of the programmes. The Internal Audit Service identified one issue concerning clearing of pre-financed amounts and formulated the following very important recommendation: The Directorate-General for Energy should use the result of the work of independent audit bodies on the disbursed amounts reported by the delegated bodies, in addition to the payment requests, to clear pre‑financed amounts. In addition, it should request that the opinion of the independent audit body for the Central Project Management Agency contain references that enable the Directorate-General to reconcile the disbursed amounts with those reported in the Agency’s summary report. Additional information provided by DG ENER on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Energy accepted the recommendation and implemented actions to mitigate the identified risks: ·In April 2020 the procedure for clearing of pre-financed amounts was updated to include: (i) the certified (audited) financial statements as soon as they are reported by the delegated bodies; and (ii) a coherence check with certified financial statements when non-certified figures are used. The Directorate-General for Energy accounting manual was updated accordingly on 17 April 2020 and duly notified to users involved in these processes. ·In February 2020, the Directorate-General for Energy obtained from the Central Project Management Agency the opinion of the independent audit body on an agreed template that facilitates reconciliation of the disbursed amounts with those reported in the summary report. This agency therefore fulfilled obligations on reporting according to the Delegation Agreement. 3.Audit on the governance structure in ERCEA The objective of the audit was to assess the governance structure specific to the European Research Council Executive Agency (ERCEA), with a focus on roles and responsibilities of the different stakeholders, i.e. the Scientific Council, the European Research Council Board, the Steering Committee and the Directorate-General for Research and Innovation, and the communication between them. The elements gathered by the Internal Audit Service during the preliminary survey, complemented by the results of the previous audits on the grant-management process in ERCEA ( ), enabled the IAS to consider the Agency’s governance framework as adequately designed and to assess the inherent risks related to its implementation as medium to low. Given the positive outcome of the preliminary survey, the audit was stopped at that stage and no formal audit report was issued. 4.Audit on site management infrastructure support services in the JRC The objective of the audit was to assess whether the Joint Research Centre has set up efficient and effective management and control systems to ensure the proper delivery of site management and infrastructure support services. There were no reservations in the Joint Research Centre’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 17 December 2019. All recommendations relate to the situation as of that date. The Internal Audit Service identified the following strengths:

·Communication between the sites of the Joint Research Centre has improved thanks to the creation of the site management network and the centralisation of all site support units (with the exception of Karlsruhe) in Directorate R, following the Directorate-General’s 2016 reorganisation. ·The identification and sharing of best practices to address cases of ineffective procurement planning. ·The completion of the site development implementation plans by the Joint Research Centre (which translate the long-term vision up to 2030 into concrete plans/projects for the next 3 years) will boost harmonisation and ease the integration of small and medium investments into the plans. ·The high level of professionalism and dedication of site support staff and the demonstrated ability to cope with high workload and to protect the financial interests of the Commission. In this respect, the Internal Audit Service highlights the following two examples: ·In procurement, JRC Geel provides information on the content of calls for tender before launching them. This gives potential candidates a better idea of the site management and infrastructure services / construction works to be performed. It also increases the number of applicants (reducing the number of calls for tender that fail due to a lack of suitable applicants). ·As part of the measures to increase the number of competitions and broaden the reach of potential candidates, notifications are addressed to various chambers of commerce in the area of JRC Karlsruhe (IHK-Rhein-Neckar, Karlsruhe, Rheinland-Pfalz) and information is exchanged with KIT (the German research institute in the premises of which JRC Karlsruhe is located). ·Asset management: ·the Joint Research Centre recently finalised the procedure for the 'management of old IT inventoried items under corporate network' and the 'workflow of old IT inventoried items under corporate network' initiatives; ·Geel has included in the maintenance contract the obligation for contractors to store technical parts so that space is available in the site for other purposes than storage; ·the Management Centre in Ispra recently updated its work instructions on downgrading assets and for the inventory; ·Karlsruhe has outsourced its stock-taking exercise in order to cope with the shortage of staff. The IAS identified two issues, one concerning site management and infrastructure process in respect of governance and organisation and one on HR management, and formulated the following very important recommendations: Site management and infrastructure process: governance and organisation The Joint Research Centre should assess and review the current governance and management structure of its site management and infrastructure services. It should also clarify the mandates, roles and responsibilities of those involved in the site management process, as well as those of process owners, and facilitate exchanges across sites and ensure that governing bodies’ mandates are effectively carried out. HR management The Joint Research Centre should ensure that the services performing site management and infrastructure related activities are adequately staffed. Staff should have the relevant expertise and operational staff managing site management and infrastructure procurement procedures and contracts should be able to receive adequate support from specialists. Additional information provided by JRC on the measures drawn up and/or implemented following the Internal Audit Service audit The Joint Research Centre accepted all recommendations and the corresponding action was approved by the Internal Audit Service. 5.Audit on European Union Finance for Innovators (InnovFin) in DG RTD

The objective of the audit was to assess the adequacy and effectiveness of internal controls put in place by the Directorate-General for Research and Innovation to supervise and monitor the implementation and performance of InnovFin. There were no reservations in the Directorate-General’s 2018 annual activity report relating to the area/process audited. The fieldwork was finalised on 9 December 2019. All recommendations relate to the situation as of that date. The Internal Audit Service identified one issue concerning the performance framework and formulated the following very important recommendation: The Directorate-General for Research and Innovation should: (i) ensure that the targets for the key performance indicators are well justified and consistent between different documents; (ii) formalise a methodology to calculate the key performance indicators; and (iii) ensure traceability of their calculation. In addition, it should ensure consistency between the key performance indicators presented in the different reports and if there are unavoidable differences they should be explained in the reports. Finally, the Directorate-General should improve the information on InnovFin performance presented in the different reports so that the reports demonstrate the contribution of InnovFin to Horizon 2020 policy objectives. The indicators included in the Horizon 2020 legal basis should be included in the Directorate-General’s management plan and reported in the annual activity report. Additional information provided by DG RTD on the measures drawn up and/or implemented following the Internal Audit Service audit The action plan was sent on 27 March 2020 (the final audit report was issued on 28 January 2020). The text and figures in the final annual activity report 2019 of the Directorate-General for Research and Innovation concerning InnovFin were carefully prepared and discussed and are representative of the activities in 2019, as requested by the Internal Audit Service. However, the detailed requirements of the recommendation as stated above are still under preparation by the responsible unit, Task Force 3, which will have developed and finalised the methodologies before the end of summer 2020. As for ensuring that targets for the key performance indicators are well justified and consistent between different documents, Working Document 10 is now being coordinated and prepared by the Directorate-General for Budget and the Directorate-General for Economic and Financial Affairs and will be adopted as an annex to the 2021 draft budget. 6.Consulting engagement on policy feedback from research and innovation projects delegated to executive agencies and joint undertakings in DG RTD The objective of the engagement was to review the existing research and innovation policy feedback process and to advise the Common Implementation Centre, based in the Directorate-General for Research and Innovation, on improvements required, if any, for achieving structured input for policy-making at research and innovation family level. As this was a consulting engagement, no audit recommendations were formulated. 7.Audit on supervision of autonomous EU entities by DG MOVE The objective of the audit was to assess if the Directorate-General for Mobility and Transport’s strategy for supervising autonomous entities is adequately designed and effectively implemented to ensure that the autonomous entities: ·guarantee a level of protection of the EU’s financial interests equivalent to what is expected of the Directorates-General, and; ·carry out activities in compliance with the mandate of their founding act in a way that is aligned with the Commission's political priorities. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 13 September 2019. All recommendations relate to the situation as of that date. The auditors recognised the Directorate-General’s efforts to supervise the decentralised agencies and joint undertakings. In particular: ·The supervision of autonomous entities is carried out at the highest management level. The supervision strategy and the discussion on autonomous entities’ risks is a standing point in the agenda of the Control Board ( ) meetings and regular meetings are held between the Director-General and the Directors of the autonomous entities. ·There is a supervision strategy for the autonomous entities. This includes a separate fiche for each of them, provides a division of tasks between responsible units and a timeline for the main annual supervision activities (thus going beyond the guidance template provided by the Secretariat-General of the Commission). ·Staff involved in supervision are experienced, knowledgeable and committed.

The Internal Audit Service did not formulate any critical or very important recommendations. External actions 1.Audit on annual audit and verification plans in DG DEVCO The objective of the audit was to assess: (i) the effectiveness and efficiency of the design, preparation and implementation of the annual audit and verification plans in EU Delegations; and (ii) the monitoring and follow-up of the related audit results. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 30 September 2019. All recommendations relate to the situation as of that date . The auditors identified the following strengths: ·The monitoring carried out by the Directorate-General for International Cooperation and Development Headquarters through specific key performance indicators helped speed up audit contracting and reporting over time. ·The templates provided for the terms of reference for audit work and for audit reports contribute to the overall consistency/comparability of audit reports and to their quality. ·The documentation of the tasks performed at the Directorate-General Headquarters (in particular, by Unit DEVCO.R.2) to create and publish the annual planning file is generally comprehensive and clear. ·The ‘Audit Module’ ( ) used by the Directorate-General is an efficient and effective tool for storing data and information on audits, for extracting data and statistics, and for follow-up on the status and result of audits. The Internal Audit Service identified one issue concerning monitoring the audit implementation and formulated the following very important recommendation: The Directorate-General for International Cooperation and Development should complement the current set of key performance indicators in order to cover the key steps of the audit life cycle and the completion of the annual audit and verification plans. It should also revise the targets of the existing audit-related key performance indicators to ensure that: (i) they remain relevant; (ii) continue to drive for improvements in the audit process; and (iii) are not misleading/prone to misinterpretation. Moreover, the Directorate-General should introduce central monitoring arrangements to follow up the EU Delegations’ implementation of the annual audit plans. Additional information provided by DG DEVCO on the measures drawn up and/or implemented following the Internal Audit Service audit The recommendations have already been completed by the Directorate-General for International Cooperation and Development. The Internal Audit Service will assess their effective implementation through a follow-up audit to be performed in the second quarter of 2020. 2.Audit on the control strategy for humanitarian aid actions in DG ECHO The objective of the audit was to assess the adequacy of the design and the effectiveness of the implementation of the control strategy for humanitarian aid actions in the Directorate-General for European Civil Protection and Humanitarian Aid Operations in order to ensure the legality and regularity of the transactions and sound financial management. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area audited. The fieldwork was finalised on 24 September 2019. All recommendations relate to the situation as of that date. Since the humanitarian aid actions funded by the Directorate-General for European Civil Protection and Humanitarian Aid Operations are implemented mainly by its partner organisations (humanitarian non-governmental organisations, international organisations and UN agencies), the availability of clear and comprehensive guidelines and instructions describing the working modalities is an important element of the control strategy. For this reason, the Directorate-General has developed a ‘Partners website’ ( ), which provides complete and well-organised information on the legal and contractual framework, a detailed description of the action lifecycle and guidelines for using the IT systems. The ‘Partners website’ is also a useful educational tool and provides a valuable overview of the business processes and control activities from the point of view of the implementing partners. The Internal Audit Service considers this a good practice that supports the efficiency and effectiveness of relations between the Directorate-General and its partners in delivering humanitarian aid. The IAS identified two issues, one concerning ex ante controls on final reports and final payments and one on ex post headquarters audits and verifications, and formulated two very important recommendations: Ex ante controls on final reports and final payments

The Internal Audit Service recommended that the Directorate-General for European Civil Protection and Humanitarian Aid Operations: (i) document the results of the checks by the financial initiator and verifier; and (ii) amend the formulation of the ‘certified correct’ in its internal procedures and IT tool. The Directorate-General for European Civil Protection and Humanitarian Aid Operations should also: (i) require that its partners state explicitly in the final reports the total amount of non-recoverable value added tax; (ii) strengthen the related checks; and (iii) consider the value added tax exemption status when selecting projects to undergo headquarters audits and verifications. Ex post headquarters audits and verifications The Directorate-General for European Civil Protection and Humanitarian Aid Operations should revise the audit methodology, also taking into account: (i) the outcome of the reassessment of the policy for the minimum sample size per action; and (ii) the audit contractors’ sampling methodology for headquarters audits of NGOs and international organisations. In addition, The Directorate-General should ensure that the level of testing is well justified in the audit and verification reports. It should also: (i) provide guidance to the audit contractors on how to formulate the recommendations; and (ii) revise the follow-up approach to ensure timely review of the implementation of all significant recommendations. Additional information provided by DG ECHO on the measures drawn up and/or implemented following the Internal Audit Service audit To ensure that the effectiveness of the control strategy over time and that the overall assurance are not affected, the Directorate-General for European Civil Protection and Humanitarian Aid Operations is taking action to address the recommendations. Most notably, the current control stategy has been better reflected and described in the control architecture of the 2019 annual activity report. As per the action plan, most of the actions will be completed by the end of 2020. The action plan was drawn up by the Directorate-General for European Civil Protection and Humanitarian Aid Operations and agreed with the Internal Audit Service. 3.Audit on common foreign and security policy in FPI The objective of the audit was to assess the effectiveness of the control processes put in place by the Service for Foreign Policy Instruments to implement the common foreign and security policy budget managed directly or indirectly via the common security and defence policy missions. There were no reservations in the Service for Foreign Policy Instruments’ 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 4 July 2019. All recommendations relate to the situation as of that date. The Internal Audit Service identified two issues, one concerning the closure of mandates for common security and defence policy missions and one on mitigating measures applied for European Union capacity building in Somalia, and formulated the following very important recommendations: Closure of mandates for common foreign and security policy missions The Service for Foreign Policy Instruments should close mandates in a timely manner and take appropriate measures to address the most common causes of late closure. In addition, it should ensure earlier clearing of pre-financing. Mitigating measures applied for EU capacity building in Somalia The Service for Foreign Policy Instruments should adopt adequate measures to mitigate risks that have a financial impact in the missions. These measures relate to: (i) administrative regularity of payments; and (ii) keeping supporting documents on the recruitment of international staff. Moreover, the Service for Foreign Policy Instruments should invite the European External Action Service to better coordinate with it to provide complete and clear guidance to missions on grading of local staff and to approve the main standard operating procedures with financial implications in force in EU capacity building in Somalia. Mitigating measures against the risk of missing documents in common foreign and security policy missions should also be implemented. Additional information provided by FPI on the measures drawn up and/or implemented following the Internal Audit Service audit The Service for Foreign Policy Instruments accepted all recommendations and established an action plan to address them. It is expected that the recommendations will be fully implemented during 2020. Some actions have already been implemented, as described below: Concerning the closure of mandates for common foreign and security policy missions, in order to address issues resulting in late closure of mandates the Service for Foreign Policy Instruments has, in consultation with the Directorate-General for Budget, updated the Vade-Mecum on financial and accounting procedures for CSDP missions. The updated Vade-Mecum was sent to all CSDP missions on 16 December 2019. An internal guidance note to guide project managers through the closure of mandates was issued on 12 May 2020; Concerning the mitigating measures applied for EU capacity building in Somalia, in order to mitigate risks that have a financial impact, the Mission Support Platform at the Service for Foreign Policy Instruments’ Headquarters provides continuous/daily support to EU capacity buidling in Somalia on finance and procurement issues. In addition, EU capacity building in Somalia’s standard operating procedures in finance and procurement has been updated following the Service’s assessement and recommendations. Futhermore, the updated Vade-Mecum included specific provisions on electronic archiving of supporting documents.

Finally, the Service for Foreign Policy Instruments is contributing to the local staff policy document under development by the European External Action Service’s Civilian Planning and Conduct Capability, in particular on the need for clearer guidance on grading of local staff. 4.Audit on annual audit plans in DG NEAR The objective of the audit was to assess the design and the implementation of the annual audit plans (including the monitoring and follow-up arrangements) to check whether they effectively contribute to the Authorising Officer by Delegation’s assurance on the legality and regularity of transactions. The following reservations made in the 2018 annual activity report underline the importance of the area and processes within the scope of this audit engagement: Reservation 1: Difficulties in monitoring all projects in Libya and Syria adequately Reservation 2: Error rate above 2% in direct management grants. The fieldwork was finalised on 27 September 2019. All recommendations relate to the situation as of that date. The auditors identified the following strengths: ·the Internal Audit Service acknowledges the improvement in the timing of the risk assessment exercise (compared to the previous years), which enabled the timely approval of the 2019 control plan; ·the risk assessment takes into account different types of risks that are assessed from the perspectives of both impact and likelihood; ·the templates provided for the terms of reference for audit work and for the audit reports contribute to the overall consistency of audit reports and to their generally satisfactory quality; ·the Directorate-General for Neighbourhood and Enlargement Negotiations uses the Audit Module ( ) tool, which enables it to store various audit-related information and easily extract and process data for monitoring and reporting purposes. The Internal Audit Service identified two issues, one concerning follow-up of audit results and one on key performance indicators and reporting, and formulated the following two very important recommendations: Follow-up of audit results The Directorate-General for Neighbourhood and Enlargement Negotiations should: (i) improve its strategy on the follow-up of financial findings by introducing actions that go beyond recovering ineligible expenditure; and (ii) issue corresponding guidance. It should also make full use of findings stemming from verification missions to international organisations, either via regular in-house analysis by headquarters or by concluding a formal agreement to this end with the Directorate-General for International Cooperation and Development. Key performance indicators and reporting The Directorate-General for Neighbourhood and Enlargement Negotiations should revise the current key performance indicators and targets in cooperation with the Directorate-General for International Cooperation and Development to ensure that they are relevant, appropriate, unambiguous, and understood by staff. Finally, the Directorate-General should correctly report on the achievement of the key performance indicators in its annual activity report. Additional information provided by NEAR on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Neighbourhood and Enlargement Negotiations accepted the recommendations and produced an action plan, which was approved in March 2020. The actions are being implemented according to the plan, and their completion is expected by January 2021. 5.Audit on ex ante control on payments under the European neighbourhood instrument and the European neighbourhood and partnership instrument in DG NEAR

The objective of the audit was to assess whether or not the ex ante control on interim and final payments under the European neighbourhood instrument and the European neighbourhood and partnership instrument is effective and efficient. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 16 December 2019. All recommendations relate to the situation as of that date. The auditors identified the following strengths: ·the guidance for the ex ante control on payment available in the manual of procedures is generally comprehensive and clear; ·the manual of procedures and the support provided by the helpdesk at Headquarters contribute to the consistent application of the Directorate-General’s rules and procedures throughout the delegations; ·the reporting of financial information to senior management is done via the ‘Portfolio Management Dashboard’ that extracts, computes and aggregates automatically the information from the ABAC accounting system. This information is used, amongst other, to feed the key performance indicators, which are then used to monitor implementation of the programme. The Internal Audit Service did not formulate any critical or very important recommendations. Education and citizenship 1.Audit on DG HOME’s audit activity and clearance of accounts The objective of the audit was to assess whether the Directorate-General for Migration and Home Affairs has put in place effective processes for auditing the asylum migration and integration fund and the internal security fund, for providing audit services to the Directorate-General for Justice and Consumers and for managing the clearance of accounts. The reservations below were made in the Directorate-General for Migration and Home Affairs’ 2018 annual activity report. They concern specifically the area/process under the scope of this audit engagement: ·shared management: reservation concerning the asylum migration and integration fund and the 2014-2020 internal security fund in several Member States because of serious deficiencies in the management and control system and especially in the audit work of the audit authority; ·centralised direct management: non-research grants. The reservation was issued because the residual error rate (3.29%) was above the materiality threshold of 2% for grants directly managed (except research) by the Directorate-General for Migration and Home Affairs. The fieldwork was finalised on 19 July 2019. All recommendations relate to the situation as of that date. The auditors identified the following strengths in the practices followed by the Directorate-General for Migration and Home Affairs: ·the recent reorganisation of the Directorate-General strengthened the position and independence of the ex post audit function by separating it from the Fund Management Directorate; ·as from the financial year 2018, audit authorities are required to submit an annual control report supporting their audit opinion. This significantly strengthens the Directorate-General’s assurance over the audit authorities’ work; ·the audit sector has developed a comprehensive checklist to support auditors in their checks during the clearance of accounts process; ·the checklist used by desk officers for the clearance of accounts is embedded in the workflow system ( ), which enhances the traceability and transparency of the review process; ·shared management weekly meetings (until the reorganisation of June 2019 within its Directorate E) involved financial units and the unit in charge of audits. These constituted a solid platform for discussing implementation of funds, including audit-related topics.

The Internal Audit Service identified three issues, one concerning set-up and planning of the audit activity, one on execution of the audit plan and one on the clearance of accounts, and formulated the following very important recommendations: Set-up and planning of the audit activity The Directorate-General for Migration and Home Affairs should define the mission statement and mandate of the audit activity. Roles and responsibilities for the clearance of accounts process should be adjusted to the new organisational structure. The audit strategies for both shared and direct management should be revised (including for providing the audit function to the Directorate-General for Justice and Consumers). Furthermore, the Directorate-General for Migration and Home Affairs should analyse the resource needs for the audit activity. For the 2020 audit work programme, the Directorate-General should align the annual audit plan with the available capacity and explain the impact of any shortfall. In addition, for the 2021-2027 period, it should analyse the resources required under the new programming period and examine the options/scope for making use of available expertise and capacity in the audit directorates of other Commission departments. Execution of the audit plan The Directorate-General for Migration and Home Affairs should launch direct management audits as early as possible after adoption of the audit work programme so that the audits can be completed before the end of the reporting period (i.e. 31 March N+1), as required by the audit strategy. In addition, final audit reports should be sent to the beneficiaries without delay. This process should be regularly monitored by senior management. As regards shared management, the Directorate-General should launch system audits as early as possible after finalising the review of the annual control reports and audit opinions. Draft and final audit reports should be sent on time. Clearance of accounts The Directorate-General for Migration and Home Affairs should review and update its internal procedures to ensure that the clearance decisions are made on time. Furthermore, it should clarify the procedure and timing for reviewing accounts that were submitted early (i.e. before year-end) in the context of the decommitment procedure. The processes for managing the clearance of accounts should be adapted to the new organisational structure, and the communication between the financial units and the audit sector should be improved. Additional information provided by HOME on the measures drawn up and/or implemented following the Internal Audit Service audit The Directorate-General for Migration and Home Affairs accepted the recommendations and produced an action plan which was approved by the Internal Audit Service in March 2020. The actions are being implemented according to the plan, and some of them have been already implemented. Regarding the recommendation on the setting up and planning of the audit activity, the Directorate-General performed an analysis of available capacity and resources for its 2020 audit work programme, which can be updated during the year if necessary. The Directorate-General also implemented actions in response to the recommendation on clearance of accounts. These actions included the revision of the internal procedures and the Manual for the Clearance of Accounts to ensure the timely revision of accounts submitted before the year’s end and that accounts are cleared only exceptionally after the regulatory deadline of 31 May N+1. 2.Audit on impact assessment in DG JUST The objective of the audit was to assess whether the Directorate-General for Justice and Consumers has put in place effective controls for conducting impact assessments that comply with the better regulation guidance and principles. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 18 July 2019. All recommendations relate to the situation as of that date. The auditors recognised the Directorate-General’s ongoing efforts to improve the impact assessment process and identified in particular the following strengths: ·The Directorate-General has set up a dedicated and experienced Unit 03 ‘Economic Analysis and Evaluation’. The unit has a dual role in the impact assessment process, which consists in: (i) providing comments and support to the operational units on the key steps of the impact assessment process; and (ii) playing an important role in decisions affecting the impact assessment process e.g. the quality scrutiny of a draft impact assessment report before submission to the Regulatory Scrutiny Board. Overall, the involvement and assistance provided by Unit 03 to policy officers on drafting impact assessments is perceived by the operational units to be very positive. The policy officers appreciate the regular contacts and availability of Unit 03’s staff, together with their valuable support on technical and methodological aspects of impact assessment. ·Since 2018, the Directorate-General has made use of upstream meetings offered to Directorate-Generals by the Regulatory Scrutiny Board ( ) for the preparation of impact assessments. The Internal Audit Service did not formulate any critical or very important recommendations. Economic and financial affairs 1.Audit on EASME’s project management (project monitoring, payments and amendments) under the programme for the environment and climate action covering the period from 1 January 2014 to 31 December 2020 (the LIFE programme) The objective of the audit was to assess whether the Executive Agency for Small and Medium-sized Enterprises has adequately designed and effectively implemented a project management system (project monitoring, payments and amendments and anti-fraud strategy and checks) that provide reasonable assurance to the Authorising Officer by Delegation regarding: (i) the effective contribution of the projects to the achievement of objectives of the programme for the environment and climate action and (ii) the legality and regularity of the underlying transactions. There were no reservations in the Agency’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 3 July 2019. All recommendations relate to the situation as of that date.

The auditors recognised the Executive Agency for Small and Medium-sized Enterprises’ ongoing efforts to manage and monitor the programme for the environment and climate action so as to ensure that: (i) the programme objectives are met; and (ii) the residual error rate remains far below the materiality threshold of 2% ( ). In particular, the Internal Audit Service acknowledged the following good practices: ·staff of the Agency implementing the control strategy are knowledgeable and motivated, and have valuable experience in supervising the programme implementation; ·there is good cooperation between the operational unit and the financial sector as well as with the external contractor performing the ongoing monitoring activities; ·the team managing the programme drives continuous improvement of the internal procedures, workflows, templates and checklists to be used for each project management task and phase of monitoring; ·there is an adequate document management system in place that makes all the project information and in-depth data easily accessible to the Agency staff involved. The Internal Audit Service identified one issue concerning use of risk-related information to define the level of control and cost effectiveness of controls and formulated the following very important recommendation: The Executive Agency for Small and Medium-sized Enterprises should establish an effective link between risks identified and control activities to tailor the extent and depth of checks to be performed (both by the external contractor and by its own staff). Moreover, the reporting templates and relevant checklists should be amended to reflect the differences in checks to be performed. The risk assessment tool should also be regularly updated. Additionally, the Agency should assess the cost effectiveness of controls for the environment and climate action programme. Additional information provided by EASME on the measures drawn up and/or implemented following the Internal Audit Service audit The action plan of the Executive Agency for Small and Medium-sized Enterprises was accepted by the Internal Audit Service and aims to address its recommendation by June 2020. In the meantime, several sub-actions have been implemented. These include: (i) a revised risk-based assessment methodology to better tailor the extent and depth of controls; (ii) the update of the reporting templates and checklists to reflect the different types of checks to carry out depending on the risk; (iii) the update of the risk assessment tool when new information becomes available; and (iv) training of the project advisers and financial officers on the new methodology and checklists. Further, assessment of the cost effectiveness of controls for the LIFE programme (programme for the environment and climate action) will begin soon and will be implemented with the support of the Directorate-General for Environment. 2.Audit on effectiveness and efficiency of DG ECFIN's performance-management system The objective of the audit was to assess the adequacy of the performance-management system of the Directorate-General for Economic and Financial Affairs to plan, monitor and report on the achievement of its key policy objectives. There were no reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 20 May 2019. All recommendations relate to the situation as of that date. The Directorate-General for Economic and Financial Affairs implements a wide range of activities. In addition, its operations are affected largely by the political environment. The auditors recognised its ongoing efforts to continuously improve its performance-management system within this challenging environment and highlighted the following good practices: ·the management of the strategic planning and programming cycle is well organised: a clear link has been established between the Directorate-General’s general objectives, specific objectives and activities, supported by the work-stream mapping table; ·a number of good management tools have been implemented both at directorate and unit levels, namely: ·the directorates’ work programmes, which complement the Directorate-General’s management plan; these provide a good narrative of each directorate’s priorities and explain how the directorates contribute to the Directorate-General’s general and specific objectives; ·Directorate C’s dedicated monitoring tool (the fortnightly report), which is used at directorate and unit levels, enables effective monitoring of ongoing activities for the forthcoming 2 months. Directorate C uses the table to structure discussions in the bi-weekly directorate meetings; ·different units have developed specific tools, e.g. a calendar of international events (Unit D.3), tables of communication activities and events (Unit A.4), a ‘dashboard used for the weekly Investment Committee’ (Unit L.2), and the ‘échéancier’ (Unit G.3) used to monitor closely ongoing activities.

·In terms of performance reporting: ·Unit 01 has developed an inventory of the unit’s tasks performed in 2018; ·Unit D.3 presented a mid-year report on ‘progress on 2018 work programme on economic analysis and policy advice’, which gives a complete report to senior management on the unit’s activities. The Internal Audit Service did not formulate any critical or very important recommendations. 3.Audit on monitoring of EU law implementation in DG TAXUD The objective of the audit was to assess the effectiveness and efficiency of the management and control systems of the Directorate-General for Taxation and Customs Union regarding the monitoring of EU law implementation as well as the compliance with the applicable Commission guidelines. There were no observations/reservations in the Directorate-General’s 2018 annual activity report that relate to the area/process audited. The fieldwork was finalised on 20 June 2019. All recommendations relate to the situation as of that date. The auditors recognised the Directorate-General’s ongoing efforts to continuously improve the process of monitoring EU law implementation and application and highlighted the following good practices. In particular: ·The Directorate-General has established effective cooperation with its Commissioner’s Cabinet, which is systematically consulted on any key decision with regard to new pre-infringement cases, cases of opportunity closures ( ) and for the final approval of proposals for infringement cases to be submitted for a decision in the College’s infringement cycle. There is an agreement between the Directorate-General and its Commissioner’s Cabinet to go ahead in the absence of a reply from the latter within 5 working days. ·A very good system of internal coordination exists between the units involved in EU law monitoring and the policy units. An infringement coordinator (Unit C3 Indirect taxation) effectively coordinates all activities at Directorate-General level related to EU law implementation monitoring. This coordinator is backed up by the infringement coordinators in the other units. ·The Directorate-General’s infringement coordinator in Unit C3 has put in place a ‘pop-up’ monitoring tool (called NIF) embedded in the Infringement and Directives IT application, which enables effective and efficient monitoring of all ongoing infringement cases in the Unit. The Internal Audit Service considers that this tool could also be used by the other infringement units. ·The Head of Unit of Unit D3 has developed a system to monitor compliance with the Commission guidelines and benchmarks for the transposition of all new directives in the area of direct taxation. It consists of a table for each directive and an overview table for all directives and Member States with the corresponding milestones. The overview table provides the Head of Unit with a good summary of the status of the transposition of directives for which Unit D3 is responsible. The Internal Audit Service considers that this tool could also be implemented by the Infringement Unit in the area of indirect taxation. The Internal Audit Service did not formulate any critical or very important recommendations. 4.Audit on human resources management in DG TAXUD The objective of the audit was to assess whether the Directorate-General for Taxation and Customs Union has put in place an adequate system for managing its human resources that supports effectively achievement of its operational objectives. The Directorate-General’s 2018 annual activity report did not include any reservations that relate to the area/process audited. The fieldwork was finalised on 10 December 2019. All recommendations relate to the situation as of that date. The Internal Audit Service has identified the following strengths: ·the Directorate-General regularly organises staff fora to improve communication between the Director-General and staff; ·a collaborative space known as ‘TAXUD in Action’ is available for all staff in the Directorate-General to promote dialogue and provide information, in particular in the areas of: ·learning and development;

·knowledge management and collaboration; ·well-being and work-life balance; ·green TAXUD; ·improved procedures and briefings; ·smooth running of information-technology projects; ·efficient meeting and email management. ·the Human Resources Business Correspondent team is actively involved in a wide range of human-resources activities including recruitment, training needs development and reporting. The Internal Audit Service identified three issues, one concerning human-resources strategic management, one on the management of task and skills mapping and workload assessment and one on staff allocation and project teams. The IAS formulated three very important recommendations: Human-resources strategic management The Directorate-General for Taxation and Customs Union should develop an overarching human-resources strategy, defining specific objectives and expected results, in line with its business strategy. The Directorate-General should link the actions set out in the knowledge management action plan to specific end dates and adopt measures that effectively address the main issues raised in the staff survey. Human resources management: task and skills mapping The Directorate-General for Taxation and Customs Union should implement processes to map tasks and skills covering all the activities of the service. Workload assessment, staff allocation and project teams The Directorate-General for Taxation and Customs Union should develop a workload assessment framework based on robust workload indicators and assess if the current allocation of staff is appropriate taking into consideration the tasks to be accomplished and the workload across the Directorate-General. If needed, the Directorate-General should implement measures to re-balance workload and monitor the effectiveness of these measures. The Directorate-General should set its expectations and the conditions for applying flexitime recuperation and analyse the reasons for non-recoverable overtime. The Directorate-General should further promote project teams and put in place relevant guidelines. Additional information provided by TAXUD on the measures drawn up and/or implemented following the Internal Audit Service audit The 'very important' recommendations for the Directorate-General for Taxation and Customs Union correspond also to areas covered by the Directorate-General for Human Resources and Security strategy (due by end-2020), mapping of skills and tasks (due by end-June 2021), and workload assessment framework (due by end-June 2021). All the three require (and will depend on) support from the Directorate-General for Human Resources and Security. The relevant action plan to implement recommendations was accepted by the Internal Audit Service as satisfactory on 25 February 2020. The Directorate-General for Taxation and Customs Union has started preparatory implementation work, including cooperation with the Directorate-General for Human Resources and Security. So far, it has begun drawing up its local human resources strategy in line with the guidance received from the Directorate-General for Human Resources and Security. The Directorate-General for Taxation and Customs Union has also begun to consider what methods are required for skills/tasks mapping and workload assessment. Given the imminence of some of the deadlines and the number of actions to be accomplished, the Directorate-General is endeavouring to progress on implementation, despite the adverse conditions created by the COVID-19 crisis. The whole action plan is planned to be implemented by end-June 2021. This audit by Internal Audit Service shows that some improvements to internal control principle 4 could be achieved. The action plan, as confirmed by the Internal Audit Service, adequ