[pic] | COMMISSION OF THE EUROPEAN COMMUNITIES |

Brussels, 30.5.2007

SEC(2007) 708

COMMISSION STAFF WORKING DOCUMENT Accompanying the

ANNUAL REPORT TO THE DISCHARGE AUTHORITY ON INTERNAL AUDITS CARRIED OUT IN 2006

{COM(2007) 280 final}

Overview of Audits carried out by the Internal Audit Service in 2006

TABLE OF CONTENTS

Introduction 4

1. Cross-cutting, Administrative and other Support Systems 6

1.1. IAC Quality Review overview report 6

1.2. ADMIN - Review of DG ADMIN Human Resource Management I 6

1.3. ADMIN – Human Resource Management II 7

1.4. COMM (PRESS) - Follow up Audit of In-Depth Audit of DG PRESS 2003 7

1.5. DIGIT – Data Centre- Operations and Security 8

1.6. EPSO -Limited review of the selection process as managed by EPSO 9

1.7. OPOCE – Follow up audit In-Depth Audit of the Office for Official Publications of the European Community (OPOCE) of 2004 10

1.8. PMO - Regularity of financial management and Implementation of financial circuits in PMO 10

1.9. SCIC - Financial Management and Procurement 11

2. Internal Policies 12

2.1. ADMIN, SG, BUDG, SANCO, TREN, COMP - SPP/ABM cycle in the Commission 12

2.2. COMP- Effectiveness and Efficiency of the SPP/ABM cycle 14

2.3. SANCO - Effectiveness and Efficiency of the SPP/ABM cycle 15

2.4. TREN – Effectiveness and Efficiency of the SPP/ABM cycle – resource allocation 17

2.5. SG, MARKT, ENTR, ENV, TREN: Overview Report – Monitoring the Implementation of EC Law 18

2.6. ENTR – Monitoring the Implementation of EC Law 19

2.7. MARKT- Monitoring the Implementation of EC Law 20

2.8. TREN - Review Report on Monitoring the implementation of EC Law 22

2.9. JLS - Large IT Project Management 22

2.10. MARKT - Local IT 23

2.11. SANCO- IT Management 24

2.12. TAXUD – Large IT systems 25

2.13. COMM - Limited Review of Procurement in the area of External Communication (DG COMM) and related activities within other Commission Services and the Publications Office 27

2.14. EAC - Implementation of ABAC 27

2.15. ENTR* - Financial Management of the Innovation Relay Centre (IRC) Network 28

2.16. ENV – Interim Follow-Up In-depth Audit 29

2.17. INFSO – Follow-up Audit on the in-depth audit 31

2.18. JRC - Interim Follow-up Audit 31

2.19. RTD – Ex-post Controls 31

3. Structural Measures and Common Agricultural Policy 32

3.1. AGRI, EMPL, FISH, REGIO – Overview report on Structural Funds Implementation of Article 38 of Council Regulation 1260/1999 32

3.2. REGIO - ERDF: Audit of the Implementation of Article 38 of Council Regulation 1260/1999 33

3.3. FISH – Follow-up Audit of 2004 In-Depth Audit 34

3.4. REGIO - Financial Corrections in Cohesion Fund 34

4. External Policies 35

4.1. AIDCO - Interim Follow-up audit of the In-depth Audit 35

4.2. AIDCO, ECHO - The Implementation of the Financial and Administrative Framework Agreement with the United Nations by DGs AIDCO & ECHO 36

4.3. ELARG - Ex-post control activities 37

4.4. RELEX - Ex-post control activities 39

4.5. RELEX - Follow up note (no report). 40

INTRODUCTION

THIS ANNEX CONTAINS THE SUMMARY INFORMATION FOR AUDIT ENGAGEMENTS FINALISED BY THE IAS IN 2006, INCLUDING REVIEWS. STATISTICS ON IMPLEMENTATION REFLECT THE STATUS AS OF EARLY 2007, EXCEPT FOR FOLLOW-UP AUDITS FOR WHICH the date is indicated below.

Service | Engagement | Issued |

Reviews, Administrative and other Support Systems |

32 IACs | 32 IAC quality reviews and one overview report | 12 October |

ADMIN | Human Resources Management I | 7 April |

ADMIN | Human Resources Management II | 27 October |

COMM | Follow-up of 2003 in-depth audit | 24 October |

DIGIT | Data Centre-Operations and Security | 8 December |

EPSO | Selection process as managed by EPSO | 7 April |

OPOCE | Follow-up of 2004 in-depth audit | 18 December |

PMO | Regularity of financial management, implementation of financial circuits | 8 December |

SCIC | Financial Management and Procurement | 22 September |

Internal policies |

ADMIN, SG, BUDG, SANCO, TREN, COMP | SPP/ABM cycle in the Commission | 27 November |

COMP | Effectiveness and efficiency of the SPP/ABM cycle | 20 July |

SANCO | Effectiveness and efficiency of the SPP/ABM cycle in DG SANCO | 7 April |

TREN | Effectiveness and efficiency of the SPP/ABM cycle – resource allocation | 10 April |

MARKT, ENTR, ENV, TREN, SG | Overview report: Monitoring the implementation of EC law | 22 December |

ENTR | Monitoring the implementation of EC law | 5 December |

MARKT | Monitoring the Implementation of EC law | 7 November |

TREN | Review of monitoring the implementation of EC law | 14 December |

JLS | Large IT project management | 8 June |

MARKT | Local IT | 10 November |

SANCO | IT management | 8 December |

TAXUD | Large IT systems in DG TAXUD | 24 January |

COMM | Contract management | 11 October |

EAC | Implementation of ABAC | 30 June |

ENTR* | Financial Management of the IRC Network | 6 April |

ENV | Follow-up in-depth audit | 9 February |

INFSO | Follow-up of 2004 in-depth audit | 7 December |

JRC | Interim follow-up audit report | 9 February |

RTD | Ex-post controls | 21 December |

Structural Measures and Common Agricultural Policy |

AGRI/EMPL/FISH/REGIO | Consolidated report structural funds Article 38 | 8 March |

REGIO | ERDF | 21 February |

FISH | Follow-up of 2004 in-depth audit | 18 December |

REGIO | Financial Corrections in Cohesion Fund | 22 November |

External Policies |

AIDCO | Interim Follow-up audit report | 22 February |

AIDCO | Implementation of framework agreement with UN agencies, combined with ECHO monitoring and management reporting system – overflow 2005 audit | 28 July |

ELARG | Ex-post control activities | 20 December |

RELEX** | Ex-post control activities | 22 December |

RELEX | Follow-up note | 31 October |

* Joint audit with DG ENTR, ** Joint audit with DG RELEX

CROSS-CUTTING, ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS

IAC Quality Review overview report

Objectives and Scope

Commission Communication SEC(2000)1803/3 modified by SEC(2005)1033 require that the IAS performs an external review of DG' Internal Audit Capabilities (IACs). The Institute of Internal Auditors (IIA) requires that an external review of internal audit organisations is conducted at least once every five years, which in the case of the IACs means that the first such review needs to be conducted by January 2007.

The primary objective of the exercise was to assess the IACs' conformity to the Institute of Internal Auditors' (IIA) Standards for the Professional Practice of Internal Auditing (Standards) and Code of Ethics. In accordance with both the Commission Communications and the requirements of the IIA, the IAS conducted the external review as a validation of self-assessment made by the IACs.

The IAS issued 13 proposals. The Commission's Audit Progress Committee noted the IAS findings and proposals, and insisted in particular on the coordinated audit planning and the revision of the IAC charters.

ADMIN - Review of DG ADMIN Human Resource Management I

Objectives and Scope

The review of Human Resource Management (HRM) is divided into 3 phases. The first phase covered HR management themes, such as planning, recruitment, and mobility, and how these support functions are managed, covering both ADMIN and the Offices concerned (EPSO has been subject to a separate limited review).

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress | Completed |

Priority | # | # | % Total | # | % Total |

Very important | 14 | 8 | 33,33 | 6 | 25,00 |

Important | 10 | 4 | 16,67 | 6 | 25,00 |

Yes | No |

Priority | # | # | % total | # | % Total |

Not started | In Progress |

Priority | # | # | % Total | # | % Total |

Yes | No |

Priority | # | # | % Total | # | % Total |

Not started | In Progress |

Priority | # | # | % Total | # | % Total |

Yes | No |

Priority | # | # | % total | # | % Total |

Not started | In Progress |

Priority | # | # | % Total | # | % Total |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 7 | 7 | 87,50 |

Important | 1 | 1 | 12,50 |

Total | 8 | 8 | 100,00 |

SCIC - Financial Management and Procurement

Objectives and Scope

In accordance with the IAS Audit Plan 2006, the engagement focused on the procurement of freelance interpreters' services and the associated financial management processes, in order to assess:

The efficiency and effectiveness of interpreting operations of DG SCIC;

The competitiveness of the Convention / agreement between the European institutions and the "International Association of Conference Interpreters" (IACI);

The simplification of procedures.

The audit scope covered the following issues:

The analysis of the economy of interpreting operations of DG SCIC and identification of potential savings in light of the new staff regulations, management of requests from Commission and other institutions, and hiring of freelance interpreters (ACIs);

The Convention / agreement between the European institutions and the "International Association of Conference Interpreters" (IACI).

There were no observations / reservations in the AAR that relate to the area / process audited.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 2 | 2 | 25,00 |

Important | 6 | 6 | 75,00 |

Total | 8 | 8 | 100,00 |

INTERNAL POLICIES

ADMIN, SG, BUDG, SANCO, TREN, COMP - SPP/ABM cycle in the Commission

Objectives and Scope

The objective of each of the audits that are the basis of this Overview Report was to assess the adequacy and effective application of the internal control system, risk management and governance processes with respect to the implementation of "Strategic Planning & Programming (SPP) and Activity-Based Management (ABM) cycle in the Commission". Specifically, these audits assessed whether the Internal Control Systems and risk management processes provide reasonable assurance regarding:

- The compliance with the Commission rules regarding SPP/ABM and the appropriate Commission Internal Control Standards;

- the effectiveness and efficiency of the SPP/ABM cycle, including the extent to which internal controls have been implemented in relation to the related risks and whether the strategic and operational planning processes not only aim at satisfying the reporting requirements of the horizontal services, but also aim at satisfying the operational services' own planning and management needs.

The scope of these underlying audits focused on the following components of the SPP/ABM cycle:

1. Strategic cycle :

2. The creation and revision of strategic options and linkage to political priorities, analysis of internal and external environment (impact assessment).

3. Operational cycle:

4. Programming: Annual Policy Strategy (APS), Preliminary Draft Budget (PDB), Commission Legislative and Work Programme (CLWP), Annual Management Plan (AMP).

5. Execution: Implementation and Monitoring of the Annual Management Plan.

6. Reporting: Annual Activity Report (AAR).

The "evaluation process" was excluded from the scope as this was audited by the Court of Auditors[5]and has been the subject of a Commission communication.

The IAS first reviewed in 2005 the relevant processes in the SG and DG BUDG[6] and performed a survey among the main stakeholders and a comparative analysis with other public administrations. In a second phase, the IAS audited the SPP/ABM implementation process in the following operational DGs: DG SANCO, DG TREN and DG COMP[7]. IAS issued separate reports for each of these DGs.

The third and final phase consists of the consolidation of the results of the above-mentioned audits, complemented with targeted additional audit work on the budgetary cycle, in an overview report. In this report, the IAS provides a synthesis of the observations and recommendations included in previous reports and addresses key observations and recommendations to both the horizontal services and operational services responsible for the Community policies. The recommendations of the individual audits that are the basis of this Overview Report remain fully valid for their recipients: DG SANCO, DG TREN and DG COMP.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % | # | % |

Very important | 13 | 11 | 57,89 | 2 | 10,53 |

Important | 6 | 6 | 31,58 |

GrandTotal | 19 | 17 | 89,47 | 2 | 10,53 |

Implementation progress for recommendations (IAS follow-up) |

In Progress |

Priority | # | # | % Total | # | % Total |

Very important | 11 | 1 | 5,88 | 10 | 58,82 |

Important | 6 | 6 | 35,29 |

Total | 17 | 1 | 5,88 | 16 | 94,12 |

COMP- Effectiveness and Efficiency of the SPP/ABM cycle

Objectifs et étendue de la mission

Cet audit s'inscrit dans le cadre de la deuxième phase d'un audit général du cycle SPP/ABM à la Commission ayant débuté en 2005. La première phase de cet audit a consisté dans une revue limitée du cycle SPP/ABM principalement au sein de la DG BUDG et du SG et a fait l'objet d'un rapport. La deuxième phase, dont fait partie cet audit, consiste à évaluer la mise en œuvre du cycle SPP/ABM au sein de trois directions générales (DG COMP, DG TREN et DG SANCO). Plus particulièrement, l'objectif de cet audit porte sur l'évaluation de la mise en œuvre du cycle SPP/ABM au sein de la Direction générale de la Concurrence (DG COMP) au regard de :

La conformité avec les règles édictées par la Commission en la matière, qui comprennent également certains standards de contrôle interne de la Commission.

L'efficience et l'efficacité du cycle SPP/ABM, non seulement dans la mise en œuvre d'un système de contrôle interne adéquat, mais également vis-à-vis de ses finalités et dans la valeur ajoutée que ce cycle apporte à la DG COMP en matière de gestion opérationnelle.

La troisième et dernière phase de l'audit général du cycle SPP/ABM à la Commission consistera en la consolidation des constatations et pistes de réflexion émises dans le premier rapport et des constatations structurelles provenant des trois audits réalisés lors de la seconde phase.

L'étendue de la mission examine le cycle SPP/ABM sous les angles stratégiques et opérationnels.

1. Le cycle stratégique (5 ans): consistant principalement dans l'établissement et la révision des finalités stratégiques, l'analyse de l'environnement interne et externe, le développement et la révision des stratégies, le développement et la révision d'un plan d'évaluation des performances et enfin la revue des progrès réalisés en vue de l'amélioration continue.

2. Le cycle opérationnel (annuel)

• Programmation: Débat d'orientation et contribution à la Stratégie Politique Annuelle de la Commission, avant-projet de budget, Programme de travail de la Commission, plan de gestion annuel

- Exécution: Mise en œuvre et monitoring du plan de gestion annuel

- Reporting: Rapport d'activité annuel (1er chapitre)

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 5 | 5 | 50,00 |

Important | 5 | 5 | 50,00 |

Total | 10 | 10 | 100,00 |

SANCO - Effectiveness and Efficiency of the SPP/ABM cycle

Objectives and Scope

The objective of the audit was to assess the adequacy and effective application of the internal control system, risk management and governance processes with respect to the "Strategic Planning & Programming (SPP) and Activity-Based Management (ABM) cycle in Directorate General Health and Consumer Protection (DG SANCO).

In particular the audit assessed whether the internal control system (ICS) provides reasonable assurance regarding:

The compliance with the Commission rules regarding SPP/ABM and the appropriate Commission Internal Control Standards.

The effectiveness and efficiency of the SPP/ABM cycle, including the extent to which internal controls have been implemented in relation to the related risks and whether the DG's strategic and operational planning processes not only aim at satisfying the requirements from the central services, but also at satisfying its own planning and management needs.

The audit of the SPP/ABM cycle in DG SANCO is part of the overall IAS audit objective providing an audit opinion on the key components of the SPP/ABM cycle in the Commission. In carrying out this objective, IAS first performed a limited review of the relevant processes in the SG and DG BUDG. In a second phase, the SPP/ABM cycle is audited in a limited number of operational DGs (DG COMP, DG TREN and DG SANCO).

For each of the audited DGs a separate audit report will be issued. These individual reports will mainly contain the observations and recommendations for which the audited DG is responsible. In the third and last phase, an overview report will be produced, containing the consolidated results and conclusions of the above-mentioned audits but also the crosscutting observations and recommendations for which the Central Services are responsible, since they are the ultimate process owners.

The scope of this audit engagement focused on the following components of the SPP/ABM cycle:

1. Strategic cycle (5-year cycle): amongst others: Creation and revision of strategic options and linkage to political priorities - Analysis of internal and external environment (impact assessment).

2. Operational cycle

- Programming: Orientation Debate and contribution to the Commission's Annual Policy Strategy – Preliminary Draft Budget – Commission Legislative and Work Programme – Annual Management Plan.

- Execution: Implementation and Monitoring of the Annual Management Plan.

- Reporting: Annual Activity Report (1st Chapter).

The SPP/ABM cycle was only audited for the core processes of DG SANCO, i.e. the activities: Consumer Policy, Public Health and Food Safety, Animal Health, Animal Welfare and Plant Health.

Were excluded from the scope of this audit engagement:

- The evaluation process, as it has been audited by the European Court of Auditors (except for the way the evaluation results are taken into account in the SPP/ABM cycle).

- The Annual Activity Report (except for the first chapter which deals with the policy results).

- Human Resources Management (except for the elements which deal with the allocation of resources).

No scope limitations were identified.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 5 | 5 | 35,71 |

Important | 8 | 8 | 57,14 |

Desirable | 1 | 1 | 7,14 |

Total | 14 | 14 | 100,00 |

TREN – Effectiveness and Efficiency of the SPP/ABM cycle – resource allocation

Objectives and Scope

The objective of the audit was to assess the implementation of the SPP/ABM planning cycle (Strategic Planning & Programming (SPP) and Activity-Based Management (ABM)) in Directorate-General Energy and Transport (DG TREN) with regard to the following criteria:

- The compliance with the Commission rules about SPP/ABM and the appropriate Commission Internal Control Standards.

- The effectiveness and efficiency of the SPP/ABM cycle, including application of pertinent internal controls in relation to the related risks and the extent to which the DG's strategic and operational planning processes not only aim at meeting the requirements from the central services, but also at satisfying its own planning and management needs.

The audit of the SPP/ABM cycle in DG TREN was part of the overall IAS audit objective of providing an audit opinion on the key components of the SPP/ABM cycle in the Commission. In carrying out this objective, IAS first performed a limited review of the relevant processes in the SG and DG BUDG.

In a second phase, the IAS audited the SPP/ABM cycle in a limited number of operational DGs (DG COMP, DG TREN and DG SANCO), for which separate audit reports will be issued.

In the third and last phase, the IAS will consolidate in 2006 the results and conclusions of the above-mentioned audits in an overview report. Therefore, in the consolidated report, the IAS will also address some of the observations and recommendations included in this report to the Central Services, since they are the ultimate process owners.

The scope of this audit engagement focused on the following components of the SPP/ABM cycle:

1. Strategic cycle (5-year cycle): amongst others: Creation and revision of strategic options and linkage to political priorities - Analysis of internal and external environment (impact assessment).

2. Operational cycle

- Programming: Orientation Debate and contribution to the Commission's Annual Policy Strategy – Preliminary Draft Budget – Commission Legislative and Work Programme – Annual Management Plan.

- Execution: Implementation and Monitoring of the Annual Management Plan.

- Reporting: Annual Activity Report (1st Chapter).

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 5 | 5 | 31,25 |

Important | 11 | 11 | 68,75 |

Total | 16 | 16 | 100,00 |

SG, MARKT, ENTR, ENV, TREN: Overview Report – Monitoring the Implementation of EC Law

Objectives and Scope

The timely and correct application of EC legislation is primarily the responsibility of the Member States. The control of the exercise of that responsibility by the Member States is one of the Commission's core activities as laid down in the Treaty in the fulfilment of its role as the "Guardian of the Treaties".

The Treaty allows the Commission considerable discretion in terms of how it carries out its function of monitoring the application of EC law. Given the primary responsibility of the Member States, the need for Commission action depends to a large extent on the degree of commitment and efficiency of Member States and common understanding with the Commission. Parliament and the Ombudsman also take a strong interest in the work of the Commission in this area. These external factors influence the way in which the Commission exercises its discretion and can be seen as primarily a matter of management practice.

The objective of this consolidated report is to provide an overall audit opinion on the management, efficiency and effectiveness of the pro-active and ex-post monitoring of EC law for the years 2003 to 2005. It summarises the main findings of the individual audits (DG MARKT, DG ENTR and DG ENV) and review (DG TREN) and proposes recommendations to be either implemented centrally or requiring a central decision before implementation by individual departments in order to facilitate the resolution of problems and manage the risks associated with this important Commission function.

Specific recommendations have been issued to the individual DGs audited and the focus of this report is on common issues applicable to the Commission as a whole. The four DGs subject to the audits and review are among the most productive DGs in terms of EC legislation and account for nearly 60 % of new complaints and infringement cases.

The Secretariat-General has an important central operational role in the domain of complaints and infringements. Notably it organises four preparatory infringements meetings a year, it is in charge of developing Commission-wide procedures and IT tools on complaints and notification of national implementing measures, and it initiates policies on the Commission's monitoring role. In 2005, the Secretariat-General initiated a follow-up of the 2002 Communication on Better Monitoring of the application of Community law. It set up a High Level Reflection Group which is now discussing the results of their review. IAS has worked closely with the Secretariat-General in the preparation of the individual reports. There has been close co-ordination in the identification of horizontal issues and the timing of this consolidated report. IAS has also been kept informed of the progress of the discussions of the High Level Reflection Group.

The Legal Service also plays a central operational role, in particular coordinating the inter-service preparations concluded by chairing the inter-service meeting before the special Heads of Cabinet meetings which prepare the infringements report meetings four times a year. DG COMM and DGT also have a leading role on individual horizontal aspects.

The Secretariat-General is currently preparing a Communication on monitoring the implementation of EC law which should be adopted by the College early next year [2007]. This consolidated report will provide a useful input to this process. In order to meet the Secretariat-General's deadline for the publication of their new Communication, IAS has, with the approval of the Audit Progress Committee, dropped two reviews (DGs SANCO and TAXUD) from its original 2006 audit plan.

ENTR – Monitoring the Implementation of EC Law

Objectives and Scope

Monitoring the application of EC law is one of the Commission's core activities as laid down in the Treaty. It is a very broad and multi-facetted issue which covers a whole range of activities. The objective of the engagement is to provide an opinion on the management, efficiency and effectiveness of the pro-active and ex-post monitoring of EC law for the years 2003 – 2005, in particular relating to the transposition of Directives and complaints and infringements.

The scope of the audit includes:

1) Assessing the efficiency and effectiveness of DG ENTR's processes for pro-active monitoring of the timely, correct and complete implementation of EC law (Treaty provisions and secondary legislation) — mainly for the years 2003 to 2005 — against the (success) criteria/factors defined for the different phases of proposing, negotiating and transposing a Directive and the measures proposed in the 2002 Communication on Better Monitoring.

2) Assessing DG ENTR's handling of complaints and infringements related to Directives, Regulations and the Treaty for the period 2003 to 2005 with respect to efficiency and effectiveness which includes, inter alia compliance with the Manual of Procedures .

3) Assessing the management of the EC law monitoring function (pro-active as well as ex-post) during 2003 – 2005 against relevant Commission Internal Control Standard baseline requirements.

4) Assessing potential areas for simplification of procedures.

5) Assessing compliance with the provisions of Regulation (EC) 45/2001 on the protection of personal data.

As of 31 December 2005, there have been no observations/reservations in the AAR that relate to the area/process audited.

Acceptance status of recommendations |

Acceptance Status | Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress | Completed |

Priority | # | # | % Total | # | % Total |

Very important | 5 | 2 | 20,00 | 3 | 30,00 |

Important | 5 | 1 | 10,00 | 4 | 40,00 |

Yes | No |

Priority | # | # | % Total | # | % Total |

Not started | In Progress |

Priority | # | # | % Total | # | % Total |

Yes | No |

Priority | # | # | % Total | # | % Total |

Completed |

Priority | # | # | % Total |

Critical | 2 | 2 | 5,71 |

Very important | 14 | 14 | 40,00 |

Important | 19 | 19 | 54,29 |

Total | 35 | 35 | 100,00 |

MARKT - Local IT

Objectives and Scope

L'objectif de la présente mission est de donner une opinion quant à la maîtrise des risques liés à la gestion par la DG MARKT des macro-processus Cobit[8] suivants:

- Planification et organisation (procédures, rôles et responsabilités dans la définition des objectifs, alignement et intégration de l'IT au business, monitoring et reporting);

- Gestion de projets (méthodologie de développement, méthodologie de gestion de projets, rôles et responsabilités);

- Gestion de la sécurité des systèmes d’information (intégrité, confidentialité, disponibilité, continuité des opérations (BCP)).

Le périmètre de la mission sera restreint aux procédures de contrôle mises en place et gérées par la DG MARKT dans le domaine des processus de gestion de son informatique. Les systèmes gérés par des entités externes à la DG MARKT ne seront pas inclus dans le périmètre de cet audit, qui portera cependant sur la maîtrise de ces externalisations (Service Level Agreements).

La fonction de support aux utilisateurs, ainsi que la gestion de l'infrastructure ne font pas partie du périmètre de la présente mission d'audit. De même, les contrôles 'opérationnels', comme par exemple les contrôles sur la cohérence ou la variation des données entrées dans l'application A10 ou encore les procédures mises en place pour assurer les backups au niveau humain pour l'utilisation cette même application sont hors champ.

Pour information, le rapport d'activité annuel 2005 de la DG MARKT contenait l'observation suivante[9] sur les processus audités :

"However, for the security aspects related to the availability of the underlying IT resources, MARKT is fully dependent on DIGIT's ability to maintain its ITC facilities and on its recovery procedures to cope with any possible hazards. MARKT is also aware of and notes with concern the reservation made by DIGIT in its 2005 AAR as regards continuity of operations at the Data Centre in Luxembourg."

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

Not started | In Progress |

Priority | # | # | % Total | # | % Total |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 9 | 9 | 45,00 |

Important | 11 | 11 | 55,00 |

Total | 20 | 20 | 100,00 |

TAXUD – Large IT systems

Objectives and Scope

During the desk review performed in 2004 (action 87.3) and the preliminary risk analysis of 2003 as part of the "Audit de processus de gestion de l'informatique locale", the Trans European IT systems within DG TAXUD have been identified as a potential high risk area for the Commission because of high political and business expectations and of a large dependence on IT suppliers and national administrations in a very complex technical context.

The scope definition was the result of in-depth preliminary survey during which: an analysis of main risks identified by the IAS in previous reviews was updated and refined; all information systems were ranked according to their criticality and risk profile. Also risks identified by DG TAXUD management were taken into account.

Based on the results of the preliminary survey, the IAS decided to concentrate on assessing the adequacy and the quality of the internal control system put in place for the following domains:

Planning & Organisation : addressing all information systems owned by DG TAXUD with the focus on the integration of IT short- and long-term planning with DG TAXUD's planning, the system of prioritisation and the definition of the information architecture;

Project management of the VAT Information Exchange System (VIES) and New Computerised Transit System (NCTS);

Logical security of the Tariff Quota and Surveillance System (TQS) with an emphasis on access permission management and logging;

Physical security of the Common Communication Network and Common Systems Interface (CCN/CSI) with an emphasis on availability (redundancy, scalability, disaster recovery and status reporting);

Financial management of IT expenditures and related contract management are covered by the Internal Audit Capability (IAC) and have been excluded.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress | Completed |

Priority | # | # | % Total | # | % Total |

Critical | 1 | 1 | 3,70 |

Very important | 13 | 10 | 37,04 | 3 | 11,11 |

Important | 13 | 10 | 37,04 | 3 | 11,11 |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Critical | 3 | 3 | 50,00 |

Very important | 2 | 2 | 33,33 |

Important | 1 | 1 | 16,67 |

Total | 6 | 6 | 100,00 |

ENTR* - Financial Management of the Innovation Relay Centre (IRC) Network

Objectives and Scope

This joint IAS-ENTR audit of the financial management of the Innovation Relay Centre Network (IRC) was included in the 2005 work programme of the IAS and the 2005 work programme of the Internal Audit Capability of DG ENTR. This follows a risk assessment carried out in 2004 on DG ENTR as part of the IAS's work on Action 87 of the Reform White Paper which identified the financial management of the IRCs as one of the major risks in respect of the "innovation" activity and a specific request by the Director General of DG ENTR in his letter dated 13 December 2004 (Ref: D/115197). Each year since its Annual Activity Report of 2001, DG Enterprise and Industry has made a reservation in the research area on the frequency of errors relating to accuracy and eligibility of costs claims and their compliance with the provisions of the research contracts.

The objective of the audit is to assess the Financial Management of the IRC network of DG ENTR In this context, the audit assessed the adequacy of the design and effective application of the internal control system including procedures and structures with a view to provide reasonable assurance that the financial management of the IRC network ensures the achievement of the following objectives:

7. Compliance (legality and regularity) with the relevant legal basis, in particular: the Financial Regulation (FR) and its Implementing Rules (IR) and FP5 and FP6 rules and regulations;

8. Safeguarding of financial assets of the Community;

9. Reliability of financial information;

10. Rffectiveness and efficiency of (financial) operations, i.e. "sound financial management" as stated in Article 27 of the FR.

The IRC financial management audit was a joint IAS – ENTR audit carried out by a team comprised of two IAS auditors and four DG ENTR IAC auditors. To the maximum extent possible both IAS and IAC auditors performed the audit procedures of the different audit programmes and the audit report has been drafted with collective responsibility.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress | Completed |

Priority | # | # | % Total | # | % Total |

Very important | 16 | 6 | 13,33 | 10 | 22,22 |

Important | 26 | 8 | 17,78 | 18 | 40,00 |

Desirable | 3 | 3 | 6,67 |

Very Important | 17 | 1 | 16 | 13 | 8 | 8 |

Important | 29 | 3 | 26 | 21 | 19 | 7 |

Desirable | 3 | 0 | 3 | 2 | 2 | 1 |

TOTAL | 50 | 4 | 46 | 37 | 30 | 16 |

The following chart provides an overview of the number of recommendations implemented compared to the recommendations accepted by DG ENV sorted by priority.

[pic]

In line with the IAS follow-up policy, a subsequent follow-up audit will be conducted once DG ENV has reported a sufficient level of implementation of the remaining recommendations. The second follow-up will comprise the 7 recommendations assessed by us as "not fully implemented" at the time of this report and the 9 recommendations reported by the auditee as "in progress".

The assessment of the implementation of the recommendations has led to the formulation of three new recommendations.

INFSO – Follow-up Audit on the in-depth audit

Objectives and Scope

The objective of the follow-up engagement is to assess progress made in implementing the accepted recommendations that resulted from the In-Depth Audit of DG INFSO carried out from March to October 2004.

This follow-up audit does not result in an assessment of the adequacy of controls as a whole but focuses on the specific recommendations in the original audit.

Outstanding actions still to be implemented

Four actions required for fully implementing the recommendations are still open. The recommendations still in progress in the area of ex-post controls will be taken into account and considered with those resulting from the audit in the area currently under way.

JRC - Interim Follow-up Audit

Objectives and Scope

The objective of the follow-up engagement was to assess the progress made by DG JRC in effectively implementing the recommendations resulting from the IAS' in-depth audit of DG JRC carried out between April and October 2004.

The scope of the follow-up covered the 21 recommendations accepted by DG JRC, ten of which were classified as "Very Important" and eleven of which were classified as "Important".

In line with the IAS audit follow-up policy, a follow-up audit engagement is conducted when the level of reported implementation is satisfactory.

Recommendations

No new recommendations have been issued.

RTD – Ex-post Controls

Objectives and Scope

In accordance with its Audit Plan 2006, the IAS has assessed the effectiveness and the efficiency of the ex post controls put in place by DG RTD to obtain assurance on the legality and regularity of the transactions covered by the Research Programmes and on sound financial management.

It should be noted that since 2002 DG RTD has included in its AAR a reservation on the "Frequency of errors relating to the exactitude of costs claims and their conformity with the provisions of the research contracts" covering all Research contracts for the 2002 and 2003 AARs and only FP5 for the 2004 and 2005 AARs.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Critical | 1 | 1 | 8,33 |

Very important | 8 | 8 | 66,67 |

Important | 3 | 3 | 25,00 |

Total | 12 | 12 | 100,00 |

STRUCTURAL MEASURES AND COMMON AGRICULTURAL POLICY

AGRI , EMPL, FISH, REGIO – Overview report on Structural Funds Implementation of Article 38 of Council Regulation 1260/1999

Objectives and Scope

In accordance with its Audit Plan 2005, the IAS has assessed the suitability and the effectiveness of the internal management systems and the performance of the Commission departments (i.e. the four Structural Funds DGs) in charge of the Implementation of Article 38 of the Council Regulation n° 1260/1999 laying down the general provisions on the Structural Funds in order;

- To determine whether the Commission has put in place a control system in order to satisfy itself that the management and control systems presented by the MS meet the standards required, specifically Article 38 and its Implementing Rules as specified in Commission Regulation n° 438/2001;

- To assess the design, implementation, monitoring and effectiveness of the controls put in place at the DG level, including an assessment of the effectiveness of the cooperation with the MS;

- To evaluate the overall efficiency and effectiveness of the ex-post controls carried out by the SF DGs;

- To contribute to the Commission policy leading up to a positive Déclaration d'Assurance (DAS);

- To identify good practices in the four SF DGs.

The report provides an overview of the common issues and areas for improvement identified in the four IAS reports focusing on the operations co-financed by the Structural Funds for the programming period 2000-2006. It should be noted that the follow up will be carried out at the level of the individual DGs concerned in the context of their specific audit reports.

REGIO - ERDF: Audit of the Implementation of Article 38 of Council Regulation 1260/1999

Objectives and Scope

In accordance with its Audit Plan 2005, the IAS has assessed the suitability and the effectiveness of the internal management systems and the performance of the Commission departments (i.e. the four Structural Funds DGs) in charge of the Implementation of Article 38 of the Council Regulation n° 1260/1999 laying down the general provisions on the Structural Funds in order:

- To determine whether the Commission has put in place a control system in order to satisfy itself that the management and control systems presented by the MS meet the standards required, specifically Article 38 and its Implementing Rules as specified in Commission Regulation (EC) No 438/2001.

- To assess the design, implementation, monitoring and effectiveness of the controls put in place at the DG level, including an assessment of the effectiveness of the cooperation with the MS (Member States).

- To evaluate the overall efficiency and effectiveness of the ex-post controls carried out by the SF DGs.

- To contribute to the Commission policy leading up to a positive Declaration of Assurance (DAS).

- And to identify best practices in the four SF DGs.

This specific engagement focuses on the operations co-financed by the ERDF for the programming period 2000-2006 and the results and conclusions will serve, together with the reports prepared for the 3 other SF DGs, as a basis for the overview report on the implementation of Article 38 of the Council Regulation (EC) No 1260/1999 by the Structural Funds.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress | Completed |

Priority | # | # | % Total | # | % Total |

Very important | 9 | 4 | 33,33 | 5 | 41,67 |

Important | 3 | 1 | 8,33 | 2 | 16,67 |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 7 | 7 | 87,50 |

Important | 1 | 1 | 12,50 |

Total | 8 | 8 | 100,00 |

EXTERNAL POLICIES

AIDCO - INTERIM FOLLOW-UP AUDIT OF the In-depth Audit

Objectives and Scope

The objective of the follow-up engagement was to assess progress made by AIDCO in implementing the 51 recommendations that resulted from the in-depth audit carried out in 2003 (final report issued on 26/04/2004).

On 19/09/2005 AIDCO reported to the IAS a sufficient level of implementation as of 31/07/2005.

In line with IAS policy, this follow-up audit does not result in an assessment of the adequacy of controls as a whole, but focuses on the specific recommendations in the original audit and therefore no audit opinion has been formulated.

In assessing progress, standard IAS methods were used along with a survey which assessed the impact on 13 Delegations of the implementation of the recommendations at Headquarters, and a self-assessment exercise on progress made by the three Delegations that were visited by IAS in October 2003 as part of the original in-depth audit.

Table 1

[pic]

As shown in Table 1 above, the original audit contained 51 recommendations, all of which were accepted by AIDCO. Statistically speaking, approximately 50% of actions have been fully completed and progress, sometimes substantial, has been confirmed for the remaining 50%. Delays were encountered in implementing the action plan: out of 19 Critical and Very Important recommendations, which all were to be implemented before 31/12/2005, 9 are still In Progress, and 3 have been effectively implemented after the target dates set in the original action plan.

Two recommendations have been kept open for future follow-up. Specifically, the validation of the local accounting system by the Accountant is the responsibility of DG BUDG; and the design of Disaster Recovery Plans in Delegations which is the responsibility of DG RELEX.

In line with the IAS Follow-up policy, a second follow-up audit will be conducted once AIDCO has reported a sufficient level of implementation of the recommendations still open.

The main conclusions and observations relate to the adequacy of the control structures, management of sub-delegations and deputising and designation of initiators and verifiers and the implementation of the new Financial Regulation applicable to the Budget and the EDF.

AIDCO, ECHO - The Implementation of the Financial and Administrative Framework Agreement with the United Nations by DGs AIDCO & ECHO

Objectives and Scope

The overall objective of the engagement is to evaluate the implementation of the Financial and Administrative Framework Agreement (FAFA) as regards the compliance with the provisions of the Agreement and the capacity to obtain assurance about the use of EU funds.

The scope includes the management of projects under FAFA: the decision making procedures, the awarding to implementing partners, the contract management, the ex-post verifications and controls and finally the evaluation of results.

Beside the project cycle, several "horizontal" processes were also addressed: the availability of appropriate management information; the assessment of UN organisations' conformity with internationally accepted standards on internal control, accounting, audit and procurement; the EC's regulatory framework covering the FAFA and finally the horizontal co-ordination within the EC.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Very important | 5 | 5 | 62,50 |

Important | 3 | 3 | 37,50 |

Total | 8 | 8 | 100,00 |

ELARG - Ex-post control activities

Objectives and Scope

The issue of Ex-post controls (EPC) has been identified at the level of the Gap assessment and in the Commission "Action Plan towards an Integrated Internal Control Framework: Gap analysis and action plan for Commission services (SEC(2006) 49/2)". Furthermore, the Audit Progress Committee has expressed the need to have an overview of the EPC results, due to their importance, as well as to the fact that there are significant costs and resources mobilised for this purpose.

The main purpose of this audit is to assess the effectiveness and efficiency of the EPC and their contribution to the overall assurance of the Authorising Officer by (Sub)Delegation (AO(S)D) on the legality and regularity of the transactions and on sound financial management in DG ELARG.

This audit relies on the Financial Regulation and the Gap assessment in defining the key elements of EPC. Specifically:

- The Financial Regulation (Art. 60.4) states: "The AOD shall put in place, in compliance with the minimum standards adopted by each institution and having due regard to the risks associated with the management environment and the nature of the actions financed, the organisational structure and the internal management and control procedures suited to the performance of his/her duties, including where appropriate ex post verifications."

- The Implementing Rules (Art. 47.4) state that "The ex post verifications on documents and, where appropriate, on the spot shall check that operations financed by the budget are correctly implemented and in particular that [each operation shall be subject at least to an ex ante verification]. These verifications may be organised on a sample basis using risk analysis."

- The Gap assessment[11] confirms the role of EPC contributing to assurance and states that "risk based and representative ex post controls provide a unique opportunity to verify the performance elements in the control chain and to reinforce the assurance provided".

In the absence of a Commission-wide definition, the IAS considers for the purpose of these audits that EPC encompasses both the financial and operational side of the activity (projects/ programmes), and is not embedded in the financial circuit (e.g. for final payment).

The present engagement is part of the audits that the IAS is conducting on the EPC activities in the Relex Family (i.e. in DG AIDCO, ELARG and RELEX).

DG ELARG operates in a dynamic environment, which bears a significant risk. In this context, the dismantling of the European Agency for Reconstruction (EAR) and the replacement of Phare and CARDS by the new Instrument of Pre-Accession (IPA) provide opportunity to reflect on the current EPC objectives in the DG.

EPC in DG ELARG cover "Closure Audits" under the de-centralised management of Phare (commitment credits 2005: 1280 m€), and to a large extent "audits" carried out by Delegations managing CARDS under the centralised mode (commitment credits 2005: 173 m€). The scope of the audit includes EPC procedures existing with regard to operational budget managed by DG ELARG under these two modes, for which the EPC take different places in the organisation.

There are no observations or reservations in the Annual Activity Report (AAR) 2005 of DG ELARG that relate to the EPC processes audited.

Acceptance status of recommendations |

Yes | No |

Priority | # | # | % Total | # | % Total |

Not started | In Progress |

Priority | # | # | % Total | # | % Total |

Yes | No |

Priority | # | # | % Total | # | % Total |

In Progress |

Priority | # | # | % Total |

Critical | 1 | 1 | 14,29 |

Very important | 4 | 4 | 57,14 |

Important | 2 | 2 | 28,57 |

Total | 7 | 7 | 100,00 |

RELEX - Follow up note (no report).

[1] Control Objectives for Information and related Technologies © IT Governance Institute.

[2] DG SANCO - Trade Control and Expert System.

[3] DG TAXUD - Tariff Quota and Surveillance System.

[4] DG JLS - Facilitation of the implementation of the Dublin II Regulation.

[5] Audit on Evaluation Policy Framework of the Commission (PF-1716).

[6] See audit report IAS-2005-Y COMM-001 "SPP/ABM Cycle - Effectiveness & Efficiency - SG & DG BUDG".

[7] See audit reports: IAS-2005-SANCO-002 "Effectiveness and Efficiency of the SPP/ABM cycle in DG SANCO"; IAS-2005-TREN-002 "Effectiveness and Efficiency of the implementation of SPP and ABM in DG TREN" and IAS-2005-COMP-001 "Effectiveness and Efficiency of the SPP/ABM Cycle in DG COMP".

[8] Cobit : Control Objectives for Information and related Technology.

[9] Extrait de l'AAR 2005 de la DG MARKT.

[10] For the results of the preliminary survey, see Annex 1.

2 Communication of 13.1.2006 - SEC(2006) 49 (see above), §2.3.5.

[11] FR art. 60 and IR 47.4.

[12] See "A gap assessment between the internal control framework in the Commission Services and the control principles set out in the Court of Auditors' "Proposal for a Community Internal Control Framework", opinion No 2/2004, DG BUDG, 19 July 2005.