Table of Contents

1. Level of implementation of recommendations (auditee's assessment)................................ 5

2. Summary of engagements finalised in 2012................................................................................................. 7

2.1. Horizontal audit engagements................................................................................................................. 7

2.1.1. Annual Activity Report process (multi-DG).................................................................................................... 7

2.1.2. Management and monitoring of staff allocation (multi-DG)....................................................................... 9

2.1.3. Chargeback and internal billing systems (multi-DG)................................................................................ 13

2.2. Agriculture, Natural Resources and Health................................................................................. 16

2.2.1. Control Strategy in DG MARE - European Fisheries Fund...................................................................... 16

2.2.2.Control Strategy in DG SANCO....................................................................................................................... 18

2.2.3. Control Strategy in DG AGRI - Directorate J............................................................................................... 20

2.2.4. Audit on Public Procurement in the EAHC (Joint IAS-IAC)..................................................................... 22

2.2.5. Modulation (DG AGRI).................................................................................................................................... 24

2.3. Cohesion.................................................................................................................................................................... 26

2.3.1. Cohesion Fund 2000-06 - Closure (DG REGIO)......................................................................................... 26

2.3.2. ERDF 2000-06 - Closure (DG REGIO).......................................................................................................... 28

2.3.3. ESF 2000-06 - Closure (DG EMPL)............................................................................................................... 32

2.3.4. Implementation of 2007-13 Programmes (DG REGIO).............................................................................. 35

2.4. Research, energy and transport............................................................................................................. 38

2.4.1. Control Strategy in DG ENER......................................................................................................................... 38

2.5. External Aid, development and enlargement................................................................................ 40

2.5.1. Set-up of internal organisation in EU delegations (DG DEVCO) - Limited Review............................ 40

2.5.2. Financial Management of Regional Programmes (DG ELARG).............................................................. 42

2.6. Education and citizenship............................................................................................................................ 43

2.6.1. Lifelong Learning Programme (DG EAC/EACEA)...................................................................................... 43

2.6.2. Control Strategy in DG HOME....................................................................................................................... 45

2.6.3. Control Strategy in DG JUST.......................................................................................................................... 47

2.6.4. Monitoring the implementation EU Law (DG JUST).................................................................................. 47

2.7. Economic and financial affairs.............................................................................................................. 50

2.7.1. Implementation by the EIF of the CIP Programme (DG ECFIN).............................................................. 50

2.7.2. Off-budget operations (DG ECFIN)............................................................................................................... 51

2.7.3. Control Strategy in DG ENTR......................................................................................................................... 53

2.7.4. Monitoring the Implementation of EU Law (DG TAXUD): joint IAS-IAC audit.................................... 54

2.8. General services and HR................................................................................................................................. 57

2.8.1. Strategy and coordination of statistical data production, development and dissemination .................

(DG ESTAT and DG AGRI, DG MARE, DG RTD and JRC)......................................................................... 57

2.8.2. Service Level Agreements (DG HR, OIB, OIL and PMO)............................................................................ 62

2.8.3. Ethics in the Legal Service (consulting engagement)................................................................................ 63

2.9. IT audit engagements...................................................................................................................................... 65

2.9.1. Local IT in DG DEVCO..................................................................................................................................... 65

2.9.2 Local IT in DG TRADE....................................................................................................................................... 67

2.9.3. Horizon 2020 (DG RTD, DG CNECT, ERCEA)............................................................................................ 69

2.9.4. IT Governance and performance (DG SANCO/EAHC)............................................................................... 72

2.9.5. Internal Market Information System (IMI) Project Management (DG MARKT)................................... 74

2.9.6. Capitalisation of Internally Generated Intangible Assets......................................................................... 76

2.10. Follow-up engagementsfinalised in 2012........................................................................................... 77

2.10.1. 1st Follow-up Audit on Interventions in Agricultural Markets and 2nd Follow-up Audit on Interventions in Agricultural Markets........................................................................................................................................................... 77

2.10.2. Follow-up audit on the Management of Procurement by DG HR.......................................................... 77

2.10.3. Follow-up audit on the activities of OIB.OS3: Social Infrastructures ISPRA...................................... 77

2.10.4. Follow-up audit on the Official Journal Production Process as managed by the

............... Publications Office....................................................................................................................................... 78

2.10.5. 2nd Follow-up Audit on Missions in PMO................................................................................................... 78

2.10.6. Follow-up audit on Monitoring the implementation of EU law in DG ENTR..................................... 78

2.10.7. Audit Follow-up of Audits on the Global Navigation Satellite System Programmes in DG ENTR. 78

2.10.8. Audit Follow-Up on Enterprise Europe Network IT Tools in EACI...................................................... 78

2.10.9. Follow-Up Audit on Local IT systems supporting financial management in DG TREN/........................

............... EACI/TEN-T EA............................................................................................................................................. 78

2.10.10. Follow-up audit on Schengen Facility in DG HOME............................................................................ 79

2.10.11. Follow-up audit on the EAHC Management of the operational budget............................................ 79

2.10.12. 2nd Follow-up audit on Procurement in JRC........................................................................................... 79

2.10.13. Follow-up audit on Life+ Grant management in DG ENV.................................................................... 79

2.10.14. 2nd Follow-Up Audit on Data Centre – Operations and Security in DG DIGIT................................ 79

2.10.15. Follow-Up Audit on Management of the telecommunication infrastructure and services sTESTA (DG DIGIT) 79

2.10.16. Follow-Up Audit on Security of IT environment in subcontracted projects (DG REGIO)............. 80

2.10.17. Follow-Up Audit on Treasury and Accounting System (TAS) of DG ECFIN..................................... 80

2.10.18. Follow-Up Audit on Corporate Data Network Infrastructures & Services Management (DG DIGIT) 80

2.10.19. Follow-Up Audit on Management of local IT (DG EAC)...................................................................... 80

2.10.20. Follow-up Audit on Control Strategy - Audit and Financial Correction Processes (DG REGIO) 80

2.10.21. Follow-up Audit on Control Strategy – On-the-spot controls and Fraud prevention and detection (DG RTD) 80

2.10.22. Follow-up Audit on Control Strategy - Audit and Financial Correction Processes (DG EMPL) 81

2.10.23. Follow-up audit on Financial management of main programmes in Asia (DG DEVCO)............... 81

2.10.24. Follow-up audit of Financial management of main programmes under the European Neighbourhood Policy Instrument (DG DEVCO- ENPI).............................................................................................................................................. 81

2.10.25. Follow-up audit on Financial management of main programmes in Latin America

............... (DG DEVCO-LA)........................................................................................................................................... 81

2.10.26. Follow-up audit of Financial Management of Regional Projects (DG DEVCO-Regional)........... 81

2.10.27. Follow-up audit of Food Aid (DG ECHO)............................................................................................... 81

2.10.28. Follow-up audit on Public Procurement under IPA (DG ELARG)...................................................... 81

2.10.29. Follow-up audit on Closure of pre-IPA instruments (DG ELARG)...................................................... 82

2.10.30. 2nd Follow-up audit on Ex-post Control activities in the former DG RELEX (FPI)......................... 82

2.10.31. 3rd Follow-up audit on "Implementation of selected Internal Control Standards in DG ECFIN" 82

2.10.32. Follow-up audit on Ethics in the Commission (multi-DG)................................................................... 82

Content of this document

This document contains a summary of the original executive of all engagements finalised (cut-off date for the exercise 01/02/2013).

Each executive summary underwent the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation.

1. Level of implementation of recommendations (auditee's assessment)

Table 1 sums up the level of implementation of accepted recommendations, based on the auditee’s assessment, for IAS recommendations made during the period 2008-2012.

The recommendations not yet implemented are broken down by period overdue on the right-hand side of the table.

Table 1: Level of implementation of recommendations based on auditee’s assessment

Year || Priority || Total || Implemented || In progress (by number of months overdue)

|| || || No. || % || No. || % || No delay || 0 - 6 || 6 - 12 || 12+

2008 || Critical || 0 || 0 || || || || || || ||

Very Important || 136 || 134 || || 2 || || 0 || 0 || 1 || 1

Important || 164 || 159 || || 5 || || 0 || 0 || 0 || 5

Desirable || 15 || 14 || || 1 || || 0 || 0 || 0 || 1

2008 Total || 315 || 307 || 97% || 8 || 3% || 0 || 0 || 1 || 7

2009 || Critical || 2 || 2 || || 0 || || 0 || 0 || 0 || 0

Very Important || 136 || 132 || || 4 || || 0 || 0 || 0 || 4

Important || 142 || 138 || || 4 || || 0 || 0 || 0 || 4

Desirable || 9 || 9 || || 0 || || 0 || 0 || 0 || 0

2009 Total || 289 || 281 || 97% || 8 || 3% || 0 || 0 || 0 || 8

2010 || Critical || 2 || 2 || || 0 || || 0 || 0 || 0 || 0

Very Important || 124 || 105 || || 19 || || 1 || 3 || 2 || 13

Important || 150 || 131 || || 19 || || 1 || 5 || 2 || 11

Desirable || 7 || 7 || || 0 || || 0 || 0 || 0 || 0

2010 Total || 283 || 245 || 87% || 38 || 13% || 2 || 8 || 4 || 24

2011 || Critical || 0 || 0 || || || || || || ||

Very Important || 51 || 29 || || 22 || || 7 || 9 || 5 || 1

Important || 97 || 67 || || 30 || || 7 || 16 || 5 || 2

Desirable || 10 || 10 || || 0 || || 0 || 0 || 0 || 0

2011 Total || 158 || 106 || 67% || 52 || 33% || 14 || 25 || 10 || 3

2012 || Critical || 0 || 0 || || || || || || ||

Very Important || 83 || 10 || || 73 || || 66 || 7 || 0 || 0

Important || 108 || 20 || || 88 || || 78 || 10 || 0 || 0

Desirable || 0 || 0 || || || || || || ||

2012 Total || 191 || 30 || 16% || 161 || 84% || 144 || 17 || 0 || 0

TOTAL 2008-2012 || 1236 || 969 || 78% || 267 || 22% || 160 || 50 || 15 || 42

Overall, 969 or 78 % of the total number of recommendations made over the period 2008-2012 are reported by the auditee as implemented to date, leaving a total of 267 recommendations still in progress.

Not all open recommendations are overdue. Of the total number of recommendations in progress, a total 120 very important ones are outstanding, of which 27 are more than 6 months overdue. In addition, two very important recommendation issued in 2006 were still outstanding on 1 February 2013[1].

2. Summary of engagements finalised in 2012 2.1. Horizontal audit engagements 2.1.1. Annual Activity Report process (multi-DG)

(10 audit reports: SG/BUDG, OIB, DG CNECT, DG EAC, DG REGIO, DG EMPL, DG HOME, DG MARE, DG AGRI, DG DEVCO)

Background[2]

According to the Financial Regulation[3], Directors-General and Heads of Service are empowered by the College as Authorising Officers by Delegation (AOD) to define the most adequate and effective control systems for implementing the budget and achieving their organisational objectives in accordance with the principle of sound financial management and in compliance with the rules and regulations. The Annual Activity Reports (AARs) are the means by which the AODs report on the performance of their duties, providing financial and management information to the Institution. A key element of the AAR is the declaration of assurance, in which the AOD states that he has "reasonable assurance that the resources assigned to the activities […] have been used for their intended purpose and in accordance with the principles of sound financial management, and that the control procedures put in place give the necessary guarantees concerning the legality and regularity of the underlying transactions"[4]. The declaration of assurance may be qualified by reservations if deemed necessary.

The AARs are the main basis for preparing the Synthesis report, with which the College takes full political responsibility for the implementation of the budget, in particular before the Discharge Authority.

The Secretariat General and DG BUDG play a key role in the AAR process by providing instructions, support and guidance to the Commission DGs/Services. They currently ensure, through a process that includes the peer-review exercise, that the Standing Instructions are being applied consistently by the DGs in their AAR[5].

Audit Objectives and Scope

The overall objective of the audit was to assess the adequacy and effectiveness of the Annual Activity Report process in the Commission and, in particular, the extent to which the process is effective in supporting the Declaration of Assurance.

As for any horizontal process, its effectiveness relies on an adequate design, clear guidance and regular monitoring at corporate level, and on consistent implementation by the individual

DGs/Services in compliance with centrally defined rules, regulations and instructions. For this reason, the audit followed an approach that covers:

a) Central roles and responsibilities, in particular with reference to issuance of instructions and guidance, provision of support to the DGs/Services and coordination of the AAR process;

b) Individual DGs/Services roles and responsibilities to implement the process in compliance with rules and guidelines in order to provide the addressees of the AAR (as well as other interested readers) with complete information on the achievements of objectives, the status of internal control systems, and on the elements that support the declaration of assurance.

The audit was conducted in the SG and DG BUDG for their central role as well as in nine operational DGs/Services (OIB, CONNECT, EAC, REGIO, EMPL, HOME, MARE, AGRI, DEVCO).

Through this audit engagement, the IAS aimed at identifying possible improvements in the AAR assurance building processes, together with best practices amongst individual DGs and/or within families, room for simplification and rationalisation in the AAR process as well as in the actual AARs.

The audit did not cover completeness and accuracy of financial information in the AARs nor the robustness of the DGs/Services control strategies[6]. No scope limitations have been identified to date.

The fieldwork was finalised end of November 2012. All observations and recommendations relate to the situation as of that date. However, information provided during the validation phase was duly taken into account when finalising the audit engagement.

Risks and audit recommendations

The following high risks, that may impact the achievement of the business objectives for the process audited, were identified:

· Reporting on sound management – Risk rating: High: The Standing Instructions do not provide sufficient guidance on reporting in the AARs on the economy, efficiency and effectiveness of operations and controls. Without sufficient information on sound management, the AARs may not adequately support the conclusions on sound management as well as the Declaration of Assurance in this regard. The Central Services should develop further instructions on reporting on the economy, efficiency and effectiveness of financial and non-financial activities.

· AAR quality control process and summary for the Synthesis report – Risk rating: High: Weaknesses in the AARs may remain undetected due to a quality control process which does not effectively examine the robustness of DGs’ assurance-building process. This may consequently weaken the Synthesis report in fulfilling its accountability objective towards the Discharge Authority. The Central Services should enhance the quality control process by further examining the substance and the reliability of the assurance-building processes and by asking for justification if the Services do not adequately address the questions raised by the Central Services in the finalisation of the AARs.

· Structure of the AAR – Risk rating: High: Given that the AAR in reality serves several objectives and that some important AARs are examined by a broad audience, including the College but also the ECA and, more importantly, the Discharge Authority, the current AAR structure and the way the individual AARs are presented risk not being entirely useful for all its users. The Central Services should therefore streamline the structure of the AAR, avoiding overly long and complex reports. A revised structure should be introduced with an executive summary, the body of the report with key information and annexes providing the necessary detail.

2.1.2. Management and monitoring of staff allocation (multi-DG)

(5 audit reports: SG/BUDG/HR, DG RTD, DGT, DG COMP, DG AGRI)

Background

The audit on the management and monitoring of the staff allocation is included in the IAS 2012 Audit Work Programme. This engagement has been carried out in the framework of the ever-increasing importance of efficiency and effectiveness in the use of administrative appropriations in the current political context. Human capital is by far the most important resource of the Commission and expenditure linked to staff is subject to close scrutiny by the Budgetary Authority and the general public, although it represents a small percentage of the total EU budget.

The Commission committed itself to serving political priorities in the context of "zero growth" in human resources over the last years, and adopted a proposal[7] aiming to reduce staff in each EU Institution, body and agency by 5% during the period 2013-2017 through the non-replacement of some departing staff (retiring or with expired contracts).

The Commission also established a mechanism to redeploy posts in order to meet its priorities, based upon a linear 1% levy on all basic job quotas. The application of this mechanism on 1 May 2012 has allowed the creation of a redeployment pool of 255 posts to be allocated to Commission priorities.

In July 2011, the EU institutions entered a new cycle of Multiannual Financial Framework (MFF) negotiations, defining the budgetary priorities of the EU for the years 2014-2020. The negotiations of November 2012 ended without agreement between the Heads of Government and State of the 27 MSs, who have postponed the final decision until the first trimester of 2013. Several MSs have been seeking a significant reduction in the EU administrative budget. In such a political context, the Services must already identify effective ways to implement the planned reductions of staff so that the impact on service delivery is minimised.

Audit Objectives

The objective of the audit was to assess whether the Commission Services have adequate procedures and mechanisms in place to manage and monitor staff allocation effectively and efficiently in a context of staff reduction.

Although the Central Services have significant responsibilities in this area, the focus of the audit was on the relevant procedures in place within the operational DGs. Based on the general information collected during the preliminary survey, four DGs were selected (i.e. DG AGRI, DG COMP, DGT and DG RTD) in order to have a representative view of the different activities in the Commission, with emphasis on the relatively high number of staff as one other main selection criterion. In addition, a general survey was carried out in the form of a questionnaire, in order to obtain a comprehensive overview of the procedures in place across Commission Services, and identify potential good practices.

Audit Scope

This audit focused on the procedures and systems in place within the four selected DGs to manage and monitor staff allocation. The scope of the audit included a review of the systems, methods and tools used this context. Their effectiveness and efficiency were assessed against the following set of elements that the IAS consider necessary in order to achieve an allocation of Human Resources (hereafter HR) aligned to the organisation's highest priorities:

· A clear picture of all its activities, tasks, priorities and the human resources allocated to these (task mapping);

· A comprehensive picture of the skills required for each job and information on the skills available within the Services;

· Information on the share of the workload between staff in the entities;

· Based on the above mentioned elements, a formal HR plan, updated at least annually, which identifies the current and future HR needs for achieving the objectives, as well as any ensuing measures (e.g. redeployments, recruitment, training).

The audit also aimed at identifying good practices in this field, which may potentially be spread across other Commission services.

It was not in the scope of the audit to analyse how activities are currently organised within the audited Services and how possible overlaps in the activities of Directorates and Units could be reduced. Furthermore, the scope of the audit did not include the assessment of the efficiency of operations nor the definition of optimal staffing levels in Directorates and Units.

As concerns the Central Services, the audit team collected information on the main tools, systems and methods existing at corporate level for supporting the Commission Services, and on the main current developments in this area.

There are no observations/reservations in SG, DG BUDG, DG HR, DG RTD, DGT, DG COMP and DG AGRI AARs for the year 2011, which relate to the area/process audited.

The fieldwork was finalised on 07/11/2012. All observations and recommendations relate to the situation as of that date.

Risks and audit recommendations related to the Central Services

The following High risks that may impact the achievement of the business objectives for the process audited were identified:

· Corporate Framework to support Commission Services' management and monitoring of staff allocation – Risk rating High: Insufficient corporate guidance and support to help the Commission Services in their responsibility to achieve efficient and effective HR allocation may have a negative effect on the effectiveness and efficiency of the HR allocation within the Commission Services. The Central Services should further develop a framework for the management and monitoring of staff allocation and communicate it to the Commission Services.

In addition, the insufficient support to the staff allocation process by means of corporate tools and methodologies may cause certain Services to develop similar tools and methods locally, leading to a duplication of efforts and waste of human and financial resources. The Central Services should therefore further facilitate the coordination and exchanges of experiences, good practices, tools and methodologies between the HR professionals, e.g. through joint meetings of HR and SPP practitioners.

· Reporting and accountability by Commission Services on the effective use of posts – Risk rating High: The insufficient reporting and accountability on the effective use of posts attributed to the Commission Services in the context of the staff allocation procedure may leave potential cases of non-respect of the applicable Commission decision undetected. This could lead to an ineffective or inefficient redeployment of posts, which in its turn could adversely impact the achievement of the Commission's priorities. IAS recommends that the Central Services should improve the corporate framework for reporting and accountability by Commission Services about the use of posts redeployed to these Services, in line with the Commission decisions on the allocation of posts.

Risks and audit recommendations related to DG RTD

The following High risks that may impact the achievement of the business objectives for the process audited were identified:

· Mapping of Human Resources with activities and associated priorities – Risk rating High: Insufficient information concerning the HR allocated to the DG's existing tasks and their associated priorities may lead to inappropriate trade-off decisions in this area. This may have a negative impact on the efficient and effective use of resources, especially in a context of staff reductions.

DG RTD should further develop its mechanisms and tools to ensure the availability of complete, reliable and up-to-date information concerning the existing HR and their allocation to the DG's tasks and associated priorities (task mapping).

· Workload assessment – Risk rating High: An insufficient basis for comparing in a transparent way the workload of different units/ Directorates may prevent the DG from taking the most appropriate HR allocation/reallocation decisions. There is a risk that the allocation of HR to units/Directorates is not in line with the workload, which may prevent it from achieving its objectives in an efficient way.

DG RTD should put in place tools/methods to gather sufficient and reliable information concerning the workload related to its activities/tasks.

· Identification of current and future staff needs – Risk rating High: Insufficient analysis on the current / future optimal level of staff necessary to carry out different activities/tasks may hamper the reallocation of staff according to changing priorities and the implementation of staff reduction strategies, and prevent proper justification of HR requirements.

DG RTD should develop an HR plan, including the identification of the level of resources and competences needed (for different scenarios) to carry out its current and future activities/tasks and meet its priorities. It should compare the results of this analysis to the HR available in terms of numbers, function groups and competences.

Risks and audit recommendations related to DG AGRI

The following High risks that may impact the achievement of the business objectives for the process audited were identified:

· Mapping of Human Resources with activities and associated priorities – Risk rating High: Insufficient information concerning the HR allocated to the DG's existing tasks and their associated priorities may lead to inappropriate trade-off decisions in this area. This may have a negative impact on the efficient and effective use of resources, especially in a context of staff reductions.

DG AGRI should pursue its effort to develop mechanisms and tools to ensure the availability of complete, reliable and up-to-date information concerning the existing HR and their allocation to the DG's tasks and associated priorities (task mapping).

· Workload assessment – Risk rating High: An insufficient basis for comparing in a transparent way the workload of different units/ Directorates may prevent the DG from taking the most appropriate HR allocation/reallocation decisions. There is a risk that the allocation of HR to units/Directorates is neither in line with the workload nor with the strategic priorities of the DG, which may prevent it from achieving its objectives in an efficient way.

DG AGRI should develop tools/methods to gather sufficient and reliable information concerning the workload related to its activities/tasks.

· Identification of current and future staff needs – Risk rating High: Insufficient analysis on the current / future optimal level of staff necessary to carry out different activities/tasks may hamper the reallocation of staff according to changing priorities and the implementation of staff reduction strategies, and prevent proper justification of HR requirements.

DG AGRI should develop an HR plan, including the identification of the level of resources and competences needed (for different scenarios) to carry out its current and future activities/tasks and meet its priorities. It should compare the results of this analysis to the HR available in terms of numbers, function groups and competences.

2.1.3. Chargeback and internal billing systems (multi-DG)

(3 audit reports: DG BUDG, DG DIGIT and SCIC)

Background

Several Commission DGs and Services provide various types of services to other DGs/Services or to other Institutions. When the client "pays" for the services, this process is commonly referred as Charge-back process, given the fact that the cost of the services has to be transferred from the budget line of the client to the one of the provider (by using different mechanisms like recovery orders, co-delegations and cross sub-delegations).

In absence of a formal definition of the Charge-back process within the Commission, the IAS considers it as a set of coordinated activities conducted by a provider and a client aiming at providing/receiving value-for-money services in the respect of the existing (budgetary) rules. This process encompasses different steps, from the definition of the needs by the client to the delivery of the service requested and the monitoring of the results, and is based on an agreement (formalised or not) between the two parties.

The main objective of this process is to ensure that internal resources and existing competencies are used efficiently and effectively (by requesting the provision of services to in-house specialised providers) and in compliance with the budgetary rules (to ensure the proper use of the budgetary appropriations). This should permit to realise economies of scale as well as to have more flexible and rapid response comparing with what the market could offer. In addition, the development of a cost-accounting system, necessary to correctly define the amount to be charged-back, should help in promoting the sound financial management, as it would allow gathering information on the real costs of the services to be then used to take management decisions.

The risk factors inherent to the process relate to:

· erroneous identification of services to be charged-back (possibly leading to double budgeting of services, those not charged-back when due or to misuse of budget lines[8]);

· miscalculation of costs (resulting in an over or under charge-back to the client);

· lack of information available to allow the client DG/Service to take informed decision on the services requested or obtained.

Central services, in their responsibility for ensuring compliance with rules and regulations, and for fostering sound financial management, should contribute to the efficient functioning of the process by providing guidance and instructions on the charge-back process and on the costing mechanism and by monitoring their implementation.

There is no consolidated figure providing an overview of the amounts charged-back to internal and external clients by all Commission service providers.

Audit objectives

The objectives of the audit were to assess whether the charge-back process complies with existing Commission's rules and instructions (Financial Regulation, budgetary rules, central guidance) and is implemented consistently and transparently (including how the costs of the services provided are defined and communicated). In addition, the IAS looked at whether the information is used to promote sound financial management (to operate economically, effectively and efficiently).

Audit Scope

The scope of the audit encompassed the charge-back process implemented in a sample of DGs/Service (DG BUDG, DG DIGIT and SCIC) as well as the support and monitoring activities provided by Central Services. In this context, the IAS identified DG BUDG as the main auditee for its responsibility in the implementation of the Commission budget.

There are no observations/reservations in the 2011 AAR that relate to the area/process audited.

The fieldwork was finalised in November 2012. All observations and recommendations relate to the situation at that time.

Risks and audit recommendations

The following high risks that may impact the achievement of the business objectives for the process audited were identified:

· Governance of the charge-back process (Risk rating: High): The absence of a formal definition/description of the charge-back process and of a clear allocation of responsibilities could lead to an ineffective and inefficient charge-back process due to a lack of a common understanding or to incoherent implementation. In addition, it could lead to non-compliance with the budgetary rule of specification[9] or to double budgeting of services[10]. The absence of endorsement by central services of cost model(s) currently used to define the unit cost to be charged-back may lead to non-transparent and/or inaccurate calculation of costs of the services provided.

To mitigate those risks, an existing governance body (the ABM Steering Group) should own the process and be the ultimate responsible body for the definition (scope, actors, responsibilities, reporting arrangements) of the process. It should also be in charge of endorsing the cost models used by the service providers (where relevant).

· Central guidance and instructions (Risk rating: High): The lack of central guidance and instructions may lead to inconsistencies within and across DGs/Services, possibly resulting in non-compliance with budgetary rules. In addition, Commission resources may be used to finance activities of non-EC bodies.

DG BUDG, under the responsibility of the ABM Steering Group and with the support of the DGs involved in the charge-back process, should develop a framework including guidance and instructions on the charge-back process (identification of actors and responsibilities, types of services/costs to be charged-back, charge-back mechanisms, guidelines to calculate cost of services, definition of reporting arrangements). The legality and regularity constraints and the needs for transparency and flexibility should be taken into consideration, as well as the need to avoid increasing the administrative burden.

· Clarity and transparency of budget lines used for financing IT expenditures (Risk rating: High): Due to a lack of sufficiently detailed (budgetary) information, funds may be used in a way that is not in compliance with the budgetary principle of specification (not for the intended purpose) or services may be budgeted twice. In addition, the client DG may perceive the charge-back as unjustified, leading to possible mistrust in the service provider.

For the lines used to fund specific (IT) expenditure, DG BUDG should remind the Authorising Officers about the clarity of the budgetary comments and the type of information to be included, in line with the relevant legal base. In addition, the availability of easily accessible information on the free (not charged-back) services proposed by the providers would improve the clarity of the management of the administrative budget lines used to finance IT expenditure.

2.2. Agriculture, Natural Resources and Health

(DG AGRI, DG ENV, DG CLIMA, DG MARE, EAHC, DG SANCO)

2.2.1. Control Strategy in DG MARE - European Fisheries Fund

Background

Council Regulation (EC) n° 1198/2006 established the European Fisheries Fund (EFF), defining the framework for EU support for the sustainable development of the fisheries sector, fisheries areas and inland fishing. This programme financial envelope is 4.3 billion € for the 2007-2013 period and it is implemented by shared management.

Although the Member States (MSs) have primary responsibility for implementing effective internal control systems to prevent, detect and correct irregular and illegal expenditure, the Commission performs a supervisory role over national systems and assumes final responsibility for the implementation of the budget. Therefore, DG MARE should have a credible control strategy for demonstrating that they are seeking reasonable assurance on the effective functioning of the Management and Control Systems in the MSs.

Audit Objectives

The main objective of the audit was to assess the effectiveness and efficiency of DG MARE's Control Strategy for obtaining reasonable assurance on the correct functioning of the Management and Control Systems relating to the EFF in the MSs.

Audit Scope

The audit specifically assessed:

· whether DG MARE EFF Control strategy:

o is adequate, properly planned, and the DG's audit plans are risk-based and timely updated to reflect the results of key supervisory controls; is effectively implemented, regularly monitored and adequately reported on in terms of delivery status and key results;

o ensures that corrective measures (interruptions, suspensions and financial corrections) are taken promptly and proportionately, when the Commission's audit activities detect serious deficiencies;

o is effective in monitoring the implementation of the audit strategies and plans by the National Audit Authorities (NAAs), e.g. timely detecting deviations from national audit plans and insufficient audit coverage by the NAAs;

· whether DG MARE has adequately and effectively demonstrated the reasonable assurance obtained for the EFF in the 2011 Annual Activity Report (AAR), and in particular if the key information supporting reasonable assurance is adequately disclosed.

DG MARE has included the following reservation in its 2011 AAR concerning the processes within the scope of this audit:

· Management and Control Systems for EFF programmes in the following 8 MSs: Czech Republic, Spain, Finland, Italy, the Netherlands, Romania, Slovakia and Sweden. For 5 of these MSs, national audit reports revealed error rates exceeding 2% of declared expenditure. For 3 MSs (CZ, IT and RO), the error rates were not considered to be reliable.

· Eligibility of expenditure under Art. 25(2) of Council Regulation n° 1198/2006: in a number of cases MSs did not verify that investments on board did not increase vessels' ability to catch fish. Some investments that have been funded have increased the ability to catch fish.

The fieldwork was finalised on 15 June 2012. All observations and recommendations relate to the situation as of that date.

Risks and audit recommendations

The following Very High risks that may impact the achievement of the business objectives for the process audited were identified:

· The EFF Audit Strategy and Audit Plan concerning the assurance on the effective functioning of the MSs' Management and Control Systems – Risk rating: Very High: If the audit strategy lacks clear quantitative and measurable targets and the risk assessment is incomplete, the DG may not timely achieve its audit objectives to provide reasonable assurance that the Management and Control Systems in MSs function properly.

DG MARE's audit strategy should therefore include the overall coverage that the NAAs plan to reach in terms of system audits, the assurance targets to be achieved, and the related audit coverage targets for its own audit work, based on the available resources. DG MARE should develop a more complete risk assessment on the reliability of NAAs, including specific risk factors.

· Execution and monitoring of the Audit Strategy and Audit Plans – Risk rating: Very High: DG MARE not sufficiently or appropriately monitoring the implementation of its Audit Strategy and audit plan may lead to insufficient audit coverage. The DG may also not take timely actions to correct potential significant delays or deviations compared to planned activities. Partial audit coverage of NAAs' work may jeopardise the reliance on their audit opinions and therefore the level of assurance provided by NAAs. In addition, insufficient audit procedures on the spot and audit trail may put at risk the reliance put on NAAs.

DG MARE should therefore provide a finer analysis of the information related to the assurance on the reliability of the NAAs, obtained on the basis of the modules and countries/regions covered by its audit work. It should seek to increase this level of assurance by optimising the use of its limited human resources. In addition, DG MARE should seek to optimise the added value of the work done by Structural Funds DGs on common NAAs, e.g. exploring possible ways to obtain efficiency gains in the audit function, which would also increase the level of assurance.

DG MARE Ex-post control sector should introduce a consolidated table to monitor the timely issue of reports and the associated follow-up of recommendations, sharing the information regularly with the Authorising Officers by Sub-delegation (AOSDs).

· Monitoring of the National Audit Strategies and Annual Control Reports – Risk rating: Very High: An ineffective monitoring mechanism of National Audit Strategies may prevent DG MARE from promptly identifying and addressing problems, timely launching procedures for suspending payments and applying financial corrections to safeguard the EU budget. In addition, unreliable error rates communicated by MSs may lead to an inaccurate declaration of assurance by the Authorising Officer by Delegation (AOD).

DG MARE should hence reinforce the monitoring of National Audit Strategies through an additional interim review, by further developing its central overview of the assessment of the OPs including the main Intermediate Bodies, and by developing procedures to improve the assessment of the reliability of the error rate calculated by MS.

2.2.2. Control Strategy in DG SANCO

Background

The IAS audit on the Control Strategy in DG Health and Consumers (DG SANCO) was included in the IAS 2012 Audit Work Programme. This followed the audit risk assessment carried out in 2011. The relative importance of the budget of DG SANCO in the context of the IAS Overall Opinion and the residual error rate reported in DG SANCO's 2011 AAR (4,8% observed in payments made for co-financing Member States' animal disease eradication programmes) justified its inclusion in the IAS's Strategic Audit Plan for 2011-2012.

Audit Objectives

The objective of the audit was to assess the adequacy and effective application of the internal control system (ICS), risk management and governance processes related to the Control Strategy in DG SANCO. In particular, the audit assessed whether the ICS provided reasonable assurance regarding compliance with the relevant legislation, the reliability of financial and management information and the effectiveness and efficiency of the processes mentioned in the scope below.

Audit Scope

As a result of the desk review and the interviews carried out during the Preliminary Survey (which took into account the work already performed by the IAS, the IAC, the Ex-Post Control Section in DG SANCO and by the Court of Auditors), the scope of this audit engagement focused on the:

· Ex-ante financial controls in the following sub-processes of DG SANCO: commitments, payments (pre-financing – interim payments – final payments), recoveries and de-commitments.

· Ex-post controls (external audit).

The activities of DG SANCO in Luxembourg and Ireland were excluded from the scope because the budget involved is very small. The budget delegated to EAHC was also excluded because DG SANCO is only involved in the programming phase.

Observations/reservations made in the 2011 Annual Activity Report (AAR) of DG SANCO concerning the process under the scope of the audit:

The AAR 2011 mentioned one reservation regarding the scope of this audit.

It was a reservation concerning the rate of residual errors with regard to the accuracy of Member States' cost claims under the animal disease eradication and monitoring programmes in the food and feed policy area. With the residual error rate of 4,8% observed in payments made for co-financing Member States' animal disease eradication programmes, the average residual error rate in the relevant ABB activity amounted to 4,3% which was higher than the materiality threshold of 2%. The main sources of the detected errors were cost claims of Member States, which did not correctly apply the eligibility rules fixed in the legislation.

DG SANCO took corrective actions: more precise and restrictive definition of eligible expenditure in the Commission Decision for programmes starting on 01/01/2011 and the introduction of lump sums as from the 2012 programmes. The corrective actions, however, will only affect the results of the ex-post controls starting from 2014.

During the audit, no scope limitations were identified.

The fieldwork was finalised on 19 October 2012. All observations and recommendations in this report relate to the situation as of that date and do not consider improvements introduced since then.

Risk and audit recommendation

The following high risks that may impact the achievement of the business objectives for the processes audited were identified:

· Control strategy – Risk rating high: The many incomplete and lacking chapters in the control strategy create uncertainties or may lead to wrong actions. The spread of the control strategy over various notes may lead to inefficiencies and unclarity as to which document is applicable and to be used.

The IAS recommends DG SANCO to complete and finalise as soon as possible "DG SANCO Control Strategy" and to integrate all current related notes in one comprehensive document.

2.2.3. Control Strategy in DG AGRI - Directorate J

DG AGRI budget finances the Common Agricultural Policy expenditure (2007-2013) mainly through two shared management Funds, the European Agricultural Guarantee Fund (EAGF) which fully finances EU direct aid and market measures (€250 billion payments for the period 2007-2012) and the European Agricultural Fund for Rural Development (EAFRD) which co-finances rural development programmes (€53 billion payments for the period 2007-2012). Expenditure under both funds is managed through some 81 national or regional Paying Agencies (PAs) (sometimes through delegated bodies as well) in the 27 Member States (MSs), bearing a significant inherent risk that the Commission may reimburse irregular expenditure declared by them.

The Commission performs a supervisory role over national systems to obtain reasonable assurance on their effective functioning and assumes final responsibility for the implementation of the budget.

Audit Objectives

The main objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of the monitoring of the Control Strategy put in place by DG AGRI Directorate J for 2007-2013.

The practical execution of the Control Strategy, in particular as regards the implementation of the audit engagements, their supervision and the financial corrections process, will be examined by the IAS in future audits.

Audit Scope

Specifically, the audit was conducted to assess whether DG AGRI Directorate J Control strategy for 2007-2013 is adequate, in that:

· it clearly sets out how the audit activity will adequately cover all funds,

· the available resources are properly deployed (capacity analysis and human resources management aspects),

· audit activities are properly planned, based on a thorough risk assessment, and timely updated to reflect the results of key controls carried out; in this context Directorate J Central Risk Analysis and Annual Work Programmes have been examined;

· its Key Performance Indicators (KPIs) are well defined and properly used;

· it is regularly and effectively reported on in terms of delivery status and key results.

Since this audit aimed to be forward looking, it took into account the perspective of the changes under discussion about the Clearance of accounts system post-2013.

During the audit we also analysed the action plan prepared by DG AGRI aimed at reducing the error rates in rural development.

DG AGRI has included the following reservations in its 2011 AAR concerning the processes within the scope of this audit:

· Serious deficiencies in the IACS (Integrated Administration and Control System) in Portugal and Bulgaria, in particular in the identification system, covering all agricultural areas, called Land Parcel Identification System (LPIS);

· The whole EAFRD, as the residual error rate, based on the statistical information on the results of the controls carried out by MSs, was 2.36% of the whole ABB activity and thus above the 2% materiality threshold;

· Deficiencies in the supervision and control of certified organic products, with potential negative impact on the market and on the organic farming sector and bearing the risks that the related underlying transactions are not legal and regular.

The fieldwork was finalised on 15 November 2012. All observations and recommendations relate to the situation as of that date.

Risks and audit recommendations

The following Very High risks that may impact the achievement of the business objectives for the process audited were identified:

· DG AGRI's Directorate J Audit Strategy – Risk rating Very High: In the absence of a formalised audit strategy and measurable specific audits objectives and indicators, the DG may not be able to define an appropriate audit plan and achieve the assurance that it is expected to reach.

Insufficient analysis of the reliability of the CBs, inadequate consideration of their work, and insufficient coordination between the EC audit services may lead to inefficient use of audit resources and jeopardise the assurance obtained.

DG AGRI should therefore develop and formalise its audit strategy, and seek to strengthen the role of the CBs as assurance providers, achieving further synergies with their work.

· Risk assessment and Audit planning - Risk rating Very High: Inadequate risk-assessment and therefore inappropriate audit planning may preclude the DG from achieving its audit assurance objectives.

Because of an incomplete capacity analysis, the audit plan may not be achievable, entailing backlogs, and the allocation of resources to priorities may be inadequate.

Directorate J should re-engineer the Central Risk Analysis and the other risk assessments, according to the targets defined in its Control Strategy, ensure a proper coverage of IT security matters, properly monitor and follow up recommendations issued; and conduct a thorough capacity analysis in order to have a more realistic audit plan.

· Monitoring and reporting of the implementation of the Audit Strategy and Audit Plans - Risk rating Very High: Insufficient monitoring of audit activities may hinder timely measures to correct potential significant delays or deviations compared to planned activities.

Insufficient disclosure of the results of certain key building blocks supporting management's assurance may limit its effective utilisation by third parties and expose the Commission to reputational risks.

DG AGRI should improve its quantitative and qualitative KPIs in order to enhance the monitoring of audit activities; develop monitoring of actual resource spent compared to plan; and improve the disclosure of all relevant key indicators in its AAR.

· Human resources management aspects - Risk rating Very High: High turnover and insufficient audit-related training may undermine the Directorate's productivity and performance levels.

DG AGRI Directorate J should adopt specific targets and KPIs on human resources matters, develop a training program for its auditors, identify the causes of the high turnover and develop a policy to encourage retention of staff in the Directorate.

2.2.4. Audit on Public Procurement in the EAHC (Joint IAS-IAC)

Background

The Agency's current mandate covers the Public Health Programme, the Consumers Programme and the "Better Training for Safer Food (BTSF)" actions. EAHC is monitored by its parent Directorate General, DG SANCO, which will continue to address all policy-making and institutional tasks related to the Programmes.

Public Procurement is a significant activity of the Executive Agency for Health and Consumers (EAHC) contributing to 37,4% of its budget 2011 (23% in 2010) with the up going trend which justifies this joint IAS-IAC audit in the coordinated 2011 Audit Plan.

Audit Objectives

The objective of the audit was to assess the adequacy and effective application of the internal control system (ICS), risk management and governance processes related to the Procurement process in EAHC.

In particular, the audit assessed whether the ICS provided reasonable assurance regarding compliance with the relevant legislation, the reliability of financial and management information and the effectiveness and efficiency of the processes mentioned in the scope below.

Audit Scope

As a result of the desk review and the interviews in the Preliminary Survey, the scope of this audit engagement focuses on EAHC Public Procurement management:

· Contract Preparation (Calls for tenders, Evaluation of tenders. Awarding decision)

· Budgetary commitments and contract/decisions

· Delivery and Closure (Payments, Recovery, RAL and de-commitment)

· Financial and management reporting (incl. completeness of the Annual Activity Report)

There were no observations/reservations made in the 2010 AAR of DG SANCO and EAHC concerning the processes under the scope of this audit.

During the audit, no scope limitations were identified.

The fieldwork was finalised on 28 November 2011. All observations and recommendations relate to the situation as at that date.

Risks and audit recommendations

The following high risks that may impact the achievement of the business objectives for the process audited were identified:

Autonomy- Risk rating High: The EAHC's incomplete operational autonomy may result in non-compliance with the delegation act and the Implementing Rules (Art. 45), non-optimal use of resources, duplication of administrative tasks, weakened accountability for decisions and actions taken and some uncertainties about the EAHC's capacity to perform its duties fully in line with the delegation act.

DG SANCO should therefore complete the transfer of operational tasks to the EAHC or consider managing a limited number of contracts entirely within the DG (e.g. due to their political dimension, specific field of expertise needed, etc.). The EAHC should take actions to increase efficiency and effectiveness and better align the human resources available in the Agency and the delegated tasks and control requirements.

Risk Management - Risk rating High: Inadequate risk management procedures may lead to a partial view on the current risk status of the EAHC and the possible actions to be taken, a late response to risks, new risks not being identified and mitigated and non-compliance with internal control standard №6.

The EAHC should thus systematically and regularly update its risk register, reassess risks and include any new risks in the risk register.

Award Notices for calls for tender - Risk rating High: Non-compliance with public procurement rules and regulations on award notice publications may expose the EAHC to litigation.

The Agency should therefore establish controls and checks for publishing contract award notices in a timely manner.

Negotiated Procedure- Risk rating High: The procurement objective of best value for money may not be achieved, if the use of negotiated procedures is not sufficiently justified, as it may restrict competition. DG SANCO's late submission of programme preparation documents to the Agency, may lead to excessive time pressure and ineffective execution of the EAHC's tasks and objectives. Consequently, the EAHC should formally and systematically document the justification for choosing any type of procurement procedure and further develop its knowledge on the related market. DG SANCO should ensure the timely submission of work documents.

Assessment of eligible costs- Risk rating High: Unstructured and vaguely defined contractual requirements may lead to ineffective and inefficient controls over eligibility of costs incurred by beneficiaries and thus may result in irregular transactions. The lack of a sampling methodology when assessing eligibility of costs in a high number of cost claims may result in ineffective and inefficient checks.

The EAHC should therefore improve the contractual requirements for receiving reimbursement of expenditure, develop and effectively use a sampling procedure for its eligibility checks and enhance its controls for executing payment transactions.

2.2.5. Modulation (DG AGRI)

In line with the IAS Strategic Audit Plan 2010-2012, an audit on Modulation in DG AGRI was announced in October 2011 and started in December 2011. The objective of the audit was to assess the adequacy and effective application of the governance, risk assessment and internal control process for managing Modulation in DG AGRI.

The IAS identified modulation as a high risk area in the risk assessment underpinning its strategic plan, due to the experience with voluntary modulation prior to the CAP Health Check of 2008 and the fact that it appeared to be a complex system, involving risks of difficult implementation and control.

The preliminary review resulted in a re-assessment of the originally identified risks. This led to the following conclusions.

There is no financial risk from the EU budget point of view, because once the amount of modulation was calculated for the period 2009-2012, it was transferred directly from the 1st Pillar to the 2nd Pillar of the CAP and allocated to the Rural Development Programmes. The overall expenditure allowed for agriculture and rural development remains unchanged as the transfer is budgetary neutral.

The indicative budget concerned is small compared to the total CAP Expenditure (about 3% of commitments appropriations for the period 2009-2012). Modulation currently concerns only the EU-15 Member States.

In the current system only compulsory modulation applies to the vast majority of MSs concerned, as only the UK decided to apply voluntary modulation in addition to compulsory modulation.

The new net ceilings of direct aids were set up for the period 2009-2012 in the regulation and then closely monitored by the relevant DG AGRI units as part of the budgetary and financial processes.

Practical implementation of modulation (compulsory, and voluntary only for the UK) at the level of the MSs is controlled by the Certifying Bodies and therefore by DG AGRI's Audit Directorate.

For the new programming period 2014-2020 there is no need for compulsory modulation, as the budget is directly allocated between the two pillars. Besides, the draft legislation for the new period does not foresee voluntary modulation.

The sums retained by Member States under the pre-2008 voluntary modulation scheme have been accounted for and cleared.

The results of the IAS' preliminary review and the above mentioned reassessment showed that the expected risks regarding modulation did not materialise over the last few years as both the controls in place and modified procedures adequately mitigated them. The IAS therefore decided to close the audit engagement without performing any further detailed testing.

2.3. Cohesion

(DG REGIO, DG EMPL)

2.3.1. Cohesion Fund 2000-06 - Closure (DG REGIO)

Background

The Structural Funds (SF) DGs' spending accounts for about one third of the total EC budget annually under shared management in the 2000-06 Programming Period (PP). There are some 1140 Cohesion Fund (CF) projects with a budget of EUR 32, 7 billion. According to latest data received, DG REGIO has received the full set of closure documents for 960 projects and has completed its review of 614.

The closure of projects in the case of CF represents the financial settlement of the outstanding Community commitment through payment of the final balance to the MS or issue of the debit note and de-commitment of any unused balance. Final settlement does not prejudice the Commissions right to adopt financial corrections.

Member States submit a set of closure documents (a Final Report (FR), a Winding-Up report and declaration (WU documents), and a certified statement of expenditure) to accompany the final request for payment (within 6 months for the CF)[11].

DG REGIO reviews and analyses these closure documents, making admissibility and qualitative checks in three separate workflows. The operational (Geographical) units (GU) make admissibility and qualitative checks on the FR of the body responsible for implementation (or implementing body). The Audit units (AU) check the WU documents of the national audit body. The financial and geographical units (officers) check the certified statement of expenditure, including the final payment claim. Certified statements of expenditure are only processed once the other two workflows have been finalised. The DG can also perform closure audits to obtain additional assurance if necessary.

The general rule is that closure of CF projects should be performed within a reasonable time after the deadlines for the submission of documents necessary for the payment for the balance. The Cohesion Fund guidelines foresee that in principle, if the set of documents received is complete and there are no issues requiring clarification (for which additional delays are foreseen), the closure procedure could be completed within two months.

The SFs DGs should have a credible closure process for demonstrating that all errors and irregularities in relation to deficiencies identified in the Member States management and control systems during the implementing period are detected and corrected at the latest at the closure of the OP. The objective of the closure procedure is to ensure the timely treatment of the closure documents in order to lead to a prompt liquidation of the unspent commitment balance (RAL) while ensuring compliance with the principles of sound financial management (including the application of financial corrections where necessary).

Audit Objectives

The objective of this audit was to assess whether DG REGIO has a robust and sound approach to the closure of the Cohesion Fund 2000-06 projects. More specifically, whether controls have been put in place and are being exercised in practice to ensure the adequate, timely and effective closure of CF projects, including the determination of reliable final residual error rates. Given that the closure process is still very much on going, the IAS aimed to identify improvements, for which there is still time to implement, before the closure process is finalised and all the CF projects are successfully closed. This is expected to last for another 3-4 years.

Audit Scope

The scope of the audit covered the following areas:

· The work done by DG REGIO's geographical/financial/audit units on the closure documents (the winding up declaration, final report and certificate of final expenditure) based on the admissibility and qualitative check-lists developed for the closure exercise;

· The methods used to establish and to apply financial corrections, and their effective application, including consistency aspects;

· The monitoring and reporting provisions in place for the closure process, their accuracy, completeness, timeliness, including related disclosure in the AAR;

· The risk assessment supporting the DGs' Audit Plan for closure audits and the impact of the closure audits on the establishment of the final payment amount.

The audit scope also included coordination arrangements between GUs and AUs, and between DG REGIO and other DGs/Services. In addition, the scope included the current state-of-play, the recently introduced organisational changes within DG REGIO, together with the subsequent changes in the monitoring and reporting mechanisms and the tools in place, that support the closure of the remaining open CF projects.

There were no scope limitations.

The fieldwork was finalised at the end of November 2012.

DG's AAR: The following observations/reservations were made in the 2011 AAR concerning specifically the area/process under the scope of this audit engagement:

· Reservation concerning the Cohesion Fund management and control systems for the 2000-2006 period, in Hungary and Spain for reputational reasons[12].

Risks and audit recommendations

The following high risk that may impact the achievement of the business objectives for the process audited was identified:

· Gaps in the assessment of closure documents (Report Finding 1: Risk rating –High): The gaps noted in the assessment process together with a lack of standardised approach may lead to inconsistencies which, coupled with a lack of audit trail, may impact on the quality of the assessment made. This can in turn mean that errors and irregularities are not properly detected and corrected. It can also lead to unequal treatment between Projects and Member States, which can in turn impact on the Commission’s reputation.

For the remaining CF Projects to be closed, DG REGIO should update the assessment notes, templates and methodology (e.g. Cohesion Fund Manual) in order to address the gaps in the assessment process, avoid unnecessary checks and ensure more consistency as regards the use of additional checklists or templates. It should improve coordination between the GU and AU through the development of standardised templates, including for the assessment of the FR, and ensure that qualitative checks on all key closure documents are applied on a consistent basis. Taken together, these measures should result in a better audit trail of the assessments made and help improve timeliness for closing the remaining CF projects. The IAS notes that DG REGIO recently introduced harmonised templates for the notes from the AUs to the GU[13].

2.3.2. ERDF 2000-06 - Closure (DG REGIO)

Background

The Structural Funds (SF) DGs' spending accounts for about one third of the total EC budget annually under shared management in the 2000-06 PP. There are some 379 Operational Programmes (OPs) for ERDF with a budget of EUR 129,6 billion.

The closure of OPs in the case of ERDF represents the financial settlement of the outstanding Community commitment through payment of the final balance to the MS or issue of the debit note and de-commitments of any unused balance. Final settlement does not prejudice the Commissions right to adopt financial corrections[14].

Member States submit a set of closure documents comprising of a Final Implementation Report (FIR), a Winding-Up Declaration (WUD) and a certified statement of expenditure to accompany the final request for payment within 15 months after the deadline for eligibility of expenditure.

DG REGIO reviews and analyses these closure documents, making admissibility and qualitative checks in three separate workflows. The operational (Geographical) units (GU) make admissibility and qualitative checks on the final implementation reports (FIR) of the managing authority. The audit units (AU) check the winding-up declarations (WUD) of the national audit body. The financial and geographical units (officers) check the certified statement of expenditure, including the final payment claim. Certified statements of expenditure are only processed once the other two workflows have been finalised. The DG can also perform closure audits to obtain additional assurance if necessary.

The SFs DGs should have a credible closure process for demonstrating that all errors and irregularities in relation to deficiencies identified in the Member States management and control systems during the implementing period are detected and corrected prior to or at the latest at the closure of the OP. To this effect, the SF DGs have agreed on a common methodology for building up their opinion on the admissibility and reliability of the final report and WUD and on the correctness of the final statement of expenditure. The three key elements of this methodology are i) a quality review of the submitted documents, ii) the calculation of the residual error rate for each OP in order to show the extent of the potential remaining deficiencies and their financial impact and iii) the determination of the financial corrections to be applied.

The objective is to ensure the timely treatment of the closure documents in order to lead to a prompt liquidation of the unspent commitment balance (RAL) while ensuring compliance with the principles of sound financial management (including the application of financial corrections where necessary).

Audit Objectives

The objective of this audit was to assess whether the SF DGs have a robust and sound approach to the closure of the 2000-06 PP. More specifically, whether controls been put in place were being exercised in practice to ensure the adequate, timely and effective closure of OPs/Projects, including the determination of reliable final residual error rates.

Given that the closure process takes place over a number of years and that much of that process has already been implemented, the IAS has placed particular emphasis on identifying improvements which can be used for the closure of the current, 2007-13 programming period, the planning for which is already underway[15].

Audit Scope

In determining the scope of the audit, the IAS took into account the comments already made by the ECA in the framework of its audits on the closure process[16] as well as the audits reports already produced by the IAC.

More specifically, the scope of the audit covered the following areas:

· The work done by DG REGIO's geographical/financial/audit units on the closure documents (the winding up declaration, final report and certificate of final expenditure) based on the admissibility and qualitative check-lists developed for the closure exercise;

· The methods used to establish the residual error rate and to apply financial corrections, and their effective application, including consistency aspects;

· The monitoring and reporting provisions in place for the closure process, their accuracy, completeness, timeliness, including related disclosure in the AAR;

· The risk assessment supporting the DGs' Audit Plan for closure audits and the impact of the closure audits on the establishment of the final payment amount.

DG's AAR: It should be noted that in its 2011 AAR DG REGIO made a reservation concerning specifically the area/process under the scope of this audit engagement:

· Reservation for reputational reasons concerning the ERDF for the 2000-2006 period linked to outstanding issues at closure stage in Spain, Germany, Ireland, Italy and Cross-Border programmes[17].

The IAS fieldwork was finalised at the end of November 2012. All observations and recommendations relate to the situation as of that date.

Risks and audit recommendations

The following high risks that may affect the achievement of the business objectives for the process audited were identified:

· Report on the closure 2000-2006 and DG REGIO Preparation for closure (Planning, methodology and guidance) - [Report Finding 1 – Risk Rating - High]: Preparation is key to the successful closure of OPs under shared management. Both in terms of timeliness and in terms of providing clear guidance to MS to help minimise the scope for interpretation and ensure consistent treatment. Without this, there is the risk that, in a multi-annual control environment, the time taken to deal with ensuing problems will lead to delays and overlaps between different programming periods. This may impact on the prioritization of the work done due to resource constraints and ultimately risks that the closure process fails to properly detect and correct errors and irregularities.

The closure of the 2000-06 PP is nearing conclusion, but preparations are already underway for closing 2007-13 programmes. Based on the lessons learned, DG REGIO, should, in coordination with the other SF DGs, ensure that it has a timely and proper strategy and planning process in place for the next closure exercise, which is supported by clear and comprehensive guidance to MS and which is fully in line with the legal framework. The IAS notes that draft guidance to MS on the key issue of sampling and treatment of errors and irregularities has already been prepared and that the guidelines are expected to be issued in February 2013.

In addition, and recognising the importance of the role closure plays in bringing the multi-annual control process to a conclusion, DG REGIO should, also in conjunction with the other SF DGs, report on the current state of play and effectiveness of the process in detecting and correcting errors and irregularities. In this regard, the IAS notes that in response to the Parliament's request to ensure legality and regularity when closing 2000-06 programmes[18], the SFs DGS are planning to report in early 2013 on the state of play as regards the closure process and demonstrate the corrective capacity of financial corrections.

· DG REGIO Checks on closure documents [Report Finding 2- Risk Rating - High]: A lack of a common basis between SF DGs for checks on MS closure documents may lead to inconsistent treatment, particularly where there are common MS bodies involved. Inconsistencies of approach, coupled with a lack of audit trail and effective supervision may impact on the quality of the assessment made, which could in turn mean that errors and irregularities are not properly detected and corrected.

The financial risk of unfinished projects is particularly high for Greek OPs where at the moment about 1.92 billion EUR projects remain unfinished and for which Greece will have to reimburse the EU co-financing received if the projects are not completed by the deadline.

Using the experience of the 2000-06 closure exercise, DG REGIO should ensure that the methodology and internal guidance, including the checklists to be used, are finalised in good time for closing the 2007-13 PP. They should be communicated to staff on a timely basis and the checks which are made in practice should be properly documented and supported by effective supervisory arrangements. DG REGIO should continue to monitor carefully the completion of unfinished projects for Greece and Italy and to resume recovery procedures for those projects which do not meet the deadlines (September 2012 and March 2013).

2.3.3. ESF 2000-06 - Closure (DG EMPL)

Background

The Structural Funds (SF) DGs' spending accounts for about one third of the total EC budget annually under shared management for the 2000-2006 Programming Period (PP). There are 239 Operational Programmes (OPs) for the European Social Fund (ESF) with a budget of EUR 68,5 billion.

The closure of an OP represents the financial settlement of the outstanding EU budgetary commitment through payment of the final balance to the MS or the issue of a recovery order and de-commitment of any unused balance. Financial settlement does not prejudice the Commission's right to make financial corrections.

Member States submit a set of closure documents, comprising of a Final Implementation Report (FIR), a Winding-Up Declaration (WUD) and a certified statement of expenditure to accompany the final request for payment within 15 months after the deadline for eligibility of expenditure.

DG EMPL reviews and analyses these closure documents, making admissibility and qualitative checks in three separate workflows. The operational (Geographical) units (GU) make admissibility and qualitative checks on the FIR of the managing authority. The Audit units (AU) check the WUD of the national audit body. The financial and geographical units check the certified statement of expenditure, including the final payment claim. Certified statements of expenditure are only processed once the other two workflows have been finalised. The DG can also perform closure audits to obtain additional assurance if necessary.

The SFs DGs should have a credible closure process for demonstrating that all errors and irregularities in relation to deficiencies identified in the MS management and control systems during the implementing period are detected and corrected at the latest at the closure of the OP. To this effect, the SF DGs agreed on a common methodology. The three key elements to support this methodology are i) a quality review of the submitted documents, ii) the calculation of the residual error rate for each OP in order to show the extent of the potential remaining deficiencies and their financial impact and iii) the determination of the financial corrections to be applied.

The objective is to ensure the timely treatment of the closure documents in order to lead to a prompt liquidation of the unspent commitment balance (RAL) while ensuring compliance with the principles of sound financial management (including the application of financial corrections where necessary).

Audit Objectives

The objective of this audit was to assess whether the DG EMPL had a robust and sound approach to the closure of the 2000-06 PP and more specifically, whether controls put in place have been adequately exercised in practice to ensure a timely and effective closure of OPs, with a particular focus on the controls related to the determination of adequate financial corrections and reliable final residual error rates.

Given that the closure process takes place over a number of years and that much of that process has already been implemented, the IAS has placed particular emphasis on identifying improvements which can be used for the closure of the current, 2007-13 programming period, the planning for which is already underway[19].

Audit Scope

In determining the scope of the audit, the IAS took into account the comments already made by the ECA in the framework of its audits on the closure process[20] as well as the audits reports already performed by the IAC.

More specifically, the scope of the audit covered the following areas:

· The work done by DG EMPL's geographical/financial/audit units on the closure documents (the winding up declaration, final report and certificate of final expenditure) based on the admissibility and qualitative check-lists developed for the closure exercise;

· The methods used to establish the residual error rate and to apply financial corrections, and their effective application, including consistency aspects;

· The monitoring and reporting provisions in place for the closure process, their accuracy, completeness, timeliness, including related disclosure in the AAR;

· The risk assessment supporting the DGs' Audit Plan for closure audits and the impact of the closure audits on the establishment of the final payment amount.

DG's AAR: It should be noted that in its 2011 AAR, DG EMPL made a reservation concerning specifically the area/process under the scope of this audit engagement. For the 2000-2006 PP, it concerned 13 ESF OPs[21] for which the reservation was maintained from the previous AAR and related to "deficiency of the management and control systems set up in relation to the requirements of Regulation 438/2001".

The IAS fieldwork was finalised mid-November 2012 and all recommendations relate to the situation as of that date.

Risks and audit recommendations

The following high risks that may impact the achievement of the business objectives for the process audited were identified:

· Preparations for closure (Planning, methodology and guidance) - [Report Finding 1 – Risk Rating - High]: Preparation is key to the successful closure of OPs under shared management. Both in terms of timeliness and in terms of providing clear guidance to MS to help minimise the scope for interpretation and ensure consistent treatment. Without this, there is the risk that, in a multi-annual control environment, the time taken to deal with ensuing problems will lead to delays and overlaps between different programming periods. This may impact on the prioritization of the work done due to resource constraints and ultimately risks that the closure process fails to properly detect and correct errors and irregularities.

The closure of the 2000-06 PP is nearing conclusion, but preparations are already underway for closing 2007-13 programmes. Based on the lessons learned, DG EMPL, should, in coordination with the other SF DGs, ensure that it has a timely and proper strategy and planning process in place for the next closure exercise, which is supported by clear and comprehensive guidance to MS and which is fully in line with the legal framework. The IAS notes that draft guidance to MS on the key issue of sampling and treatment of errors and irregularities has already been prepared and that the guidelines should be issued in February 2013 followed by information/training sessions to the DG's staff and representatives of the MS.

In addition, and recognising the importance of the role closure plays in bringing the multi-annual control process to a conclusion, DG EMPL should, also in conjunction with the other SF DGs, report on the current state of play and effectiveness of the process in detecting and correcting errors and irregularities. In this regard, the IAS notes that in response to the Parliament's request to ensure legality and regularity when closing 2000-06 programmes[22], the SFs DGS are planning to report in early 2013 on the state of play as regards the closure process and demonstrate the corrective capacity of financial corrections.

· DG EMPL Checks on closure documents [Report Finding 2- Risk Rating - High]: A lack of a common basis between SF DGs for checks on MS closure documents may lead to inconsistent treatment, particularly where there are common MS bodies involved. Inconsistencies of approach, coupled with a lack of audit trail and effective supervision may impact on the quality of the assessment made, which could in turn mean that errors and irregularities are not properly detected and corrected.

Using the experience of the 2000-06 closure exercise, DG EMPL should ensure that the methodology and internal guidance, including the checklists to be used, are finalised in good time for closing the 2007-13 PP. They should be communicated to staff on a timely basis and the checks which are made in practice should be properly documented and supported by effective supervisory arrangements.

DG EMPL has envisaged to organise information/training sessions to the DG's own staff on the content of the closure guidelines and the different aspects of the closure. In addition, for the 2007-2013 closure, The IAS notes that DG EMPL does not intend to outsource the analysis work of the closure documents.

2.3.4. Implementation of 2007-13 Programmes (DG REGIO)

Background

The Cohesion area spending accounts for more than one third of the total EC budget. For the 2007-2013 Programming Period (PP) covering the European Regional Development Fund (ERDF) and Cohesion Fund (CF), there are a total of 317 Operational Programmes (OPs). In 2011, DG REGIO made payments of EUR 25,84 billion covering both ERDF and CF.

Under shared management, the Member States (MS) have primary responsibility for implementing effective internal control systems to prevent, detect and correct irregular expenditure, while the Commission performs a supervisory role over national systems and assumes final responsibility for the implementation of the budget.

Audit Objectives

Recognising the persistently high error rates in the Cohesion area, the IAS conducted this audit on the implementation of the 2007-13 PP for ERDF/CF programmes in order to assess firstly, the extent to which DG REGIO has determined and reported reliable error rates and secondly, the extent to which it has taken sufficient and adequate measures to reduce the high error rates.

Audit Scope

The audit specifically covered the following areas:

· The guidance provided to MS Audit Authorities (AAs) on the methodology for determining error rates and the checks made by DG REGIO on the reliability of those error rates.

· The checks made by DG REGIO in order to place reliance on AAs and their Annual Control Reports (ACR), based on a sample of files and by accompanying DG REGIO auditors during audit missions to MS.

· Follow up of the actions resulting from the Commission working paper on the analysis of errors on Cohesion Policy and from other action plans.

· Preventive, detective and corrective measures to tackle the problem of high error rates.

· Through file examination, analysis of the key decision processes basis for making/lifting reservations, interruptions, suspensions and financial corrections.

· Analysis of the DG process for addressing the high risk OPs, including accompanying DG REGIO auditors in a sample of Bridging the Gap missions to MS.

There were no scope limitations.

The fieldwork was finalised in mid-November 2012. All observations and recommendations relate to the situation as of that date.

DG's AAR: The following reservation was made in the 2011 AAR concerning specifically the area/process covered by the scope of this engagement:

· "Reservation concerning the ERDF/Cohesion Fund management and control systems for the period 2007-2013:

o Significant issues regarding the effective functioning of management and control systems in the following Member States: Austria, Bulgaria, Czech Republic, Estonia, France Germany, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovenia, Slovakia, Spain, United Kingdom and Territorial Cooperation programmes.

o Compliance assessment not yet approved: one Italian programme

o Reputational risks for Greece, Hungary, Romania."

The total number of OPs in reservation for the ERDF/CF is 146 of which, 93 are in reservation for the entire programme, 28 for only part of the programme, and 25 are in reservation for reputational risks.

Risks and audit recommendations

The following high risks that may impact on the achievement of the business objectives for the process audited were identified:

· Reliability of Audit Authority error rates (Report Finding 1: Risk rating – High): The IAS recognises the high inherent risk of a process in which DG REGIO depends heavily on the work of the AAs. Reliable AA error rates are key to the assurance building process and the IAS notes the progress made. However, problems experienced by AAs in interpreting the guidance on sampling means there is a risk that error rates may be understated. DG REGIO recognises this and, together with the other SFs DGs, is currently finalising revised guidance aimed at addressing the gaps noted. DG REGIO should complete this process as soon as possible and follow up with AAs to ensure that the guidance is properly understood and implemented in practice.

Concerning the DG's checks on the reliability of AA error rates, the complex and time -consuming nature of this work means there is a risk that mistakes may not be identified and corrected and/or key information is not taken into account when concluding on reliability. DG REGIO should amend its checklist for reviewing the AA ACR, taking also into account the on-going clarifications on guidance, to ensure that auditors conclude in their checklist on the potential impact of their review on the overall assessment of the AA error rate.

· Detective measures to reduce error rates (Report Finding 2: Risk rating – High): Given the high inherent risks of the shared management system whereby the DG is so dependent on the work of AAs, it is essential that it undertakes its own very robust detective checks on the spot in the MS. Notwithstanding the need for a risk based approach, the variations in the depth and extent of DG REGIO audit testing noted by the IAS, in particular for on-the-spot work at final beneficiaries and checks made on original documents, means there is a risk that system weakness and/or errors and irregularities may not be detected. DG REGIO should ensure more consistency of approach for the same audit enquiry type through further instruction/guidance on the extent of testing to be carried out on-the-spot. It should explain more clearly in its Audit Strategy that the scope of on-the-spot work can vary considerably between the audit teams, depending on programmes and ensure that appropriate checklists are used on missions. Their completion should be clearly evidenced for management/quality review and tailor-made checklists used for each mission which involves the follow up of an action plan, including the specific corrective measures set out in the interruption/pre-suspension letter.

2.4. Research, energy and transport

(EACI, ERCEA, DG CNECT, JRC, REA, DG RTD, TEN T-EA, DG MOVE, DG ENER)

2.4.1. Control Strategy in DG ENER

Background

The IAS audit on The Control Strategy in DG Energy (DG ENER) was included in the IAS coordinated 2011 Audit Work Programme. This followed the audit risk assessment carried out in 2010. The relative importance of the budget of DG ENER (174 million EURO commitments in 2011) and the error rate (4,4% for the 6th Research Framework Programme in 2010) which affects the ECA DAS, justified its inclusion in the IAS' Strategic Audit Plan for 2011-2012.

Audit Objectives

The objective of the audit was to assess the adequacy and effective application of the internal control system (ICS), risk management and governance processes related to the Control Strategy in DG ENER.

In particular, the audit assessed whether the ICS provides reasonable assurance regarding compliance with the relevant legislation, the reliability of financial and management information and the effectiveness and efficiency of the processes mentioned in the scope below.

Audit Scope

As a result of the desk review and the interviews carried out during the Preliminary Survey (which took into account the work already performed by the IAS, the SIAC and the Financial Audit Unit SRD.5 in DG ENER and by the Court of Auditors), the scope of this audit focussed on the following processes:

· Ex-ante financial controls in the following sub-processes of DG ENER: commitments, payments (prefinancing – interim payments – final payments), recoveries and decommitments.

· Ex-post controls (external, financial audit).

The part of the budget sub-delegated to the Executive Agency for Competition and Innovation (EACI) is excluded from the scope of this audit because it is covered by other audits[23].

Observations/reservations made in the 2011 AAR of DG ENER concerning the processes under the scope of this audit:

· Reservation concerning the rate of residual errors with regard to the accuracy of cost claims in Sixth Framework Programme (FP6) contracts. The residual error rate observed by ex-post controls was 4,44%, which is higher than the control objective (2%).

· Reservation concerning the rate of residual errors with regard to the accuracy of cost claims in Seventh Framework Programme (FP7) contracts. The residual error rate detected by ex-post controls is higher than the control objective (2%). As the limited number of random FP7 audits was insufficient to give a representative indication of the likely trend in its FP7 error rate, DG ENER considers 4,5% (i.e. the average of the DG RTD and DG INFSO error rates) as the best estimate of its likely error rate.

During the audit, no scope limitations were identified.

The fieldwork was finalised on 24 February 2012. All observations and recommendations relate to the situation as at that date and do not consider improvements introduced since then.

Risk and audit recommendation

The following high risks that may impact the achievement of the business objectives for the processes audited were identified:

· 3220- Completeness and consistency of audit working papers – Risk rating high: Ex-post audits that are not properly documented, reviewed and filed may affect the control efficiency and might lead to non-compliance with the International Audit Standards. The risk of fraud is not sufficiently mitigated.

The IAS recommends DG ENER to improve the audit files by using standardised audit programmes and working papers, by cross-referencing information on the working papers with the underlying evidence and the audit issues in the audit report and by documenting their review and approval. Checks should also address fraud prevention and detection.

2.5. External Aid, development and enlargement

(DG DEVCO, DG ECHO, DG ELARG, FPI)

2.5.1. Set-up of internal organisation in EU delegations (DG DEVCO) - Limited Review

Background

The creation of the European External Action service (EEAS), along with the adaptation of the relevant legal provisions, has required the set-up of a number of new structures and processes, involving both Headquarters and Delegations, while at the same time ensuring the implementation of the main operations related to external aid. Delegations, in particular, play a crucial role in implementing both the Commission's operational budget and the EEAS's administrative budget[24]. The setting up of adequate financial circuits is a key element to ensure financial and operational accountability and an effective implementation of a sound financial management system. This exposes DG DEVCO to a high level of residual risk in this area.

As a result, the IAS undertook a limited review on the set-up of the internal organisation in EU Delegations following the creation of the European External Action Service (EEAS). The related report deals exclusively with the issues identified in the management of the operational budget of the Commission. A separate report was addressed to the EEAS concerning issues related to the administrative budget and those of a cross-cutting nature.

Due to the constantly changing environment following the creation of the EEAS (e.g. revised financial circuits in place after the end of the limited review fieldwork) or the implementation of a revised internal control architecture in the Delegations (e.g. revamped External Assistance Management Reports, declaration of assurance from Heads of Delegation), the effective implementation of these revised arrangements will be the subject of a future audit once the controls have been embedded in DG DEVCO and the Delegations.

Objectives and Scope

The general objective of this engagement was to assess the procedures put in place between the European Commission and the EEAS to ensure the sound financial management of the external aid budget implemented through EU Delegations.

The detailed objectives were as follows:

· To assess the organisational arrangements and functioning of financial circuits, including sub-delegations and deputising arrangements.

· To assess the support provided by DG DEVCO (HQ) to EU Delegations, i.e. in defining internal management and control systems in Delegations, the provision of specific training to newly appointed Heads of Delegation addressing in particular their duties, obligations and accountability towards the Commission.

· To assess the role of Heads of Delegation (and Deputy Heads of Delegation, where applicable) to ensure the set up and functioning of an adequate internal management and controls system and for the management of funds and operations within their Delegations.

· To assess the reporting mechanisms from EU Delegations to provide assurance to DG DEVCO’s Authorising Officers by Delegation (AOD), i.e. completeness, quality, timeliness, etc.

· To assess the procedures put in place by the Appointing Authority to ensure that the rotation exercise does not have a negative impact on the implementation of the external aid budget.

Main risks and recommendations

In addition to the setting up of new structures and processes following the creation of the EEAS, DG DEVCO launched a major revision of its internal control architecture (Control Pyramid strategy) in 2010. One of the expected benefits is better accountability through improved reporting systems. This initiative has resulted in a number of specific actions including a new web-based reporting tool (External Assistance Management Reports) for Delegations. As from 2012, Heads of Delegation have also been required to provide a declaration of assurance and hence need to cooperate closely with the Commission for the proper implementation of the funds in order to ensure, in particular, the legality and regularity of financial transactions, the respect of the principle of sound financial management of the funds and the effective protection of the financial interests of the union.

One high risk was identified and a corresponding recommendation was made:

Role of Deputy Head of Delegation

· Risk: A cross-cutting inter-institutional governance issue identified in an audit report of the IAC of DG ELARG concerns the current role of Deputy Heads of Delegation. The post of Deputy Head of Delegation was created in the enlargement EU Delegations to help the Head of Delegation in the management of financial assistance. These officials were selected due their knowledge and experience in financial assistance at the Commission. As of 1 Januar