EUROPEAN COMMISSION Brussels, 7.6.2022 SWD(2022) 160 final COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS



Annual report to the Discharge Authority on internal audits carried out in 2021 {COM(2022) 292 final}



Table of contents Table of contents Content of the staff working document Part 1 Final reports 1. Horizontal audits 2. Agriculture, natural resources and health 3. Cohesion 4. Research, energy and transport 5. External actions 6. Education and citizenship 7. Economic and financial affairs 8. General services 9. Information technology audits Part 2 - FOLLOW-UP ENGAGEMENTS (SUMMARISED) List of audits for which all recommendations have been closed in 2021 after a follow-up audit Part 3: summary of long-outstanding recommendations – state of play as at 31 January 2022 List of abbreviations

CHAFEA: Consumers, Health; Agriculture and Food Executive Agency CINEA: European Climate, Infrastructure and Environment Executive Agency (former INEA – Innovation and Networks Executive Agency) DG AGRI: Directorate-General for Agriculture and Rural Development DG BUDG: Directorate-General for Budget DG CLIMA: Directorate-General for Climate Action DG CNECT: Directorate-General for Communications Networks, Content and Technology DG COMM: Directorate-General for Communication DG COMP: Directorate-General for Competition DG DEFIS: Directorate-General for Defence Industry and Space

DG DEVCO: Directorate-General for International Cooperation and Development DG DIGIT: Directorate-General for Informatics DG EAC: Directorate-General for Education, Youth, Sport and Culture DG ECFIN: Directorate-General for Economic and Financial Affairs DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion DG ENER: Directorate-General for Energy DG ENV: Directorate-General for Environment DG ESTAT: Eurostat DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union DG GROW: Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs DG HOME: Directorate-General for Migration and Home Affairs

DG HR: Directorate-General for Human Resources and Security DG INTPA: Directorate-General for International Partnerships (former DG DEVCO) DG JUST: Directorate-General for Justice and Consumers DG MARE: Directorate-General for Maritime Affairs and Fisheries DG MOVE: Directorate-General for Mobility and Transport DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations DG REFORM: Directorate-General for Reform (former SRSS DG REGIO: Directorate-General for Regional and Urban Policy DG RTD: Directorate-General for Research and Innovation DG SANTE: Directorate-General for Health and Food Safety DG SCIC: Directorate-General for Interpretation DGT: Directorate-General for Translation DG TAXUD: Directorate-General for Taxation and Customs Union DG TRADE: Directorate-General for Trade EACEA: European Education and Culture Executive Agency (former Education, Audiovisual and Culture Executive Agency) ECHA: European Chemicals Agency EEA: European Environment Agency EISMEA: European Innovation Council and small and medium-sized enterprises (SMEs) Executive Agency EPPO: European Public Prosecution Office

EPSO: European Personnel Selection Office ERCEA: European Research Council Executive Agency F4E: Joint Undertaking for ITER and the Development of Fusion for Energy (F4E) FPI: Service for Foreign Policy Instruments FRONTEX: European Border and Coast Guard Agency IAS: Internal Audit Service IDEA: Inspire, Debate, Engage, and Accelerate Action JRC: Joint Research Centre OIB: Office for Infrastructure and Logistics in Brussels OIL: Office for Infrastructure and Logistics in Luxembourg OLAF: European Anti-Fraud Office OP: Publications Office of the European Union PMO: Office for the Administration and Payment of Individual Entitlements REA: European Research Executive Agency SG: Secretariat-General SG.RECOVER: Secretariat-General Recovery SJ: Legal Service Content of the staff working document Part 1 of this document contains:

a summary of the internal audit engagements performed as part of the 2021 Internal Audit Service (IAS) audit plan (reports issued between 1 February 2021 and 31 January 2022); and the principal recommendations (critical and very important ) made. The information contained in this document reflects the state of play when the audit engagements were finalised. Each audit followed the applicable standard professional validation and contradictory procedures between auditor and auditee at the time of the finalisation of the engagement. The enclosed summary of each engagement aims to provide an overview of the audits and their main results. Additional, up-to-date information is provided in specific sections by the auditees on measures drawn up and already implemented after the internal audit engagements were finalised. Part 2 of this document contains a summary of the results of the IAS follow-up engagements performed between 1 February 2021 and 31 January 2022 . Part 3 provides a summarised overview of the eight long overdue very important recommendations as at 31 January 2022.



Part 1 Final reports 1.Horizontal audits 2.Audit on the implementation of audit results in Horizon 2020 (CINEA, DG CNECT, EISMEA, ERCEA, REA, DG RTD) The objective of the audit was to assess if the internal control system set up for the process for implementing H2020 Common Audit Service and European Court of Auditors audit results, H2020 audit results extensions and financial recommendations from OLAF investigations in the research family is adequately designed and effectively implemented in compliance with the applicable rules. There are no observations/reservations in the 2020 Annual Activity Reports of the Directorates-General and Executive Agencies involved that relate to the processes audited. . The fieldwork was finalised on 24 November 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the following strengths/good practices in relation to the implementation of Common Audit Service audit results: ·The process for the implementation of the Common Audit Service audit results and extensions is overall well designed. ·The roles and responsibilities related to the implementation of the Common Audit Service H2020 audits results and extensions in the H2020 implementing entities are clearly defined. ·The project officers and the financial officers are provided with the necessary tools to implement the Common Audit Service audit results effectively. In particular: –central guidance (eGrants Vademecum) has been developed by the Common Implementation Centre which details the checks to be made for the implementation of the Common Audit Service audits results, i.e. clear description of the checks and steps that need to be performed, centrally developed templates to be used by the project officers and financial officers;

–the implementation of Common Audit Service audit results (including extensions) is supported by a specifically developed electronic workflow (‘AURI’) in the COMPASS IT system. The IAS identified three very important issues at corporate family level (Common Implementation Centre - DG RTD) concerning: (1) monitoring of the implementation of Common Audit Service audit results and extensions; (2) reporting on the implementation of Common Audit Service and European Court of Auditors audit results and extensions; (3) implementation of the results of the non-joint European Court of Auditors audits; and one very important issue at the level of the implementing bodies (CINEA): implementation of Common Audit Service audit results and extensions and formulated four very important recommendations: Monitoring of the implementation of Common Audit Service audit results and extensions (One very important recommendation addressed to the Common Implementation Centre - DG RTD) The Common Implementation Centre should define the guidance and methodology for the monitoring of the implementation of audit results including adopting a set of common targets and indicators. It should also improve the content and the quality of the COMPASS AURI report, in order to provide a reliable supporting tool/monitoring instrument for Directorates-General/Executive Agencies. Reporting on the implementation of Common Audit Service and European Court of Auditors audit results and extensions (One very important recommendation addressed to the Common Implementation Centre - DG RTD) The Common Implementation Centre should develop a common approach on how the implementing bodies should report on the implementation of H2020 audit results and audit extensions in their Annual Activity Report, to ensure consistency and comparability/consolidating of data in the Research family. Implementation of the results of non-joint European Court of Auditors audits (One very important recommendation addressed to the Common Implementation Centre - DG RTD) The Common Implementation Centre should develop a central guidance for the implementation of the European Court of Auditors non-joint audit results and define a common approach for the use of the information technology system for European Court of Auditors non-joint audits Implementation of Common Audit Service audit results and extensions of audit results (One very important recommendation addressed to CINEA) CINEA should implement measures (such as participation of staff in trainings or workshops, organised by the Common Implementation Centre) to raise the financial officer’s awareness of the applicable H2020 guidance (e-grants Vademecum) on the process of completion of the calculation sheets, the implementation of recovery orders, and the process related to deviations. Additional information provided by CINEA and DG RTD on the measures defined and/or implemented following the Internal Audit Service audit The action plan addressing the recommendations of the implementation of audit results was sent to the IAS on 24 February 2022. According to DG RTD’s corporate action plan the implementation of the following actions will be completed until the end of 2022. For recommendation n°2, the actions are: (1) to consult the members of the Research & Innovation Network of Ex ante Control practitioners (RINEC) and research and innovation audit network (RIAN) groups to analyse the targets and indicators used by the different implementing services to monitor the implementation of audit results; (2) to agree with the stakeholders on the best targets and indicators to monitor the implementation of audit results; and finally (3) to draft guidance setting common targets and indicators for the monitoring of implementation of audit results. The Common Implementation Centre will assess if and how the COMPASS AURI report can be improved to serve as a reliable supporting/monitoring instrument for the implementing services. For recommendation n°3, the Common Implementation Centre will coordinate with the different implementing services and define a common approach to be endorsed by the Common Implementation Centre Governance on what data should be reported on the implementation of H2020 audit results/audit extensions in their annual activity report. For recommendation n°4, a new feature in the corporate database for the external audit data (AUDEX) allowing the encoding of results on these non-joint ECA audits is currently under development. This new feature was presented in the RIAN meeting in October 2021 and the group unanimously welcomed it. Once the new feature is available in AUDEX, the AURI workflow will be used to implement the results of non-joint ECA audits the same way as that of any other audits. CINEA developed an action plan, which outlines two main actions to be implemented by the end of 2022 to ensure that all financial officers have the adequate knowledge. The actions are related to the tutoring of newcomers and the participation to relevant trainings. 3.Audit on relations with decentralised agencies: European Environment Agency (EEA) and European Chemicals Agency (ECHA) (DG CLIMA, DG ENV) The objective of the audit was to assess whether DG ENV and DG CLIMA have put in place adequate internal control systems to ensure that relations with their main decentralised agencies (EEA and ECHA) are managed effectively and efficiently and in accordance with the applicable legislation and corporate guidance. There are no observations/reservations in the 2020 Annual Activity Report of DG ENV and DG CLIMA that relate to the area/process audited. The fieldwork was finalised on 30 June 2021. All observations and recommendations relate to the situation as of that date.

The IAS recognised the in-depth knowledge, experience and strong commitment of staff of DG ENV and DG CLIMA in their day-to-day relations with the EEA and the ECHA and the (longstanding and) good working relationships that have been established over time. The IAS identified two very important issues concerning: (1) DG ENV supervision and coordination mechanisms with the EEA; and (2) the oversight role of both DGs CLIMA and ENV on the EEA’s resources, and formulated three very important recommendations: DG ENV supervision and coordination mechanisms with the EEA (One very important recommendation addressed to DG ENV) DG ENV should establish a process including a written description to monitor the progress of activities that DG ENV requests to the EEA, establish a supervision strategy vis-à-vis the EEA with key elements and initiate discussion with Central services to find ways to strengthen the coordination with other DGs requesting activities to the EEA. Oversight role of both DGs CLIMA and ENV on the EEA’s resources (Two very important recommendations addressed to DG CLIMA and DG ENV) DG ENV and DG CLIMA should enhance controls and guidance for the preparation of the financial fiches, strengthen the coordination with other Commission services and clarify roles and responsibilities for shared projects at the planning stage, including to the extent possible the financing sources to ensure optimal financing practices. Additional information provided by DG CLIMA and DG ENV on the measures defined and/or implemented following the Internal Audit Service audit DG CLIMA and DG ENV have coordinated an action plan, to be implemented by the end of 2022. It notably aims at enhancing controls on the ‘financial fiches’ requesting resources for the EEA, strengthening the structured dialogues between DG ENV, DG CLIMA and the EEA, better coordinating EEA activities with other Commission services, and preparing guidance on the financing of non-core activities. Work on the implementation of these recommendations has started. In particular, a ‘structured dialogue’ has been established between DG ENV, DG CLIMA and the EEA with Senior Management meetings twice a year to discuss strategic priorities in terms of the EEA support, in a context of increasing demands and limited resources. An ‘Intergroup’ (DG ENV – CLIMA – EEA) has been created for implementing such a strategy. In addition, a permanent Inter-Service Group (ISG) has been established to strengthen the coordination with other DGs regarding EEA activities. In the context of the European Green Deal, more and more DGs request support and have agreements with the EEA (in total, 12 ongoing or foreseen agreements between EEA and other Commission services have been identified). The ISG will also be consulted for the evaluation of the EEA and for drafting the Commission Opinion on the agency Programming Documents. 4.Limited review on the error rate calculation (DG DEFIS, DG GROW) The objective of the limited review was to check the correctness of the calculation of the error rates by DG DEFIS and DG GROW and of the disclosure in their Annual Activity Reports. The IAS did not formulate any critical or very important recommendations. 5.Audit on crisis communication (DG COMM, DG ECHO, DG SANTE, SG) The objective of the audit was to assess whether the Commission has put in place an adequate internal control system that is effective and efficient for communication during a crisis. There was no observation/reservation in the 2020 Annual Activity Reports of DG COMM, DG ECHO, DG SANTE and SG on crisis communication that relate to the area/process audited. The fieldwork was finalised on 22 July 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the commitment of the Commission’s communication community at large, which was visible during the multi-sectoral COVID-19 pandemic crisis when they managed extra tasks under high workload and tight deadlines, while at the same time adapting to novel working conditions. The IAS did not formulate any critical or very important recommendations. 6.Audit on delegations and efficiency of decision making in the European Joint Undertaking for ITER and the Development of Fusion for Energy and cooperation mechanisms with DG ENER (DG ENER)

The objective of the audit was to assess the adequacy of the design and the effective implementation of F4E’s internal control processes for financial circuits and financial delegations and deputising arrangements for its key operational processes. Furthermore, the audit assessed DG ENER’s and F4E’s cooperation and supervision mechanisms. The fieldwork was finalised on 30 September 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the DG ENER’s efforts to supervise Fusion for Energy (F4E). In particular: ·The supervision of F4E is carried out at the highest management level. Regular meetings are held between the Deputy Director-General and the Director of F4E. ·The current supervision strategy for F4E provides a division of tasks between responsible units and a timeline for the main annual supervision activities (thus going beyond the guidance template provided by the Secretariat-General of the Commission). The IAS did not address any critical or very important recommendations to DG ENER. 7.Audit on interruptions, suspensions and financial corrections for the European Structural and Investment Funds 2014-2020 (DG EMPL, DG MARE, DG REGIO) The objective of the audit was to assess the adequacy of the design and the effective implementation of: (1) preventive measures: interruptions and suspensions mechanisms; and (2) corrective measures: financial correction processes applied by DG REGIO, DG EMPL and DG MARE to protect the EU budget. As regards reporting in the Annual Activity Reports, reservations were made by DG REGIO, DG EMPL and DG MARE for deficiencies in the management and control systems of a number of operational programmes which affect the legality and regularity of the payments concerned. The fieldwork was finalised on 31 October 2021. All observations and recommendations relate to the situation as of that date. The IAS identified a number of good practices that the Directorates-General apply in their management of the interruptions, suspensions and financial corrections processes: ·The dedicated SharePoint site for the Interruptions, suspensions and financial corrections committee in DG REGIO, the presentation of the committee’s proceedings, the library of the supporting documents and the monitoring tables available for both preventive and corrective measures facilitate an easy access to all relevant information on the decisions made and the status of specific cases. ·The DG REGIO Wiki tool, an online library of the procedures, guidelines and explanatory materials available for all users, is a best practice. ·During our testing we noted cases of very good cooperation and coordination of actions between desk officers and auditors, both inside and across Directorates-General, especially in the context of strict legal deadlines that are applicable to preventive measures. ·The creation of the joint audit directorate is a catalyst for harmonising and streamlining the internal procedures for applying preventive and corrective measures and the role of the audit units. The IAS identified three very important issues concerning: (1) preventive measures - key criteria for preventive measures; (2) preventive measures - warning letters and (3) corrective measures - financial corrections, and formulated eight very important recommendations: Preventive measures - key criteria for preventive measures (Two very important recommendations addressed to DG EMPL, DG REGIO) For the 2014-2020 programming period, DG REGIO and DG EMPL should ensure that the use of the 10% threshold to interrupt payments is clearly explained in the related guidance, as well as how this links to the acceptance of accounts process and subsequent financial corrections, both in terms of the underlying rationale and the choice of this particular threshold level. In this context, the Directorates-General should assess the need to revise the criteria for deciding on interruptions as part of a proactive response from the Commission to protect the budget and include an analysis in their Annual Activity Reports of the resulting impact on persistently high error rates. For the 2021-2027 programming period, DG REGIO and DG EMPL should re-assess and explain clearly in the related guidance the underlying rationale for interrupting payments taking into account different thresholds for retention of interim payments (5% instead of 10%) under the 2021-2027 period and include an analysis in their Annual Activity Reports on the possible impact on persistently high error rates. Preventive measures - warning letters (Three very important recommendations addressed to DG EMPL, DG REGIO)

DG REGIO and DG EMPL should evaluate the effectiveness of warning letters sent in case a payment request was received (i.e. warning letters for corrective measures), manage more rigorously the process of issuing and following-up on warning letters and include an analysis in their Annual Activity Reports of the resulting impact on persistently high error rates. DG EMPL should set deadlines for initiating the internal process by geographical units for deciding on warning letters. Corrective measures - financial corrections (Three very important recommendations addressed to DG EMPL, DG MARE, DG REGIO) DG REGIO, DG EMPL and DG MARE should update their guidance and operational procedures on financial corrections to set internal deadlines for the key steps of the financial corrections process. The guidance should be updated to take into account all relevant Legal Service opinions, including on net financial corrections. The Directorates-General should use a simple document (e.g. a checklist, flow chart) listing all requirements for pursuing net financial corrections and thereby document whether these conditions were met for each potential case. Finally, the Directorates-General should provide a clearer explanation in their respective Annual Activity Reports as regards the legal constraints in applying net financial corrections, link this clearly to the fact that no such corrections have been applied in practice for the 2014-2020 programming period, and analyse the impact on the Commission’s corrective capacity. Additional information provided by DG REGIO, DG EMPL and DG MARE on the measures defined and/or implemented following the Internal Audit Service audit DG REGIO and DG EMPL will update the guidance note on interruptions and clearly explain in a guidance note the use and impact of the 10% threshold to interrupt payments, its link with the acceptance of accounts exercise and with the subsequent potential financial correction procedure. The criteria for deciding on interruptions will also be reviewed in the light of persisting material levels of error reported by the ECA for the cohesion area. An evaluation of the effectiveness of warning letters for corrective measures will be made. The financial corrections manual will be updated. In the AAR 2021 a more comprehensive explanation on the net financial corrections instrument is presented highlighting legal constraints and challenges in the application and the impact on the Commission’s corrective capacity. DG MARE will update its financial corrections manual, and ensure consistency with those issued by DG REGIO and DG EMPL. 8.Audit on the preparation for the 2021-2027 programming period (DG EMPL, DG MARE, DG REGIO) The objective of the audit was to assess whether DG REGIO, DG EMPL and DG MARE had designed and implemented effective processes to support the start of the 2021-2027 programming period. As the legislation for the 2021-2027 period was formally adopted in 2021, in their 2020 Annual Activity Reports, DG REGIO, DG EMPL and DG MARE did not issue a reservation specifically on the 2021-2027 programming period. The fieldwork was finalised on 24 November 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by DG REGIO, DG EMPL and DG MARE to effectively prepare for the 2021-2027 programming period. The IAS identified the following strengths and good practices in this area: ·DG REGIO’s 2021-2027 Programming Negotiations Progress Reports: regular reports are prepared for the attention of the Board of Directors outlining the overall progress in the negotiations and the main issues arising during the latter to be flagged. The content of the report has evolved over time and is now very comprehensive covering different areas and topics relevant during the programming process. Launch of the 2021-2027 programming period: based on the experience of the previous programming period, the 2021-2027 negotiations’ process was launched on time in 2019 and subsequent coordination arrangements were decided and put in place by DG REGIO. ·Coordination arrangements: the IAS welcomed the initiative of DG REGIO: (1) to engage the Common Provisions Regulation Directorates-General (and the SG country team leaders) in the discussions with Member States on partnership agreement level information; (2) to organise coordination arrangements between Directorates-General timely and early in the process of the programming period; (3) to seek cooperation with other Directorates-General and services not part of the Common Provision Regulation family, e.g. DG AGRI, DG ENV. ·Stock Taking Group: the Stock Taking Group is an important tool for cooperation between the Commission services for the phases of informal and formal dialogue with Member States. This includes discussion on common issues, deciding on the most appropriate solutions for the participating Directorates-General, information sharing as regards on-going initiatives on joint planning. All Common Provisions Regulation Directorates-General (DG REGIO, DG EMPL, DG MARE and DG HOME) participate actively and regularly in the Group’s meetings and the Directorates-General have made efforts to incorporate DG HOME, which became part of the Common Provisions Regulation family only as from the 2021-2027 programming period. The IAS identified two very important issues concerning: (1) support to Member States in the preparation of the 2021-2027 programming period (deficiencies in procedures to provide guidance for Member States); and (2) timing of the preparation and operational start of the 2021-2027 programming period (delays in launching IT system and frequency of internal reporting) and formulated seven very important recommendations: Support to Member States in the preparation of the 2021-2027 programming period (Two very important recommendation addressed to DG REGIO) DG REGIO should: ·Establish a clear procedure for issuing ‘non-guidance documents’ (including the identification of the process owner, the purpose and scope of these documents, the procedure for preparation, consultation and adoption of such documents) and implement this procedure consistently.

·Make all guidance and non-guidance documents addressed to Member State authorities responsible for programming, implementation and audit available in a common repository. DG REGIO should make all internal guidance and non-guidance documents related to the Common Provision Regulation accessible to all Common Provision Regulation Directorates-General desk officers in a common repository (i.e. REGIO Wiki). Timing of the preparation and operational start of the 2021-2027 programming period (Five very important recommendations addressed to DG EMPL, DG MARE, DG REGIO) DG REGIO, DG EMPL and DG MARE should: ·Improve the communication and coordination between the structural funds common database team (SFC) and the Common Provisions Regulation Directorates-General to identify elements where a common approach is needed in SFC 2021 (in particular for future development of SFC 2021 modules, such as payments to programmes or the reporting obligations). ·Ensure the participation of all Common Provisions Regulation Directorates-General in the development and finalisation of the checklist for the assessment of the horizontal enabling condition on the Charter of Fundamental Rights. ·Improve their internal reporting system to senior management. DG REGIO should finalise and upload the Interreg checklist for programmes assessment and upload in Wiki (and later on, when filled in, in MyWorkplace). DG EMPL should develop a financial checklist to support the relevant units in their checks while the validations rules in SFC 2021 are not yet fully operative. Additional information provided by DG REGIO, DG EMPL and DG MARE on the measures defined and/or implemented following the Internal Audit Service audit DG EMPL agreed on an action plan with the IAS. All important recommendations have been implemented, including improvement of communication and coordination between the SFC Team and the Common Provision Regulation DGs as well as of the internal reporting system to the senior management, and the production of financial checklists. The important recommendation concerning clear procedures for “non guidance documents” will be implemented in accordance with the time limits (end June 2022) as indicated in the action plan. DG MARE has implemented the actions related to the most important recommendations, notably the improvement of communication and coordination between the SFC Team and the Common Provisions Regulation DGs as well as the internal reporting system to the senior management, and the production of financial checklists. DG REGIO is preparing a clear procedure for issuing (non-) guidance documents and creating a common repository of documents on the REGIO Wiki extranet accessible for the national authorities implementing the policy. In addition, REGIO further improved the communication and coordination between SFC Team and Common Provisions Regulation DGs and increased reporting frequency to senior management, including on country specific issues. 9.Audit on governance, stakeholder management and external communication in the European Border and Coast Guard Agency comprising where relevant DG HOME The objective of the audit was to assess the adequacy of the design and the effective implementation of the governance structure and arrangements in Frontex, and DG HOME’s oversight role and responsibilities as concerns Frontex. The 2020 Annual Activity Report of DG HOME (2.1.5 Declaration of Assurance and reservations) comprises the following reservation, which relates to the areas and processes audited: ‘Reservation on reputational grounds related to weaknesses identified in the effective implementation of Frontex’s new mandate in accordance with good governance and the requirements of the European Border and Coast Guard Regulation.’ The fieldwork was finalised on 16 November 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts of DG HOME to improve its oversight controls in Frontex. In particular, the IAS noted the following strengths:

Frontex Support Group Meetings – In May 2021, DG HOME put in place a new process aimed at ensuring internal coordination between the different units dealing with Frontex-related topics. Held every two weeks, the Frontex Support Group Meetings enable DG HOME staff to discuss those topics in an efficient manner by, for example: (1) providing updates on the state of play, with Directorate B briefing other directorates about relevant information, e.g. following Frontex’s management board meetings; (2) discussing current priorities with regard to the Agency; and (3) proving inputs to letters received from Frontex and discussing the corresponding replies. The IAS did not formulate any critical or very important recommendations. 10.Agriculture, natural resources and health 11.Audit on support, monitoring and checks of the work of Certification Bodies (DG AGRI) The objective of the audit was to assess whether the measures taken by DG AGRI to support, monitor and check the work of Certification Bodies are adequately designed and effectively implemented to allow it to draw the necessary assurances from their work. There were no observations/reservations in the 2019 Annual Activity Report of DG AGRI that relate to the area/process audited. The fieldwork was finalised on 26 February 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the ongoing efforts made by DG AGRI to improve the implementation of the measures taken to support, monitor and check the work of Certification Bodies. In particular, the audit identified the following strengths: ·Enhanced coordination within Directorate H vis-à-vis Certification Body audit activities. DG AGRI.H has enhanced coordination between audit units as regards audit activities on Certification Bodies (e.g. through the creation of the peer review group or specific trainings provided by AGRI.H.5 to other Directorate H audit units). ·DG AGRI has incorporated the Certification Body risk in its central risk analysis. In 2019, DG AGRI reviewed its central risk analysis to include an additional risk factor linked to the risk of ‘insufficient or inadequate audit work by the Certification Body’. This new risk factor was used for the first time in the 2020-2023 multi-annual work programme and reflects the extended role given to the Certification Bodies by the 2013 horizontal regulation. The IAS did not formulate any critical or very important recommendations. 12.Audit on monitoring and supervision arrangements regarding land parcel identification system in Member States (DG AGRI) The objective of the audit was to assess the adequate design and effective implementation of the controls put in place by DG AGRI to support the management of Member States land parcel identification systems and to monitor their quality. There are no reservations in the 2020 Annual Activity Report of DG AGRI that relate to the land parcel identification system (LPIS) quality assessment (QA) process audited. The fieldwork was finalised on 3 August 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged a number of strengths: ·The commitment, dedication and highly technical expertise of the staff within AGRI.D3 (unit AGRI.C1 since 16 January 2022) involved in the land parcel identification system quality assessment exercise. ·The efforts made by AGRI.D3 (unit AGRI.C1 since 16 January 2022), in cooperation with the JRC, to provide highly detailed and technical guidance to the Member States via the WikiCAP website. The IAS identified one very important issue concerning the monitoring and follow-up of the land parcel identification system quality assurance exercise and formulated one very important recommendation: Regular analyses of the land parcel identification system quality assurance exercise

DG AGRI should, on an annual basis, perform a global analysis of the outcome of the land parcel identification system quality assurance exercise and report on it to internal and external stakeholders. Moreover, in order to improve the monitoring of the land parcel identification system quality assurance, DG AGRI should perform a regular qualitative in-depth analysis of the assessment reports (in cooperation with other relevant services), an annual assessment of the remedial action plans based on agreed criteria and put in place working arrangements to systematically follow up identified remedial actions. Finally, DG AGRI should set up regular dedicated internal meetings and reporting arrangements regarding the land parcel identification system quality assurance exercise. DG AGRI should also improve communication and coordination between AGRI.D3 (unit AGRI.C1 since 16 January 2022) and AGRI.H3 to increase efficiency and synergies, whilst respecting the specific roles and mission of the two units. Additional information provided by DG AGRI on the measures defined and/or implemented following the Internal Audit Service audit DG AGRI accepted the recommendation and submitted an action plan that was assessed as satisfactory to mitigate the risks identified by the IAS. The recommendation is due for 30 June 2022. DG AGRI committed to implement the following actions for the very important recommendation: 13.Develop a template for an “annual state of play note of the land parcel identification system (LPIS) quality assessment (QA)” for AGRI hierarchy and relevant units. A summary of this note will be shared with Member States at the nearest Committee meeting. 14.a) In cooperation with other relevant services, e.g. the JRC, DG AGRI will develop and describe the methodology of a more in-depth analysis of LPIS QA reports. This analysis will be done every 3 years. The most recent results of this exercise will feed in and be summarised in the “annual state of play note of LPIS QA”. b) perform regular in-depth qualitative analyses of the assessment reports (ARs) in cooperation with other relevant services (e.g. JRC), an annual assessment of the remedial action plans (RAPs) based on agreed criteria and put in place working arrangements to systematically follow up identified remedial actions. DG AGRI has already implemented two actions, still to be confirmed by the IAS: 15.DG AGRI developed a template for the annual state of play of LPIS QA. 16.b) DG AGRI prepared three documents: a documentation on the criteria used for the evaluation of the remedial action plans and criteria for follow-up; a template for the evaluation of the remedial action plans and a template for reporting on the status of the remedial action that will serve for the annual state of play of LPIS QA reports. 17.Cohesion 18.Audit on processes put in place for the delivery of technical support to Member States (DG REFORM) The objective of the audit was to assess the adequacy of the design and effective implementation of DG REFORM’s processes and controls for delivering technical support projects carried out under the Structural Reform Support Programme. Reservations were raised in the 2017-2020 Annual Activity Reports on the rate of the residual error that was calculated under direct grant management – in the 2020 Annual Activity Reports, the reservations concerned grant agreements signed with non-pillar assessed beneficiaries under the technical support funds (European Structural and Investment Funds and Structural Reform Support Programme) for which the legality and regularity-related criterion of 2% was breached. It is to be noted that the reservation was lifted in the 2021 Annual Activity Report in application of the “de minimis” rule. The fieldwork was finalised on 21 October 2021. All observations and recommendations relate to the situation as at that date. The IAS recognised the ongoing efforts made by DG REFORM to improve the design of individual projects under the SRSP programme and to strengthen the monitoring of their implementation. The IAS identified the following strengths and good practices in these areas: ·Policy officers are very knowledgeable about the available delivery means for implementing technical support projects and the established processes enable the selection of appropriate delivery means/sub-tasks in each case. ·Existing controls ensure that the reprogramming of the projects (i.e. the change of key aspects of projects) and amendments of the underlying individual contracts/grant agreements comply with the applicable rules. ·The recently reinstated JIRA (a project monitoring tool) correspondents’ network provides a platform for structured discussions on JIRA user needs and developments between operational units and the horizontal unit A2 which is responsible for JIRA. The IAS identified one very important issue concerning the project preparation and monitoring: tools, guidance and practices and formulated one very important recommendation: Project preparation and monitoring: tools, guidance and practices

DG REFORM should: ·Finalise the e-manual of procedures and the revised JIRA workflows. ·Provide a common information technology solution for monitoring the project implementation that will assist the responsible officers in their daily tasks. ·Persist in current efforts to improve the completeness and reliability of project data encoded in JIRA (e.g. through providing training courses and communication activities to the responsible officers). ·Put in place a robust tool for performing effective plagiarism checks on project deliverables. Additional information provided by DG REFORM on the measures defined and/or implemented following the Internal Audit Service audit DG REFORM accepted all the recommendations received and submitted an action plan that was assessed as satisfactory to mitigate the risks identified by the IAS. The action plan has started with implementation at the latest by 30 June 2023. 19.Research, energy and transport 20.Audit on support, monitoring and enforcement of the existing energy ‘acquis’ (DG ENER) The objective of the audit was to assess whether DG ENER has put in place an internal control system that ensures an effective and efficient support, monitoring and enforcement of EU energy law application. There are no observations/reservations in the 2020 Annual Activity Report of DG ENER that relate to the area/process audited. The fieldwork was finalised on 11 November 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by DG ENER regarding the support, monitoring and enforcement of the energy acquis and identified the following strengths: ·As regards the organisation, DG ENER staff responsible for the support, monitoring and enforcement of the energy acquis are knowledgeable and motivated, and have accumulated valuable experience in the legal energy field. In line with best practices highlighted in the coherence exercise, the same staff responsible for policy development are also responsible for the monitoring and enforcement of its implementation. ·There is good cooperation internally between the sectorial units and the Planning and Legal Affairs unit, as well as externally with key stakeholders in policy implementation (Member States, national regulators, supervisory agencies, etc.). Additionally, the Directorate-General has established effective cooperation with its Cabinet, which is systematically consulted on any key decision regarding new EU-Pilot dialogues and infringement cases, and for the final approval of proposals for infringement cases to be submitted for a decision at the College’s infringement cycle . ·Before the entry into force of the energy legislative initiatives, there is proactive support to Member States, as well as regular dialogue and effective communication with Member States and key stakeholders regarding challenges, conflicts of interpretation and other issues identified in the implementation of the policy. This is used as lessons learnt for policy development. The IAS identified one very important issue concerning the management supervision for the reporting and verification of compliance assessment results for the transposition of Directives and formulated one very important recommendation: Management supervision for the reporting and verification of compliance assessment results DG ENER should develop guidance on the compliance assessment process and define the requirements for formal documentation of the compliance checks, including the verification of the assessment reports prepared by external contractors and the basis for recommending specific enforcement actions on detected issues. Also, it should ensure and document adequate management supervision of the compliance assessment process.

Additional information provided by DG ENER on the measures defined and/or implemented following the Internal Audit Service audit For implementation of the recommendation DG ENER has committed to: ·Establish additional guidance on the compliance assessment process. ·Define the requirements for formal documentation of the compliance checks. ·Develop a more effective and documented management supervision of the compliance assessment process. 21.Consulting on supervision of the Energy Community Secretariat (DG ENER) The objective of the consulting engagement was to propose improvements in DG ENER’s processes for supervising the Secretariat, including through modifications in the financial and staff rules of the Energy Community Secretariat. As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS. 22.Audit on H2020 grant management - phase III, including scientific management for longer duration projects (ERCEA) The objective of the audit was to assess the effectiveness of the ex ante controls on the H2020 grant payments in ERCEA, and their contribution to the assurance on the legality, regularity and sound financial management of the related expenditure. There are no observations/reservations in the 2020 annual activity report of ERCEA relating to the area/process audited. The fieldwork was finalised on 15 May 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the efforts made by ERCEA in ensuring effective implementation of ex ante controls on H2020 grant payments in the context of an increasing workload. In particular, ERCEA has a strong control environment and has applied the following good practices: ·The project officers produce a note to the file for every interim/final payment. This note summarises all information related to reviews of audits, amendments, outcome of the mid-term/final scientific reports, outcomes of previous interim periods and principal investigator’s time commitment reports. This note allows ERCEA to monitor the progress of a project during its lifetime; ·ERCEA has proactively reacted in response to the COVID-19 pandemic. In particular, by establishing a COVID-19 task force comprising representatives of each unit and providing an analysis of the impact of COVID-19 on ERCEA’s activities. ·Unlike the other bodies implementing H2020, ERCEA carries out the scientific reviews mostly with its own staff and does not often use external experts. This allows flexibility to adapt the planning and cope with the workload, as the scientific review is not depending on the availability of expert management. The IAS did not formulate any critical or very important recommendations. 23.Audit on support, monitoring and enforcement of the transport ‘acquis' (DG MOVE) The objective of the audit was to assess whether DG MOVE has put in place an internal control system that ensures effective support, monitoring and enforcement of EU transport law application. There are no observations/reservations in the 2020 Annual Activity Report of DG MOVE that relate to the area/process audited. The fieldwork was finalised on 10 November 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by DG MOVE regarding the support, monitoring and enforcement of the transport acquis, and identified the following strengths:

·Since its establishment, DG MOVE has deployed an infringement cell in the coordination Unit A.4 ‘Legal issues & enforcement’ to support the line units on all procedural aspects related to the processing of complaints, EU-Pilot cases and infringements, including the monitoring of the state of play. This cell participates in the Secretariat-General-led discussions on the definition of the Commission’s enforcement and monitoring policy. Unit A.4 also has a legal cell that provides substantive legal advice to case handlers on all enforcement cases (i.e. CHAP, EU-Pilot and infringements). Both cells communicate continuously and cooperate constructively on monitoring and enforcement of EU transport legislation with the line units. ·DG MOVE set up a CHAP coordinator in October 2019 to supervise the registration and assignment of complaints to the relevant line unit, and to regularly remind the line units to respect the obligation to notify the complainant. The CHAP coordinator is one of the members of the infringement cell and also provides substantive advice on the drafting of letters to complainants. ·In 2016, DG MOVE put in place a comprehensive Vade Mecum on infringements, aiming at bringing together all the key elements relevant to the Directorate-General’s compliance assessment of directives and management of complaints, EU-Pilot cases and infringements. The document describes the internal controls performed during the different phases of the process of monitoring and enforcing EU transport legislation, as well as the actors involved. The Vade Mecum is regularly updated to take into account specific needs identified at Directorate-General level and any changes in the procedures decided at central level. The IAS did not formulate any critical or very important recommendations. 24.Audit on SEDIA implementation (REA) The objective of the audit was to assess whether the Single Electronic Data Interchange Area (SEDIA)-related services by REA are provided in an effective and efficient manner, in compliance with the applicable regulations, and as agreed between the parties. There are no observations/reservations in the 2020 Annual Activity Report of REA that relate to the area/process audited. The fieldwork was finalised on 27 September 2021. All observations and recommendations relate to the situation as of that date. The IAS acknowledged the following strengths: ·The results of the Central Validation Service clients’ survey conducted by the IAS in the context of this audit show a high satisfaction rate (92%) of REA’s clients. ·SEDIA is implemented by knowledgeable and committed staff in the Central Validation Service. Furthermore, a good collaboration between REA and DG BUDG and the effectiveness of the controls performed by REA has enabled DG BUDG to reduce its controls on legal validations, moving from a systematic verification to a sampled-based one. ·REA implements effective controls on legal and financial validation and verification services despite recurrent and significant delays in the delivery of information technology components for the upgrade of the participant data management (PDM) information technology system. The IAS identified two very important issues concerning: (1) personal data protection and access to personal data and; (2) delivery of information technology components and formulated two very important recommendations: Personal data protection and access to personal data REA should review the information provided to the participants in order to clarify that identity documents can only be uploaded in the folder ‘identity documents’. In addition, it should assess with the service provider the feasibility of implementing automated controls on the documents uploaded by the participants, review the existing documents uploaded in PDM and remove those that include personal data. Finally, REA should finalise and endorse the internal implementing rules for personal data management and access to PDM for the Central Validation Service. Delivery of IT components REA should, in the short term, prepare a plan for the remaining information technology developments, including detailed milestones and deliverables and a narrative of the expected improvements, and submit it to the Grant and Procurement Steering Board for endorsement. In the mid-term, REA should perform a high-level analysis, together with DG Budget, the Common Implementation Centre and DG DIGIT on either: (1) the potential integration/interface of PDM by/with SUMMA; or (2) developing a new PDM tool as part of the new generation of eGrants/eProcurement suite, and submit it to the Grant and Procurement Steering Board for decision. Additional information provided by REA on the measures defined and/or implemented following the Internal Audit Service audit REA accepted all the IAS recommendations. According to the action plan accepted by the IAS, the following actions will be taken. In respect to improving the protection of personal data in SEDIA:

- REA will provide to DG DIGIT the updated information to be visible to the participants in the Participant Register, in the form of a pop-up window. - REA will request from DG DIGIT to perform a common assessment on the technical possibilities of the PDM tool to determine the feasibility: to implement automated controls on the documents uploaded by the participants that detect in particular identity documents; and to review the existing documents uploaded in PDM and remove those that include personal data, where not required. The results of these assessments will be discussed with DIGIT in order to reach a common position on the technical possibilities of implementing these control features. - REA’s Central Validation Service will finalise and endorse a) the internal implementing rules for personal data management and b) the document on access to PDM for the Central Validation Service. In respect to improve the timely delivery of IT components by DG DIGIT, REA will: - Prepare together with DG DIGIT a plan for the remaining IT developments. The Business Process Owner (BPO) for Participant Register will then submit it to the Grant and Procurement Steering Board (GPSB) for endorsement. - Perform a high-level analysis recommended by the IAS, together with DG BUDG, the Common Implementation Centre (DG RTD) and DG DIGIT, to be submitted by the BPO for Participant Register to the GPSB for decision. The prospective implementation time for the recommendation is mid 2022 for the recommendation regarding the delivery of IT components, and end 2022 for those relating to personal data protection. 25.Audit on ‘Article 185 bodies’ (DG RTD) The objective of the audit was to assess whether the supervision of article 185 bodies by DG RTD is effective and provides the necessary assurance that the financial contribution of the European Union is compliant with the applicable rules. The audit engagement was launched in December 2020 and the preliminary survey phase, carried out in the first quarter of 2021, covered the five article 185 bodies under the responsibility of DG RTD. The evidence gathered by the IAS during the preliminary survey, during which no major weaknesses related to the key supervisory tools used by DG RTD (in particular the project officers’ checks for the assessment of the annual reports) were identified, complemented by the fact that only two out of the five article 185 bodies under DG RTD responsibility will continue in the present form under Horizon Europe, enabled the IAS to re-assess the inherent risks related to the design and implementation of the supervision of article 185 bodies by DG RTD as medium to low. As a result, the IAS decided to close the audit after the preliminary survey. The IAS did not formulate any critical or very important recommendations. 26.Limited review on the Horizon 2020 error rate calculation by the Common Audit Service (DG RTD) The objective of the limited review was to assess if the Common Audit Service effectively implemented the revised methodology for the calculation of the detected and residual error rates for H2020 and its disclosure in the 2020 Annual Activity Reports in the research and innovation family. There are no observations/reservations in the 2020 Annual Activity Report of Directorate-General in Research and Innovation (DG RTD) that relate to the area/process audited. The fieldwork was finalised on 5 March 2021. All observations and recommendations relate to the situation as of that date. The IAS identified the following strengths and good practices: ·The use of information technology tools to encode audit data and in the calculation of the detected error rate (Microsoft Access currently used for the old methodology) makes these procedures more efficient (less resources spent on performing the same tasks) and effective (less error prone). ·The experience and knowledge of the staff involved in the calculation of the error rates at the different stages of the process (calculation of the top-up, of the detected error rate through the Microsoft Access database and of the residual error rate).

The IAS did not formulate any critical or very important recommendations. 27.External actions 28.Limited review on the measures implemented to address the error rate for indirect management with beneficiary countries (DG INTPA) The objective of the limited review was to assess the adequacy and effectiveness of the actions taken by DG INTPA to analyse the root causes of errors detected by the Residual Error Rate study in indirect management with beneficiary countries contracts; the design of the measures to address them; and the implementation of these measures. There are no observations/reservations in the 2020 Annual Activity Report of DG INTPA that relate to the area/process audited. The fieldwork was finalised on 21 June 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by DG INTPA to prepare and implement annually an action plan to address the root causes of the errors and other high risk areas, and to assess its implementation regularly. The IAS did not formulate any critical or very important recommendations. 29.Audit on the closure process of previous programmes - IPA I and ENPI (DG NEAR) The audit assessed the adequacy of the design and the efficient and effective implementation of the controls put in place by DG NEAR for managing the closure of contracts and programmes for the European Neighbourhood and Partnership Instrument and the Instrument for Pre Accession I. There are no observations/reservations in the 2020 Annual Activity Report DG NEAR that relate to the area/process audited. The fieldwork was finalised on 22 September 2021. All observations and recommendations relate to the situation as of that date. The IAS identified the following strengths: ·The closure checklists are clear, complete and suitable for the different management modes and, in our sample, they were correctly filled-in by staff responsible for closing contracts and financing decisions. ·The high level of digitalisation of the closure file (checklists, routing slip, explanatory notes, etc.) provides an easily accessible audit trail. ·Staff in both DG NEAR headquarters and EU Delegations are fully aware of the monitoring tools at their disposal. ·The key performance indicators related to closure (such as expired contracts, reduction of old ‘Reste à Liquider’, and the annual ‘potentially abnormal Reste à Liquider’ exercise) provide the Directorate-General with an aggregate view on its contract portfolio on aspects relating to closure. The IAS did not formulate any critical or very important recommendations. 30.Audit on IPA II grants in direct management (DG NEAR) The audit objective was to assess whether internal controls on the Instrument for Pre Accession (IPA) II grants in direct management are adequately designed and efficiently and effectively implemented to ensure legality and regularity of the underlying transactions.

DG NEAR made the following reservation in the 2020 Annual Activity Report concerning the area/process under the scope of this audit engagement: reservation concerning the errors in expenditure in direct management grants, due to a residual error rate (3.17%) above 2%. The actual exposure for 2020 was estimated at EUR 20.8 million. The fieldwork was finalised on 25 November 2021. All observations and recommendations relate to the situation as of that date. The auditors recognised the ongoing efforts made by DG NEAR to maintain and continuously update its internal control framework underpinning the legality and regularity of IPA II grants in direct management. In particular, the following strengths/good practices were observed: ·Since 2001, the grant selection and award process has been governed by the ‘Practical guide on contract procedures for European Union external action’, which is a complete and regularly updated body of guidance used by DG INTPA, DG NEAR and FPI. Overall, the grants in our sample conformed to key requirements of the guide applicable to the processes under audit. ·DG NEAR’s manual of procedures which details the ex ante checks to be performed when processing the payments. Overall, the grants in our sample conformed to key manual of procedures requirements. ·The IPA Contracts and Finance unit (NEAR.R.5) regularly organises meetings with staff dealing with finance and contracts in IPA Delegations and Headquarters, serving as a platform for awareness raising on financial and control procedures and for the exchange of best practices. ·Headquarters supervision missions to IPA Delegations have appropriate frequency and geographical coverage. They represent a good monitoring control on the application of the internal control framework in the Delegations. ·The EU Delegation to Serbia and the EU Office to Kosovo established the good practice of performing on the spot project visits, which are carried out at least once in the lifetime of each grant by teams composted of both financial and operational staff. The cooperation between the Finance & Contracts and Operation sections may contribute to more effectively detecting ineligible costs and taking timely corrective measures. ·DG NEAR measures the time from informing applicants that they have been successful to signing grant agreement via key performance indicator 5 ‘Time to grant’ and reports on it in the Annual Activity Report. On this key performance indicator, DG NEAR was significantly below the maximum of 90 days stipulated in the Financial Regulation (38.4 days in 2019 and 50.2 days in 2020). The IAS did not formulate any critical or very important recommendations. 31.Education and citizenship 32.Audit on the preparation for the 2021-2027 programming period of DG HOME funds (DG HOME) The objective of the audit was to assess whether DG HOME has designed and put in place an effective internal control system in support of its preparation for the start of the 2021-2027 programming period. As the legislation for the 2021-2027 period was formally adopted in 2021, in its 2020 Annual Activity Report, DG HOME did not issue a reservation specifically on the 2021-2027 programming period. The fieldwork was finalised on 30 November 2021. All observations and recommendations relate to the situation as of that date. The IAS identified the following strengths in the practices followed by DG HOME: ·In the programming period 2021-2027, DG HOME is for the first time part of the Common Provisions Regulation family. The IAS acknowledges the involvement of DG HOME into the coordination arrangements of the other Common Provision Regulation DGs (DG EMPL, DG MARE, and DG REGIO). The Stock Taking Group is a long-standing well-established coordinating mechanism and remains an important tool for the preparation and the programming of the 2021-2027 Multi-annual Financial Framework between the Commission services during the informal dialogue and the formal negotiations with Member States. Compared to previous programming periods where DG HOME was not part of the Common Provision Regulation family, DG HOME now regularly attends the steering group meetings and actively participates in them. Not only does DG HOME play an active role in contributing to the discussions by sharing views with other DGs via this platform, but it also adopts good practices already developed and implemented by the other Common Provision Regulation DGs in previous programming periods. ·DG HOME has developed its own tool in order to monitor the internal progress in programming. Its so-called dashboard is an Excel spreadsheet, published on the 2021-2027 programming period intranet site and available to all DG HOME staff. Its Desk Officers update it for each country on an ongoing basis. It aggregates information on the negotiation process for partnership agreements and operational programmes (for DG HOME funds and other than DG HOME funds) for each Member State. The dashboard also includes information on submission dates, registration, leading Directorates-General, ongoing internal and inter-service consultations and the latest state of play on the respective Member State negotiation. Thus, the dashboard provides a comprehensive overview of the latest status of the negotiation progress for horizontal units and desk officers from DG HOME’s perspective. The IAS identified two very important issues concerning: (1) delays in work programmes of the thematic facility; and (2) monitoring of progress in the programming of the 2021-2027 period and reporting to senior management and formulated two very important recommendations: Delays in work programmes of the thematic facility

DG HOME should: (1) as a matter of urgency finalise the adoption of the outstanding work programmes and financing decisions for the thematic facility 2021-2022; (2) prepare guidance on the management of the thematic facility to all parties involved, e.g. desk officers, members of the evaluation committees, future applicants/beneficiaries. Monitoring of progress in the programming of the 2021-2027 period and reporting to senior management DG HOME should: (1) establish an effective monitoring of the programming process in the Member State to ensure correct estimates about the state of play and reliable forecasts of expected submission dates of programmes by Member State; (2) prepare regular written reporting to senior management on the progress on the programming process. Additional information provided by DG HOME on the measures defined and/or implemented following the Internal Audit Service audit For one very important recommendation (delays in work programmes of the Thematic Facility) DG HOME implemented already the actions related to the adoption of work programmes and financing decisions for the Thematic Facility 2021-2022, and will fully implement the remaining action to provide guidance by June 2022. In relation to the second recommendation (monitoring of progress in the programming 2021-27 period and reporting to senior management) DG HOME already took actions in relation to the effective monitoring of the programming process in the Member States by developing a dashboard and also by reporting weekly to senior management. The full implementation of this recommendation is foreseen by June 2022. 33.Economic and financial affairs 34.Audit on preparedness of the Competition programme (DG COMP) The objective of the audit was to assess whether DG COMP has put in place an adequate framework to prepare for the Competition programme under the 2021-2027 multi-annual financial framework and has adequately designed the elements necessary for its implementation. There are no observations/reservations in the 2020 Annual Activity Report of DG COMP that relate to the area/process audited. The fieldwork was finalised on 18 November 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the efforts made by DG COMP to establish and improve its internal processes in order to prepare for the adoption and implementation of the Competition programme. In this respect, DG COMP developed a monitoring system for the procurement of studies called the ‘traffic lights system’ which enables the tracking of the progress of planned actions and their compliance with the estimated timetable, thus helping to ensure a timely implementation of the actions. The ‘traffic lights system’ is coordinated by Unit R2; and each Directorate is responsible for monitoring and reporting on the progress made. The IAS identified one very important issue concerning the elements for the implementation of the Competition programme and formulated three very important recommendations: Elements for the implementation of the Competition programme (Three very important recommendations addressed to DG COMP) DG COMP should formally define the internal process for the implementation of the Competition programme covering the main steps (planning, monitoring and reporting) and should finalise the design of internal arrangements and tools which support the implementation of the programme. In addition, DG COMP should update the design of the specific planning and programming process to include: (1) clear steps for the prioritisation of activities; and (2) a clear methodology for the approval of budget adjustments and subsequent budget reallocations at the programme level. Finally, DG COMP should define the internal Competition programme monitoring and reporting arrangements. Additional information provided by DG COMP on the measures defined and/or implemented following the Internal Audit Service audit An action plan to address the recommendations was submitted and agreed with the IAS in January 2022, for implementation by September 2022. 35.Audit on the performance of the treatment of stakeholders' complaints concerning the Internal Market (DG GROW)

The objective of the audit was to assess the design and effective implementation of DG GROW’s processes for treating stakeholder complaints, including compliance with existing rules and procedures and monitoring arrangements. There are no observations/reservations in the 2020 Annual Activity Report of DG GROW that relate to the area/process audited. The fieldwork was finalised on 15 November 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by DG GROW to handle the increasing number of stakeholders' complaints concerning the Internal Market on a timely basis, while at the same time streamlining and adjusting the relevant processes following the reorganisation which took place in the first quarter of the year. DG GROW has put in place procedures that address the necessary steps of the complaint handling cycle and which are aligned with the relevant corporate guidance. The staff members involved in the handling of complaints are experienced and showed commitment. The internal communication channels enable management and staff to fulfil their responsibilities related to case handling effectively. DG GROW uses standard communication channels with other actors involved (SG, Legal Service, associated Directorates-General, Cabinet) in line with corporate standards. The IAS did not formulate any critical or very important recommendations. 36.Audit on effectiveness of cooperation with external stakeholders (DG TAXUD) The objective of the audit was to assess whether DG TAXUD has set up and implemented appropriate management and control systems to effectively organise, monitor and improve the cooperation with its external stakeholders. There are no observations/reservations in the 2020 Annual Activity Report of DG TAXUD that relate to the area/process audited. The audit covered the period 2020-2021. The fieldwork was finalised on 23 November 2021 and all observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by DG TAXUD to cooperate effectively with its wide range of external stakeholders and observed the following strengths in relation to the audited process: ·Over the years, DG TAXUD has established an effective cooperation within its expert groups that contributes to achieving their mandate. The external members of such groups meet DG TAXUD’s expectations in terms of effectively contributing to discussions to support the Directorate-General’s policy work and the achievement of the related objectives. ·DG TAXUD is striving to continuously improve cooperation with its external stakeholders within its expert groups. For instance, the Directorate-General made efforts to foster a more pro-active role of the external members in the discussions held within certain groups, and to embrace the new challenges related to its policy work (e.g. by including members from civil society in certain expert groups). ·DG TAXUD has taken actions towards a better oversight over the activities in the audited area to improve their efficiency and effectiveness. These actions include setting up the list of its recurrent meetings, and the ongoing exercise aiming at streamlining the numerous groups the Directorate-General interacts with. The IAS did not formulate any critical or very important recommendations. 37.General services 38.Consulting on synergies and efficiencies in procurement (DG COMM) The objective of the consulting engagement was to provide advice to DG COMM’s management in further achieving synergies and efficiencies in procurement and the related financial management. As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS.

39.Audit on preparedness for the new European Statistical Programme under the 2021-2027 Multiannual Financial Framework’ (DG ESTAT) The objective of the engagement was to assess whether DG ESTAT: ·has put in place an adequate framework (i.e. governance, definition of roles and responsibilities, internal coordination, planning of resources, etc.) to prepare the Directorate-General for the implementation of the European Statistical Programme of the 2021-2027 Multi-annual Financial Framework; ·has adequately designed the elements necessary for successfully implementing the European Statistical programme (planning and programming, monitoring and reporting systems, financial management procedures). The IAS did not formulate any critical or very important recommendations. 40.Consulting on ‘Globalisation risk’ (DG ESTAT) The objective of the consulting engagement was to provide advice to DG ESTAT on how to further improve the ‘Early Warning System’, created to mitigate the impact of major restructuring of multinational enterprise groups on the quality of European business statistics, national accounts and balance of payments statistics. As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS. 41.Audit on preparedness to implement the European Public Prosecutor’s Office Regulation (OLAF) The objective of the audit was to assess the adequacy and effectiveness of the internal control systems put in place by OLAF to prepare for the future cooperation with the European Public Prosecutor’s Office (EPPO). There are no reservations in the 2020 Annual Activity Report of OLAF that relate to the area/process audited. The fieldwork was finalised on 20 September 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts made by OLAF to prepare for the cooperation with EPPO and in particular found that: ·OLAF has implemented a number of organisational changes to align its structure to the new environment. In particular, in 2018, OLAF set up a specific task force to support the set-up of EPPO which was operational until mid-2020 while in 2021, it established an ‘EPPO Team’ responsible for discussing and coordinating with EPPO staff on the key operational aspects of the cooperation arrangements, and finally created a new Unit 03 responsible for all operational matters related to the cooperation with EPPO. ·In September 2020, OLAF reinforced its internal workgroup on ‘Investigation Instructions and Workforms’ (INWOG) to work on the proposal for the new OLAF Regulation and revision of OLAF’s internal guidelines and instructions. ·OLAF reported regularly to its Supervisory Committee on key aspects of the internal preparations for cooperation with EPPO. ·During EPPO’s set up phase (2019-2020), OLAF delivered awareness-raising sessions to all its staff focusing on the state of play of the establishment of EPPO and the revision of the OLAF regulation. Moreover, in March 2021, OLAF organised a Questions and answers debate for its staff with two representatives from EPPO on the topic of ‘Everything that you always wanted to know about, and dare to ask to EPPO’. ·In the period June – mid-July 2021, OLAF transferred to EPPO 155 cases which OLAF’s operational units previously identified as falling under EPPO’s responsibility. OLAF explained that as result of the transfer, EPPO initiated around 80 criminal investigations contributing to the overall protection of the EU budget. ·On 5 July 2021, OLAF signed with EPPO the ‘Working arrangement between the European Anti-fraud office and the European Public Prosecutor’s Office’ to establish and formalise the areas of cooperation between the two organisations in the exercise of their respective mandates. The IAS identified three very important issues concerning: (1) planning and monitoring of the internal preparatory process, (2) investigation and data protection guidelines, (3) information technology related aspects and formulated three very important recommendations:

Planning and monitoring of the internal preparatory process OLAF should reassess the risks related to the cooperation with EPPO, identify and implement the relevant mitigating measures, as well as monitor and update its risk register accordingly. Regarding the 2021 ‘Preparedness plan for the Arrival of EPPO’, OLAF should ensure that it is formally adopted by senior management and communicated to all relevant staff. The plan should indicate all responsible actors. The status of implementation of the actions in the plan should be monitored regularly by senior management. Investigation and data protection guidelines OLAF should plan and implement the update of all its investigation and data protection guidelines and templates. It should adopt the updated guidelines and publish them as relevant. It should prepare a list of new templates needed for the cooperation with EPPO, define the timeline for their creation, adoption and regular update. Information technology related aspects OLAF should implement the changes to its case management system related to the cooperation with EPPO as soon as possible. It should develop and agree with EPPO technical annexes to their working arrangement on the hit/no-hit system and secure communication line. Furthermore, it should adopt a methodology for the implementation of the current manual hit/no-hit system and subsequent information exchange process. Finally, it should perform an analysis of the key elements necessary to take informed decisions on the future of the hit/no-hit system. Additional information provided by OLAF on the measures defined and/or implemented following the Internal Audit Service audit OLAF has prepared an action plan to address the recommendations from the ‘audit on preparedness of OLAF to implement the EPPO regulation’. In this action plan, OLAF will implement several specific measures, to be carried out until December 2022, approximately. These measures include identifying and monitoring risks related to the cooperation with EPPO, as well as keeping the OLAF "Preparedness plan for the Arrival of EPPO" continuously updated and adapted to the cooperation between both offices. This plan will be approved by OLAF’s senior management and will be implemented by the end of 2022. Regarding the update of OLAF investigation and data protection guidelines and templates, OLAF has started a new revision of the Guidelines on investigation procedures, as well as necessary updates of standard templates. Those that have already been developed are being continuously updated, especially the ones related to the cooperation with EPPO. The Guidelines for Data Protection, on the other hand, have already been approved and developed. Lastly, all the recommended changes related to OLAF's case management system are currently under development and will be implemented before the end of the year. The technical annexes included in the OLAF-EPPO working arrangements are being discussed with the EPPO on a continuous basis and will also be finalised by December 2022. 42.Consulting on risk management (OLAF) The objective of the consulting engagement was to provide advice to OLAF’s Director-General on how to improve the risk management process in his service. As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS. 43.Audit on establishment of statutory rights and calculation of individual entitlements (PMO) The objective of the audit was to assess whether PMO has an effective and efficient control system in place to ensure the correct establishment of rights and calculation of entitlements for active and post-active staff. There were no observations/reservations in the 2020 Annual Activity Report of PMO that relate to the processes audited. The fieldwork was finalised on 23 July 2021. All observations and recommendations relate to the situation as of that date. The IAS identified the following strengths: ·Since February 2021, significant changes in the management process have been made, supported by a ‘change management strategy’, with a clear roadmap and objectives. The changes involve consulting staff to identify PMO’s main challenges and collecting suggestions for improvement. Furthermore, a ‘collaboration forum’ and ‘communities of practice’ have been established. Finally, a number of focused workshops have been organised and improvements made to communication channels. ·The IAS welcomed these changes, in particular, the establishment of the ‘community of practice’ on internal control and on knowledge management, which aims at improving coherence and collaboration, the exchange of good practices and training on cross-cutting issues in the Office. Expected outcomes from the knowledge management community of practice include more harmonised, streamlined and efficient procedures and working methods, commonly developed guidelines for staff, and an improved knowledge management system overall.

·The IAS also welcomed the continuous information technology developments aimed at supporting the activities of the Office. In relation to the audited processes, new online declarations on the place of origin and installation allowance are now in a test phase, and a new module to manage the entry into service rights and mobility is being developed. These developments are expected to increase efficiency, lower the cost of control and reduce the risk of error. The IAS identified one very important issue concerning the control strategy and formulated one very important recommendation: Control strategy PMO should strengthen its general control system, in particular by developing a single and coherent control strategy (aligned with the applicable provisions of the legal base in relation to effective control systems) for the establishment of rights and calculation of individual entitlements at Office level. It should establish a process to identify and assess operational risks at process level and match the intensity and frequency of controls with the level of risks. PMO should also strengthen the ex ante controls related to the category ‘allowances from other sources’ and clearly distinguish between ex ante and ex post controls to ensure that they are performed in compliance with the provisions of the Financial Regulation. Furthermore, PMO should centralise the ex post control function to ensure segregation of duties and independence of actors involved in those controls. Finally, it should substantially revise its ex post control methodology and the method for the calculation of the error rate, by applying a statistically representative sampling approach. Additional information provided by the PMO on the measures defined and/or implemented following the Internal Audit Service audit An action plan has been recently adopted and is currently being implemented. Following the reorganisation of PMO, the ex post control function is already centralised in unit PMO.7 as of 1 January 2022. 44.Information technology audits 45.Consulting on SUMMA programme (DG BUDG) The objective of this consulting engagement was to review and advise DG BUDG on improvements required, if any, in the design of the governance setup for the SUMMA programme and in the DG’s process for identifying business requirements and defining the target solutions, which aim to simplify and harmonise business processes and stay as close as possible to standard SAP functionalities. As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion and no formal recommendations were issued. Instead, the report contained issues for consideration. Their effective implementation will not be formally followed up by the IAS. 46.Audit on the management and monitoring of compliance with the Commission’s information technology security framework (DG DIGIT) The objective of the audit was to assess the adequacy of DG DIGIT’s processes for managing and monitoring compliance with the Commission’s information technology security framework. The IAS noted a number of good practices regarding the processes for managing and monitoring information technology security compliance: ·As regards the information technology security framework itself, although a limited number of areas remain to be completed (i.e. creating or updating standards on ‘Network Security’, ‘Identity Management’ and ‘Secure Software Development’ planned for inter-service consultation at the end of 2021), the framework is largely in place in terms of implementing rules and standards. ·DG DIGIT has made significant progress in the rollout of the information technology security governance, risk and compliance tool, which is designed to facilitate the Directorates-General actual implementation of the information technology security requirements and provide for its monitoring. This constitutes a key part of the compliance management and monitoring process and has been a major challenge for DG DIGIT to provide a comprehensive and workable tool. The IAS identified two very important issues concerning: (1) information technology security compliance management and reporting practices, and (2) information technology security compliance management process and formulated two very important recommendations: Information technology security compliance management and reporting practices DG DIGIT should launch a Commission-wide campaign to raise awareness on the information technology security framework compliance monitoring activities and to report in a comprehensive and reliable way on the current status of implementation of information technology security framework controls. In particular, the requirements needed to be compliant with the Commission’s information technology security framework need to be clarified more precisely. Based on the information and practical experience collected from the Directorates-General, DG DIGIT should propose to the Information Technology and Cybersecurity Board additional and effective methods for enforcing information technology security compliance. Information technology security compliance management process DG DIGIT should create standard compliance assessment, management and monitoring procedures, guidelines and training materials to help make the overall process as operational and as streamlined as possible and thus to promote commitment and take-up. To facilitate the process and help the Directorates-General to use their resources most effectively, DG DIGIT should also define the relative priorities of the information technology security controls so stakeholders can focus the compliance efforts on the most critical information technology security controls and risks. These should be made clear to the process stakeholders as part of a concerted communication effort.

DG DIGIT should also examine the possibilities for improving synergies and coherence between the information technology risk assessment and information technology security compliance processes to ensure maximum possible alignment of the underlying information technology security framework and effective use of resources. Additional information provided by DG DIGIT on the measures defined and/or implemented following the Internal Audit Service audit DG DIGIT prepared and submitted an action plan end October 2021, which was accepted by IAS early November 2021. DIGIT is currently implementing the action plan according to the agreed target dates, therefore mitigating the related risks. As part of the audit action plan to improve overall monitoring and reporting on the compliance levels, DG DIGIT is working closely with the other DGs to collect a first set of priority compliance attestations and to report compliance key performance indicators to the Information Technology and Cybersecurity Board. To further improve the execution efficiency of the DGs in their overall IT security management activities, DG DIGIT is also providing a compliance support tool and is working on an integrated risk and compliance process and workflow. 47.Audit on information technology security management in the HR family (DG DIGIT, EPSO, DG HR, PMO) The objective of the audit was to assess the adequacy of the design and the effectiveness of the implementation of the governance, management and control processes put in place by HR family members for their systems. There are no observations/reservations in the 2019-2020 Annual Activity Report of the audited Directorates-General that relate to the area/process audited. The fieldwork was finalised on 30 April 2021. All observations and recommendations relate to the situation as of that date. The IAS recognised the ongoing efforts by EPSO to continuously further improve information security and identified the following strengths: ·There is a solid knowledge of technical and non-technical information security issues amongst key personnel. ·There is effective and close cooperation between the business and information technology sides defining and enforcing the business needs on the information technology security domain. There is effective communication between EPSO and DG DIGIT as in respect of the development and management of the communication and information systems. The IAS recognised the ongoing efforts by PMO to improve information security and identified the following strengths: ·A Systems Security Officer has been appointed. ·Systems risk exercises are performed using the ITSRM² methodology. ·There are first or draft versions of security plans for all systems (as at the completion of the audit fieldwork stage). The IAS identified three very important issues concerning: (1) logical system-related controls (2) information technology service provider management (3) information technology security governance (and risk management) and formulated seven very important recommendations: Logical system-related controls (Two very important recommendations addressed to DG DIGIT and DG HR) DG DIGIT should strengthen user access management processes on database level and ensure, together with HR family members, that obsolete database interfaces are timely deleted. Moreover, DG DIGIT should reduce the use of production data in non-production environments to a minimum. Furthermore, DG DIGIT should provide the system owners with a regular security health check report on technical level. In addition, DG DIGIT should strengthen oversight of manual interventions by sample cross checks of activities performed on database level. DG HR should assess whether the secure hosting solution offered by DG DIGIT would be feasible or, as a minimum, some individual controls from this solution could be applied in the current basic hosting solution to strengthen the security level. Based on the results, DG HR should (in cooperation with the other HR family members) complete a service level agreement with DG DIGIT and clearly identify roles and responsibilities as regards the implementation, monitoring and reporting of information technology security controls. Information technology service provider management (Two very important recommendations addressed to DG DIGIT and DG HR)

DG DIGIT should inform the system owners about substantial changes having an impact on production data, such as the creation of environments storing production data or the establishment of system interfaces in a production environment. DG DIGIT should launch an exercise together with HR family members to assess the gaps between the basic hosting and the secure hosting solution. Based on this process, DG DIGIT should update the service level agreements with the family members. In these service level agreements, roles and responsibilities should be clearly defined. DG HR should define and implement basic security processes, including user account management, logging and monitoring, vulnerability management as well as reviewing system interfaces. It should strengthen oversight on manual interventions in Sysper, assess the feasibility to improve protection of data in motion and reduce the use of production data in non-production environments to a minimum. Information technology security governance (One very important recommendation addressed to DG HR) DG HR should improve its information technology security management by keeping an up-to-date system inventory and endorsing information technology security plans as a key tool for steering information technology security. Moreover, DG HR should strengthen its process for ensuring a continuous improvement of its information technology security arrangements, including roles and responsibilities related to information technology security. Information technology security governance (One very important recommendation addressed to EPSO) EPSO should restart the information technology steering committee meetings, ensuring information technology security issues are discussed in these meetings. It should also develop/improve its information technology security standards and procedures ensuring all staff involved are aware of the framework and their roles and responsibilities. Moreover, EPSO should implement the security controls identified on the information technology security plan and yet to be implemented, and formally appoint the relevant information technology security roles and ensure the objectives of each role are properly fulfilled. Information technology security governance and risk management (One very important recommendation addressed to PMO) PMO should: ·Strengthen its internal oversight on technical security controls implemented by DG DIGIT. ·Strengthen the LISO function by enhancing his/her involvement in information technology security issues across the service. ·Strengthen the process of continuous improvement of information technology security by executing risk-based assessments on all PMO systems, and implementing compensating measures. ·Assess the risk landscape for all PMO systems, and review alignment of these risks with the technical and organisational controls in place. ·Update all PMO security plans and for the missing controls, prepare a roadmap on how to implement these controls. Additional information provided by DG DIGIT, DG HR, PMO and EPSO on the measures defined and/or implemented following the Internal Audit Service audit DG DIGIT prepared and submitted an action plan early December 2021, which was accepted by IAS mid-December 2021. DIGIT is currently implementing the action plan according to the agreed target dates, therefore mitigating the related risks. Relevant actions are in progress in the following areas: ·User access management (developing procedures on user access management on database level; defining, in collaboration with the HR family, a process for review of user accounts on database level). ·System interfaces and separation of production from non-production (producing inventory of database links in the HR family systems). ·Manual interventions (reviewing the current available tools for reconciliation activities).

·Use of production data (reviewing current situation of environments). ·Assessment of appropriate hosting solutions (gathering inputs from the hosting provider). Following the IAS’ acceptance of DG HR’s action plan in December 2021, implementation progresses are according to plan. Actions requiring major technical investments are being assessed for timely and cost efficient ‘solutioning’. An action plan has been recently adopted and is currently being implemented. Since the end of the audit, risk management for PMO systems is carried out by PMO (instead of DIGIT), additional mitigating measures are planned, and the local information security officer is more involved in this process. EPSO has accepted all audit findings and recommendations and submitted in December 2021 an action plan, which was accepted by IAS, to implement all recommendations by the end of 2022. EPSO has restarted to have regular IT Steering Committee (ITSC) meetings with DIGIT, with the presence of our c-LISO, to also cover any security related matters. Ad-hoc meetings also take place between c-LISO and senior management of EPSO to discuss relevant security matters. Work is on-going on the implementation of the other recommendations (security standards, security controls, roles - due end 2022), with the collaboration of DIGIT.IT Security plans covering all EPSO’s IT systems have been finalised in January 2022. 48.Audit on information technology project management and software development (DG RTD) The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the management and control systems put in place by DG RTD for its information technology project management and software development processes. There were no observations/reservations in the 2020 Annual Activity Report of DG RTD that relate to the area/process audited. The IAS noted a number of strengths regarding project management and software development practices in DG RTD. Specifically, that the key elements of the audited processes are mature and well established, notably the respective methodologies, governance structures, effective business-provider relationships and interactions, monitoring/reporting of pro