Opinion No 1/2000

on a proposal for a Council Regulation amending the Financial Regulation of 21 December 1977 and separating the internal audit function from the ex ante financial control function (fifth paragraph of Article 24 of the Financial Regulation)

(submitted pursuant to Article 279 EC)

(2000/C 327/01)

THE COURT OF AUDITORS OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community, and in particular Article 248(4) and Article 279 thereof,

Having regard to the Treaty establishing the European Coal and Steel Community, and in particular Article 45c(4) and Article 78h thereof,

Having regard to the Treaty establishing the European Atomic Energy Community, and in particular Article 160c(4), and Article 183 thereof,

Having regard to the Financial Regulation applicable to the general budget of the European Communities(1), as most recently amended by Council Regulation (EC, ECSC, Euratom) No 2673/1999 of 13 December 1999(2), and in particular Articles 21, 24, 139 and 142 thereof,

Having regard to Commission Regulation (Euratom, ECSC, EC) No 3418/93 of 9 December 1993 laying down detailed rules for the implementation of certain provisions of the Financial Regulation of 21 December 1977(3), and in particular Articles 34 to 43 thereof,

Having regard to the proposal submitted by the Commission for a Council Regulation amending the Financial Regulation of 21 December 1977 and separating the internal audit function from the ex ante financial control function(4),

Having regard to the request for an opinion on this proposal, sent by the Council to the Court of Auditors on 14 June 2000 and received by the Court on 21 June 2000,

Whereas the Commission has developed a project for creating an "Internal Audit Service... to assist management... to (1) control risks, (2) monitor compliance, (3) provide an independent opinion about the quality of management and control systems, and (4) make recommendations for improving the efficiency and effectiveness of operations and ensuring that Commission resources are used cost-effectively (security for money and value for money)";

Whereas the system thus envisaged also includes the following provision. "Each Directorate-General will set up a specialised audit capability (that could range from an individual relying largely on the work of the Internal Audit Service to a fully-fledged unit), reporting directly to the Director-General, to carry out reviews of the internal control system of the DG as well as reviews of the management and use of Commission funds paid to external beneficiaries";

Whereas "an audit progress committee will be set up. Its job will be to monitor (1) the control processes of the Commission through the results of audits of the Internal Audit Service and the Court of Auditors, (2) the implementation of audit recommendations, including those from the Court of Auditors accepted by the Commission, and (3) the quality of audit work";

Whereas, in the Commission's words, this system "should fully remedy the 'de-responsibilising effect' and eliminate the potential conflict of interest between financial control and internal audit that marks current arrangements"(5);

Whereas the Commission's proposal for separating the internal audit function from the financial control function pending a fuller recasting of the Financial Regulation is a development that has been advocated by the Court for a very long time,

HAS ADOPTED THE FOLLOWING OPINION:

1. As long ago as 1981(6), the Court mentioned the latent conflict between the power of the financial controller to give prior approval, and thus to authorise expenditure, and the task of subsequently evaluating the same expenditure on the basis of sound financial management criteria, which is, in fact, the function of an internal auditor.

2. More recently, the Court observed, 'The main objectives of the whole set of financial regulations should be to help the Communities to achieve their political aims effectively by allocating their budgetary resources in the best possible way, to guarantee the legality and regularity of their acts, to protect their assets and to ensure the disclosure and the transparency of their financial operations. To this end, a new Financial Regulation should in particular contain the following principles and provisions:

- the status and powers of the financial controller should be redefined, on the assumption that he would exercise the functions of internal auditor of the institution,

- a clearer indication of the scope of authorising officers' powers in respect of financial management and financial control. Since the prior approval procedure is likely to be used significantly less or even, in the end, to disappear, additional provisions need to be introduced to ensure the legality, regularity and sound financial management of Community measures and to protect the Communities' financial interests, in particular to prevent officials from having to face any situation where a conflict of interest arises between the interests of the service and the interests of third parties,

- on the same assumption, the powers of the accounting officer need to be strengthened'(7).

3. In particular, the Court pointed out that the organisational and operational consequences of the suggestion that the financial controller should also act as internal auditor are not set out clearly. In the absence of clarification and safeguards it would not offer sufficient compensation to protect the financial system against any internal control defect that might result from the discontinuation of prior approval. Furthermore, abolishing prior approval completely would only be acceptable if it were to be replaced by other procedures that offer at least equivalent safeguards and could also involve officials other than the financial controller(8).

4. The Court's recommendations were drafted in the context of radical changes in the role of the financial controller, combined with increased responsibility for authorising officers and accounting officers and the creation of a real internal audit function(9).

5. On a similar point, the International Organisation of Supreme Audit Institutions states, "Management often establishes an internal audit unit as part of its internal control structure. While internal auditors can be a valuable resource to educate and advise on internal controls, the internal auditor should not be a substitute for a strong internal control structure."(10)

6. It might, therefore, be preferable for the system that is under consideration to be comprehensive, rigorous and consistent, especially as there is always a possibility that the solution that is being proposed for a transitional period might remain in force for longer than the Commission anticipates.

Scope of the reform

7. Internal audit is defined as "an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes"(11). Therefore, "the scope and objectives of internal audit vary widely and depend on the size and structure of the entity and the requirements of its management"(12).

8. The internal audit function must be included in the Financial Regulation as a general concept, but the method of designating the internal auditor (whether an individual or a unit), the detailed objectives of the duties, scope of the work and implementing procedures are a matter for the institutions themselves to decide, in terms of their specific characteristics and requirements, having due regard to current international internal auditing standards. The text of Article 24 of the Financial Regulation should be amended accordingly. An alternative text for Article 2 of the Commission proposal is suggested in the Annex.

The incompatibility of the internal auditor function and other functions

9. The proposed reform provides for the internal auditor function to be added to the functions that are traditionally part of the Communities' financial procedure, namely authorising officer, financial controller and accounting officer.

10. Article 24a does, indeed, provide that the internal auditor is to be independent of the financial controller. Nevertheless, in order to properly provide the necessary overall balance in the internal control system, a further amendment should be added to the measures already proposed by the Commission. The fourth subparagraph of Article 21 of the Financial Regulation should set out the principle that the functions of authorising officer, financial controller and accounting officer may be combined neither with each other nor with the function of internal auditor.

Independence of the internal auditor

11. The proposal gives the internal auditor an official status similar to that of the financial controller. However, because of the importance of the principle that an auditor must be independent of the persons or bodies audited, this principle should be laid down in the Financial Regulation itself. The Financial Regulation should provide, without ambiguity, that in carrying out his duties the internal auditor is responsible only to the institution that designated him and that he reports direct to that institution.

The duties of an internal auditor

12. The draft Article 24a mentions two of the duties required of an internal auditor. However, as explained in paragraph 7, the objectives, nature and list of duties to be carried out by the internal auditor may vary according to the institution in which the internal audit is carried out.

13. It would, therefore, be advisable for the internal auditor's duties to be defined in terms that are more general, by means of a reference to the current international standards governing this matter.

The creation of a new title in the Financial Regulation

14. The office of internal auditor, unlike the offices of authorising officer, accounting officer and financial controller, does not include any powers that affect the implementation of the budget. For that reason the Commission's proposed amendment to the Financial Regulation should be included in a separate title, rather than in Title III of the Financial Regulation.

This opinion was adopted by the Court of Auditors in Luxembourg at its meeting of 5 October 2000.

For the Court of Auditors

Jan O. Karlsson

President

(1) OJ L 356, 31.12.1977, p. 1.

(2) OJ L 326, 18.12.1999, p. 1.

(3) OJ L 315, 16.12.1993, p.1.

(4) Commission Document 2000/135 (CNS) - COM(2000) 341 final.

(5) "Reforming the Commission" - A White Paper, Part I, COM(2000) 200 final/2, p. 26 - 27.

(6) European Court of Auditors, Study of the financial systems of the European Communities (1981) (OJ C 342, 31.12.1981, p. 1).

(7) Opinion No 4/97 on the proposal for a Council Regulation (Euratom, ECSC, EC) amending the Financial Regulation of 21 December 1977 applicable to the general budget of the European Communities, paragraph 16, first subparagraph and paragraph 16(c) (OJ C 57, 23.2.1998, p. 4).

(8) Opinion No 4/97, paragraph 15, fifteenth indent and paragraph 5.5 of the Annex.

(9) Opinion No 4/97, paragraph 5.10 of the Annex.

(10) Intosai Internal Control Standards Committee, Guidelines for internal control standards, June 1992, paragraph 74.

(11) Definition of the Institute of Internal Auditors (IIA), approved by the IIA Board of Directors on June 26, 1999.

(12) International Federation of Accountants - Handbook 1999 - Technical Pronouncements, ISA No 610, paragraph 5.

Annex

PROPOSED ALTERNATIVE TEXT FOR ARTICLE 2 OF THE COMMISSION'S PROPOSAL

(ref. 2000/0135(CNS)

'Article 2

A new title is added to the Financial Regulation:

THE INTERNAL AUDITOR

1. Each institution shall establish an internal audit function within the institution. The internal audit function shall be independent of the financial controller.

Internal auditing is an assurance and consulting activity designed to add value and improve the institution's operations, as well as helping it to accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the management and control processes.

2. Each institution shall designate the internal auditor according to the method appropriate to its specific characteristics and requirements.

In carrying out his duties the internal auditor shall be responsible only to the institution that designated him and shall report direct to the institution.

Each institution shall, according to its specific characteristics and requirements, decide the scope of the internal auditor's work and adopt detailed objectives and procedures for the internal audit function, having due regard to international internal auditing standards.

3. The internal auditor shall be guaranteed the independence and access to information that he considers necessary for the performance of his duties. In particular, where the internal auditor is an official or other servant of the institution that has designated him, he shall, in order to be able to exercise his duties, have access to the same information as the financial controller and, in order to maintain his independence, shall be subject to the same rules and specific measures as are applicable to the financial controller under the eighth and ninth paragraphs of Article 24.'