Annual report on EU agencies for the financial year 2017

(2018/C 434/01)

TABLE OF CONTENTS

List of acronyms 2

CHAPTER 1 The EU agencies and the Court’s audit 4

CHAPTER 2 Overview of audit results 15

CHAPTER 3 Statements of Assurance and other agency-specific audit results 29

LIST OF ACRONYMS

The list of acronyms includes the EU agencies and other Union bodies covered by this report.

Acronym Full name Location ACER Agency for the Cooperation of Energy Regulators Ljubljana, Slovenia BEREC Office Office of the Body of European Regulators for Electronic Communications Riga, Latvia CdT Translation Centre for the Bodies of the European Union Luxembourg, Luxembourg Cedefop European Centre for the Development of Vocational Training Thessaloniki, Greece CEPOL European Union Agency for Law Enforcement Training Budapest, Hungary Chafea The Consumers, Health, Agriculture and Food Executive Agency Luxembourg, Luxembourg CPVO Community Plant Variety Office Angers, France EACEA Education, Audiovisual and Culture Executive Agency Brussels, Belgium EASA European Aviation Safety Agency Cologne, Germany EASME Executive Agency for Small and Medium-sized Enterprises Brussels, Belgium EASO European Asylum Support Office Valletta, Malta EBA European Banking Authority London, UK ECDC European Centre for Disease Prevention and Control Stockholm, Sweden ECHA European Chemicals Agency Helsinki, Finland EEA European Environment Agency Copenhagen, Denmark EFCA European Fisheries Control Agency Vigo, Spain EFSA European Food Safety Authority Parma, Italy EIGE European Institute for Gender Equality Vilnius, Lithuania EIOPA European Insurance and Occupational Pensions Authority Frankfurt, Germany EIT European Institute of Innovation and Technology Budapest, Hungary EMA European Medicines Agency London, UK EMCDDA European Monitoring Centre for Drugs and Drug Addiction Lisbon, Portugal EMSA European Maritime Safety Agency Lisbon, Portugal ENISA European Union Agency for Network and Information Security Heraklion, Greece ERA European Union Agency for Railways Valenciennes, France ERCEA European Research Council Executive Agency Brussels, Belgium ESMA European Securities and Markets Authority Paris, France ETF European Training Foundation Turin, Italy EUIPO European Union Intellectual Property Office Alicante, Spain eu-LISA European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice Tallinn, Estonia EU-OSHA European Agency for Safety and Health at Work Bilbao, Spain Euratom Euratom Supply Agency Luxembourg, Luxembourg Eurofound European Foundation for the Improvement of Living and Working Conditions Dublin, Ireland Eurojust The European Union's Judicial Cooperation Unit The Hague, The Netherlands Europol European Union Agency for Law Enforcement Cooperation The Hague, The Netherlands FRA European Union Agency for Fundamental Rights Vienna, Austria Frontex European Border and Coast Guard Agency Warsaw, Poland GSA European Global Navigation Satellite Systems Agency Prague, Czech Republic INEA Innovation & Networks Executive Agency Brussels, Belgium REA Research Executive Agency Brussels, Belgium SRB Single Resolution Board Brussels, Belgium

CHAPTER 1

The EU agencies and the Court’s audit

TABLE OF CONTENTS

Paragraph Page INTRODUCTION 1.1 – 1.3 5 THE EU AGENCIES 1.4 – 1.21 5 Different types of agencies help the EU design and implement policy 1.4 – 1.14 5 Decentralised agencies address specific policy needs 1.8 – 1.9 7 Commission executive agencies implement EU programmes 1.10 8 Other bodies have specific mandates 1.11 – 1.14 8 Agencies are financed by various sources and under different MFF headings 1.15 – 1.20 8 The EU Agencies Network facilitates inter-agency cooperation and communication with stakeholders 1.21 13 OUR AUDIT 1.22 – 1.32 13 We have a mandate to audit the agencies’ annual accounts and transactions 1.22 – 1.24 13 Our audit addresses the risks identified 1.25 – 1.32 13

INTRODUCTION

1.1. The European Court of Auditors (ECA) was established by the Treaty on the Functioning of the European Union ( 1 ) as the external auditor of the EU’s finances. In this capacity we act as the independent guardian of the financial interests of the citizens of the Union, notably by helping to improve the EU’s financial management. More information on our work can be found in our activity reports, our annual reports on the implementation of the EU budget, our special reports, our landscape reviews and our opinions on new or updated EU laws or other decisions with financial management implications ( 2 )

1.2. Within this mandate we carry out an annual examination of the accounts, and the underlying transactions, for EU institutions, agencies and other Union bodies ( 3 )

1.3. This report presents the results of our audit of the EU agencies and other Union bodies (collectively referred to as ‘the agencies’) for the financial year 2017. The report is structured as follows: — Chapter 1 describes the agencies and the nature of our audit, — Chapter 2 presents the overall results of the audit, — Chapter 3 contains the statement of assurance for each of the 41 agencies with our opinions and observations on the reliability of the agencies’ accounts and on the legality and regularity of the underlying revenue and payments (transactions).

THE EU AGENCIES

Different types of agencies help the EU design and implement policy

1.4. Agencies are distinct legal entities set up by secondary legislation to carry out specific technical, scientific or managerial tasks that help the EU institutions design and implement policies. Many are highly visible and have significant influence in important areas of European citizens’ daily life, such as health, safety, security, freedom and justice. A short description of the tasks carried out by each agency is given with their statements of assurance in Chapter 3.

1.5. In this report we refer to specific agencies by their acronyms, a list of which is provided at the beginning of the report.

1.6. There are three types of agencies: decentralised agencies, executive agencies and other bodies. The main characteristics of each are described below. The number of agencies has increased over the years and stood at 41 in 2017, as shown in Box 1.1 .

Box 1.1

Increase in the number of agencies

Source: ECA.

1.7. Commission executive agencies are located at the seats of the Commission in Brussels and Luxembourg. Decentralised agencies and other bodies are located across the EU in 23 different Member States as shown in the list of acronyms and in Box 1.2 . Their locations are decided by the Council or jointly by the Council and the European Parliament.

Box 1.2

Agencies’ locations across Member States

Source: ECA.

Decentralised agencies address specific policy needs

1.8. 32 decentralised agencies The ( 4 ) play an important role in preparing and implementing EU policies, especially for tasks of a technical, scientific, operational and/or regulatory nature. The intention is to address specific policy needs and to reinforce European cooperation by pooling technical and specialist expertise from the EU and national governments. They have been set up for an indefinite period by Regulation of the Council or of the European Parliament and the Council.

1.9. Decentralised agencies work under the control of a board consisting of representatives of the Member States, the Commission and in some agencies other parties. The Board establishes the operational framework the agency has to follow, such as the multi-annual and annual work programmes, draft budgets and staff establishment plans, which are implemented under the responsibility of their (executive) directors. Each decentralised agency is subject to an individual discharge procedure on the implementation of its budget, in most cases by the European Parliament and the Council ( 5 ) , covering its staff, administrative and operational expenditure.

Commission executive agencies implement EU programmes

1.10. six Commission executive agencies The ( 6 ) are entrusted with executive and operational tasks relating to one or more EU programmes and are set up for a fixed period of time. They were created by a Commission decision and work under the supervision of Steering Committees appointed by the Commission. They work on the basis of multi-annual and annual work programmes established and implemented under the responsibility of executive directors. They are subject to individual discharge procedures by the European Parliament and the Council for their own budgets. In contrast to decentralised agencies, their budgets cover staff and administrative expenditure only, while all the operational expenditure that they implement stems from the Commission budget and is therefore part of the general discharge given to the Commission. The executive agencies’ own budgets therefore represent only a very small part of the budget they actually implement.

Other bodies have specific mandates

1.11. The three other bodies are the EIT, Euratom and the SRB.

1.12. The EIT in Budapest is an independent, decentralised EU body, which pools scientific, business and education resources to boost the Union’s innovation capacity by providing grant funding. It was set up for an indefinite period by the European Parliament and the Council. It is headed by a director and supervised by a Governing Board, and is subject to an individual discharge procedure by the European Parliament and the Council.

1.13. Euratom in Luxembourg was created for an indefinite period by the Council to support the aims of the European Atomic Energy Community Treaty. It is subject to an individual discharge procedure by the European Parliament and the Council. An Advisory Committee composed of members from Member State assists the Euratom in carrying out its tasks by giving opinions and providing analysis and information. Euratom’s director general works under the supervision of the Commission.

1.14. The SRB is the central resolution authority within the banking union and has its seat in Brussels. Its mission is to ensure an orderly resolution of failing banks with minimum impact on the real economy, the financial system, and the public finances of the participating Member States and beyond. The SRB is represented by its Chair, who also assumes the role of appointing authority. The Chair of the SRB is subject to an individual discharge procedure by its Board, which is composed of members from the national resolution authorities of participating Member States.

Agencies are financed by various sources and under different MFF headings

1.15. Box 1.3. The agencies with the highest increase in their budgets in 2017 were GSA and EIT, which are financed under MFF The total 2017 budget of all agencies (excluding the SRB) amounted to 3,5 billion euros (2016: 3,4 billion euros) which is equivalent to some 2,7 % of the 2017 EU general budget (2016: 2,4 %) as shown inThe agencies with the highest increase in their budgets in 2017 were GSA and EIT, which are financed under MFF ( 7 ) heading 1a (Competitiveness for growth and jobs) and Frontex, EMA and EASO, financed under MFF heading 3 (Security and Citizenship).

1.16. In addition, the 2017 budget of the SRB amounted to 6,6 billion euros (2016: 11,8 billion euros) ( 8 ) . This consists of contributions from credit institutions to the Single Resolution Fund.

1.17. The budgets of the decentralised agencies and the other bodies cover their staff, administrative and operational expenditure, whereas the executive agencies implement programmes financed by the Commission’s budget, and their own budgets (some 241 million euros in total) only cover their staff and administrative expenditure. Commission operational expenditure implemented by the six executive agencies in 2017 amounted to some 6,8 billion euros, i.e. more than twice the total budget of all the other agencies together excluding the SRB.

Box 1.3

Agencies’ financing sources 2017

Source: EU general budget 2017 and agencies’ budgets 2017, compiled by ECA.

1.18. Most agencies, including all executive agencies, are financed almost entirely by the EU general budget. The others are fully or partially financed by fees and charges and by direct contributions from participating countries: Member States, EFTA countries, etc. In total, the EU general budget financed some 2,5 billion euros, with 1 billion euros financed by fees and charges and direct contributions from participating countries. Box 1.4 shows a breakdown of the agencies by the size of the EU budget contributions received.

Box 1.4

Agencies ranked by size of EU budget contribution

Source: Agencies, compiled by ECA.

1.19. The 2,5 billion euros in contributions from the EU general budget are financed under different MFF headings as illustrated in Box 1.5 .

Box 1.5

Agency financing by EU general budgets’ MFF heading

Source: EU Multiannual financial framework covering the period 2014-2020 and agencies’ budgets 2017, compiled by ECA.

1.20. Box 1.6. With regard to staff, at the end of 2017 the agencies employed some 11 000 staff ( 9 ) (2016: 10 300), about one sixth of the total staff employed by EU institutions and agencies. The breakdown of total staff by agency is presented in

Box 1.6

Numbers of staff per agency at the end of 2017

Source: Agencies, compiled by ECA.

The EU Agencies Network facilitates inter-agency cooperation and communication with stakeholders

1.21. The EU Agencies Network (EUAN) was set up by the agencies as an inter-agency cooperation platform to enhance the agencies’ visibility, to identify and promote possible efficiency gains and to add value. The EUAN operates on the basis of priorities agreed by the agencies in a 5-year Strategy Agenda (2015-2020) and yearly Work Programmes specifying activities and deliverables. One important role assigned to EUAN is to ensure efficient communication between the agencies and stakeholders, mainly with the European Institutions. EUAN is chaired by a different agency every year on a rotational basis.

OUR AUDIT

We have a mandate to audit the agencies’ annual accounts and transactions

1.22. As required by Article 287 of the Treaty on the Functioning of the European Union (TFEU), we have audited (a) the accounts of all agencies, which comprise the financial statements (10) and the reports on the implementation of the budget (11) for the financial year ended 31 December 2017; and (b) the legality and regularity of the transactions underlying those accounts.

1.23. On the basis of the results of our audit, we provide the European Parliament and the Council, or the other discharge authorities referred to in Chapter 3 of this report, with one statement of assurance per agency as to the reliability of the agencies’ accounts and the legality and regularity of the underlying transactions. We complement the statements of assurance with significant audit observations, where appropriate.

1.24. As stipulated in Article 208(4) of the EU Financial Regulation ( 12 ) , the accounts of 32 agencies receiving contributions from the EU budget were verified by independent external auditors. We reviewed the reliability of the verification results according to International Standards on Auditing and took them into account when preparing our own audit opinions.

Our audit addresses the risks identified

1.25. In order to obtain sufficient assurance, we designed our audit to address the main risks identified.

Risk to the reliability of agencies’ accounts is low in general

1.26. Overall, we consider the risk to the reliability of accounts to be low for all agencies. The agencies’ accounts are established by applying the accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. The number of material errors found in the past was small.

Risk to the legality and regularity of transactions is medium overall, but varies

1.27. The overall risk to the legality and regularity of transactions underlying the agencies’ accounts is considered to be medium, but varies from low to high for the specific budget titles.

Title I (Staff expenditure)

1.28. Risk is generally low. Salaries are administered by the Commission’s PMO service which the Court audits within the framework of its specific assessments of administrative expenditure. No material errors were found in relation to staff expenditure in recent years. However, where agencies have to recruit a high number of additional staff within a short time, there is a medium to high risk to the legality and regularity of recruitment procedures.

Title II (Administrative expenditure)

1.29. Risk is considered to be medium. Procurements of different kinds of services, with increasing amounts related to IT, involve complex procurement rules and procedures, and agencies’ administrations sometimes do not achieve satisfactory transparency and best value for money. Serious procurement errors affecting the conditions for payments have traditionally been one of the main reasons for qualified audit opinions and observations by the Court. However, office rent is often the main cost category paid on a recurrent basis, and changes usually only occur when agencies move to new premises, so the overall risk is medium.

Title III (Operational expenditure)

1.30. The risk is considered to be low to high. This depends on the specific agencies and the type of operational expenditure they have. In general, procurement-related risks are similar to those in relation to title II, although the amounts involved can be higher. As far as grants paid under budget title III are concerned, previous audits found that, while — overall — the agencies’ controls have improved, they are not always fully effective.

Risk to Sound Financial Management (SFM) is medium

1.31. Risk to SFM is considered to be medium and mainly identified in the areas of IT and public procurement. We previously reported findings on the agencies’ diverse IT landscape and weaknesses in IT project management, as well as procurement procedures that did not ensure best value for money.

1.32. From a broader perspective, the number of small agencies (see Boxes 1.4 and 1.6 ), each with their own administrative structures and procedures, creates a risk to administrative efficiency.

CHAPTER 2

Overview of audit results

TABLE OF CONTENTS

Paragraph Page INTRODUCTION 2.1 – 2.2 16 RESULTS FROM THE ANNUAL AGENCY AUDITS FOR THE YEAR 2017 ARE POSITIVE OVERALL 2.3 – 2.49 16 ‘Clean’ opinions on the reliability of all agencies’ accounts 2.4 16 Emphasis of matter paragraphs are fundamental for the understanding of the accounts 2.5 – 2.11 16 ‘Clean’ opinions on the legality and regularity of the revenue underlying all agencies’ accounts 2.12 17 ‘Clean’ opinions on the legality and regularity of the payments underlying the agencies’ accounts, except for EASO 2.13 – 2.14 17 Other matter paragraphs address issues of specific importance 2.15 – 2.21 17 Our observations cover a range of issues 2.22 – 2.49 18 AUDIT RESULTS FROM OTHER AGENCY-RELATED REPORTS ISSUED BY THE COURT IN 2017 2.50 – 2.55 24 ECA rapid case review on the implementation of the 5 % reduction of staff posts 2.50 24 ECA special report on the SRB 2.51 – 2.53 25 ECA specific annual report on contingent liabilities arising as a result of the SRB’s performance of its tasks 2.54 26 Other ECA special reports also referring to one or more agencies 2.55 26 THE EU AGENCIES NETWORK’S REPLY 28

INTRODUCTION

2.1. This Chapter presents an overview of the results from the Court’s annual audits of the agencies for the year 2017 as well as other agency-related audit work carried out by the Court in the course of 2017.

2.2. The statements of assurance (audit opinions) on the reliability of the agencies’ accounts and the revenue and payments underlying these accounts, as well as all matters and observations not calling into question these opinions, are provided in Chapter 3 .

RESULTS FROM THE ANNUAL AGENCY AUDITS FOR THE YEAR 2017 ARE POSITIVE OVERALL

2.3. Overall, our audit of the annual accounts of the agencies for the year ended 31 December 2017 and the revenue and payments underlying them confirmed the positive results reported in previous years.

‘Clean’ opinions on the reliability of all agencies’ accounts

2.4. unqualified (‘clean’) audit opinions on the accounts of all agencies. In our opinion, these accounts present fairly, in all material respects, the agencies’ financial positions as at 31 December 2017 and the results of their operations and their cash flows for the year then ended, in accordance with the provisions of the applicable financial regulations and the accounting rules adopted by the Commission’s Accounting Officer We issuedon the accounts of all agencies. In our opinion, these accounts present fairly, in all material respects, the agencies’ financial positions as at 31 December 2017 and the results of their operations and their cash flows for the year then ended, in accordance with the provisions of the applicable financial regulations and the accounting rules adopted by the Commission’s Accounting Officer ( 13 )

Emphasis of matter paragraphs are fundamental for the understanding of the accounts

2.5. Emphasis of matter paragraphs draw the readers’ attention to matters of importance that are fundamental to the users’ understanding of the accounts.

2.6. For EASO, we drew attention to the fact that the human resources situation at the Office has deteriorated exponentially. The Office currently does not have the administrative capacity to fill the high number of vacancies. Overall, the human resources situation causes a significant risk to the continuation of the Office’s operations at the current scale.

2.7. In the case of the SRB we emphasised that Single Resolution Fund contributions are calculated on the basis of information provided by credit institutions to the Board through the national resolution authorities. However, the Single Resolution Mechanism Regulation does not provide for a comprehensive and consistent control framework to ensure the information is reliable. Furthermore, we noted that the methodology for calculating contributions laid down in the legal framework is very complex, resulting in a risk to accuracy. For confidentiality reasons the Board cannot release the credit institutions’ data used for the calculation of Fund contributions, which reduces transparency.

2.8. Ex post verifications by the Agency identified the need for considerable fee corrections, with the total amount of corrections being unknown at the end of 2017. This observation demonstrates the limitations of a system that relies excessively on self-declarations made by applicants. For ECHA the Court emphasised that the Agency is partly self-financed and receives a fee from every company applying for the registration of chemicals as required under the REACH Regulation ( 14 ) . The Agency calculates and invoices the fees on the basis of information provided by the companies on application.verifications by the Agency identified the need for considerable fee corrections, with the total amount of corrections being unknown at the end of 2017. This observation demonstrates the limitations of a system that relies excessively on self-declarations made by applicants.

2.9. For the GSA, we drew attention to the fact that the outcome of the public procurement procedure for one of the agency’s main contracts (1,5 billion euro framework contract) has been challenged by one of the tenderers.

2.10. In relation to the two London-based agencies, EMA and EBA, we drew attention to the fact that they will leave the UK in 2019 and that their accounts and related notes were prepared using the information available at the date the accounts were signed. We also referred to implications from the current lease arrangements in London and possible decreases in revenue following the UK’s departure from the EU.

2.11. For Chafea, we reported on significant weaknesses in the accounting environment.

‘Clean’ opinions on the legality and regularity of the revenue underlying all agencies’ accounts

2.12. For all agencies, we issued unqualified (‘clean’) audit opinions on the legality and regularity of the revenue underlying the annual accounts for the year ended 31 December 2017. In our opinion, revenue was legal and regular in all material respects.

‘Clean’ opinions on the legality and regularity of the payments underlying the agencies’ accounts, except for EASO

2.13. For 40 agencies, we issued unqualified (‘clean’) audit opinions on the legality and regularity of the payments underlying the annual accounts for the year ended 31 December 2017. In our opinion, payments were legal and regular in all material respects.

2.14. For EASO we issued an adverse opinion due to material and systematic instances of non-compliance of payments with the Office’s Financial Regulation and other applicable rules and provisions, mainly related to public procurement and recruitment procedures underlying payments. The systematic nature of non-compliances demonstrates an inadequate internal control system. The combined error from non-compliant payments amounts at least to 7,7 million euros or 10,3 % of the Office’s total payments made in 2017.

Other matter paragraphs address issues of specific importance

2.15. Other matters paragraphs draw the readers’ attention to matters other than those that are presented or disclosed in the annual accounts or related to the legality and regularity of revenue and payments.

2.16. For the EIT we addressed that the initial grant reimbursement rates to Knowledge and Innovation centres (KICs) were increased towards the end of the eligibility period, which goes against the purpose of encouraging KICs to become less dependent on EIT financing. Furthermore, some new activities were retroactively added to the annual business plans for two KICs. For one of the KICs, this caused a substantial change to the initial award decision. Substantial changes can affect the equal treatment of KICs and are not compliant with Financial Regulation.

2.17. In the case of Frontex, since 2014 we have consistently reported that proof of the expenditure claimed by cooperating countries was often insufficient. This was also confirmed by this year’s audit results. In response to our recommendation from 2016, Frontex is introducing a simplified cost reimbursement model.

2.18. For EBA, EIOPA and ESMA we drew attention to the fact that their budgets are financed partly from European Union funds and partly through direct contributions from EU Member States’ supervising authorities and/or supervised entities. It is possible that the authorities’ revenue will decrease in future as a result of the UK’s decision to leave the EU.

2.19. For the GSA we reported that the Agency operates both Galileo Security Monitoring Centre (GSMC) and Galileo ground stations on UK territory, which might need to be relocated.

2.20. For the CdT we referred to the fact that several agencies were making increasing use of in-house and other alternative translation solutions, which implied that the CdT’s capacity was not being utilised to the greatest possible extent. Moreover, there is a duplication of effort at European level concerning translation systems development and running costs.

2.21. In December 2016, BEREC Office requested translations from CdT for four calls for expression of interest for the establishment of staff reserve lists, even though all posts authorised by the budgetary authorities in its establishment plan were filled. In our view, there was no justification for the translation request in December 2016. The related payment made in March 2017 counted for 2,5 % of the 2017 budget.

Box 2.1

2014-2017 annual audit opinions on agencies’ accounts and transactions

Source: ECA.

Our observations cover a range of issues

2.22. We made a total of 145 observations concerning 37 agencies to highlight matters of importance and to indicate room for improvement. These observations, which can be found in Chapter 3, are summarised below. The majority of observations concern sound financial management.

Major risks leading to serious weakness in EASO

2.23. In the case of EASO we highlighted major risks inherent to the nature of the Office’s activities and extraordinary operational challenges caused by the migration crisis. Those risks were not mitigated by a solid governance structure and effective controls, which led to numerous instances of material non-compliance.

2.24. Since 2014 the Office suffered from high staff turnover and the recruitment procedures were suspended since December 2017. Moreover, the Office has neither an internal audit capability nor a legal service and systematic review of legal documents.

2.25. Almost all services audited, which were based on public procurement or recruitment procedures, were systematically affected by significant weaknesses in assessment of the Office’s needs, drafting of tender specifications, choice of the type of the contract, evaluation and award methods, amendments and extension of contracts, execution of contracts and verification of services provided, etc. Such weaknesses go against the principles of competition, transparency, equal treatment and non-discrimination.

Progress towards a more harmonised IT landscape

2.26. Agencies carry out a wide range of operational activities, requiring adequate and occasionally tailor-made IT solutions. However, key operational and administrative activities are implemented on the basis of the same legal framework, which suggests that they have similar processes that can be supported by similar IT solutions. While the agencies made very good progress in the use of similar budget management and accounting systems, as we reported in our 2016 summary report on agency audit results, there was still a multitude of IT solutions used in other key areas, such as human resources management and procurement/contract management.

2.27. Agencies are considering further harmonisation of IT solutions in these areas, mainly in order to enhance cost-efficiency, to reduce internal control risks and to strengthen IT governance. Good progress in relation to IT tools on human resources management was made in 2017, when 20 agencies signed agreements with the Commission on the use of its SYSPER II tool, which will provide for a more uniform IT landscape in the area. It is planned that the majority of agencies will use the Commission’s tool as from 1 January 2019, while some of the agencies started in the 3 rd quarter of 2018.

Box 2.2

Agencies’ introduction of common SYSPER II HR tool

Source: ECA based on information from agencies.

The introduction of e-procurement is on its way

2.28. In this fragmented scenario the use of similar electronic tools to procure supplies or services (e-procurement) would also be an important move to achieve a more harmonised IT framework among agencies. According to the Financial Regulations which entered into force in 2012 and 2013 respectively, all EU Institutions and agencies ‘…shall, to the greatest possible extent, design and implement solutions for the submission, storage and processing of data submitted in grant and procurement procedures, and to this end, shall put in place a single electronic data interchange area for applicants, candidates and tenderers’ ( 15 ) ( 16 ) . While no target date for the introduction of e-procurement was set by the Financial Regulations, the 2014 EU Public Procurement Directive ( 17 ) mandates the use of electronic means for public procurement in the EU Member States by 2018, while the 2014 EU e-Invoicing Directive ( 18 ) requires all public authorities to allow receipt of e-invoices by 2019.

2.29. As the same requirement exists for all EU Institutions, the Commission is developing a comprehensive IT solution covering all phases of public procurement procedures. While all agencies publish their calls for tender electronically via TED (Tenders Electronic Daily), the European public procurement journal, the Commission also launched tools for electronic invoicing in 2010 (e-invoicing), for the electronic publication of documents related to contract notices in the EU Official Journal in 2011 (e-tendering) and for the electronic submission of tenders in 2015 (e-submission). By the end of 2017, most agencies had introduced e-invoicing and e-tendering for certain procedures, but not e-submission.

Box 2.3

Agencies’ introduction of e-procurement tools

Source: ECA based on information from agencies.

IT consultancy and project management improving at EMA and eu-LISA

IT consultancy and project management at EMA

2.30. In the course of last year’s audit we carried out an analysis of the Agency’s management of consulting services. The excessive use of consulting firms led to a critical dependency on external expertise. We also reported that control over project development and implementation was inadequate and that projects were considerably delayed and costs were escalating.

2.31. In the course of 2017 the Agency implemented several measures to improve the situation. However, reducing the Agency’s critical dependence on consulting firms will take time and the impact of the measures taken will only be seen over the years.

IT consultancy and project management at eu-LISA

2.32. Given the nature of eu-LISA operations, the Agency uses consultancy services mainly in connection with IT projects. In 2017 the Agency’s IT projects were implemented within the budgets and timeframes set.

2.33. For the development and implementation of IT projects the agency applies an outsourcing model where some 90 % of the related work is carried out by three contractors. Although IT projects are owned by and under the control of the Agency, a model under which the evolution and development activities for such sensitive IT systems is outsourced to such an extent creates risks of over-reliance and dependency on contractors.

2.34. At the same time, the small number of staff in key operational units creates risks for the continuity of operations.

Shortcomings persist in the management of procurements

2.35. The objective underlying public procurement is to ensure competition between economic operators and to achieve the most economically advantageous purchase in a transparent, objective and consistent manner on the basis of the applicable legal framework. For 14 agencies ( BEREC Office, CEPOL, Chafea, eu-LISA, EASO, EBA, EEA, EFSA, EIGE, EUIPO, ERA, EASA, FRA and SRB ) we observed weaknesses in public procurement, mostly relating to services, that put value for money at risk. Frequent shortcomings identified include; lack of adequate balance between price and quality aspects for contract award criteria, a non-optimal design of framework contracts, the use of framework contracts that allowed the purchase of services for which specifications and/or price were not sufficiently detailed and the unjustified use of intermediary services.

Most agencies analysed BREXIT implications

2.36. On 29 March 2017 the United Kingdom (UK) notified the European Council of its decision to withdraw from the European Union (Brexit). Unlike most of the other agencies, five of them ( ACER, BEREC Office, CEPOL, ENISA, EU-OSHA ) did not carry out a comprehensive analysis of the likely Brexit impact on their organisation, operations and accounts.

Vacancy notices could be published on the EPSO website

2.37. Most of the agencies ( ACER, Cedefop, CEPOL, Chafea, EASA, EBA, ECHA, EEA, EIGE, EIOPA, EIT, EMA, EMCDDA, EMSA, ENISA, ESMA, eu-LISA, Eurojust, Europol, Frontex, GSA, SRB ) publish vacancy notices on their own websites and on social media, but frequently not on the website of the European Personnel Selection Office (EPSO). A publication on the EPSO website would increase transparency and publicity, and allow citizens to identify vacancies published by all European institutions and agencies. The main reason given by the agencies is that EPSO accepts the publication of vacancy notices only if this is done in all EU official languages, which entails high translation costs.

Fewer observations on the legality and regularity of payments

2.38. The number of observations on the legality and regularity of payments decreased to eight (2016: 11), which illustrates the agencies’ continued efforts to comply with the legal framework, particularly the provisions laid down by the Financial and Staff Regulations. While five observations again addressed weaknesses related to procurement procedures ( EASO, EASA, EIGE, Frontex ), three observations related to recruitment procedures ( EASO, Cedefop, Frontex ).

Budgetary management shows improvements

2.39. Under the Financial Regulation, budget appropriations granted for a given year can be carried over to the next year under certain conditions ( 19 ) . While the Financial Regulation does not set ceilings for such carry-overs and the multi-annual nature of operations can explain them to a considerable extent, excessive levels can indicate delays in the implementation of work programmes or procurement plans and can also be in contradiction with the budgetary principle of annuality.

2.40. Box 2.4 shows the number of agencies for which we reported on high carry-overs in 2017 and in previous years. The decrease to only two agencies ( Chafea, EU-OSHA ) in 2017 resulted from a better and more transparent explanation and justification of carry-overs by the agencies, but also by a change in our reporting approach in 2017. As from 2017, we are only reporting on carry-overs if we do not consider them sufficiently justified.

Box 2.4

Decreasing number of observations on excessive or high carry-overs

Source: ECA based on information from agencies.

2.41. In addition, we reported cancellations of budget appropriations carried over from previous years for two agencies ( Frontex, EUIPO ). These indicated an overestimation of budgetary needs, notably on the part of public administrations of Member States and other cooperating countries.

Accounting environments could be further enhanced

2.42. In the course of this year’s annual audits, we also reviewed the agencies’ accounting environments, which are an important element for the preparation of reliable accounts. In accordance with the Financial Regulation, each agency has its own accounting officer, which has led to a situation where a total of 37 accounting officers are in charge of 2 % of the European budget. The main duties of the accounting officer are; implementing payments, collecting revenue and recovering amounts, preparing, presenting and keeping the accounts, laying down and validating the accounting systems and treasury management. In order to increase efficiency in 2012 the Commission’s accounting officer invited the agencies to delegate their accounting functions to him on a contractual basis. The first agency (to accept the proposal) was CEPOL in 2014. By the end of 2017, only three more agencies (GSA, BEREC Office, ACER) had joined this arrangement.

2.43. The hierarchical position of an accounting officer within an agency can affect his independence. In particular, accounting officers need to be independent from anyone having (sub-) delegation to authorise commitments and payments. We see a need to strengthen the accounting officer’s independence by making him directly responsible to the Agency’s Director (administratively) and Board (functionally). This observation was included for a total of 13 agencies ( CdT, EACEA, EASA, EASME, EEA, EFSA, EIOPA, EMA, EMCDDA, ERA, EU-OSHA, Eurofound, FRA ). This would also require the appointment and annual appraisal of the accounting officer to be the responsibility of the Board.

2.44. The Financial Regulation requires accounting officers to confirm the reliable functioning of the agencies’ accounting systems (validation). While for most of the agencies their accounting systems are covered by up-to-date validations, we found that major changes made to the accounting systems of seven of the agencies ( ACER, BEREC Office, CEPOL, EASME, EIT, EMA, GSA ) require a timely re-validation.

Box 2.5

Independence of agencies’ accounting officers and re-validation of accounting system overdue

Source: ECA based on information from agencies.

We found internal control weaknesses in some agencies

2.45. For three agencies ( EASO, CPVO, REA ) the documentation relating to procurements, grant awards or recruitment procedures was inadequate.

2.46. Some weakness in the implementation of the internal control standard concerning their business continuity plan were identified for three agencies ( ACER, EIT, Frontex ). These weaknesses might create a considerable risk to business continuity in the event of major disasters, as data might be lost irretrievably.

Agencies are following up on previous years’ audit findings

2.47. Where applicable, we provided a status report on follow-up actions taken by the agencies in response to observations from previous years.

Box 2.6 shows that for the 170 observations that had not been addressed at the end of 2016, corrective action was completed or ongoing in most cases. Out of the 13 outstanding observations, the corrective action needed in relation to 3 observations was not under the agency’s control.

Box 2.6

Agencies’ efforts to follow up previous years’ observations

Source: ECA.

We report suspected fraud to OLAF

2.48. Fraud is an act of deliberate deception to gain a benefit. We report all suspected fraud cases detected during our audit work to OLAF, the European Union’s anti-fraud office. It is then up to OLAF to investigate and follow up these cases, where appropriate in co-operation with national judicial authorities. In 2017, we found and reported to OLAF three instances of suspected fraud in the approximately 1 000 transactions and 150 procurement procedures that we audited for our statements of assurance on the agencies. The instances of suspected fraud concerned procurement irregularities.

We provide information on the Commission’s internal audit service (IAS) and external evaluation reports

2.49. We also referred, for information, to audit reports prepared by the IAS and to external evaluation reports prepared on behalf of the Commission. In 2017, there were 26 IAS reports and 9 instances where an external evaluation of an agency was carried out. We did not verify the related audit or evaluation processes.

AUDIT RESULTS FROM OTHER AGENCY-RELATED REPORTS ISSUED BY THE COURT IN 2017

ECA rapid case review on the implementation of the 5 % reduction of staff posts

2.50. Box 2.7 shows the impact of the percentage change on the staff posts in the establishment plans of all institutions, bodies and agencies. In 2017 the Court issued a rapid case review ( 20 ) on how European Union institutions and agencies implemented the commitment made to cut 5 % of staff in their establishment plans during the period 2013-2017 (for agencies 2014-2018). For the agencies we concluded that the 5 % reduction had been implemented, albeit with some delays. Whilst decentralised agencies with traditional tasks managed to decrease staff by 8,9 %, staff increased by 19,9 % and 42,9 % for the new tasks and responsibilities of some decentralised and executive agencies respectively.shows the impact of the percentage change on the staff posts in the establishment plans of all institutions, bodies and agencies.

Box 2.7

Analysis of the variations in staff post numbers in the establishment plans between 2012 and 2017 (in percentage)

Source: ECA.

ECA special report on the SRB

2.51. The Brussels-based Single Resolution Board (SRB) was set up in August 2014 as part of the policy response to the financial crisis. Its mission is the resolution of any of the banks within its remit if they are failing. In January 2017 the SRB had 139 banks including 130 banking groups under its remit ( 21 )

2.52. The special audit ( 22 ) examined whether the SRB is equipped to carry out bank resolutions effectively and analysed the quality of the SRB’s resolution planning for individual banks, whether the SRB was adequately set up to comply with its statutory framework for resolution planning and whether the SRB had adequate human resources to carry out its tasks.

2.53. We found shortcomings in all of these areas, although the set-up of the SRB as a completely new structure was a very significant challenge and any weaknesses must be seen in this context. We made a number of recommendations relating to the preparation of resolution plans and completing its rules and guidance and on the improvement of staffing levels and HR procedures.

ECA specific annual report on contingent liabilities arising as a result of the SRB’s performance of its tasks

2.54. ex ante contributions, which rose to 1 420 million euros as of 30 September 2017. No bank resolutions were initiated by the SRB in 2016 and consequently no contingent liability was to be disclosed in relation to resolution decisions for the financial year 2016. However, due to the resolution decision taken on Banco Popular Español S.A. in June 2017, 90 legal cases had been brought against the SRB before the General Court of the European Court of Justice (ECJ) and 46 appeals submitted to the SRB’s appeal panel by the end of October 2017 when our 2016 report on contingent liabilities arising as a result of the SRB’s performance of its tasks was published. The Commission and the Council had been notified of 26 cases brought before the General Court of the ECJ in connection with that same resolution decision. The related contingent liabilities will be subject to our audit and report for the financial year 2017. The Single Resolution Mechanism Regulation provides ( 23 ) that the Court must prepare a report on any contingent liabilities arising as a result of the performance by the SRB, the Council and the Commission of their tasks under this Regulation. As of 31 December 2016, the SRB’s contingent liability amounted to 842 million euros fromcontributions, which rose to 1 420 million euros as of 30 September 2017. No bank resolutions were initiated by the SRB in 2016 and consequently no contingent liability was to be disclosed in relation to resolution decisions for the financial year 2016. However, due to the resolution decision taken on Banco Popular Español S.A. in June 2017, 90 legal cases had been brought against the SRB before the General Court of the European Court of Justice (ECJ) and 46 appeals submitted to the SRB’s appeal panel by the end of October 2017 when our 2016 report on contingent liabilities arising as a result of the SRB’s performance of its tasks was published. The Commission and the Council had been notified of 26 cases brought before the General Court of the ECJ in connection with that same resolution decision. The related contingent liabilities will be subject to our audit and report for the financial year 2017.

Other ECA special reports also referring to one or more agencies

2.55. Apart from audit reports specifically dedicated to the agencies, in the course of 2017 we also issued a number of special audit reports on EU policy implementation which referred to a number of agencies (see Box 2.8 ).

Box 2.8

Other ECA special audit reports referring to agencies

Source: ECA.

THE EU AGENCIES NETWORK’S REPLY

The Agencies appreciate the Court’s positive conclusions on the reliability of their accounts and the transactions underlying them.

2.27. The Network would like to express its concern that given the fact that the Commission only provides a basic package of modules to Agencies in Sysper, Agencies have been and will be obliged to continue maintaining separate tools such as, e.g. for appraisal, teleworking, flexitime and HR reporting. The IT landscape in HR management will therefore only partially become more uniform and much less so than the Commission could have decided to.

Agencies are also investigating the possibility to adopt a shared service solution supporting recruitment processes currently not covered by Sysper.

2.39. In the area of procurement, there has been a clear trend towards harmonisation of the e-tools in the recent 2 years. It started softly back in 2015-16 when e-Prior e-procurement suite designed by DIGIT in coordination with BUDG was created. Since then this suite of e-modules covering all the phases of the procurement cycle became more and more a standard to which the EU Agencies are adhering. In 2018 this trend further intensified with new e-submission modules and ABAC LCK module being introduced and open to Agencies. While still to be developed e-evaluation and e-award modules. Agencies step by step abandon their own isolated tools, some more quickly, other more slowly, but this trend is unstoppable.

2.42. The suggested efficiency gains that a delegation to the European Commission could lead to are in reality hard to achieve. It is the not the sum of the budget that decides the workload only, but the finalisation of the accounts in a tight window at the beginning of the year. The experience is that when having to conclude more than one set of accounts (i.e. with additional funding via delegation agreements) it requires almost double the manpower despite smaller amounts (and fewer transactions). By delegating to the Commission, each Agency is still required to have a so-called ‘antenna’ as there will still be accounting-related tasks to be implemented. Hence competencies related to accounting would have to be kept, and given this the specialisation the minor gain in released efforts cannot be redeployed to other tasks. As long as this is the case, the saving will not be a full-time equivalent. In addition hereto is the annual fee that has to be paid. Consequently few Agencies have chosen to delegate this task to the Commission.

2.43. The Network would like to underline that there is no background or risk analysis that can justify the conclusion that the accountants independence will increase by reporting directly to the Authorising Officer as opposed to an Authorising Officer by delegation. Some Agencies opted for the adoption of a Charter for the Accounting Officer including provisions for reporting to the Governing Board if required.

CHAPTER 3

Statements of Assurance and other agency-specific audit results

TABLE OF CONTENTS

3.1. Information in support of the statements of assurance 31

AGENCIES FUNDED UNDER MFF HEADING 1A — COMPETITIVENESS FOR GROWTH AND JOBS 33

3.2. Agency for the Cooperation of Energy Regulators (ACER) 33

3.3. Body of European Regulators for Electronic Communications (BEREC) 38

3.4. European Centre for the Development of Vocational Training (Cedefop) 43

3.5. European Aviation Safety Agency (EASA) 46

3.6. European Banking Authority (EBA) 51

3.7. European Chemicals Agency (ECHA) 56

3.8. European Insurance and Occupational Pensions Authority (EIOPA) 61

3.9. European Institute of Innovation and Technology (EIT) 64

3.10. European Maritime Safety Agency (EMSA) 75

3.11. European Union Agency for Network and Information Security (ENISA) 79

3.12. European Union Agency for Railways (ERA) 83

3.13. European Securities and Markets Authority (ESMA) 87

3.14. European Agency for Safety and Health at Work (EU-OSHA) 90

3.15. European Foundation for the Improvement of Living and Working Conditions (Eurofound) 94

3.16. European GNSS (Global Navigation Satellite System) Agency (GSA) 98

AGENCIES FUNDED UNDER MFF HEADING 2 — SUSTAINABLE GROWTH: NATURAL RESOURCES 103

3.17. European Environment Agency (EEA) 103

3.18. European Fisheries Control Agency (EFCA) 109

AGENCIES FUNDED UNDER MFF HEADING 3 — SECURITY AND CITIZENSHIP 112

3.19. European Union Agency for Law Enforcement Training (CEPOL) 112

3.20. European Asylum Support Office (EASO) 116

3.21. European Centre for Disease Prevention and Control (ECDC) 128

3.22. European Food Safety Authority (EFSA) 132

3.23. European Institute for Gender Equality (EIGE) 136

3.24. European Medicines Agency (EMA) 141

3.25. European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) 149

3.26. European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA) 153

3.27. The European Union’s Judicial Cooperation Unit (Eurojust) 161

3.28. European Union Agency for Law Enforcement Cooperation (Europol) 165

3.29. European Union Agency for Fundamental Rights (FRA) 169

3.30. European Border and Coast Guard Agency (Frontex) 173

AGENCIES FUNDED UNDER MFF HEADING 4 — GLOBAL EUROPE 184

3.31. European Training Foundation (ETF) 184

AGENCIES FUNDED UNDER MFF HEADING 5 — ADMINISTRATION 188

3.32. Euratom Supply Agency (Euratom) 188

SELF-FINANCED AGENCIES 191

3.33. Community Plant Variety Office (CPVO) 191

3.34. European Intellectual Property Office (EUIPO) 195

3.35. Single Resolution Board (SRB) 199

3.36. Translation Centre for the Bodies of the European Union (CdT) 205

COMMISSION EXECUTIVE AGENCIES 209

3.37. Education, Audiovisual and Culture Executive Agency (EACEA) 209

3.38. Executive Agency for Small and Medium-sized Enterprises (EASME) 213

3.39. European Research Council Executive Agency (ERCEA) 217

3.40. Innovation and Networks Executive Agency (INEA) 221

3.41. Research Executive Agency (REA) 225

3.42. Consumers, Health, Agriculture and Food Executive Agency (Chafea) 229

3.1. INFORMATION IN SUPPORT OF THE STATEMENTS OF ASSURANCE

Basis for opinions

3.1.1. We conducted our audit in accordance with the IFAC International Standards on Auditing (ISAs) and Codes of Ethics and the INTOSAI International Standards of Supreme Audit Institutions (ISSAIs). Our responsibilities under those standards are further described in the Auditor’s responsibilities section of our report. We are independent in accordance with the International Ethics Standards Board for Accountants’ Code of Ethics for Professional Accountants (IESBA Code) together with the ethical requirements that are relevant to our audit, and we have fulfilled our other ethical responsibilities in accordance with these requirements and the IESBA Code. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion.

Responsibilities of management and those charged with governance

3.1.2. In accordance with Articles 310 to 325 of the TFEU and the agencies’ Financial Regulations, agencies’ management is responsible for the preparation and presentation of their accounts on the basis of internationally accepted accounting standards for the public sector and for the legality and regularity of the transactions underlying them. This includes the design, implementation and maintenance of internal controls relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error. Management is also responsible for ensuring that the activities, financial transactions and information reflected in the financial statements are in compliance with the authorities which govern them. Agencies’ managements bear the ultimate responsibility for the legality and regularity of the transactions underlying the accounts of the agencies.

3.1.3. In preparing the accounts, management is responsible for assessing an agency’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless management either intends to liquidate the entity or to cease operations, or has no realistic alternative but to do so.

3.1.4. Those charged with governance are responsible for overseeing the agencies’ financial reporting process.

Auditor's responsibilities for the audit of the accounts and underlying transactions

3.1.5. Our objectives are to obtain reasonable assurance about whether the accounts of the agencies are free from material misstatement and the transactions underlying them are legal and regular and to provide, on the basis of our audit, the European Parliament and the Council or the other respective discharge authorities with statements of assurance as to the reliability of the agencies’ accounts and the legality and regularity of the transactions underlying them. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit will always detect a material misstatement or non-compliance when it exists. These can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these accounts.

3.1.6. For revenue, we verify subsidies received from the Commission or cooperating countries and assess the agencies’ procedures for collecting fees and other income, if any.

3.1.7. For expenditure, we examine payment transactions when expenditure has been incurred, recorded and accepted. This examination covers all categories of payments (including those made for the purchase of assets) other than advances at the point they are made. Advance payments are examined when the recipient of funds provides justification for their proper use and an agency accepts the justification by clearing the advance payment, whether in the same year or later.

3.1.8. As part of an audit in accordance with ISAs and ISSAIs, we exercise professional judgment and maintain professional scepticism throughout the audit. We also: — Identify and assess the risks of material misstatement of the accounts and of material non-compliance of the underlying transactions with the requirements of the legal framework of the European Union, whether due to fraud or error, design and perform audit procedures responsive to those risks, and obtain audit evidence that is sufficient and appropriate to provide a basis for our opinions. The risk of not detecting a material misstatement or non-compliance resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. — Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the internal control. — Evaluate the appropriateness of accounting policies used and the reasonableness of accounting estimates and related disclosures made by management. — Conclude on the appropriateness of management’s use of the going concern basis of accounting and, based on the audit evidence obtained, whether a material uncertainty exists related to events or conditions that may cast significant doubt on an agency’s ability to continue as a going concern. If we conclude that a material uncertainty exists, we are required to draw attention in our auditor’s report to the related disclosures in the accounts or, if such disclosures are inadequate, to modify our opinion. Our conclusions are based on the audit evidence obtained up to the date of our auditor’s report. However, future events or conditions may cause an entity to cease to continue as a going concern. — Evaluate the overall presentation, structure and content of the accounts, including the disclosures, and whether the accounts represent the underlying transactions and events in a manner that achieves fair presentation. — Obtain sufficient appropriate audit evidence regarding the financial information of the agencies to express an opinion on the accounts and transactions underlying them. We are responsible for the direction, supervision and performance of the audit. We remain solely responsible for our audit opinion. — Considered the audit work of the independent external auditor performed on the agencies’ accounts as stipulated in Article 208(4) of the EU Financial Regulation (24), where applicable.

3.1.9. We communicate with the management regarding, among other matters, the planned scope and timing of the audit and significant audit findings, including any significant deficiencies in internal control that we identify during our audit.

3.1.10. From the matters communicated with the agencies, we determine those matters that were of most significance in the audit of the accounts of the current period and are therefore the key audit matters. We describe these matters in our auditor’s report unless law or regulation precludes public disclosure about the matter or when, in extremely rare circumstances, we determine that a matter should not be communicated in our report because the adverse consequences of doing so would reasonably be expected to outweigh the public interest benefits of such communication.

Agencies funded under MFF heading 1a — Competitiveness for growth and jobs

3.2. AGENCY FOR THE COOPERATION OF ENERGY REGULATORS (ACER)

INTRODUCTION

3.2.1. The Agency for the Cooperation of Energy Regulators (hereinafter ‘the Agency’, aka ‘ACER’), which is located in Ljubljana, was created by Regulation (EC) No 713/2009 of the European Parliament and of the Council ( 25 ) . The Agency's main task is to assist National Regulatory Authorities in exercising, at Union level, the regulatory tasks that they perform in the Member States and, where necessary, to coordinate their action. Under the REMIT regulation ( 26 ) , the Agency was given additional responsibilities, together with national regulatory authorities, regarding the monitoring of the European wholesale energy market.

3.2.2. Table presents key figures for the Agency Thepresents key figures for the Agency ( 27 ) Table Key figures for the Agency 2016 2017 Budget (million euros) 16 13 Total staff as at 31 December (28) 103 91 Source: budget published in OJ.

THE COURT’S STATEMENT OF ASSURANCE PROVIDED TO THE EUROPEAN PARLIAMENT AND THE COUNCIL — INDEPENDENT AUDITOR’S REPORT

OPINION 3.2.3. We have audited: (a) the accounts of the Agency which comprise the financial statements (29) and the reports on the implementation of the budget (30) for the financial year ended 31 December 2017; and (b) the legality and regularity of the transactions underlying those accounts, as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). Reliability of the accounts Opinion on the reliability of the accounts 3.2.4. In our opinion, the accounts of the Agency for the year ended 31 December 2017 present fairly, in all material respects, the financial position of the Agency at 31 December 2017, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. Legality and regularity of the transactions underlying the accounts Revenue Opinion on the legality and regularity of revenue underlying the accounts 3.2.5. In our opinion, revenue underlying the accounts for the year ended 31 December 2017 is legal and regular in all material respects. Payments Opinion on the legality and regularity of payments underlying the accounts 3.2.6. In our opinion, payments underlying the accounts for the year ended 31 December 2017 are legal and regular in all material respects.

3.2.7. The observations which follow do not call the Court’s opinion into question.

OBSERVATIONS ON THE RELIABILITY OF THE ACCOUNTS

3.2.8. In the course of this year’s audit of all EU agencies, we did an analysis of the accounting environments, including the aspect of the timely (re-)validation of accounting systems. In October 2017 the Agency delegated its accounting function to the Commission’s Accounting Officer. Despite this significant change, the last validation of the accounting system was done in 2011.

OBSERVATIONS ON INTERNAL CONTROLS

3.2.9. In 2011, an additional task in the area of wholesale energy market monitoring (REMIT) was assigned to the Agency. In 2017, all the elements foreseen by the REMIT monitoring framework were in force for the first time. However, while initially a disaster data recovery site for REMIT was established in Maribor, Slovenia, this was moved in April 2017 to the Agency’s main data centre in Ljubljana. Consequently, the backup data now is stored at the same location as the original data. This causes a considerable risk to business continuity in case of major disasters, as data might get lost irrevocably.

OBSERVATIONS ON SOUND FINANCIAL MANAGEMENT AND ON PERFORMANCE

3.2.10. On 29 March 2017 the United Kingdom (UK) notified the European Council of its decision to withdraw from the European Union (Brexit). Unlike most of the other agencies, the Agency did not carry out a comprehensive analysis of the likely Brexit impact on its organisation, operations and accounts.

3.2.11. The Agency publishes vacancy notices on its own website and in social media, but usually not on the website of the European Personnel Selection Office (EPSO), which would increase transparency, publicity and allow citizens to identify vacancies published by the different European Institutions and agencies collectively.

3.2.12. According to their Framework Financial Regulation, agencies should introduce a single solution for the electronic exchange and storage of information with third parties participating in public procurement procedures (e-procurement) ( 31 ) ( 32 ) . As the same requirement exists for all EU Institutions, the Commission is developing a comprehensive IT solution covering all phases of public procurement procedures. The Commission launched tools for electronic invoicing in 2010 (e-invoicing), for the electronic publication of documents related to contract notices in the EU Official Journal in 2011 (e-tendering) and for the electronic submission of tenders in 2015 (e-submission). By the end of 2017, the Agency had not yet introduced any of these tools.

INFORMATION ON INTERNAL AUDIT SERVICE REPORTS

3.2.13. In 2017, the Commission’s Internal Audit Service issued an audit report on ‘Human Resources Management’ at ACER ( 33 ) . The Agency prepared an action plan to address some potential areas for improvement.

FOLLOW-UP OF PREVIOUS YEARS’ OBSERVATIONS

3.2.14. An overview of the corrective action taken in response to the Court's observations from previous years is provided in the Annex.

ANNEX

Follow-up of previous years’ observations

Year Court's observations Status of corrective action (Completed / Ongoing / Outstanding / N/A) 2014 According to the Seat Agreement between the Agency and the Slovenian government a European School will be established in Slovenia. However, more than four years after the agreement no European School has been set up. Ongoing 2016 In its audit report dated May 2016, the Commission’s Internal Audit Service (IAS) highlighted a strong need to clarify roles and responsibilities and to analyse workload in the procurement cell in order to achieve more efficient processes and procedures. It also concluded that procurement planning and monitoring needs to be significantly improved. The Agency and IAS agreed on a plan to take corrective action. Ongoing 2016 The Agency carried over 4,9 million euros, i.e. 86 % of committed appropriations for Title III operational expenditure (2015: 1,4 million euros, i.e. 59 %). As was the case in previous years, carry-overs mainly relate to the implementation of the REMIT Regulation on wholesale energy market integrity and transparency with 4,7 million euros in 2016 (2015: 1,1 million euros). For Title II administrative expenditure the Agency carried over 1 million euros, i.e. 38 % of committed appropriations (2015: 0,8 million euros, i.e. 35 %). N/A 2016 The increasing level of carry-overs is a matter of concern and in contradiction with the budgetary principle of annuality. It is directly linked to a concentration of procurement procedures finalised and contracts signed late in the year, leading to deliveries and/or payments in the following year. In 2016, 98 out of 299 contracts were signed in November and December (5 976 122,47 euros or 40 % of the total value of contracts concluded in 2016). The Agency may consider introducing differentiated budget appropriations to better reflect the multi-annual nature of operations and unavoidable delays between the signature of contracts, deliveries and payments. Ongoing

THE AGENCY’S REPLY

3.2.8. The Agency agrees with the finding and would like to clarify that the Agency is recording all its financial transactions in the financial system provided by the European Commission, which is updated, maintained and validated by the Commission. With the accounting services outsourced to the Commission as from October 2017, the Agency will accept the validation of the accounting system that will be provided by the Commission in 2018.

3.2.9. Ever since the ARIS Primary and Disaster Recovery sites were migrated to the internal ACER Data Centre in early April 2016 and integrated into one single site to optimise and advance performance and address increasing space requirements in June 2017, business continuity can no longer be ensured. However, it has to be noted that the current situation, in which business continuity cannot be guaranteed, has been forced onto the Agency by the significant reduction in its budget over the last two years. The Agency has repeatedly alerted the Commission and the Budgetary Authority of the severe consequences of the budgetary limitations it faces, but without any result in terms of additional resources. The Agency will continue to assess the possibility to re-establish a disaster recovery site for ARIS, but currently does not have the budget to do so in 2018. The re-establishment of the disaster recovery site would require the Agency to be provided with additional financial resources.

3.2.10. Given that the risks related to Brexit have been considered very low and limited, the possible impact of Brexit was only informally analysed by the management in 2017. In early 2018 the Agency conducted a comprehensive analysis on the impact of Brexit on its governance, operations and financial areas highlighting the impact and actions required.

3.2.11. In 2014 the Administrative Board of the Agency adopted Decision AB No 15/2014 on the language regime of the Agency. Despite this, the Agency still has to translate the vacancy notices published on the EPSO website in all official EU languages. Due to its severe financial resource limitations, repeatedly highlighted to the Budgetary Authority, the Agency cannot afford the cost of translation of every vacancy notice in all the EU official languages, in order for these notices to be published on the EPSO website. Still, in 2017, four of the nine vacancy notices, including two open calls, were published on the EPSO website and thus translated in all EU official languages. The remaining five vacancy notices for posts in operational departments were published only on the Agency website, as these were mainly of interest to candidates already working in the sector, who typically follow the activities of the Agency, including our website. This approach struck a pragmatic balance between reaching out to potential candidates and an efficient use of the limited resources.

3.2.12. The Agency is not yet using the Commission’s IT solution for e-invoicing, e-tendering and e-submission. In the course of 2018 the Agency will start with e-tendering which will subsequently be extended with the use of e-submission and e-invoicing during the course of 2019.

3.2.13. Following the report of the Commission’s Internal Audit Services (IAS) on ‘Human Resources Management’ the Agency has agreed with the IAS on an action plan and is currently implementing the recommended improvements.

3.3. BODY OF EUROPEAN REGULATORS FOR ELECTRONIC COMMUNICATIONS (BEREC)

INTRODUCTION

3.3.1. The Office of the Body of European Regulators for Electronic Communications (hereinafter ‘the Office’), which is located in Riga, was established by Regulation (EC) No 1211/2009 of the European Parliament and of the Council ( 34 ) . The Office’s main task is to provide professional and administrative support services to the Body of European Regulators for Electronic Communications (BEREC) and, under the guidance of the Board of Regulators, to collect and analyse information on electronic communications and to disseminate among National Regulatory Authorities regulatory best practices such as common approaches, methodologies or guidelines on the implementation of the EU regulatory framework.

3.3.2. Table presents key figures for the Office Thepresents key figures for the Office ( 35 ) Table Key figures for the Office 2016 2017 Budget (million euros) (36) 4 4 Total staff as at 31 December (37) 27 27 Source: data provided by the Office

THE COURT’S STATEMENT OF ASSURANCE PROVIDED TO THE EUROPEAN PARLIAMENT AND THE COUNCIL — INDEPENDENT AUDITOR’S REPORT

OPINION 3.3.3. We have audited: (a) the accounts of the Office which comprise the financial statements (38) and the reports on the implementation of the budget (39) for the financial year ended 31 December 2017; and (b) the legality and regularity of the transactions underlying those accounts, as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). Reliability of the accounts Opinion on the reliability of the accounts 3.3.4. In our opinion, the accounts of the Office for the year ended 31 December 2017 present fairly, in all material respects, the financial position of the Office at 31 December 2017, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. Legality and regularity of the transactions underlying the accounts Revenue Opinion on the legality and regularity of revenue underlying the accounts 3.3.5. In our opinion, revenue underlying the accounts for the year ended 31 December 2017 is legal and regular in all material respects. Payments Opinion on the legality and regularity of payments underlying the accounts 3.3.6. In our opinion, payments underlying the accounts for the year ended 31 December 2017 are legal and regular in all material respects. Other matter 3.3.7. In December 2016, the Office requested translations from CdT for four calls for expression of interest for the establishment of staff reserve lists, even though all posts authorised by the budgetary authorities in its establishment plan were filled. In our view, there was no justification for the translation request in December 2016. The related payment made in March 2017 amounted to 106 432,50 euros (i.e. 2,5 % of the 2017 budget).

3.3.8. The observations which follow do not call the Court’s opinion into question.

OBSERVATIONS ON THE RELIABILITY OF THE ACCOUNTS

3.3.9. In the course of this year’s audit of all EU agencies, we did an analysis of the accounting environments, including the aspect of the timely (re-)validation of accounting systems. The Office delegated its accounting function to the Commission’s Accounting Officer in 2016. In 2017, the Office introduced a new paperless system. While these events caused significant modifications to the Office’s procedures and the accounting system, it was not re-validated since 2013.

OBSERVATIONS ON BUDGETARY MANAGEMENT

3.3.10. In December 2017, the Office signed both legal and budgetary commitments of 20 000 euros for a training planned for the end of March 2018. The financing of 2018 activities from the 2017 budget is in contradiction with the budgetary principle of annuality.

OBSERVATIONS ON SOUND FINANCIAL MANAGEMENT AND ON PERFORMANCE

3.3.11. In August 2015, the Office launched a call for tender to conclude a four-year multiple framework service contract in cascade with an estimated market volume of 3 million euros for the organisation and planning of events such as meetings, workshops, conferences, etc. The award criteria did not attach sufficient weight to the price element. Furthermore, the potential event costs were not covered by the competitive procedure, but only the tenderer’s management fee. The procurement procedure, therefore, did not ensure adequate competition on price and the contract may not represent the most economically advantageous offer.

3.3.12. According to their Framework Financial Regulation, agencies should introduce a single solution for the electronic exchange and storage of information with third parties participating in public procurement procedures (e-procurement) ( 40 ) ( 41 ) . As the same requirement exists for all EU Institutions, the Commission is developing a comprehensive IT solution covering all phases of public procurement procedures. the Commission launched tools for electronic invoicing in 2010 (e-invoicing), for the electronic publication of documents related to contract notices in the EU Official Journal in 2011 (e-tendering) and for the electronic submission of tenders in 2015 (e-submission). By the end of 2017 the Office had introduced e-tendering for certain procedures, but not e-invoicing and e-submission.

3.3.13. On 29 March 2017 the United Kingdom (UK) notified the European Council of its decision to withdraw from the European Union (Brexit). Unlike most of the other agencies, the Office did not carry out a comprehensive analysis of the likely Brexit impact on its organisation, operations and accounts.

FOLLOW-UP OF PREVIOUS YEARS’ OBSERVATIONS

3.3.14. An overview of the corrective action taken in response to the Court's observations from previous years is provided in the Annex.

ANNEX

Follow-up of previous years’ observations

Year Court's observations Status of corrective action (Completed / Ongoing / Outstanding / N/A) 2014 The 2014 budget provision for contributions from EFTA’s (42) national regulatory authorities having observer status at BEREC did not materialise in the absence of agreements with EFTA countries. Outstanding (Not under the Office’s control) 2016 In March 2016 the Office launched a procurement procedure with the aim to sign one framework contract (FWC) with the two existing international schools in Riga for the children of its staff. While the technical specifications of the tender state that the Office would establish one multiple framework contract in cascade with two economic operators, the award criteria state that the choice of the school is with the parents. Consequently, the 400 000 euros framework contract signed in July 2016 is based on contradicting concepts, causing legal uncertainty to the Office and the schools. Moreover, in this specific case a FWC was unnecessary. N/A 2016 Following reclassification, one staff member was assigned to a higher grade directly at step 2 instead of step 1, which is not in line with the EU Staff Regulations. N/A 2016 In March 2016 the Office signed a 60 000 euros for the provision of human resources related professional support and consultancy services. The procurement procedure was exclusively based on price. The engagement of a consultant without considering competence and expertise as award criteria does not ensure best value for money. N/A 2016 In 2016, the average employment period in the Office was 2,58 years and staff turnover was high with 25 %. This situation affects the Office’s efficiency and poses risks to the implementation of its work programmes. A possible reason is the salary correction coefficient applied for the host state (73 % as at 1 July 2016). Completed 2016 The Office’s founding regulation does not require periodical external performance evaluations. The Office should, together with the Commission, consider commissioning such an evaluation at least every five years, as is the case for most of the other Agencies. Any future revision of the founding regulation should introduce such a requirement. Outstanding (Not under the Office’s control)

THE OFFICE’S REPLY

3.3.7. In view of the high staff turnover identified by the management as a risk factor to execute its work programme the Management Committee (MC) of the BEREC Office requested the establishment of reserve lists for minimum 75 % ( 43 ) of the job profiles in the Agency. To comply with the obligation to publish the calls for expression of interest ( 44 ) on EPSO website ( 45 ) BEREC Office needed to translate the documents in all official languages of the EU. The use of pre-established reserve lists enables the Agency to comply with the requirement of the MC to keep the vacancy rate below 15 % and to send job offers with 1 month from the establishment of a recruitment need. To reduce the high expenses on mandatory translations in the future, the BEREC Office plans to develop standard templates of calls and short specific parts for translations.

3.3.9. In 2016 BEREC Office outsourced its accounting services to the European Commission (EC). Therefore the EC Accounting Officer (within DG Budget) provides all services required by Articles 50 of the Framework Financial Regulation applicable to Agencies, including validation of local systems. The validation approach is currently under way and announced by the EC Accounting Officer via an official note under ref: Ares(2018)3149885 on 14 June 2018. The EC Accounting Officer’s services will conclude the process and issue a report on the results during the 4th quarter of 2018.

3.3.10. BEREC Office started preparation for the training event already in November 2017, having contacted the potential trainers and reviewing the availability of the venues. Therefore, it was necessary to sign the contract with the event organiser to ensure the availability of trainers and moderators and to secure the venue for the planned dates of the training. The contract was signed in December 2017 and consequently a budget commitment was opened prior to the contract signature, as required by the Financial Regulation. Experiences show that to organise a training event in the first quarter of a year is very challenging without a carry-over from the previous year so for future training events the BEREC Office will consider different timing.

3.3.11. The choice of a FWC was made in 2015. At that time a ‘cost-plus-fixed-fee contract’ was considered as compliant with the Financial Regulation since several cost-plus-fixed-fee contracts were and are still currently used by other EU institutions (e.g. travel agency or banking services). Due to the specificities of the BEREC operation a large part of the expenses related to BEREC events covered by the BEREC Office are related to reimbursement of experts, mainly to public bodies established in the EU Member States (e.g. national regulatory authorities — NRAs). It should therefore be noted that the contractor has no influence on this type of expenditure. Further to the comments and valuable exchange of views with ECA, in the relaunch of the procurement the BEREC Office will consider also other types of FWCs, which did not exist under the legal framework in force in 2015.

3.3.12. The BEREC Office takes note on the Court’s observations and informs the latter that it is planning to implement these modules by the end on 2018, taking into consideration the budget availability of the Agency.

3.3.13. Currently the Agency does not employ UK nationals, who might be affected. The impact on the Agency workload could be assessed only after the final decision on the relations between the EU and the UK. Having in mind the fact that the BEREC Office budgets and staffing were not amended when Croatia joined the EU to address the additional expenditure and workload and considering the small budget of the BEREC Office, similar approach could be expected with the Brexit.

3.4. EUROPEAN CENTRE FOR THE DEVELOPMENT OF VOCATIONAL TRAINING (CEDEFOP)

INTRODUCTION

3.4.1. The European Centre for the Development of Vocational Training (hereinafter ‘the Centre’, aka ‘Cedefop’), which is located in Thessaloniki, was established by Council Regulation (EEC) No 337/75 ( 46 ) . Its core mandate is to serve the development of vocational training at Union level. In order to achieve this objective, it has the task of compiling and disseminating documentation on vocational training systems.

3.4.2. Table presents key figures for the Centre Thepresents key figures for the Centre ( 47 ) Table Key figures for the Centre 2016 2017 Budget (million euros) (48) 18 18 Total staff as at 31 December (49) 122 117 Source: data provided by the Centre

THE COURT’S STATEMENT OF ASSURANCE PROVIDED TO THE EUROPEAN PARLIAMENT AND THE COUNCIL — INDEPENDENT AUDITOR’S REPORT

OPINION 3.4.3. We have audited: (a) the accounts of the Centre which comprise the financial statements (50) and the reports on the implementation of the budget (51) for the financial year ended 31 December 2017; and (b) the legality and regularity of the transactions underlying those accounts, as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). Reliability of the accounts Opinion on the reliability of the accounts 3.4.4. In our opinion, the accounts of the Centre for the year ended 31 December 2017 present fairly, in all material respects, the financial position of the Centre at 31 December 2017, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. Legality and regularity of the transactions underlying the accounts Revenue Opinion on the legality and regularity of revenue underlying the accounts 3.4.5. In our opinion, revenue underlying the accounts for the year ended 31 December 2017 is legal and regular in all material respects. Payments Opinion on the legality and regularity of payments underlying the accounts 3.4.6. In our opinion, payments underlying the accounts for the year ended 31 December 2017 are legal and regular in all material respects.

3.4.7. The observations which follow do not call the Court’s opinion into question.

OBSERVATIONS ON THE LEGALITY AND REGULARITY OF TRANSACTIONS

3.4.8. The management of two recruitment procedures for management positions was weak and the procedures are considered irregular. There was insufficient proof of the requested managerial experience and confidentiality requirements were not met, calling into question the equal treatment of candidates.

OBSERVATIONS ON SOUND FINANCIAL MANAGEMENT AND ON PERFORMANCE

3.4.9. The Centre publishes vacancy notices on its own website and in social media, but usually not on the website of the European Personnel Selection Office (EPSO), which would increase transparency, publicity and allow citizens to identify vacancies published by the different European Institutions and agencies collectively.

3.4.10. According to their Framework Financial Regulation, agencies should introduce a single solution for the electronic exchange and storage of information with third parties participating in public procurement procedures (e-procurement) ( 52 ) ( 53 ) . As the same requirement exists for all EU Institutions, the Commission is developing a comprehensive IT solution covering all phases of public procurement procedures. The Commission launched tools for electronic invoicing in 2010 (e-invoicing), for the electronic publication of documents related to contract notices in the electronic version of the EU Official Journal in 2011 (e-tendering) and for the electronic submission of tenders in 2015 (e-submission). By the end of 2017 the Centre had not introduced any of these tools.

INFORMATION ON INTERNAL AUDIT SERVICE REPORTS

3.4.11. In November 2017, the Commission’s Internal Audit Service (IAS) issued an audit report on the Centre’s Web-based services ( 54 ) . The Centre prepared an action plan for any potential areas for improvement.

THE CENTRE’S REPLY

COMMENTS ON THE LEGALITY AND REGULARITY OF TRANSACTIONS

3.4.8. We acknowledge the comment from the Court on the irregularity of the two recruitment procedures. Cedefop is carrying out an in-depth assessment of both procedures and is considering remedial measures both concerning the two procedures at stake and recruitment procedures in general to address the weaknesses identified by the Court.

COMMENTS ON SOUND FINANCIAL MANAGEMENT AND ON PERFORMANCE

3.4.9. Cedefop uses the EPSO platform in some cases. Cedefop publishes its vacancy notices on its own homepage as well as on the Inter-Agencies online platform which is accessible to all EU citizens and uses various channels to share vacancies such as ReferNet, Skillsnet, Governing Board as well as other means such as networks of economists etc. Cedefop publishes the vacancies of the Director and Deputy Director in EPSO and uses its social media for key positions. Considering the extra cost for the translation of the vacancy notices in all EU languages for the EPSO portal, Cedefop considers it is not proportional to the gain we stand to have.

3.4.10. Cedefop is in the process of joining the e-Tendering and e-Submission (modules of e-Prior platform) in autumn 2018, which is in line with the deadline set in the Directive 2014/24/EU on public procurement for all Contracting Authorities to use electronic exchange of information with economic operators (http://ec.europa.eu/growth/single-market/public-procurement/e-procurement_en). In this regard Cedefop collaborates with DIGIT, the Directorate-General of the Commission responsible for the on-boarding of Contracting Authorities. The first open tendering procedure with e-Tendering and e-Submission will be launched in October 2018. All open procedures will be launched using the e-tools from then on. The time of the launch of e-invoicing is depending on the decision of Cedefop management to deploy ABAC (which supports e-Invoicing as a module) or to continue with the in-house platform, Fibus (which will necessitate the development of a link to e-Invoicing platform).

3.5. EUROPEAN AVIATION SAFETY AGENCY (EASA)

INTRODUCTION

3.5.1. The European Aviation Safety Agency (hereinafter ‘the Agency’, aka ‘EASA’), which is located in Cologne, was established by Regulation (EC) No 1592/2002 of the European Parliament and of the Council ( 55 ) which was repealed by Regulation (EC) No 216/2008 ( 56 ) . The Agency has been given specific regulatory and executive tasks in the field of aviation safety.

3.5.2. Table presents key figures for the Agency Thepresents key figures for the Agency ( 57 ) Table Key figures for the Agency 2016 2017 Budget (million euros) 193 192 Total staff as at 31 December (58) 774 771 Source: data provided by the Agency.

THE COURT’S STATEMENT OF ASSURANCE PROVIDED TO THE EUROPEAN PARLIAMENT AND THE COUNCIL — INDEPENDENT AUDITOR’S REPORT

OPINION 3.5.3. We have audited: (a) the accounts of the Agency which comprise the financial statements (59) and the reports on the implementation of the budget (60) for the financial year ended 31 December 2017; and (b) the legality and regularity of the transactions underlying those accounts, as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU). Reliability of the accounts Opinion on the reliability of the accounts 3.5.4. In our opinion, the accounts of the Agency for the year ended 31 December 2017 present fairly, in all material respects, the financial position of the Agency at 31 December 2017, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector. Legality and regularity of the transactions underlying the accounts Revenue Opinion on the legality and regularity of revenue underlying the accounts 3.5.5. In our opinion, revenue underlying the accounts for the year ended 31 December 2017 is legal and regular in all material respects. Payments Opinion on the legality and regularity of payments underlying the accounts 3.5.6. In our opinion, payments underlying the accounts for the year ended 31 December 2017 are legal and regular in all material respects.

3.5.7. The observations which follow do not call the Court’s opinion into question.

OBSERVATIONS ON THE RELIABILITY OF THE ACCOUNTS

3.5.8. In the course of this year’s audit of all EU agencies, we did an analysis of the accounting environments including the hierarchical position and independence of accounting officers. The superior of the Agency’s accounting officer is the Head of Finance Department. We see a need to strengthen the accounting officer’s independence by making him directly responsible to the Agency’s Director (administrative) and Management Board (functional).

OBSERVATIONS ON THE LEGALITY AND REGULARITY OF TRANSACTIONS

3.5.9. Framework contracts are agreements with suppliers to establish terms governing specific purchases during the life of the agreement. For the procurement of IT services for a volume of up to 22 million euros, the Agency chose to use framework contracts with three contractors in cascade. Under such procedure, a ranking of contractors (the cascade) is established resulting from a competitive procedure and all specific purchases have to follow this ranking. However, the terms used in the framework contract were not specific enough to allow fair competition and to justify a ranking of contractors for all future specific purchases. According to the rules of application of the Financial Regulation ( 61 ) , in such circumstances a competitive procedure between the selected contractors must be used for the specific purchases.

3.5.10. According to the Agency’s Financial Regulation ( 62 ) , procurements must be approved by the Management Board either in the Agency’s annual work programme or by an ad hoc financing decision. One IT framework contract for a maximum amount of 15 million euros has been procured and signed although the financing decision covered an amount of 5 million euros only.

OBSERVATIONS ON SOUND FINANCIAL MANAGEMENT AND ON PERFORMANCE

3.5.11. In 2014, the Commission on behalf of more than 50 EU Institutions and bodies including EASA signed a framework contract with one contractor for the acquisition of IT hard and software and the provision of maintenance and support (IT services). The framework contractor acts as an intermediary between the Agency and suppliers that can deliver the IT services. While most of these IT services and related prices were defined in the framework contract resulting from the competitive procurement procedure, it also allows the purchase of IT services not specifically mentioned. In the case of one audited payment amounting to some 300 000 euros the Agency purchased, through the contractor, IT services without any competitive procedure. In 2017, total payments to the framework contractor amounted to 2 million euros.

3.5.12. The Agency publishes vacancy notices on its own website and in social media, but not on the website of the European Personnel Selection Office (EPSO), which would, increase transparency, publicity and allow citizens to identify vacancies published by the different European Institutions and agencies collectively.

3.5.13. According to their Framework Financial Regulation, agencies should introduce a single solution for the electronic exchange and storage of information with third parties participating in public procurement procedures (e-procurement) ( 63 ) ( 64 ) . As the same requirement exists for all EU Institutions, the Commission is developing a comprehensive IT solution covering all phases of public procurement procedures. The Commission launched tools for electronic invoicing in 2010 (e-invoicing), for the electronic publication of documents related to contract notices in the EU Official Journal in 2011 (e-tendering) and for the electronic submission of tenders in 2015 (e-submission). According to information from the Commission, by the end of 2017 the Agency had introduced e-tendering and e-submission for certain procedures, but not e-invoicing.

INFORMATION ON INTERNAL AUDIT SERVICE REPORTS

3.5.14. In 2017, the Commission’s Internal Audit Service issued an audit report on ‘The preparation of the European Plan for Aviation Safety’ by EASA ( 65 ) . The Agency prepared an action plan to address any potential areas for improvement.

FOLLOW-UP OF PREVIOUS YEARS’ OBSERVATIONS

3.5.15. An overview of the corrective action taken in response to the Court's observations from previous years is provided in the Annex.

ANNEX

Follow-up of previous years’ observations

Year Court's observations Status of corrective action (Completed / Ongoing / Outstanding / N/A) 2016 Although 2016 industry financed activities resulted in a deficit of 7,6 million euros, budgetary results fluctuate over the years (66) and the Agency has accumulated a 52 million euros surplus from this category of activity. The Agency’s Founding Regulation establishes that Industry fees levied should be adequate to cover the Agency’s cost for the related certification activities. It does not, however, foresee an accumulated surplus. Ongoing 2016 Over the period 2014 to 2016, the Agency spent 9,4 million euros (4,4 million euros in 2016) from its accumulated surplus in financing the 12,4 million euros refurbishment (and removal) cost for the Agency’s relocation to a new building. The Commission also contributed 3 million euros from the EU budget for this purpose. This financing split between industry and Union contributions was in line with the standard cost allocation methodology employed by the Agency and resulted in these works being financed, in large part from industry fees. N/A

THE AGENCY’S REPLY

3.5.8. The Agency takes note of the Court’s observation. The Agency has discussed this topic in the Network of Agencies forum to explore possibilities and to arrive at a common position. The Agency will implement the agreed common approach and will consider in any case clearly separate the accountant role from any operationalisation function as well as engaging the Management Board in the renewal and appraisal cycle.

3.5.9. In preparation for this procedure, the Agency performed a market prospectus and it concluded that the main IT service providers support all required services in the scope of this procedure. As a result, the Agency surmised that a multiple framework contract with re-opening of competition would have led to a high administrative complexity, which was considered disproportionate to a benefit it could potentially bring. As has been the case to date with high-value procurement procedures and as a result of the Court’s comment, going forward, the Agency will place increased consideration on the reopening of competitions in order to ensure enhance competition.

3.5.10. This framework contract intends to support the proof of concept and inception phase of a novel project (Data4Safety) for which the funding and structure has been evolving over months with a number of parties. The contract was for 15 million euro, however the financial commitments amount finally to a maximum 4 million euro. Thus, eliminating the possibility to make payments above this amount.

3.5.11. The Agency considered this approach to be in accordance with the principle of sound financial management when using the existing inter-institutional FWC. In