Opinion No 2/2004 of the Court of Auditors of the European Communities on the "single audit" model (and a proposal for a Community internal control framework)
Date: 2004-03-18
Institutions: European Court of Auditors
Subjects: audit, budgetary control, general budget

30.4.2004

EN

Official Journal of the European Union

C 107/1

I

(Information)

COURT OF AUDITORS

of the Court of Auditors of the European Communities on the ‘single audit’ model (and a proposal
for a Community internal control framework)

OPINION No 2/2004

(2004/C 107/01)

THE COURT OF AUDITORS OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Commu-
nity, and in particular Article 248(4), second subparagraph, thereof,

Having regard to the request of the European Parliament in para-
graph 48 of its decision of 10 April 2002 concerning discharge
in respect of the implementation of the general budget of the
European Union for the 2000 financial year (Commission), for
the Court to provide an opinion on the feasibility of introducing
a single audit model applicable to the European Union budget in
which each level of control builds on the preceding one, with a
view to reducing the burden on the auditee and enhancing the
quality of audit activities, but without undermining the indepen-
dence of the audit bodies concerned,

Whereas the Commission’s responsibility to implement the bud-
get is subject to different methods, governed by Article 53 of
Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002
on the Financial Regulation applicable to the general budget of
the European Communities (1);

Whereas there is no single recognised definition of ‘single audit’;

Whereas there is a need for efficient and effective internal control
over the European Union budget;

Whereas there has been significant progress in improving internal
control systems, but there still remains scope for further improv-
ing their design by establishing clear and consistent objectives,
ensuring effective coordination, providing information on costs
and benefits and ensuring a consistent application of require-
ments;

Whereas the Commission was requested to prepare a report on
the same subject by the same decision, but has not yet done so;

Whereas internal control systems covering European Union rev-
enue and expenditure should provide reasonable assurance that
revenue and expenditure is raised and spent in accordance with
the legal provisions and managed so as to achieve value for money;

Whereas the Court’s Opinion is intended as a contribution to the
Community institutions’ reflections, but does not pre-empt the
Court’s right to provide further opinions in accordance with
Article 248(4) of the Treaty;

Whereas the European Court of Auditors is the external auditor
of the European Union and therefore not an element of internal
control;

Whereas Article 274 of the Treaty establishing the European
Community makes the Commission responsible for the imple-
mentation of the budget having regard to the principles of sound
financial management, and requires the Member States to cooper-
ate with the Commission to ensure that the appropriations are
used in accordance with these principles;

Whereas international auditing standards, issued namely by the
International Federation of Accountants and INTOSAI, provide a
framework for the relation between external audit and internal
control, as well as using the work of other auditors;

(1) OJ L 248, 16.9.2002.

C 107/2

EN

Official Journal of the European Union

30.4.2004

In view of the observations and conclusions on the preparatory
work supporting the Opinion set out in the attached document
‘Information supporting the Opinion No 2/2004 on the “single
audit” model (and a proposal for a Community internal control
framework)’,

The Commission should define the minimum require-
VI.
ments for internal control systems whilst taking into account the
specific characteristics of the different budgetary areas. Systems in
each area should be accompanied by a coordinated information
approach to ensure beneficiaries are clearly aware of the objec-
tives and consequences of being checked.

HAS ADOPTED THE FOLLOWING OPINION:

I.
In order to ensure effective and efficient internal control of
EU funds, a Community internal control framework should be
developed containing common principles and standards, to be
used as a basis for developing new or existing control systems at
all levels of administration.

II.
Controls should be applied to a common standard and
coordinated to avoid unnecessary duplication. The overall cost of
controls should be in proportion to the overall benefits they bring
in both monetary and political terms.

Controls should be applied, documented and reported in
III.
an open and transparent way, allowing the results to be used and
relied upon by all parts of the system. The ‘owner’ of the checks
should be the European Union, not the individual control organi-
sations.

VII.
The internal control systems should include mechanisms
to ensure that weaknesses in the systems themselves, as well as
errors and irregularities in transactions, are identified and cor-
rected, and where necessary, recoveries made.

VIII.
Internal control systems require an appropriate balance
between the cost of controlling a particular budgetary area and
the benefits the checks bring in terms of limiting the risk of loss
and irregularity to an acceptable level.

IX.
The Commission should be responsible for promoting
the improvement in internal control systems in partnership with
Member States. The Council and Parliament should be responsible
for approving the cost/benefit balance for the different budgetary
areas.

IV.
To allow controls to be effective and efficient, legislation
underlying policy and processes should be clear and unambigu-
ous, and avoid unnecessary complexity.

X.
Clearly defined standards and objectives of internal con-
trol systems would provide an objective basis against which the
Court could assess their design and operation when auditing
them.

V.
Internal control systems should have, at their basis, a chain
of control procedures, with each level having specific defined
objectives which take into account the work of the others. Claims
of expenditure or costs over a certain threshold should be accom-
panied by an independent audit certificate and report, based on
common standards of approach and content.

XI.
Many of the proposed principles and standards are either
fully, or partially, in place, whilst others will need to be developed
and introduced. Changes will be needed in legislation and work
practices that will require considerable commitment from both
the European institutions and the Member States.

This Opinion was adopted by the Court of Auditors in Luxembourg at its meeting of 18 March 2004.

For the Court of Auditors

Juan Manuel FABRA VALLÉS

President

30.4.2004

EN

Official Journal of the European Union

C 107/3

INFORMATION SUPPORTING THE COURT OF AUDITOR’S OPINION No 2/2004 ON THE
‘SINGLE AUDIT’ MODEL (AND A PROPOSAL FOR A COMMUNITY INTERNAL CONTROL
FRAMEWORK)

CONTENTS

Paragraph

Page

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

CURRENT CONTROL FRAMEWORK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Internal control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1-5

6-33

8-13

External audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14-15

Current strengths and weaknesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

16-30

Unclear and inconsistent objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

19-21

Lack of coordination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

22-23

No information on costs and benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24-26

Inconsistent application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

27-30

Impact of Commission’s administrative reform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

31-33

CHARACTERISTICS OF AN EFFECTIVE AND EFFICIENT INTERNAL CONTROL
FRAMEWORK FOR THE EUROPEAN UNION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34-56

Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

35-36

Conditions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

37-38

Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39-44

Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

45-49

Costs and benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

50-53

Roles and responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

54-56

CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

57-59

Glossary of terms and concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

ANNEX I — Single audit in the USA and the Netherlands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

ANNEX II — Internal control arrangements in the different areas of the EU budget

. . . . . . . . . . . . . . . . . . . .

ANNEX III — Example of a chain-based control model for shared management expenditure . . . . . . . . . . . . .

4

4

5

6

6

6

7

7

7

8

8

8

9

9

10

10

11

11

12

13

16

18

C 107/4

EN

Official Journal of the European Union

30.4.2004

INTRODUCTION

In addition, the Court analysed similar concepts applied else-
where, and identified points which could be applicable to the EU
context (see Annex I).

1.
In March 2002 the European Parliament expressed its wish
for the Commission to prepare a report on the feasibility of intro-
ducing a single audit model applicable to the European Union
budget in which ‘each level of control builds on the preceding
one, with a view to reducing the burden on the auditee and
enhancing the quality of audit activities, but without undermin-
ing the independence of the audit bodies concerned’. Parliament
also asked the Court to prepare an opinion on the same sub-
ject (1).

5.
The Opinion concentrates on the aspects of internal con-
trol systems which assure the legality and regularity of revenue
and expenditure, and not those concerned with ensuring effec-
tiveness or value for money (3).

Partly because there is no agreed definition of single audit,
2.
and partly because where it is applied the concept is relatively
restrictive in scope, this Opinion has been prepared from the
wider perspective of the whole process of internal control and
external audit over the EU budget (2).

CURRENT CONTROL FRAMEWORK

3.
The Court has underlined in its reports the need to improve
control of the EU budget in order to arrive at efficient and effec-
tive systems of internal control of EU revenue and expenditure.
The Opinion puts forward the idea of a Community internal con-
trol framework (CICF), establishing a rational framework for devel-
oping new or existing internal control systems based on common
principles and standards. The Opinion is intended as a contribu-
tion to the Community institutions’ reflections, but does not pre-
empt the Court’s right to provide further opinions in accordance
with Article 248(4) of the Treaty.

6.
The European Union is a unique organisation due to its
political and legal context, scale and complexity. Management of
the budget involves the European institutions and Member States
(and beneficiary countries outside the Union), and is complicated
by the large number and varied nature of the schemes, the mil-
lions of beneficiaries, and the involvement of many different bod-
ies in Member States, often representing different administrative
cultures.

4.

In preparing its Opinion, the Court:

— analysed the current internal control arrangements over the

European Union budget; and

— identified the broad principles that might be embodied in a

CICF.

7.
Oversight and control of the EU budget involves not just
the Commission, the Court and the other Community institu-
tions, but also national parliaments and audit institutions (see
Diagram I). As this Opinion concentrates on internal control and
external audit within the immediate Community environment,
the role of these other bodies is not considered in detail.

(1) Paragraph 48 of Parliament discharge decision on the 2000 financial

year (OJ L 158, 17.6.2002).

(2) Similar considerations apply to the internal control of the European

Development Funds.

(3) Value-for-money aspects of management generally differ significantly
from legality and regularity, and the approach to internal control dif-
fers accordingly. For example, high-level considerations such as the
overall conception and management of expenditure schemes by the
Commission and Member States are important, as well as implemen-
tation aspects such as project-selection procedures and tendering pro-
cedures.

30.4.2004

EN

Official Journal of the European Union

C 107/5

Overview of internal control and external audit of the EU budget

Diagram I

Internal control

8.
The Commission is responsible, in cooperation with Mem-
ber States, for the implementation of the budget (1), and therefore
for developing and implementing effective control systems to
provide assurance that financial management is sound. Over 80 %
of the EU budget is managed in partnership with Member or ben-
eficiary (2) States. Partnership means that while the Commission
retains overall responsibility for the budget, the Member (or ben-
eficiary) States are responsible for the day-to-day administration
and control of these schemes, following rules established by the
Union. Administration involves the identification and selection of
beneficiaries, and making payments thereto. The remainder of the
budget (‘internal policies’, directly managed elements of ‘external
actions’ (3) and administration) is managed directly by the Com-
mission, including the selection of, and payments to, beneficiaries
or suppliers.

(1) Article 274 of the EC Treaty states ‘Member States shall cooperate
with the Commission to ensure that appropriations are used in accor-
dance with the principles of sound financial management’.

(2) Countries outside the Union which are beneficiaries of the Commu-

nity budget.

(3) The management of external actions, which comprises aid to develop-
ing countries, is currently undergoing a decentralisation of manage-
ment from central Commission services to its delegations in third
countries.

9.
The Commission has an internal audit function which helps
management ensure that its procedures are being followed and its
objectives met. The internal audit service (IAS) is a central service
that undertakes audits on issues concerning both the institution
as a whole and individual areas of interest, and provides technical
support to internal audit capabilities in directorates-general.

10.
The Commission is organised in directorates-general (DGs)
that are responsible for implementing specific policy areas and
the corresponding parts of the EU budget. Operational units check
and approve payments before they are made. Control units make
ex post checks that expenditure is being implemented correctly
both within the Commission and in Member States, and internal
audit capabilities help the management of the DG ensure that
internal controls are operating effectively.

11.
The administration of the budget is complex. Areas of
shared management comprise many administrative layers, starting
with the Commission services, passing through different combi-
nations of Member State central, regional and local administra-
tions (or agricultural paying agencies) down to the payment of EU
aid to individual beneficiaries. The different layers have different
roles and responsibilities, but the overall objective is the same: to
make payments from the EU budget to final beneficiaries. The
various intermediate levels are subject to controls by various bod-
ies including Commission services, local or national audit bodies,
internal audit services of the organisations concerned, govern-
ment departments and certifying bodies.

C 107/6

EN

Official Journal of the European Union

30.4.2004

For legality and regularity of transactions, the key part of
12.
the process is at the boundary where payments pass to final ben-
eficiaries. If payments are made to beneficiaries who have made
incorrect claims or who do not comply with the related criteria,
then the errors will persist within the system unless identified and
corrected by subsequent controls.

Whilst significant progress in improving systems has been
17.
made recently, the quality of systems nevertheless remains vari-
able. There is no overall vision or coordination of the many and
varied systems, including no mechanism to ensure that improve-
ments made to one system are taken into account for the improve-
ment of the others.

Detailed information on internal control arrangements in

13.
specific budgetary areas is provided in Annex II.

External audit

14.
The European Court of Auditors is the external audit body
of the European Union and therefore not an element of internal
control. The Court is responsible for providing independent over-
sight of the financial management of EU funds and reports to the
budgetary authority (European Parliament and Council). It assesses
how the Commission has discharged its functions for the orderly
management of the budget. During its work the Court checks that
the financial statements are complete and accurate, transactions
are legal and regular and funds have been soundly managed. The
Court pays particular attention to evaluating control systems and
making recommendations for corrective action.

15.
Each Member State has a national audit institution (NAI)
responsible for the independent external audit of their respective
state budgets. Although the NAIs have no formal role in the inter-
nal control (1) or external audit of the EU budget, the Treaty
requires them to cooperate with the Court in undertaking its
duties. Whilst most NAIs do not audit EU funds directly, they are
often responsible for auditing the national funds co-financing
EU-funded projects. In addition, Member State administrations
often have control units and internal audit departments who may
undertake checking of the use of EU funds or national co-financing.

Current strengths and weaknesses

18.
For own resources and the areas of shared management
(agriculture, structural measures, pre-accession aid), the systems
differ in conception and implementation, and many aspects are
left to the discretion of Member States. Even when systems are
judged as relatively satisfactory, such as the integrated administra-
tive and control systems (IACS) covering much of agricultural
expenditure, the Court notes instances where improvements are
necessary (2).

Unclear and inconsistent objectives

19.
The current internal control frameworks over the differ-
ent budgetary areas have evolved in a piecemeal fashion, at dif-
ferent times, and with little evidence of coordination by the Com-
mission (3). There is no clearly established strategy leading to
overall or specific objectives for the various systems (e.g. what
they are intended to achieve), which makes it difficult to establish
systems to the required quality, define the level of resources
required, judge the results they give and provide a baseline for
subsequent audit.

20.
For example, without clear objectives it could be inter-
preted that the purpose of internal control systems is to guarantee
or assure the complete legality and regularity of all transactions.
This is unrealistic, due to the disproportionate cost of undertak-
ing detailed on-the-spot checks imposed by the nature of the
expenditure (e.g. information provided by the beneficiary) and the
large number of geographically dispersed payments.

16.
The effectiveness of the systems of administration and
control over EU revenue and expenditure — in terms of design
and/or implementation — has been a cause of concern for a num-
ber of years. The Court has, since it was set up, identified many
instances of poor or inexistent control, exacerbated by EU expen-
diture programmes of high inherent risk of error, leading to errors
and irregularities, or inefficient or ineffective use of funds.

21.
Both agriculture and structural measures are subject to
control systems defined by regulation. The crux of both of these
systems is the intensity of checking at the final beneficiary level,
as this is where the majority of errors occur. A similar level of
checking is required by the legislation in both areas, but there is
no evidence of the basis on which this was agreed.

(1)

In some cases the NAIs have chosen to take on the function of certify-
ing body for agricultural paying agencies, which is a specific task
done within the remit of internal control of the EU budget.

(2) Court’s Annual Report for the financial year 2002, Chapter 4, Annex II

(OJ C 286, 28.11.2003).

(3) Such as through the identification and promulgation of best practice.

30.4.2004

EN

Official Journal of the European Union

C 107/7

Lack of coordination

Checks on EU revenue and expenditure arise from a
22.
number of different sources: the Treaty which gives the Commis-
sion overall responsibility for implementing the budget, in coop-
eration with Member States, the Financial Regulation which gov-
erns how EU funds are to be administered, decisions by the
European Parliament and Council, specific Council and Commis-
sion regulations for particular budget areas and national rules and
practices in Member States.

Within the current framework, no information is cur-
26.
rently available on the cost of controls borne by either Member
States or the Commission, or on the benefit they bring. Further-
more, the fact that much of the cost is borne by the Member
States, but the benefit accrues to the EU budget, results in a lack
of transparency and makes it difficult to manage the balance
between the two.

Inconsistent application

23.
There is no formal requirement for control bodies to
coordinate the planning of these checks, or to take into account
the checks made by the others. With insufficient coordination
there is a risk that resources are not used in the most effective
way. There is a possibility that different control functions under-
take the same work resulting in wasted effort, undue burden on
the auditee and a poor image of the management of EU funds.
Certain categories of expenditure may fall outside any effective
control remit. Information provided by Member States on the
results of checks is sometimes inadequate or inconsistent (1).

27.
The detailed checks of underlying transactions are required
by the regulatory control frameworks covering agriculture and
structural measures to be undertaken on both a risk and random
basis. However, these two approaches have very different and
mutually exclusive objectives (see paragraph 48), and, when insuf-
ficiently defined in the rules, result in confusion and reduced
effectiveness (3). Even when the rules are clearly defined, the
Court’s audit work identifies problems of implementation (4).

No information on costs and benefits

In the areas of shared management (representing over
24.
80 % of expenditure) the majority of the costs of undertaking
controls are borne by Member or beneficiary States. However, the
benefit of these controls accrues to the EU budget, and therefore
only indirectly to the Member State itself. This results in little
incentive for Member States to devote sufficient resources to con-
trolling EU funds, and explains why the Commission needed to
resort to defining the type and intensity of control procedures in
regulation.

As no system can reasonably be expected to assure abso-
25.
lute correctness of all transactions, the extent and intensity of
checking should make an appropriate balance between the overall
cost of operating those checks and the overall benefits they
bring (2). The benefit can be considered in terms of reducing or
containing the incidence of error, irregularity and ineffective use
of funds, as well as other considerations, such as the EU budget
being seen by the citizens of the Union as well managed.

(1) Court’s Annual Report for the financial year 2002, paragraph 4.23.
(2) The requirement for IACS checks to be increased over the regulatory
minimum when a certain level of error is detected illustrates the need
for the balance between cost and benefits to take into account the dif-
ferent inherent risks of the various budgetary areas.

28.
Both the Commission and the Member States have a high
level of decentralisation of control procedures, but in practice
there is not always consistency on basic matters such as approach,
extent, timing, coverage, margins and follow-up. As a result, there
are differences between the quality of the checks (5).

Independent audits of expenditure claims or cost state-
29.
ments are used in some areas of the budget. The terms of refer-
ence setting out how the work is to be undertaken and reported
are sometimes inadequate (6). Furthermore, there are not always
standard procedures for the selection of the auditors (7).

(3) Court Special Report No 10/2001, paragraph 20 (OJ C 314, 8.11.2001).
(4) For example see paragraph 4.51 of the Court’s Annual Report for the

financial year 2002.

(5) For example see paragraphs 4.27 and 5.32 of the Court’s Annual

Report for the financial year 2002.

(6) Court’s Annual Report for the financial year 2002, paragraphs 7.24,
7.27 and 8.11; Court Special Report No 1/2004, paragraphs 44 and
45 (OJ C 99, 23.4.2004); Court Special Report No 11/2003, para-
graphs 76 and 77 (OJ C 292, 2.12.2003); Court’s Annual Report for
the financial year 2001, paragraphs 3.57 and 3.58 (OJ C 295,
28.11.2002).

(7) Court’s Annual Report for the financial year 2002, paragraphs 7.24

and 7.25.

C 107/8

EN

Official Journal of the European Union

30.4.2004

Publicity about checks varies between different schemes
30.
and Member States, and beneficiaries often have little perception
of the possibility of being checked or its consequences. This
reduces the deterrent effect of the system. Penalties to deter ben-
eficiaries from making incorrect applications are used within agri-
cultural expenditure, and in internal policies starting with the
Sixth Framework Programme for Research and Technological
Development (RTD) (1), but not in the other budgetary areas (2).

in a position to arrive at an opinion on the systems within the
Commission, they are unable to do so for systems in Member
States in areas of shared management (6). Furthermore, the Com-
mission has experienced difficulties in employing staff with the
necessary financial experience, and instilling an adequate control
culture within the organisation (7).

Impact of Commission’s administrative reform

CHARACTERISTICS OF AN EFFECTIVE AND EFFICIENT
INTERNAL CONTROL FRAMEWORK FOR THE EUROPEAN
UNION

31.
The Commission’s wide-ranging administrative reform
programme (3) is focused on implementing improvements in man-
agement in general, and financial management in particular. The
key principles of the reform are simplification, decentralisation
and the assumption of greater responsibility by department
heads (4). A central internal audit service has been created together
with internal audit capabilities within each directorate-general. A
revised Financial Regulation has been issued and fundamental
accounting reform is ongoing.

Along with these measures, significant efforts have been
32.
made to improve the systems of internal control within the Com-
mission, taking into account the extent and quality of the control
procedures themselves as well as instilling a control culture
throughout the organisation. This process has been centred on a
set of 24 internal control standards (5) intended to provide a
framework for the control environment and internal control sys-
tems. The standards are general in nature and are only applicable
at Commission level.

33.
Key elements of the reform process in terms of the con-
trol framework are the annual activity reports and director-general
declarations, produced since 2001 for each directorate-general.
These include a self-assessment about the implementation of the
internal control standards, and are intended to provide reasonable
assurance that the control procedures put in place give the neces-
sary guarantees concerning the legality and regularity of the
underlying transactions and resources have been used for their
intended purpose. The Court has found when examining the first
two years of this procedure that while directors-general are mostly

(1) Court Special Report No 1/2004, paragraph 43.
(2) With no penalties, and interest only payable from the date of the
recovery order, beneficiaries required to repay Community aid benefit
from interest-free funds. This increases the risk of irregular claims.

(3) COM(2000) 200.
(4) Rules governing expenditure have been simplified, making them
easier to administer, and the centralisation of the ex ante financial con-
trol authorisation has been replaced by those authorising expenditure
and payments becoming responsible for their actions.

(5) SEC(2001) 2037/4 sets out the internal control standards which
where inspired by the COSO (see glossary) framework. An important
element of this framework is that it recognises that internal controls
provide reasonable, and not absolute, assurance on the reliability of
financial statements, the legality and regularity of transactions and the
soundness of financial management.

In order that the citizens of the Union have assurance
34.
that the European Union budget is subject to effective and effi-
cient internal control, the Court proposes the development of a
Community internal control framework for developing new and
existing internal control systems (8), based on common concepts
aiming for a transparent and optimum use of resources.

Objectives

35.
It is essential that the objectives of internal control systems are
clearly and comprehensively defined and disseminated. General objectives
will be common to all internal control systems, whereas more detailed
objectives will depend on the characteristics of the particular area. The
objectives should define: the scope (the budgetary area); the pur-
pose (legality and regularity, and/or sound financial manage-
ment (9)); those involved (the levels of administration from the
Commission through to those paying the final recipients); what
it comprises (control procedures based on common principles
and standards); to what end (to ensure a cost-effective control
over the area); with what constraints (that zero risk of irregular-
ity is neither realistic nor economic); to what extent (type and
intensity of checking set by an acceptable balance between cost
and benefit); and how (open and transparent, exchange of infor-
mation, control chain).

36.
The internal control systems should actively contribute to
improving the management of the EU budget by including safeguards
that remedial action is taken and recoveries made. Control procedures
are only effective at improving financial management if complete
and timely corrective action is taken on errors in transactions and
weaknesses in the systems themselves.

(6) Court’s Annual Report for the financial year 2002, paragraph 1.97.
(7) Court’s Annual Report for the financial year 2002, paragraph 0.8.
(8) The CICF relates to internal control over the Community budget, even
if some of the procedures may be called audits, and are undertaken
by auditors (e.g. the audit of cost claims by independent auditors —
see paragraph 43).

(9) See paragraph 5.

30.4.2004

EN

Official Journal of the European Union

C 107/9

Conditions

Member State levels are operating effectively and as intended. An
example of a chain-based model is given in Annex III.

37.
Controls should be undertaken in an open and transparent way,
allowing the results to be used and relied upon by all parts of the system.
The ‘owner’ of the checks should be the European Union, not the indi-
vidual control organisations. Controls should be undertaken to an
adequate standard, and the work done, results and supporting
documents made available for quality review. This is a basic
requirement for an effective chain system, and emphasises the
Community nature of the systems, rather than the work of indi-
vidual control units or organisations.

40.
The structure of individual systems will need to take into
account the specific characteristics of the budgetary area and
Member State organisations. However, all systems and structures
should follow the common concepts of checks undertaken to a
consistent minimum standard, reliance on checks done by other
levels, transparency and availability of results and appropriate bal-
ance between costs and benefits.

38.
For the internal control systems to be effective and efficient, leg-
islation underlying policy and processes should be clear and unambigu-
ous and sufficient to secure the proper use of funds, but not unnecessarily
complex. The purpose of controls over legality and regularity is to
ensure that rules and regulations covering EU revenue and expen-
diture are complied with. The rules and regulations should mini-
mise the scope for differing interpretations and not impose require-
ments that cannot be subsequently verified by controllers or
auditors. The more demanding and difficult the requirements are,
the greater is the risk that they will not be followed either by
design or accident. Well designed rules and regulations contribute
to the achievement of the policy objectives set, decrease the risk
of error, simplify the controls required and reduce the number
and cost of controls necessary for a defined level of ‘acceptable
risk’. Furthermore, legislation should include an incentive for
beneficiaries to make accurate claims by strengthening penalties
and sanctions and extending their use to all areas of the budget.

Structure

39.
In order to optimise the use of resources the internal control sys-
tems should have, as their basis, an effective chain of controls operating
to common standards, with each level having specific defined objectives
which take into account the work of the others. Within Member States
someone should be responsible for providing assurance that the
control work undertaken at the local level is to the required stan-
dard and quality, and thereby allows reliance to be placed on that
work (1). The Commission supervisory level should ensure that

(1) Examples of organisations in the current systems which perform this
function include: specific departments established in each Member
State to coordinate, monitor and report on the checks required by
Council Regulation (EEC) No 4045/89 (OJ L 388, 30.12.1989) as last
amended by Council Regulation (EC) No 2154/2002 (OJ L 328,
5.12.2002); certifying authorities in each Member State for each
Structural Fund intervention established by Council Regulation (EC)
No 1260/1999 (OJ L 161, 26.6.1999).

41.
The internal control systems should recognise that a key
part of the system is the controls that apply at the level of the
beneficiary and provide evidence on the physical existence and
accuracy of underlying actions and costs. For expenditure, pay-
ments are made to final beneficiaries based on compliance with a
number of conditions which can be physical (e.g. numbers, sizes,
amounts) or monetary (costs incurred). The critical aspect for
checking the legality and regularity of the transactions is the exist-
ence and accuracy of the conditions declared by beneficiaries,
many of which can only be verified by physical inspection at the
final beneficiary level.

42.
The internal control systems should recognise the diffi-
culties of compensating for ineffective control at the final benefi-
ciary level with checks undertaken at a more central level. For
example, a review of a list of claims by a central ministry is unlikely
to identify all material errors caused by inaccurate or misleading
claims. Some may be identified through the use of desk checks
based on data, although many can only be discovered on the spot.
The key to a soundly managed system is therefore through effec-
tive primary on-the-spot checks when the payment is made, and
secondary controls also directed at this level. The cost of check-
ing claims in detail on-the-spot is often relatively high compared
to the value of the average payment, but the overall effectiveness
of control procedures is largely proportional to the number of
checks done at this level.

43.
Claims for reimbursement of expenditure or costs over a defined
threshold should be accompanied by an audit certificate established by
an independent external auditor or, in the case of public bodies, by a
competent public officer. Beneficiaries should be required to provide
a certificate attesting to the reality, accuracy and compliance with
relevant rules and regulations of cost claims (2). Audit certificates
should be used for all claims, or periodic sequences of claims, by
a beneficiary, over a certain threshold. The threshold should be
specific to the different intervention mechanisms and be defined
by the Commission based on cost and benefit considerations.

(2) As currently applied in the internal policies area for the Sixth RTD

Framework Programme.

C 107/10

EN

Official Journal of the European Union

30.4.2004

Management of the process needs to take into account
44.
the fact that the auditors are selected, engaged and paid by the
beneficiary, but report to the Commission either directly or indi-
rectly (i.e. through Member States). The scope and extent of the
audit work as well as minimal requirements for materiality and
confidence levels, documentation of audit testing, form and con-
tent of audit report and right of access to working papers should
be defined and standardised.

Application

45.
The Commission should define the minimum requirements for
control systems at all levels within the process, which take into account
the specific characteristics of the different budgetary areas.This will
require an analysis and common definition of the basic building-
block components of systems and control procedures. For the
legality and regularity of transactions, aspects to be taken into
account include administrative checks, segregation of duties,
record keeping, checking of input, control accounts, reconcilia-
tions and on-the-spot checks.

46.
Control procedures should be implemented to an adequate com-
mon standard, and the work done and results documented in a common
format and recorded in a database with access for others in the control
chain as a basis for placing reliance. An efficient system requires that
checks on transactions and systems are undertaken to adequate
common standards of method, coverage and quality no matter
who undertakes them, and at whatever location. Controls to a
common standard should allow reliance to be placed by central-
level controllers on controls undertaken by others in the control
chain.

47.
The common standard should be applied through the use
of a common approach to documenting, evidencing and report-
ing all aspects of the process including: reason for selection of the
transaction or system; objective of the checks; description of the
checks undertaken; supporting documentation; results; reaction
of controllee; and follow-up. This information should be main-
tained in central databases, with access available to all participants
in the control process subject to appropriate security safeguards.

48.
Control systems should use sampling for clearly defined pur-
poses: risk-based samples should be used to identify and correct irregu-
larities; representative sampling should be used to confirm the effective-
ness of the systems. Sampling is a widely used technique for auditing
large populations of transactions, particularly when the auditor
wishes to estimate characteristics such as the average level of
irregularity. Sampling recognises that resources are not available
to audit (or control) every item and can be applied at a number of
different levels, including the selection of transactions within a
population, and the selection of items for detailed audit within a

transaction. Sampling can be split into two main categories —
risk-based and representative — with different objectives and pur-
poses.

49.
The internal control systems should be accompanied by an
effective and coordinated information approach. The more beneficia-
ries are aware of the existence of an effective system of controls
and its consequences, the greater the efforts they may make to
ensure that claims are legal and regular. Information should be
provided to all beneficiaries on the control system in a coordi-
nated and coherent way, emphasising the common Community
purpose of the checks rather than the bodies undertaking them.

Costs and benefits

50.
The type and intensity of checking within internal control sys-
tems would be set with reference to the cost and benefits. Any control
system is a trade-off between the cost of operating the defined
intensity of checks on the one hand, and the benefit these proce-
dures bring on the other. In the Community context the benefit
involves reducing the risk that funds are wasted and containing
the risk of error to a tolerable level. It is likely that the level of
tolerable error or irregularity would vary between different bud-
getary areas, depending on both the cost of controls as well as the
inherent risk of transactions containing errors or irregularities.

In practical terms the tolerable risk of error would be
51.
defined together with the intensity of checking at the final ben-
eficiary level considered necessary to achieve this result (1). The
results of the checking would be monitored and the intensity of
the checks adjusted accordingly for the following year or period.
In practice it is highly unlikely that the desired cost/benefit bal-
ance would be achieved immediately, but would require fine-
tuning over a number of years taking into account information
on costs, and the results and effectiveness of different types and
intensities of checking.

52.
The system should record information on the cost of operating
controls as well as the benefit in terms of the residual risk of irregularity.
The cost of controls should be relatively easy to define and the
introduction of activity-based management will facilitate the pro-
vision of this information at the Commission. An accurate esti-
mate of costs incurred by Member States is likely to be more dif-
ficult to obtain. One alternative would be for the cost of the checks
to be financed by the EU budget, thus allowing the costs to be
known and provide an adequate degree of transparency in the
process.

(1) For example, the tolerable risk could be set by reference to an accept-
able error rate and the intensity of checking, defined in terms of the
proportion of transactions necessary to be checked to reach that level
of residual risk.

30.4.2004

EN

Official Journal of the European Union

C 107/11

One way of measuring and monitoring the benefit of the
53.
control procedures would be through random representative sam-
pling to estimate the residual level of illegality and irregularity, in
order to compare it with the tolerable risk set for the area.

Roles and responsibilities

54.
The Commission should be responsible for promoting the
improvement in internal control systems in partnership with Member
States, and subsequently providing assurance that they are operating
effectively. The Commission would be required to define the com-
mon characteristics of the systems for the different budgetary
areas and to take appropriate measures to monitor the cost of
controls and evaluate the benefits they bring.

55.
The budgetary authorities (Parliament and Council) should be
responsible for approving the cost/benefit balance for the different policy
areas. The trade-off between the costs of controls against the ben-
efits they bring is a critical aspect of control strategy, and should
be open and transparent. Given its key importance, the desired
balance should be approved by the political authorities of the
Union, based on a detailed proposal of the Commission, taking
into consideration the costs to be devoted to checking revenue
and expenditure, and the risks to be tolerated. It is likely that dif-
ferent budgetary areas will be subject to different levels of balance,
based on the type and risks of the transactions concerned.

56.
The Court of Auditors, as the EU’s external auditor, audits the
internal control systems. International auditing standards require
auditors to assess the reliability of internal control when deter-
mining the approach and extent of testing (1), and cover the pro-
cess of making use of the work of other auditors (2). This latter
aspect requires the other auditor’s work to have been undertaken
to an acceptable professional standard and be available for review
and scrutiny. Clearly defined standards and objectives of internal
control systems would provide an objective basis against which
the Court could assess their design and operation when auditing
them, thereby increasing the effectiveness of its work.

CONCLUSION

57.
The Court encourages the establishment of coherent and
comprehensive systems of internal controls over the EU budget,
based on a logical framework using common principles and stan-
dards (Community internal control framework) to be applied at
all levels of administration in the institutions and Member States
alike. The Court considers that the internal controls should pro-
vide reasonable assurance on the legality and regularity of trans-
actions, and compliance with the principles of economy, effi-
ciency and effectiveness. The cost of the controls should be in
proportion to the benefits they bring in both monetary and
political terms. The system should be based around a logical chain
structure where controls are undertaken, recorded and reported
to a common standard, allowing reliance to be placed on them by
all participants. Many of the building blocks for implementing
such a framework are fully or partially in place in the current sys-
tems, whereas others would need to be introduced.

58.
The existence of an efficient and effective system of inter-
nal controls over EU revenue and expenditure would be signifi-
cant in helping the Court in fulfil its role of external auditor of the
European Union, as conferred on it by the Treaty. By placing reli-
ance on well developed and implemented control systems the
Court will be able to make the best use of its own resources and
so improve the accomplishment of its tasks.

59.
The EU budget is a complex instrument, involving many
different aspects and layers of administration. To define and imple-
ment a system of common controls will demand considerable
commitment from both the European institutions and Member
and beneficiary States. It will require the active participation of all
parties involved in the financial control of the EU budget, changes
in both legislation and work practices, and a level of openness
and transparency over the management of the EU budget not yet
achieved. By working together to ensure an efficient and effective
control of the EU budget, the institutions and Member States of
the European Union would demonstrate their commitment to a
common purpose for the benefit of the citizens.

(1)
(2)

INTOSAI auditing standard 3.3.1
International Standard on Auditing 600 issued by the International
Federation of Accountants (IFAC).

C 107/12

EN

Official Journal of the European Union

30.4.2004

GLOSSARY OF TERMS AND CONCEPTS

Control procedures: Those procedures which check or verify that transactions or systems are accurate and comply with
the necessary rules and regulations. Controls may be administrative (e.g. on the coherence and apparent accuracy of claims)
or on-the-spot (e.g. on the physical reality of the costs or aspects claimed).

COSO: Committee of Sponsoring Organisations of the Treadway Commission — a voluntary private-sector organisation
established by professional accounting and audit bodies dedicated to improving the quality of financial reporting through
business ethics, effective internal controls and corporate governance. See www.coso.org.

Direct management: Where the Commission is solely responsible for the management, administration and control of cer-
tain areas of the EU budget.

External audit: An independent oversight of financial management of an organisation which reports to stakeholders on
the completeness and accuracy of financial statements and produces objective reports on aspects of management. The Euro-
pean Court of Auditors is the external auditor of the European Union.

Indirect or shared management: Where the Commission is responsible for the management, administration and control
of areas of the EU budget in partnership with Member States.

Internal audit: An independent function within an organisation which helps management ensure that systems are in place
and working effectively. Internal audit is part of internal control.

Internal control: The whole system of financial and other controls, including the organisational structure, methods, pro-
cedures and internal audit, established by management to assist in conducting the business of the entity in a regular, eco-
nomic, efficient and effective manner, ensuring adherence to management policies, safeguarding assets and resources, secur-
ing the accuracy and completeness of accounting records and producing timely and reliable financial and management
information.

Internal control system: A system of control procedures established by management in order to prevent or detect and cor-
rect errors and irregularities and ensure that the entities’ objectives are met.

INTOSAI: International Organisation of Supreme Audit Institutions — an international and independent body which aims
at promoting the exchange of ideas and experience between supreme audit institutions in the sphere of public control. See
www.intosai.org.

National audit institution (NAI): The public body of a State which reports to the national parliament and provides an
independent external audit of the State budget.

Random representative sampling: Statistically based sampling technique designed to provide an estimate of a given char-
acteristic of a population of transactions, such as the average level of irregularity. The technique is not appropriate for iden-
tifying and correcting individual errors, although it can be used to identify areas of particular risk.

Regulatory controls: Those control systems and procedures established by regulation.

Reliance on controls: A concept by which an auditor or controller relies on the work of other auditors or controllers in
arriving at an opinion. The auditor or controller must obtain evidence that the work of the other has been undertaken to an
adequate standard.

Risk analysis: Technique used to identify transactions that are likely to contain errors.

Risk-based sampling: Samples based on risk analysis.

System: A collection of management, administrative and/or control procedures and processes applied in an organised and
uniform manner to a defined class of transactions or budgetary area.

30.4.2004

EN

Official Journal of the European Union

C 107/13

ANNEX I

SINGLE AUDIT IN THE USA AND THE NETHERLANDS

The term (and concept) ‘single audit’ is used in the United States of America (the Single Audit Act), and the Netherlands
(single audit approach). This Annex provides an overview of both of these examples and identifies parallels that can be drawn
with the European Union context.

United States of America

Around one sixth (or USD 300 billion) of the United States federal budget is expended by non-federal (and non-State) organisa-
tions. Such organisations may receive multiple grants for different subjects. In the past this resulted in a number of audits of
the same organisation, sometimes overlapping in time, and often covering the same material. This inflated the overall audit
cost and placed an unnecessary burden on auditees. The Single Audit Act of 1984 tackled the problem by providing that
only one audit need be undertaken on the organisation as a whole (e.g. its annual financial statements) — replacing the need
for individual audits of individual funds — and established uniform audit standards.

‘Single audit is intended to provide a cost-effective audit of NFEs [non-Federal entities]. Efficiencies can be considerable when an
organization-wide, or single audit, is conducted in lieu of multiple audits of individual Federal programs. The parties involved in the audit
process know beforehand what is expected and what the products of the audit will be. Furthermore, repeated exposures to a structured
audit process promote discipline in an auditee’s accounting practices.

The auditor provides an opinion as to whether the auditee’s financial statements are presented fairly, thus providing a tool to assess the
financial condition of the auditee.

A risk-based audit approach assures audit coverage to high-dollar, high-risk Federal programs and provides opportunities for the audit-
ing of small-dollar, high-risk programs.’

‘Single audit reports are not intended to provide detailed audit coverage of all the Federal awards or provide detailed financial information
for individual awards. To do so would be cost prohibitive.’ (1)

Characteristics of the application of the US single audit are:

— A single audit is required for a recipient organisation which expends more than USD 300 000 in a financial year.
Organisations with annual expenditure of less than this threshold are required to make their records available for review
or audit.

— Recipient organisations are required to maintain effective internal controls and comply with all applicable rules and

regulations.

— It is the recipient organisation’s responsibility to arrange for an audit (including selection of auditor), ensure it is prop-

erly completed, submit the report when required and take corrective action on audit findings.

— The cost of the single audit is funded by the federal grant.

— The audit is conducted in accordance with Government auditing standards and the auditor must: (i) provide an opinion
on the financial statements and schedule of expenditure of the federal grant; (ii) gain an understanding of the internal
controls over federal programmes and test them; and (iii) provide an opinion on compliance with programme require-
ments.

(1) Extract from ‘Highlights of the Single Audit Process’ of October 2001, produced by the Grants Management Committee

of the Chief Financial Officers Council.

C 107/14

EN

Official Journal of the European Union

30.4.2004

— Upon receipt of the Single Audit Report the federal awarding agency has six months to issue a management decision
on each audit finding. This specifies the corrective action needed including repayment of funds. The auditee has the
right to appeal.

— To ensure that single audits are carried out to the required standard, the workpapers can be subject to a quality-control

review by federal agencies.

In terms of relevance to the European Union context the following should be noted:

— The US structure is simpler than that of the Union. Federal departments deal directly with the implementing organisa-
tions, making a much flatter management and control structure (no real ‘cascade’). Single audit is therefore more
restricted and easier to define and operate, as no intermediary organisations are involved.

— The US approach includes no common standards on the internal controls to be applied, although examination of these
is an integral part of the single auditor’s remit. The scale (in terms of number of beneficiaries and relatively low value
of claims) in the EU context requires specific consideration of this aspect.

— There is no specific consideration made of the work of internal auditors (other than presumably an evaluation of their

place within the internal control structure as a whole).

— For much of the EU budget (e.g. agriculture) there are many more individual beneficiaries, very few of which will receive
significant grants. For Structural Funds there are more individually significant beneficiaries, although not many man-
age multiple grants.

— The US experience is more akin to the EU directly managed expenditure. The use of a standardised audit approach and
particularly standard reporting document would be of specific interest, as would the system of ‘management decision’.

— Selection of auditor by the auditee introduces an element of risk (underqualified or insufficiently independent auditors),
although this risk can be managed by comprehensive terms of reference, detailed reporting and the review of working
papers.

— The particular attention paid to corrective action indicates the positive and dynamic nature of the process.

— Funding of the audit through the federal grant significantly adds to the transparency and control over the process.

The Netherlands

The definition and application of single audit within the Netherlands is somewhat different and rather more wide-ranging
than in the US. The first phase concerned the audit of Government ministries by the external auditor, the Netherlands Court
of Audit (NCOA). This involved reliance by the NCOA on the work of the internal auditors of the ministries, having first set
up common standards and guidance for their operation. The second phase covers a lower level within the control chain
whereby the ministry auditors rely on the work of the auditors of local authorities over the use of Government funds man-
aged by them. The ministry issues terms of reference indicating the issues the regional or local auditor should cover in his/
her opinion.

The first phase was introduced as part of a wide-ranging improvement in the quality of financial control and audit of min-
istries, including the implementation of an adequate system of internal control procedures. The central audit service of the
Ministry of Finance played a key role in monitoring the ministries and regularly informing the Parliament about the progress
made. Because of political pressure and thanks to the support of the NCOA, it was possible to bring about considerable
improvements. The improvements included provision of timely and efficient information flows and adequate compatible
computerised accounting and information systems. Particular attention was paid to establishing strong and effective internal
audit units in each ministry and the requirement to provide an annual audit opinion was formalised. The opinions are based
on financial audits, which themselves are based on risk analysis. Internal audit standards were established and promulgated
which were compatible with the standards of the NCOA. And the NCOA established standards for the review of the work
of the internal audit department.

30.4.2004

EN

Official Journal of the European Union

C 107/15

The second phase concerned the lower tier of public financial management in the Netherlands, namely regional and local
authorities. These organisations have their own accountability structures, including local audit and discharge procedures.
The aspect concerning single audit was the central government funds managed by these bodies, such as specific-purpose
grants which represent around 20 % of the national budget. The previous arrangement was for audit certificates to be
obtained for all grants; however, as for the US experience, this resulted in a multitude of uncoordinated reporting and audit
requirements by the various ministries responsible for the various grants, with the associated burden on the auditees.

A Cabinet decision of 1989 set the objectives of the Dutch single audit policy on lower-tier levels as follows:

— streamlining of audit activities,

— establishing efficient and effective information flows,

— obtaining a sufficient view about legality/regularity and effectiveness of financial management for shared management

tasks,

— removing the impediments to decentralisation and deregulation.

Single audit at this level revolves around the need for the local authority or other body to produce only one set of financial
statements annually, and for the audit certificate provided on these financial statements to include a verification of the com-
pliance of the central government grants with the respective obligations. The audit at the lower level is done in a way to also
meet the requirements of those at a higher level.

An important finding and result of single audit in the Netherlands was to highlight the need for legislation governing the use
of national funds that is coherent, practical and applicable. Compliance with inadequate or inappropriate legislation cannot
be audited effectively, whether through single audit or otherwise. As such the single audit had a corresponding effect of
stimulating an improvement in the clarity, effectiveness and relevance of legislation. A further recent development has been
the move towards financial statements that concentrate on achievement of policy objectives and performance indicators, in
addition to presenting basic financial accounting data.

In terms of relevance to the European Union context the following should be noted:

— The single audit concept is just that — an audit concept — and, as such, doesn’t directly cover the definition and

application of control procedures.

— The administrative structure is somewhat more complex than for the USA, although less so than for EU revenue and

expenditure.

— The Dutch single audit concept places the Dutch NCOA above and outside the process. The NCOA has taken effective

steps for reviewing the work of other auditors in terms of reliance.

— Implementing the Dutch single audit has not been a quick or easy process, despite being introduced in a relatively small

national context.

The Dutch single audit concept requires considerable responsibility and workload to be placed on the internal audit capabili-
ties of the ministries, and the availability of sufficient resources to perform the corresponding tasks.

C 107/16

EN

Official Journal of the European Union

30.4.2004

INTERNAL CONTROL ARRANGEMENTS IN THE DIFFERENT AREAS OF THE EU BUDGET

ANNEX II

Own resources are the revenues by which the EU budget is financed. Over 80 % of own resources derives from GNP and
VAT bases involving monthly transfers from Member States. The remainder of own resources represent customs duties and
agricultural and sugar levies. These are collected by Member State administrations (e.g. customs) who are required to oper-
ate appropriate controls to ensure completeness and accuracy of collection. The Commission DGs operate supervisory con-
trols to check that Member States are meeting their obligations. The joint audit arrangement (JAA) has been developed within
the traditional own resources field since 1994, and covers cooperation between the Commission and internal audit func-
tions in the majority of Member States. The JAA has resulted in the preparation of common audit plans and tools, with
particular emphasis on assessing the adequacy of control systems covering the identification and payment of own resources.
Three Member States (Austria, Denmark and the Netherlands) have fully adopted this methodology, involving the internal
audit service of the national customs authority undertaking audit procedures agreed between itself and the Commission.
The cost of the checks is borne by the Member State. 25 % of customs duties collected are retained by Member State administrations.

Agricultural expenditure, with payments of 43 521 million euro in 2002, represents over 50 % of EU expenditure. The
expenditure involves many millions of relatively small payments to millions of individual farmers through a wide range of
schemes. Payments are made by paying agencies, established and financed by Member States following rules established by
the Commission. Paying agencies are subject to an independent audit each year by a certifying body, which certifies whether
the financial claims to the Commission are accurate, and if the required control systems are in place and the necessary checks
have been carried out. The paying agencies are required to undertake a number of checks within the integrated administra-
tive and control system (IACS) which covers the payments based on declared area or numbers of animals. IACS comprises
both administrative checks of claims and on-the-spot inspections of beneficiaries. Expenditure not subject to IACS, such as
production and processing aid and export refunds, is subject to checks (1) by a Member State coordinating body based on
risk analysis and subject to the monetary amounts involved. The cost of the checks is borne by the Member State.

Structural measures expenditure, with payments of 23 499 million euro in 2002, represents 28 % of EU expenditure. The
expenditure involves payments for eligible projects within the framework of operational programmes, and often involves
reimbursement of costs to public bodies engaged in construction or training projects. The expenditure is managed by Mem-
ber State administrations (managing and paying authorities (2)) that select projects and make payments to beneficiaries.
Member States are responsible in the first instance for ensuring the financial control of EU expenditure. In the second half
of the 1990s the Commission issued a regulation (3) defining the administrative and control requirements on structural
measures expenditure in order to address criticisms about the quality of management. These introduced the requirement for
an independent body to provide a closure statement on the accuracy and legality and regularity of expenditure presented to
the Commission for reimbursement. Such statements are largely based on an inspection of a defined value (5 %) of underly-
ing expenditure intended to verify the effectiveness of the management and control systems, as well as the transactions
themselves. In November 2002 the Commission made a proposal to the Structural Funds Technical Group entitled ‘Contrat
de confiance’. The contrat de confiance does not add new regulatory requirements but is based on effective coordination of EU
and national controls, the presentation by the Member States of an adequate control strategy and provision of annual reports
detailing the results of control activities. As a counterparty the Member States are promised less checking by the Commis-
sion. The cost of the checks is borne by the Member State.

Pre-accession aid is the other budgetary area which is largely co-managed with the beneficiary States. Expenditure, which
totalled 1 752 million euro in 2002, is aimed at helping the countries prepare for accession to the Union, and comprises
three main funds — Sapard, which relates to rural development, and Phare and ISPA which concern structural develop-
ment. The expenditure finances investment projects as well as institution-building measures such as twinning, and is under-
taken by agencies within the countries concerned which are homologated by the Commission. The cost of the checks is borne
by the Member State.

(1) Council Regulation (EEC) No 4045/89 (OJ L 388, 30.12.1989), as last amended by Regulation (EC) No 2154/2002

(OJ L 328, 5.12.2002).

(2) Article 9 of Council Regulation (EC) No 1260/1999 (OJ L 161, 26.6.1999).
(3) Commission Regulation (EC) No 2064/1997, superceded by Commission Regulation (EC) No 438/2001 (OJ L 63,

3.3.2001).

30.4.2004

EN

Official Journal of the European Union

C 107/17

For expenditure in the field of ‘internal policies’ the Commission partly reimburses costs incurred by private or public legal
entities participating in Community actions. Payments in 2002 amounted to 6 567 million euro. The co-financing takes
place through the reimbursement of eligible expenditure or costs incurred and substantiated by the final beneficiary. The
Commission makes financial and non-financial checks, including ex post financial audits, at the level of the final beneficiary.
For the RTD framework programmes, which represent over half of internal policies expenditure, the Commission mandates
independent auditors to carry out part of these audits on its behalf, based on standardised guidelines. In 1999 the Com-
mission set the objective to audit 10 % of contractors participating in the RTD framework programmes for the Fifth Frame-
work Programme (1998-2002). From the Sixth Framework Programme (2002-2006) the financial statements for indirect
RTD actions have to be accompanied by an audit certificate certifying the eligibility and reality of the costs claimed. However,
the Commission remains responsible for assessing whether these costs were necessary for undertaking the action. The cost
of providing audit certificates is considered an eligible cost and, up to a certain ceiling, is fully reimbursed by the EU.

External actions are directly managed by the Commission and comprise payments made to finance eligible development
aid projects outside the Union, mostly in the developing world. Payments in 2002 amounted to 4 424 million euro. In the
context of decentralisation, much of the expenditure is increasingly managed by the Commission delegations that are respon-
sible for making payments and checking projects. Other expenditure is channelled through NGOs and some expenditure is
paid directly by the Commission central services (who also perform checks). Some projects are subject to independent audit
of the expenditure declarations. The cost of the controls is borne by the EU budget.

Administrative expenditure is for the running of the EU institutions and is managed directly by the Commission (or other
institution involved). The expenditure, some 5 212 million euro in 2002, largely comprises payment of salaries and other
staff costs, as well as accommodation costs. The expenditure is checked by the institutions’ services involved, and the cost is
borne by the EU budget.

C 107/18

EN

Official Journal of the European Union

30.4.2004

EXAMPLE OF A CHAIN-BASED CONTROL MODEL FOR SHARED MANAGEMENT EXPENDITURE

ANNEX III

This example shows how a chain-based control model could be applied to shared management expenditure. The structures would need to
be adapted to specific budgetary areas and Member State organisational structures.

Primary controls would be those undertaken by the paying organisation on the grant application or claim (local level). They
generally comprise administrative checks, together with checks of reality on the spot for claims considered at risk.

Secondary controls would also be undertaken at a local level, but by a functionally separate control unit or organisation,
and would obtain evidence that the primary systems and controls are operating effectively, and then undertake risk-based
checking of transactions in line with the tolerable risk.

Central controls would be undertaken by Member State central or regional level and would examine the operation of the
primary and secondary controls, and undertake testing of a representative sample of transactions to estimate the residual
level of risk in the population.

Commission supervisory controls would oversee the process in the Member State to ensure that it was being implemented
correctly and monitor the cost/benefit balance.

See diagrams II and III.

30.4.2004

EN

Official Journal of the European Union

C 107/19

Diagram II

CICF: internal control levels for chain-based model

NB: Structure to be adapted to needs of specific budgetary areas and Member State organisation.

C 107/20

EN

Official Journal of the European Union

30.4.2004

Diagram III

CICF: overview of responsibilities and tasks