Communication from the Commission - Annual Report to the Discharge Authority on Internal Audits Carried out in 2003 (Article 86(4) of the Financial Regulation) {SEC(2004) 1351}
Date: 2004-10-26
Institutions: European Commission
Subjects: European Commission, activity report, audit, budgetary discharge, financial regulation, management accounting

COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 26.10.2004 
COM(2004) 740 final 

COMMUNICATION FROM THE COMMISSION 

Annual Report  
to the Discharge Authority  
on Internal Audits Carried out in 2003 

(Article 86(4) of the Financial Regulation)  

{SEC(2004) 1351} 

EN 

   EN 

 
 
 
  
 
 
 
 
 
 
 
 
CONTENTS 

1. 

2. 

3. 

Introduction...................................................................................................................3 

Overview of IAS Audit work in 2003 ..........................................................................3 

Summary of Systemic Findings and Recommendations ..............................................5 

3.1. 

Accounting and Management Information Systems.....................................................5 

3.2. 

Delegation Risk ............................................................................................................6 

3.3. 

Activity Based Management – ABM Tools .................................................................7 

3.4. 

Legacy Risks, Resource Allocation and Risk Management .........................................7 

3.5. 

Management Assurance and Control Activities ...........................................................8 

EN 

2 

   EN 

 
1. 

INTRODUCTION 

The  aim  of  this  summary  report  is  to  inform  the  Discharge  Authority,  in  line  with  the 
requirements  of  the  Financial  Regulation  under  Article  86.4,  of  Internal  Audit  findings 
and recommendations in 2003 from the Internal Audit Service (IAS) and to report on the 
follow-up.  

The report focuses on the number and type of findings and recommendations, which arise 
from  the  audits  carried  out  by  the  IAS  in  2003.  The  Commission  Services  Working 
Document  submitted  alongside  with  this  report  is  structured  by  broad  sector  of  activity 
and  contains  short  descriptions  and  follow-up  information  on  the  individual  audit 
engagements  completed  by  the  IAS  in  2003.  It  also  gives  follow-up  information  for 
previous audits, mainly based on information provided by the audited departments. 

2. 

OVERVIEW OF IAS AUDIT WORK IN 2003 

Based on Action 87 of the Reform White Paper, the IAS planned to carry out by 2003 a 
complete  cycle  of  in-depth  audits  of  all  DGs.  The  objective  was  to  allocate  enough 
resources  to  ‘high  risk  profile’  DGs  to  be  able  to  carry  out  system  audits,  including 
substantive testing, and to limit the scope for the other DGs to the identification of their 
major risk areas.  

Some of the implementation of the 2003 audit programme was postponed into 2004 with 
the special request to the IAS concerning the review of contracts and grants managed by 
or  with  the  involvement  of  ESTAT.  In  the  resolution  accompanying  its  decision  of  8 
April  2003  to  grant  discharge  to  the  Commission  for  the  year  2001,  the  European 
Parliament requested that “the Commission’s Internal Audit Service examines by summer 
2003  the  legality  and  the  regularity  of  all  contracts  concluded  by  Eurostat  since  1999, 
and  to  include  in  its  investigation  those  contracts  concluded  by  other  Commission 
services”. Consequently, the Commission decided on 11 June 2003 to instruct the IAS to 
undertake  an  examination,  on  an  agreed  upon  procedures  basis,  of  the  legality  and 
regularity  of  contracts  and  grants  completed  by  ESTAT  or  by  other  DGs  following 
ESTAT’s advice from 1999 to 2002. 

The  IAS  was  able  to  finalise  in  2003  nine  Action  87  DG-specific  audits,  two  thematic 
audits, two follow-up audits and the review of ESTAT contracts and grants at the request 
of the Commission. It has also included in this report one Action 87 audit for which the 
final report was issued early in 2004. 

The following table gives an overview of IAS audit engagements completed in 2003: 

EN 

3 

   EN 

 
Overview of IAS Audit engagements completed in 2003: 

Audit 

Audit Planning 
Memorandum 

Draft Report 

Final Report 
(Transmission Date) 

APC Discussion 

Cross-cutting Budgetary Management, Accounting and Internal Control Systems 

BUDG – Accounting 
system 

05-Apr-01 

15-Oct-02 

15-Apr-03 

15-Sep-03 

BUDG – SINCOM2 

23-Sep-02 

BUDG – Treasury 
management 

30-Sep-02 

Internal Policies including Research 

10-Feb-03 

10-Apr-03 

21-May-03 

22-May-03 

15-Sep-03 

15-Sep-03 

RTD 

ESTAT contracts and 
grants 

21-May-03 

11-Jun-03 

31-Oct-03 

10-Oct-03 

02-Dec-03 

22-Oct-03 

16-Feb-04 

Discussed by 
Commission 
(APC 7-May-04) 

Structural Measures and Common Agricultural Policy 

REGIO 

AGRI 

30-Sep-02 

20-Nov-02 

24-Jan-03 

06-Jun-03 

26-Feb-03 

13-Oct-03 

External Policies including Pre-accession Aid 

ELARG 

DEV 

EDF counterpart funds 
(Follow-up) 

RELEX 

Governance review in 
the RELEX field 
(Follow-up) 

18-Mar-03 

14-Feb-03 

23-Mar-03 

28-Feb-03 

18-Mar-03 

Administrative and other Support Systems 

13-Nov-03 

21-Nov-03 

23-May-03 

08-Sep-03 

08-Apr-03 

22-Dec-03 

02-Feb-04 

12-Jun-03 

16-Oct-03 

15-Apr-03 

28-Apr-03 

10-Nov-03 

8-Dec-03 

19-Jan-04 

15-Mar-04 

10-May-04 

13-Oct-03 

16-Feb-04 

16-Jun-03 

IT governance 

Training Update 

PRESS 

15-Mar-02 

24-Feb-03 

17-Feb-03 

21-Jan-03 

19-Mar-03 

08-Jul-03 

23-May-03 

22-Jul-03 

12-Sep-03 

15-Sep-03 

13-Oct-03 

13-Oct-03 

Recommendations made by the IAS have been widely accepted by auditees and are to a 
large extent, according to information from auditees, either already implemented or in the 
course of being implemented.  

The following table gives an overview over the degree of acceptance of recommendations 
for the audits covered in the present report: 

EN 

4 

   EN 

 
Acceptance of IAS audit recommendations: 

Accepted 

Accepted with 
comments 

Partly 
rejected 

Rejected  Outdated 

Total 

% 

Critical 
Very 
imp. 
Important 
Desirable 
Total 
% 

33 

27 

11 

3 

3 

77 

12,16% 

152 
161 
31 
377 
59,6% 

70 
42 
16 
155 
24,5% 

16 
12 
4 
43 
6,8% 

23 
17 
11 
54 
8,5% 

1 
0 
0 
4 
0,6% 

262 
232 
62 
633 
100,0% 

41,39% 
36,65% 
9,79% 
100,0% 

Following  the  completion  of  its  cycle  of  DG  audits  in  2004,  the  IAS  will  be  able  to 
present a consolidated picture of findings later this year, which should assist in gauging 
the relative importance of each of these. 

Little  progress,  other  than  general  planning,  has  been  made  with  the  IAS  new  remit  to 
audit  14  Agencies,  a  task  required  by  Article  185  of  the  Financial  Regulation  and  the 
Implementing Rules, which lead to a reservation in the 2003 Annual Activity Report of 
the IAS.  

The  IAS  also  carries  out  from  time  to  time  specific  consultancy  engagements  and  is 
frequently asked to contribute to or volunteers its professional advice on internal control 
issues,  resource  management  and  operations.  The  IAS  undertakes  such  consulting 
activities  in  line  with  normal  internal  auditing  practice  and  with  its  mandate  under  the 
Financial Regulation and the IAS Charter. 

3. 

SUMMARY OF CROSS-CUTTING FINDINGS AND RECOMMENDATIONS 

The  following  five  chapters  discuss  the  recommendations  made  by  the  IAS  on  cross-
cutting  issues,  derived  from  the  findings  of  the  audits  presented  in  the  attached 
Commission  Services  Working  Paper  and  reinforcing  in  many  cases  similar  findings 
made in earlier Annual Reports from the IAS. 

Delegation of responsibility, accountability and supervision, which are core objectives of 
the Reform, are at the heart of many of the findings and recommendations emerging in 
IAS reports and underlie most of the systemic issues raised. 

3.1. 

Accounting and Management Information Systems 

The  IAS  considers  that,  parallel  to  financial  management  and  accounting  reform,  the 
accounting  function  within  DGs  needs  to  be  strengthened  and  professionalised  so  that 
within and across DGs the Commission and its management can have systemic assurance 
that  the  accounts  are  complete,  accurate  and  relevant.  Systems  must  ensure  that  the 
accounts capture all relevant information and  staff must be aware of the dangers of not 

EN 

5 

   EN 

 
 
  
recording  it.  Management  and  external  stakeholders  need  to  have  assurance  that  the 
numbers  represent  reality,  otherwise  decisions  will  be  ill-founded.  For  this  reason,  the 
IAS considers it preferable that the monitoring/recording function should have not only 
professionalism but also not fully depend on the authorising function. 

Based on these considerations, the IAS proposes that functional reporting be formalised 
between  those  responsible  for  the  accounting/monitoring  function  in  the  DGs  and  the 
Accounting  Officer.  It  is  the  view  of  the  Commission,  that  the  existing  contacts  in  the 
network of financial units (RUF), the group of resources directors, the group of the DG 
internal  control  co-ordinators  and  the  creation  of  the  accounting  correspondent  and 
accounting system user network, together with the need to keep clear and unambiguous 
reporting lines to the Director-General means that it does not intend to formalise further 
relations between the accounting and the monitoring function at DG and at central levels. 

In order to comply with the provisions of the Financial Regulation regarding the role and 
function of the Accounting Officer (Art. 61), the IAS considers that it is necessary for the 
Accounting Officer to assume, beyond a consolidation function relying exclusively on the 
assurance  given  by  delegated  Authorising  Officers  as  provided  in  Article  61(2),  also 
systemic  and  overall  product  responsibility  for  the  integrity  of  the  accounts  for  the 
Institution  as  a  whole.  The  IAS  proposes  to  confirm  or  clarify,  if  necessary  through  a 
change to the Financial Regulation. Based on the provisions of the Financial Regulation, 
according to which it is the Authorising Officers by delegation, and not the accountant, 
who  is  responsible  for  the  underlying  assurance  of  legality  and  regularity  of  the 
transactions  and  for  the  reliability  of  the  related  information,  the  Commission  has 
confirmed the systemic responsibility of the Accounting Officer. In application of Article 
61(1e) of the Financial Regulation, the Accounting Officer has launched in 2004 a survey 
to validate the DGs' information systems and accounting procedures.  

Given  the  impossibility  to  attribute  major  categories  of  overheads to  activities,  the  IAS 
proposes  an  evaluation  of  the  tools  necessary  for  the  pursuit  of  the  implementation  of 
ABM,  with  particular  reference  to  the  need  for  cost  accounting  of  key  overheads.  The 
Commission will consider this recommendation in the event that further development of 
the existing SPP/ABM structure stemming from the administrative reform undertaken by 
the present Commission is deemed appropriate.  

3.2. 

Delegation Risk 

Progress  has  been  made  in  acknowledging  the  delegation  risk,  which  results  from  the 
Commission having final budget responsibility for all its expenditure but having to meet 
that  responsibility  also  when  EU  funds  are  implemented  in  shared  management  with 
Member  States.  The  IAS  report  renews  the  suggestion  that  this  crucial  issue  be  solved 
through a clear protocol as to the exact responsibility of Member States on the one hand 
and  the  Commission  on  the  other,  reinforced  by  a  country  disclosure  and  assurance 
statement. 

Accordingly,  the  IAS  suggests  that  concrete  steps  be  taken  now  to  ensure  that  the 
Structural Funds legislative framework for the next programming period include ‘ex ante’ 

EN 

6 

   EN 

 
Disclosure Statements by managing authorities with a clear legal authority for penalties 
affecting  the  overall  funding  of  the  Member  State  concerned,  in  case  of  inadequate 
disclosure. The Commission, in its recent proposals for the legal framework of the next 
Structural  Funds  programming  period  has  introduced  the  requirement  to  present  audit 
assurance  statements  by  Member  State  audit  bodies  together  with  reinforced  provisions 
on financial corrections. As far as agriculture is concerned, the legislative framework for 
the  next  programming  period  includes  an  assurance  statement  for  the  Paying  Agencies 
which are in charge of the management and control in the Member States. This proposal 
concerns all agricultural expenditure (2 funds: FEAGA and FEADER). 

The IAS proposes that a joint approach be developed with the ECA on the way forward 
towards  agreed  acceptably  qualified  assurance.  The  Commission  welcomes  the  Court's 
new DAS approach and sees in that the basis for working towards an agreed statement, 
based on solid financial management information presented in the DG's Annual Activity 
Reports and the Commission's synthesis report.  

3.3. 

Activity Based Management – ABM Tools 

Audit findings have led the IAS to raise a number of issues in this area: Firstly and most 
basically, the definition of objectives can be too global, which reveals itself in difficulties 
with resource allocation and risk analysis. Secondly, there is understandable difficulty in 
developing  meaningful  performance 
IAS  has  proposed  no 
recommendation  on  these  observations  at  this  stage  since  they  may  just  be  teething 
problems with the new ABM mechanisms. Thirdly, in some cases there is no clear link 
between  the  Annual  Management  Plan  (AMP)  for  a  DG  and  a  comparable  plan  at  the 
level of Directorates or Units. This would, however, lead to a clear and integrated single 
planning  structure  for  a  DG,  the  DG  level  AMP  having  more  chance  of  being 
implemented if underpinned by Unit level plans. Accordingly, the IAS advises to clarify 
the  instructions  to  DGs  regarding  the  necessary  coherence  of  AMPs  at  all  levels  of  the 
organisation.  

indicators.  The 

The  Commission  recognises  the  need  for  Annual  Management  Plans  at  unit  level,  but 
does not want to introduce mandatory standards, as units' responsibilities widely vary and 
decentralisation  of  management  responsibilities  towards  DGs  implies  that  they  are  best 
placed  to  organise  their  internal  management,  reporting  locally  and  according  to  their 
own circumstances. 

3.4. 

Legacy Risks, Resource Allocation and Risk Management 

The Commission has inherited a number of serious legacy risks, some created by earlier 
under-resourcing,  which,  in  the  view  of  the  IAS,  are  either  not  gaining  adequate 
recognition  or  are  being  managed  at  the  expense  of  sound  management  of  current 
programmes.  The  IAS  considers  that  there  should  be  explicit  recognition  of  these 
situations  and  they  should  feature  in  an  Institution-wide  management-led  risk  analysis. 
This  should  be  the  basis  for  resource  allocation  decisions,  including  as  appropriate  the 
use of executive agencies, and the ‘under-managed’ risks should be made known to the 
Budgetary Authority. 

EN 

7 

   EN 

 
The IAS recommends that the Commission and its departments ensure that resources are 
made  available  for  audit  work  to  be  carried  out  early  enough  in  the  lifetime  of 
programmes  to  prevent  the  creation  of  future  legacy  problems.  Such  audits  would  be 
more effective in preventing the build up of new legacy exposures if they were combined 
with disclosure statements, as suggested. It also recommends that the correction of past 
errors should be carried out promptly on discovery and that corrective action be properly 
recorded and documented. The Commission agrees with the recommendations from the 
IAS  and  will  pay  proper  attention  to  these  considerations,  in  the  limits  of  what  is 
possible, in resource allocation and planning. In particular, for the Structural Funds, for 
the  current  programming  period,  there  will  be  increased  cooperation  with  national 
authorities  concerning  system  audits  and  ex  post  controls.  The  new  ex-post  controls 
network, a sub-group of the network of the DG internal control co-ordinators provides a 
forum for exchanging best practice and harmonising methodology and strategies. It will 
start  its  work  in  autumn,  drawing  up  an  inventory  of  ex-post  control  activities  and 
methods existing in DGs. 

The  IAS  repeats  its  recommendation  of  last  year,  accepted  by  the  Commission,  that  an 
institution-wide  risk  management  be  developed  and  that  specifically  the  DGs’ 
management  risk  self-assessments  be  further  shared  and  centrally  analysed 
to 
complement the CFS overview of the state of internal controls. This consolidated picture 
should  be  completed  by  such  material  as  the  results  of  audits,  the  Court  of  Auditors' 
reports  and  the  Discharge  resolution  to  provide  a  risk  picture  for  the  Institution  as  a 
whole,  with  a  view  to  the  establishment  of  a  management-led  central  capacity.  The 
growth  and  potential  of  executive  agencies  as  a  means  to  deal  with  staff  shortage  in 
programme  management  could  usefully  be  directed  and  monitored  through  this  same 
central capacity. 

The Commission had accepted this recommendation in its synthesis report for 2002 and 
confirmed in its 2003 synthesis report that "risk analysis should help in orienting resource 
allocation, alongside other elements such as policy priorities"1. 

3.5.  Management Assurance and Control Activities 

The DG assurance statement has gained recognition for its importance as a transparency 
and  accountability  tool  and  has  gone  through  a  second  year.  Since  the  February  2004 
decisions2, the DGs’ Resource Directors co-ordinate internal control issues and sign off 
the relevant annexes to the Annual Activity Report, thereby strengthening the checks and 
balances  at  DG  level.  It  remains  Reform’s  major  change  instrument,  and,  in  the  IAS' 
view, the Commission’s AAR Synthesis report and related Overview on Internal Control 
from the Central Financial Service (CFS) should continue to be reinforced. 

1 
2 

"Synthesis of Annual Activity Reports 2003 of DGs and Services", point 4. 
"Completing the Reform Mandate", COM(2004) 93 of 10 February 2004. 

EN 

8 

   EN 

 
                                                 
The IAS recommends that future Synthesis reports should focus on the AOD declarations 
which relate to the effectiveness of controls and that the CFS position statement should 
progressively give more prominence to the evaluation of effectiveness than to the degree 
of  formal  compliance  with  the  internal  control  standards.  The  Commission  agrees, 
stressing  in  its  2003  synthesis  report  the  "need  for  enhanced  attention  by  DGs  and 
services  on  the  effectiveness  of  their  internal  control  systems,  also  to  ensure  that  they 
adequately  support  the  assurance  to  be  given  yearly  by  them  as  authorising  officers  by 
delegation"3. 

Controls  on-the-spot  are,  in  the  opinion  of  the  IAS,  not  frequent  enough  to  provide  a 
disincentive  to  over-claiming  and/or  do  not  form  part  of  an  overall  control  and  audit 
strategy.  In  cases  where  internal  management  is  fully  decentralised,  the  managing  unit 
should  be  carrying  out  all  necessary  controls  under  its  own  responsibility;  this  should 
include  those  on-the-spot  checks  designed  to  prevent  over-claiming  where  grants  are 
linked  to  real  expenditure.  Managing  units  often  do  not  have  the  necessary  skills  to  do 
this and, if it is done at all, it is done by central control units in the DGs.  

Clarity  is  needed  conceptually  that,  in  such  cases,  the  specialised  units  are  providing 
assistance to the managing units and not assuming its responsibilities; staff of managing 
units  should  participate  in  drawing  up  the  audit  strategy  and  risk  analysis  and  should 
participate in the controls on-the-spot. There needs to be a clear distinction between this 
activity and internal audit (IAC) work intended to verify the effectiveness of management 
systems  as  a  whole.  Against  this  background,  the  IAS  proposes  that  the  CFS  assist  in 
the 
clarifying  conceptually 
responsibilities  of  AODs  and  AOSDs  and  issue  appropriate  instructions  or  amended 
internal  control  standards  in  order  to  ensure  its  proper  implementation.  The  above-
mentioned  ex-post  control  network,  set  up  within  the  network  of  the  DG's  Control  Co-
ordinators  and  chaired by  the  CFS,  has,  among  others,  the  mandate  of  exchanging best 
practice and harmonising control activities and methods, taking into account international 
standards. 

the  activity  of  on-the-spot  control 

in  relation 

to 

3 

"Synthesis of Annual Activity Reports 2003 of DGs and Services", point 7. 

EN 

9 

   EN