Report on the annual accounts of the European Network and Information Security Agency for the financial year 2005 together with the Agency's replies
Date: 2006-09-28
Institutions: European Court of Auditors
Subjects: European Court of Auditors, European Union Agency for Cybersecurity, administration of the Institutions, financial control, interinstitutional relations (EU), report

19.12.2006

EN

Official Journal of the European Union

C 312/1

I

(Information)

COURT OF AUDITORS

REPORT

on the annual accounts of the European Network and Information
Security Agency for the financial year 2005 together with the
Agency’s replies

(2006/C 312/01)

CONTENTS

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

STATEMENT OF ASSURANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

OBSERVATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1-2

3-6

7-8

Tables 1 to 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The Agency’s replies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2

2

2

3

5

Paragraph

Page

C 312/2

EN

Official Journal of the European Union

19.12.2006

INTRODUCTION

Reliability of the accounts

The European Network and Information Security Agency
1.
(hereinafter
the Agency) was created by Regulation (EC)
No 460/2004 of the European Parliament and of the Council of
10 March 2004 (1). It became fully autonomous in the second
half of 2005. The Agency’s main task is to enhance the capability
of the Community to prevent and respond to network and infor-
mation security problems by building on national and Commu-
nity efforts. In principle its mandate expires in 2009.

2.
Table 1 summarises the Agency’s competences and activi-
ties. Key information from the financial statements drawn up by
the Agency for the financial year 2005 is presented in Tables 2, 3
and 4.

STATEMENT OF ASSURANCE

3.
This Statement is addressed to the European Parliament
and the Council in accordance with Article 185(2) of Council
Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 (2); it
was drawn up following an examination of the Agency’s accounts,
as required by Article 248 of the Treaty establishing the European
Community.

4.
The Agency’s accounts for the financial year ended
31 December 2005 (3) were drawn up by its Executive Director,
pursuant to Article 17 of Regulation (EC) No 460/2004, and sent
to the Court, which is required to give a statement of assurance
on their reliability and on the legality and regularity of the under-
lying transactions.

The Agency’s accounts for the financial year ended 31 Decem-
ber 2005 are, in all material respects, reliable.

Legality and regularity of the underlying transactions

The transactions underlying the Agency’s annual accounts,
taken as a whole, are legal and regular.

The observations which follow do not call the Court’s state-
ment into question.

OBSERVATIONS

7.
The implementation of the budget for the financial year
2005 was marked by a low rate of commitment (70 %) and a sub-
stantial rate of carry-over (more than 40 % overall and up to
almost 80 % for operating expenditure). This situation was in part
due to problems inherent in the Agency’s start-up period and to
the fact that it did not start becoming operational until the sec-
ond half of 2005. In future, the Agency should be vigilant con-
cerning this risk, in particular by ensuring strict programming of
its activities.

5.
The Court conducted its audit in accordance with its poli-
cies and standards, which are based on international auditing
standards that have been adapted to the Community context. The
audit was planned and performed to obtain reasonable assurance
that the accounts are reliable and the underlying transactions are
legal and regular.

The Court has thus obtained a reasonable basis for the

6.
statement set out below.

8.
The Court noted that no activity-based management had
been brought in, despite the Agency’s financial regulation mak-
ing provision for its introduction, on the lines of that applied to
the general budget, with a view to improving the monitoring of
performance. In this context, achieving the Agency’s aims should
not mean merely carrying out a series of tasks. It should rather be
seen as contributing to the goals laid down in its basic Regula-
tion. The Agency’s work programme should, in principle, express
this contribution in operational and measurable terms.

This report was adopted by the Court of Auditors in Luxembourg at
28 September 2006.

its meeting of

For the Court of Auditors
Hubert WEBER
President

(1) OJ L 77, 13.3.2004, p. 1.
(2) OJ L 248, 16.9.2002, p. 1.
(3) These accounts were drawn up on 1 July 2006 and received by the

Court on 7 July 2006.

Table 1

European Network and Information Security Agency

.

1
9
1
2
2
0
0
6

.

Areas of Community
competence

Competences of the Agency
(Council Regulation (EC) No 460/2004 of 10 March 2004)

Governance

Resources made available
to the Agency

Products and services supplied

E
N

Objectives:

Tasks:

1. Management Board

2005 final budget:

Working groups:

The representatives of the
Member State governments
have, by common agree-
ment, adopted a statement
on the creation of a Euro-
pean Network and Infor-
mation Security Agency.
The Agency should operate
as a point of reference and
establish confidence by
virtue of its independence,
the quality of the advice it
delivers and the informa-
tion it disseminates, the
transparency of its proce-
dures and methods of
operating, and its diligence
in performing the tasks
assigned to it.

(Council Decision of 19 Feb-
ruary 2004, taken on the
basis of Article 251 of the
Treaty)

— enhance the capability of

the Community, the Mem-
ber States and businesses to
prevent network and infor-
mation security problems,

— provide assistance and

advice to the Commission
and the Member States on
issues related to network
and information security,

— develop a high level of

expertise on the basis of
national and Community
experience,

— assist the Commission in
the preparatory work for
updating and developing
Community legislation in
the field of network
and information security.

— collect appropriate informa-
tion to analyse current and
emerging risks,

— provide the European Parlia-
ment, the Commission and
European or national bodies
with advice,

— facilitate cooperation between
the Commission and the
Member States in the develop-
ment of common methodolo-
gies to prevent network
and information security
issues,

— track the development of

standards for products and
services on network
and information security,

— cooperate with third countries
and international organisa-
tions to promote a common
global approach to network
and information security
issues,

— express its own conclusions

independently.

Source:

Information supplied by the Agency.

Composition

— one representative of each Mem-

ber State,

— three representatives from the

Commission,

— three representatives, appointed
by the Council, without the right
to vote, each representing one of
the following groups:

— the information and communica-

tion technologies industry,

6,3 million euro (100 % Com-
munity subsidy).

Staff numbers at 31 Decem-
ber 2005:

38 posts in the establishment
plan

Three working groups were set
up in 2005 and finished their
work: Risk Management, Aware-
ness Raising and CERTS.

Publications:

— one annual report

posts occupied: 35

— ENISA Quaterly Newsletter: 3

+ 15 other staff (seconded
national experts)

Total staff: 50

— consumer groups,

assigned to the following duties:

— academic experts in network
and information security.

operational: 22

administrative: 28

Task

Adopt the Agency’s annual work pro-
gramme and its annual report.

2. Executive Director

Appointed by the Management Board
on a proposal from the Commission.

3. External audit

Court of Auditors.

4. Internal audit

The Commission’s Internal Auditor.

5. Discharge authority

Parliament on a recommendation
from the Council.

issues

Cooperation with Member
States and the other institu-
tions:

(number of events organised
jointly):

— Member States: 2 seminars

and 7 events organised in the
Member States

Other products/services:

— Who’s Who on Network
and Information Security

— 1 CD-ROM ‘ENISA inventory
of CERT activities in Europe’

— 1 CD-ROM ‘Raising Aware-
ness in Information Security,
Insight and Guidance for
Member States’

O

f
f
i
c
i
a
l

J
o
u
r
n
a
l

o
f

t
h
e

E
u
r
o
p
e
a
n
U
n
o
n

i

C
3
1
2
/
3

C 312/4

EN

Official Journal of the European Union

19.12.2006

EUROPEAN NETWORK AND INFORMATION SECURITY AGENCY

Table 2

Implementation of the budget for the financial year 2005

Source of revenue

Community
subsidies

Revenue

Revenue entered in
the final budget for
the financial year

Revenue received

Allocation of expenditure

6 346

4 400

Title I
Staff

Title II
Administration

Title III
Operating activities

(1 000 euro)

Expenditure

Final budget appropriations

entered

com-
mitted

paid

carried
over

cancelled

2 375

1 764

1 490

257

628

2 483

1 772

453

1 065

965

1 488

1 004

196

790

502

Total

6 346

4 400

Total

6 346

4 540

2 139

2 112

2 095

Revenue and expenditure account for the financial year 2005

Table 3

Operating revenue

Community subsidies

Operating expenditure

Staff

Administration

Operating activities

Assets

Fixed assets

Receivables

Cash and cash equivalents

Liabilities

Accumulated surplus/deficit

Economic result for the year

Current liabilities

Total (a)

Total (b)

Operating result (c = a – b)

Table 4

Balance sheet at 31 December 2005

Total

Total

(1 000 euro)

4 251

4 251

1 040

1 594

517

3 151

1 100

(1 000 euro)

344

13

2 510

2 867

0

1 100

1 767

2 867

Source: Agency data — These tables summarise the data supplied by the Agency in its annual accounts.

19.12.2006

EN

Official Journal of the European Union

C 312/5

THE AGENCY’S REPLIES

The Agency became operational only in September 2005.
7.
Being understaffed, and having limited time available, it proved
very difficult to improve the budget implementation rates. The
management will take necessary action and it is expected to have
higher execution rates for the budget implementation of 2006.

Having less than 12 months of operational activity, the
8.
Agency lacks the necessary resources in order to introduce and
apply effectively an Activity Based Management system. It is true
that Activity Based Management would improve dramatically the
measurability of
the Agency’s work. The management will
endeavour to have it in place as soon as the Agency is in a posi-
tion to dedicate the necessary resources for an Activity Based
Management system to be developed.