Annual Report to the Discharge Authority   on Internal Audits Carried out in 2006
Date: 2007-05-30
Institutions: European Commission
Subjects: European Commission, activity report, audit, budgetary discharge, financial regulation, management accounting

COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 30.5.2007 
COM(2007) 280 final 

ANNUAL REPORT 

TO THE DISCHARGE AUTHORITY  

ON INTERNAL AUDITS CARRIED OUT IN 2006 

(presented by the Commission) 

{SEC(2007) 708} 

EN 

   EN 

 
 
 
  
 
 
 
TABLE OF CONTENTS 

1. 

2. 

Introduction .................................................................................................................. 3 

Working environment and audit plan........................................................................... 3 

2.1.  Working environment .................................................................................................. 3 

2.2. 

2.3. 

2.4. 

3. 

3.1. 

3.2. 

3.3. 

3.4. 

3.5. 

3.6. 

4. 

Developments in the Internal Audit Process................................................................ 4 

Implementation of the IAS audit plan.......................................................................... 5 

Acceptance of recommendations and views of auditees and stakeholders .................. 6 

Findings........................................................................................................................ 7 

Quality review of all IACs ........................................................................................... 7 

Governance, planning and organisation....................................................................... 7 

Management of EU funds ............................................................................................ 8 

Human resources management .................................................................................... 9 

ABAC......................................................................................................................... 10 

Follow-up ................................................................................................................... 10 

Conclusions ................................................................................................................ 11 

EN 

2 

   EN 

 
1. 

INTRODUCTION 

This report informs the Discharge Authority about the work carried out by the Commission's 
Internal  Audit  Service  (IAS)  in  2006,  in  accordance  with  Article  86(4)  of  the  Financial 
Regulation (FR). It is based on the report of the IAS according to Article 86(3) of the FR on 
key  audit  findings  and,  in  accordance  with  professional  standards,  on  significant  risk 
exposures and control issues and corporate governance issues. The present report is based on 
IAS  audit  work  and  consulting  activities  in  2006.  It  also  draws  on  the  work  of  the  DGs' 
Internal  Audit  Capabilities  (IACs),  via  the  IAS's  twice-yearly  reports  on  IAC  work.  It  does 
not  cover  the  IAS  audit  work  for  the  Community  agencies,  apart  from  the  figures  on 
implementation of the work programme1. 

The  Commission's  reactions  to  the  findings  and  conclusions  of  the  Internal  Auditor  are 
covered in the synthesis report on the annual activity reports of the Directors-General. In this 
synthesis  report,  adopted  at  the  same  time,  the  Commission  takes  a  position  on  the  cross-
cutting  issues  raised  by  the  Internal  Auditor,  the  European  Court  of  Auditors,  and  the 
Discharge  Authority,  or  identified  by  the  Audit  Progress  Committee  and  by  the  Director-
General for Budget in his overview report. This means that certain views or opinions in this 
report are not necessarily fully shared by the Commission. This difference of views reflects 
the normal process of dialogue between the institution and its Internal Auditor. 

2. 

WORKING ENVIRONMENT AND AUDIT PLAN 

2.1.  Working environment 

An  action  plan  for  the  roadmap  towards  an  integrated  internal  control  framework  was 
presented in January 2006 with a series of 16 specific proposals. The Commission improved 
accountability,  for  instance  by  the  individual  assurance  declarations  and  reservations  issued 
by  Directors-General,  and  on  this  basis  the  Commission  drew  for  the  first  time  also  on  the 
synthesis report in order to explicitly assume its political responsibility for management. 

The  Commission's  Accounting  Officer  presented  to  the  European  Court  of  Auditors  (ECA) 
the financial statements for 2005, the first to be prepared on a full accrual basis in accordance 
with internationally accepted accounting standards. The Court noted that important progress 
has been achieved. Attaining complete compliance with all accounting standards throughout 
the Commission is a process which will take time to complete. Migration of ABAC assets to 
SAP  and  the  inclusion  of  ABAC  contracts  in  ABAC  workflow  are  still  at  the  preliminary 
studies  stage.  The  major  tasks  in  progress  are  the  progressive  implementation  of  the  new 
accounting system also for the European Development Fund, as well as in the agencies, in the 
European  Economic  and  Social  Committee  and  the  Committee  of  the  Regions  and  in  the 
Commission delegations. 

1 

In  some  cases,  however,  agency  audits  resulted  in  recommendations  concerning  the  Commission  and 
are taken into account in the statistics in Section 2.4. 

EN 

3 

   EN 

 
                                                 
The sign-off of the accounts by the Accounting Officer has been embedded in the amended 
Financial  Regulation2,  which  entered  into  force  on  1  May  2007,  including  the  possibility  to 
check the information received. 

Establishment of executive agencies, including, in some cases, their internal audit functions, 
has continued, and the readiness of one to take over programme implementation tasks from its 
parent  DG  was  audited  by  the  IAC.  Particular  attention  should  be  paid  to  a  clear  and 
organised handover of tasks from DGs to their executive agencies. 

The  Commission  strengthened  its  business  continuity  management  and  issued  a  Framework 
Communication  on  preparations  for  any  major  disruptions  affecting  its  activities,  staff, 
buildings,  information  and  other  assets  in  order  to  ensure  that  the  Commission  is  able  to 
continue operating as far as possible. 

The  Commission  held  its  first  ethics  day  in  the  form  of  a  one-day  training  session,  divided 
into four workshops which produced lively  discussions and good participation by staff. The 
objective  was  to  raise  awareness  of  the  personnel  about  ethical  issues  and  to  initiate 
discussions on ethics and integrity issues inside the different DGs and services. 

these  achievements  are  certainly  encouraging, 

the  Commission  still  shares 
While 
implementation  of  about  80%  of  the  EU  budget  with  the  Member  States.  Therefore,  the 
overall success of the efforts to create an integrated control framework largely depends on the 
determination and capability of Members States to implement effective and efficient control 
systems that reduce the risk to an acceptable level and to provide declarations of assurance on 
these systems. 

2.2. 

Developments in the internal audit process 

In 2006 a quality review of all 32 Commission IACs was carried out by the IAS for the first 
time.  It  paved  the  way  for  a  coordinated  strategic  audit  planning  (in  which  most  IACs 
participate) and for revised audit charters (on which work has started). 

Cooperation between the IAS and IACs further improved throughout 2006, inter alia through 
new joint audits. Coordination of audit plans, joint training efforts and cooperation on ABAC 
audits are examples of the working relationship with the ECA.  

New  templates  for  audit  and  follow-up  reports  were  designed  and  implemented  to  allow 
auditors to produce more focused audit reports. 

Preparatory  work  was  carried  out  for  introduction  of  a  new,  more  user-friendly  web-based 
version of the Audit Management System (AMS), scheduled for the first quarter of 2007. 

With a view to simplification proposals, efforts to identify relevant issues will be stepped up 
in 2007. 

2 

Council  Regulation  (EC,  Euratom)  No  1995/2006  of  13  December  2006  amending  Regulation  (EC, 
Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European 
Communities (OJ L 390, 30.12.2006, p. 1). 

EN 

4 

   EN 

 
                                                 
2.3. 

Implementation of the IAS audit plan 

The 2006 audit plan of the IAS was endorsed by the Commission's Audit Progress Committee 
(APC)  on  5  December  2005  and  fine-tuned  throughout  the  year.  In  an  effort  to  avoid 
duplication with audits carried out by the ECA most IAS ABAC audits in the operational DGs 
and  the  audit  on  rural  development  were  cancelled  and  replaced  by  mainly  new  follow-up 
engagements, work on the 2007-2009 strategic audit plan and increased resources for the IAC 
quality reviews. 

The work programme was implemented at 88%: 69 Commission reports (23 audit reports, 8 
follow-up  reports,  and  38  review  reports)  and  8  audits  of  agencies  audits  were  finalised  in 
2006. Executive summaries of the Commission audits and reviews are annexed. 

List of finalised Commission audits and reviews: 

DG/Service 

Issued 

Engagement 

Reviews, administrative and other support systems 

32 IACs 

ADMIN 

ADMIN 

COMM 

DIGIT 

EPSO 

OPOCE 

PMO 

SCIC 

32 IAC quality reviews and one overview report 

12 October  

Human resources management I 

Human resources management II 

Follow-up of 2003 in-depth audit 

Data centre-operations and security 

Selection process as managed by EPSO 

7 April  

27 October  

24 October 

8 December 

7 April  

Follow-up of 2004 in-depth audit  

18 December 

Regularity of financial management, implementation of 
financial circuits  

8 December  

Financial management and procurement 

22 September  

Internal policies 

ADMIN, 
SANCO, TREN, COMP 

SG,  BUDG, 

COMP 

SANCO 

TREN 

SPP/ABM cycle in the Commission 

27 November  

Effectiveness and efficiency of the SPP/ABM cycle 

20 July  

Effectiveness and efficiency of the SPP/ABM cycle 

7 April  

Effectiveness  and  efficiency  of  the  SPP/ABM  cycle  – 
resource allocation 

10 April 

SG,  MARKT, 
ENV, TREN 

ENTR, 

Overview report: Monitoring the implementation of EC 
law 

22 December 

ENTR 

MARKT 

TREN 

JLS 

MARKT 

SANCO 

Monitoring the implementation of EC law 

Monitoring the implementation of EC law 

5 December  

7 November  

Review of monitoring the implementation of EC law  

14 December  

Large IT project management 

Local IT 

IT management 

8 June  

10 November  

8 December  

EN 

5 

   EN 

 
 
 
TAXUD 

COMM 

EAC 

ENTR* 

ENV 

INFSO 

JRC 

RTD 

Large IT systems 

Contract management 

Implementation of ABAC 

Financial management of the IRC network 

Follow-up of in-depth audit 

Follow-up of 2004 in-depth audit  

Interim follow-up audit report 

Ex-post controls 

24 January  

11 October  

30 June  

6 April  

9 February  

7 December  

9 February  

21 December 

Structural Measures and Common Agricultural Policy 

AGRI,EMPL,FISH,REGIO  Overview report Structural Funds (Article 38) 

8 March  

REGIO 

FISH 

REGIO 

External Policies 

AIDCO 

AIDCO, ECHO 

ELARG 

RELEX** 

RELEX 

ERDF 

Follow-up of 2004 in-depth audit  

21 February  

18 December 

Financial corrections in Cohesion Fund 

22 November  

Interim follow-up audit report  

Implementation  of  framework  agreement  with  UN 
agencies,  combined  with  ECHO  monitoring  and 
management reporting system – overflow 2005 audit 

Ex-post control activities 

Ex-post control activities 

Follow-up note 

22 February  

28 July 

20 December 

22 December 

31 October 

*Joint audit with DG ENTR, ** Joint audit with DG RELEX 

2.4. 

Acceptance of recommendations and views of auditees and stakeholders 

In 2006 the rate of acceptance of audit recommendations by auditees was 89.4%, with 7.9% 
rejected and 2.7% pending3. 

Commission audits (excluding IAC quality review) 

Recommendations 

Accepted  Rejected Pending* % 

Total 

Critical  

Very 
important  

Important 

Desirable 

11 

182 

162 

8 

1 

6 

25 

0 

0 

8 

3 

0 

2.9 

12 

48.3 

196 

46.8 

190 

2.0 

8 

3 

Commission audits only, excluding the IAC quality review. 

EN 

6 

   EN 

 
                                                 
% 

Total 

89.4 

363 

7.9 

32 

2.7 

11 

406 

* Being considered in the context of a Commission decision 

As concerns the IAC quality review, 241 recommendations were issued, of which 228 were 
accepted and 13 were rejected. 

Auditees' feedback on the audit scope and the conduct of the audit yielded an average result of 
1.95 (previous year: 1.82) on a scale from 1 (highest) to 4 (lowest). In  a fresh stakeholders' 
survey at the end of 2006, 75% thought that the IAS had a clear audit strategy (compared with 
the  previous  result  of  79%),  86%  that  audits  were  performed  with  honesty,  objectivity  and 
fairness  (down  from  93%)  and  61%  (previously  63%)  that  the  IAS  recommendations  are 
readily  useful.  In  all,  80%  (up  from  71%)  considered  that  the  mission  of  the  IAS  is  well 
understood. 

3. 

FINDINGS 

3.1. 

Quality review of all IACs  

This quality review of IACs took the form of validation reports by the IAS on 32 individual 
IAC self-assessments and the resulting overview report. The objective was to assess the IACs' 
conformity  with  the  Institute  of  Internal  Auditors'  (IIA)  Standards  for  the  Professional 
Practice for Internal Auditing and the Code of Ethics. Eleven of the 32 IACs were found to be 
generally  compliant  with  both  attribute  and  performance  standards,  17  were  partially 
compliant and 30 were found to be compliant with the Code of Ethics. This clearly shows that 
the  effort  to  increase  professionalism  and  compliance  with  audit  standards  has  to  be 
maintained. 

This review triggered discussions and reflections on the role and organisation of internal audit 
within the Commission. Considering that some 120 auditors work in the IACs and around 60 
for  the  IAS,  there  is  a  clear  need  for  a  common  definition  of  the  audit  universe,  risk 
assessment  and  coordinated  audit  planning.  Without  prejudging  any  further  Commission 
decision, some IAS proposals related to the independence of the IAC and the possibility for a 
head of IAC to address a party outside the DG are currently being examined with the IACs. 
The APC will review implementation of the IAS proposals in July 2007. 

3.2. 

Governance, planning and organisation 

Monitoring the implementation of EC law 

The timely and correct implementation of EC legislation is primarily the responsibility of the 
Member  States,  but  as  “guardian  of  the  Treaty”  the  Commission  has  a  monitoring  task.  In 
order  to  improve  monitoring  of  implementation  of  EC  law,  the  IAS  proposed  a  risk-based 
plan  on  transposition  of  EC  directives,  a  more  systematic  approach  to  verification  of 
implementing  measures  at  the  level  of  Member  States,  prioritisation  criteria  for  complaints 
and  infringement  cases  and  maximum  throughput  times  for  the  most  important  cases.  A 
Commission  Communication  on  monitoring  EC  law  is  currently  being  prepared  and  is 
expected to be adopted by the end of 2007. 

EN 

7 

   EN 

 
 
 
 
Implementation of SPP/ABM process 

While the DGs audited were found to be formally in compliance with the Commission rules 
on  SPP/ABM  and  the  corresponding  Commission  Internal  Control  Standards,  the  IAS 
considers that further progress is needed on the effectiveness and efficiency of the SPP/ABM 
cycle  so  that  DGs  can  move  from  formal  compliance  to  real  ownership  and  to  leverage  the 
benefits  for 
internal  management.  Some  IAS  recommendations  have  already  been 
implemented,  such  as  the  need  for  multi-annual  strategic  planning  and  to  take  into  account 
core  business  instead  of  focusing  exclusively  on  new  initiatives  in  the  APS.  The  IAS  also 
recommended  screening.  In  response  to  the  European  Parliament's  request,  the  Commission 
has prepared an assessment of its mid-term staff needs and a detailed report on the staffing of 
support  and  coordination  functions.  Progress  has  also  been  made  on  integrating  risk 
management  into  the  policy-making  process.  Other  recommendations,  such  as  developing  a 
strategy  to  support  the  SPP/ABM  cycle  with  IT  and  full  monitoring  of  human  resources 
allocations have not been taken on board. 

IT management/systems 

The IAS audited the Commission's data centre and IT management in four operational DGs 
and  the  risk  analysis  was  confirmed  by  five  (out  of  a  total  of  twelve)  resulting  critical 
recommendations. 

Two critical recommendations related to physical security in the JMO and BECH buildings in 
Luxembourg.  Another  very  important  one  was  to  set  up  a  comprehensive  disaster  recovery 
plan covering all critical information systems hosted in the Data Centre. This is linked to the 
fact that DGs might not be sufficiently prepared to ensure the continuity of their operations, as 
reliable information on their critical systems was not available. 

The  Schengen  Information  System  (SIS  II)  was  found  to  have  suffered  from  inadequate 
project management, in particular insufficient monitoring of contractors' performance due to 
insufficient specialised staff and non-optimised use of staff, leading the Commission to rely 
heavily on the quality and reliability of the contractor. 

Measures should also be taken to ensure that all DGs fully comply with Regulation (EC) No 
45/2001  on  the  protection  of  personal  data  and  that  the  local  information  security  officer 
performs sufficient controls and acts independently. 

IT-related audits were also carried out by three IACs. Issues identified at local level included 
the need for a thorough planning process for IT applications, definition of the role of project 
owners and the need to have a complete local IT inventory. 

3.3.  Management of EU funds 

Structural Funds 

The objective was to determine whether the Commission has put in place a system to verify if 
the  control  systems  presented  by  Member  States  meet  the  required  standards,  to  assess  the 
controls put in place at DG level, including assessment of cooperation with Member States, 
and  to  evaluate  ex-post  controls  carried  out  by  the  structural  funds  DGs.  The  IAS 
recommended that reporting requirements for authorising officers by sub-delegation should be 
defined  more  precisely.  Structural  Funds  DGs  should  establish  a  common  audit  strategy, 

EN 

8 

   EN 

 
based  on  the  coordination  work  already  undertaken.  Greater  coordination  with  Member 
States,  including  through  "contracts  of  confidence",  improved  compliance  with  minimum 
auditing  standards  and  a  clear  and  precise  audit  opinion  or  disclaimer  would  improve  the 
assurance process. The main audit results should be clearly disclosed in DGs' annual activity 
reports  in  order  to  obtain  a  fuller  picture  of  the  level  and  type  of  assurance  given  on  the 
management and control systems put in place by the Member States. 

The  IAS  considers  that  the  financial  correction  procedure  for  the  cohesion  fund  should  be 
significantly  improved  to  reduce  its  overall  length.  In  order  to  avoid  the  risk  of  non-
compliance  with  the  Financial  Regulation  and  other  rules,  the  interpretation  of  the  "net 
reduction"  principle  and  the  application  of  the  "flat  rate"  correction  criterion  should  be 
clarified. The financial reporting should be reinforced as well, in particular with regard to the 
forecasting of revenue. 

FAFA (Financial and Administrative Framework Agreement with the UN) 

The  objective  of  the  audit  was  to  evaluate  compliance  with  the  FAFA  and  the  capacity  to 
obtain assurance about the use made of EU funds. The IAS identified a risk that the EU funds 
might not have been used for intended purposes, especially as the reporting of indirect costs 
lacked transparency. The audit demonstrated the  usefulness of  the  FAFA, which provided a 
much  needed  reference  framework  for  cooperation  between  very  diverse  partners  on  both 
sides  of  the  EC/UN  partnership.  The  APC  invited  the  IAS  to  assess  the  materiality  of  the 
residual risks with regard to indirect costs in particular, associated with the overall controls on 
EC/UN funding in the framework of the FAFA and the UN financial control system. 

Ex-post controls on research activities 

These audits were carried out to assess the compliance, efficiency and effectiveness of ex-post 
controls on research activities, which are instrumental for a positive declaration of assurance. 
In line with  the ECA's last annual  report,  the  IAS found  that  ex-post control activities were 
unsatisfactory and that coordinated and risk-based planning of ex-post controls is needed. The 
IAS recommended that objectives of ex-post  controls and the underlying strategy should be 
defined more clearly and the results should be better documented in the DGs' annual activity 
reports.  Sufficient  coverage  of  the  auditable  programmes  and  beneficiaries  should  be 
guaranteed. The requirements of the Financial Regulation should be met in terms of forecasts 
of revenue from cost claims following ex-post controls. The coverage by ex-post controls is 
clearly insufficient compared with the control objectives, which led to a reservation entered in 
the annual activity report. 

3.4. 

Human resources management 

These  reviews  covered  planning,  recruitment,  mobility,  underperformance,  absenteeism  and 
the system of internal controls in the selection process for permanent staff. The IAS pointed to 
the need for DG ADMIN to play a greater coordinating and monitoring role, with the aim of 
ensuring  the  consistent  application  of  human  resources  management  policies  across  the 
Commission. The IAS also proposed making human resources management an integral part of 
the  Commission's  strategic  planning/management  process  in  order  to  improve  the  match 
between the needs of the DGs and the availability of human resources and to develop a long-
term vision for effective human resources management. 

EN 

9 

   EN 

 
IAS proposals included developing workload indicators, setting targets for vacancy rates and 
the lead time to recruit, achieving better management of compulsory mobility, reconsidering 
the  ratio  between  permanent  and  temporary  staff  and  ensuring  better  management  of 
underperformance by improving the human resources skills of managers. Introducing a series 
of control and monitoring activities in the recruitment process could make it easier to organise 
the  appropriate  number  of  competitions  in  the  right  areas  and  to  increase  the  number  of 
successful applicants finally recruited. 

The IAS also found a lack of a long-term human resources strategy or the need for improved 
planning of human resources allocation in the audits relating to the SPP/ABM process. 

Human resources management was also the subject of audits by two IACs in 2006, in which 
the 
strategic  planning  and  efficient 
recommendations. Very important recommendations in a number of other IACs' audit reports 
also related to human resources issues. 

featured  prominently 

resource  allocation 

in 

3.5. 

ABAC 

The  implementation  of  the  new  accrual-based  accounting  system  (ABAC)  is  a  major 
challenge  for  the  Commission.  In  2006  both  the  IAS  and  ECA  included  ABAC  audits  in 
various DGs in their audit plan. Considering that one of the principal obligations of the ECA 
as  external  auditor  is  to  give  its  opinion  on  the  consolidated  financial  statements,  the  IAS 
decided  to  cancel  planned  ABAC  audits  in  a  number  of  DGs  covered  by  the  ECA  and,  in 
close  cooperation  with  the  ECA,  to  perform  an  audit  on  implementation  of  accrual-based 
accounting in DG EAC which covered the transition process to accrual based accounting as 
well as the 2005 year-end closing of the accounts in DG EAC. 

Based  on  the  results  of  the  IAS  audit  the  accounting  control  systems  of  DG  EAC  appeared 
inadequate  to  ensure  the  completeness,  accuracy  and  reliability  of  the  accounting  data. 
Therefore, the year-end accounting entries reported by DG EAC did not give a true and fair 
view of the financial position and performance of DG EAC. IAS opinion was based mainly on 
the  lack  of  adequate  documentation  of  the  year-end  closing  procedures,  the  absence  of  full 
reconciliation between the local systems and the central accounting systems plus significant 
accounting errors in the accrual calculations with a material impact on the account balances. 

3.6. 

Follow-up 

As production of audits has continued, follow-up has become an increasingly important issue 
and  is  now  subject  to  a  systematic  approach  and  separate  reports.  The  IAS's  2006  year-end 
report,  issued  in  February  2007,  concluded  that  while  the  number  of  outstanding 
recommendations is falling, significant delays still exist: 50% of outstanding critical and very 
important  recommendations  are  overdue  by  more  than  six  months.  Therefore  there  are  still 
significant weaknesses in management's implementation of action plans. 

In  two  cases  the  IAS  concluded  that  the  level  of  implementation  of  the  pending 
recommendations  was  not  sufficient  to  carry  out  a  full  follow-up  audit.  Recommendations 
from past IAS annual reports by the internal auditor should also be followed up. Examples of 
recommendations that were not sufficiently followed up in 2006 include the proposals on IT 
governance and the consolidation of IT infrastructure. 

EN 

10 

   EN 

 
4. 

CONCLUSIONS 

On  the  basis  of  his  2006  Commission  audits  and  reviews  and  related  work,  the  Internal 
Auditor  of  the  Commission  draws  the  following  conclusions  (the  Commission's  position  is 
contained in the synthesis report on the annual activity reports of the Directors-General). 

IAS Conclusion 1: Continue improvement efforts 

The IAS audit work found clear improvements in the internal control systems in many areas. 
Big  steps  have  been  taken  by  the  Commission  to  improve  the  control  environment,  for 
instance the Communication on business continuity, the ethics day and the focus provided by 
the high-level group looking at EC law. However, there are also still major weaknesses and 
further  efforts  are  needed,  as  illustrated  by  the  number  of  critical  IAS  recommendations 
(twelve) and the number of audits with adverse IAS opinions (nine). Areas for improvement 
include  ex-post  controls,  IT  (buildings,  data  security,  adequate  staffing  and  planning 
processes for IT projects and continuity of services), implementation of new accounting rules 
and  contract  management4  (oversight  of  use  of  framework  contracts,  monitoring  of 
subcontracting and multiple roles of a single service provider). 

IAS Conclusion 2: Follow-up, a recurring issue 

The overview reports on follow-up show that the culture of follow-up proposed in the 2005 
report has not yet been fully established. Further efforts must be made in the Commission in 
order  to  ensure  proper,  systematic  and  swift  follow-up  of  audit  recommendations. 
Implementation  of  internal  and  external  audit  recommendations  is  vital  to  achieving  the 
Commission’s strategic objective of a positive DAS. 

IAS Conclusion 3: Integrated Human Resources strategy  

Not  only  the  reviews  of  the  human  resources  management,  but  also  the  audits  of  the 
SPP/ABM  process,  of  monitoring  of  implementation  of  EC  law  and  of  IT  management 
showed that a long-term strategy for human resources management is an important factor in 
success  and  that  inadequate  allocation  of  human  resources  can  have  a  substantial  negative 
impact  on  the  operations  and  reputation  of  the  Commission.  DG  ADMIN,  as  the  central 
service  in  charge  of  human  resources  management,  together  with  the  decentralised  human 
resources units in DGs and services, should develop a strategy fully aligned on the strategic 
planning process. 

IAS Conclusion 4: 
architecture 

Improve 

the  efficiency  and  robustness  of 

internal  audit 

The Commission has a two-tier system of internal audit: the IACs and the IAS, which closely 
reflects the Commission’s governance architecture. The quality review concluded that the vast 
majority  of  IACs  partly  or  generally  complied  with  the  standards.  However,  the  efforts  to 
increase  professionalism  should  continue  and  the  recently  introduced  coordinated  planning 
process  should  be  solidly  embedded  in  order  further  to  improve  the  overall  efficiency  of 
internal audit work in the Commission. Without prejudging any further Commission decision, 
some  issues,  such  as  further  strengthening  the  independence  of  IACs  by  giving  them  the 

4 

A number of IAC audit reports also related to efficient contract management in public procurement. 

EN 

11 

   EN 

 
                                                 
possibility  to  escalate  issues at  a  corporate  level  in  the Commission,  were  openly  discussed 
and are still pending; they will be revisited by the APC in 2007. 

IAS Conclusion 5: Annual governance statement 

A  number  of  governance-related  issues  were  addressed  in  the  audits  finalised  in  2006 
(SPP/ABM,  monitoring  of  EC  law,  etc.)  and  in  the  IAC  quality  review;  governance  issues 
were also focused on at the 2006 IAS conference. The Commission has laid a solid foundation 
for its governance. In order to achieve full maturity and to make its governance architecture 
and  its  latest  developments  known  to  stakeholders,  the  Commission  should  describe  its 
governance  policy  and  practice,  preferably  in  the  synthesis  report  summarising  the  DGs' 
annual activity reports, make it available on its website and provide for its regular updating5. 
Such a description could include explanations of the Commission's risk management system, 
strategic planning, the code of ethics, the role of the Accountant, the internal control systems, 
internal audit and the APC. In this way, the Commission could increase credibility and trust 
on the part of its stakeholders and EU citizens. 

5 

Directive 2006/46/EC (OJ L 224, 16.8.2006, p. 1) placed an obligation on companies whose securities 
are admitted to trading on a regulated market and which have their registered office in the Community 
to  disclose  an  annual  corporate  governance  statement  as  a  specific  and  clearly  identifiable  section  of 
their annual report. 

EN 

12 

   EN