Report on the annual accounts of the European Network and Information Security Agency for the financial year 2006 together with the Agency's replies
Date: 2007-09-27
Institutions: European Court of Auditors
Subjects: European Court of Auditors, European Union Agency for Cybersecurity, administration of the Institutions, financial control, implementation of the budget, powers of the institutions (EU), report

19.12.2007

EN

Official Journal of the European Union

C 309/1

IV

(Notices)

NOTICES FROM EUROPEAN UNION INSTITUTIONS AND BODIES

COURT OF AUDITORS

REPORT

on the annual accounts of the European Network and Information
Security Agency for the financial year 2006 together with the Agency’s
replies

(2007/C 309/01)

CONTENTS

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

STATEMENT OF ASSURANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

OBSERVATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1-2

3-6

7-9

Tables 1 to 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The Agency’s replies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2

2

2

3

5

Paragraph

Page

C 309/2

EN

Official Journal of the European Union

19.12.2007

INTRODUCTION

The Court has thus obtained a reasonable basis for the

6.
Statement set out below:

The European Network and Information Security Agency
1.
(hereinafter
‘the Agency’) was created by Regulation (EC)
No 460/2004 of the European Parliament and of the Council of
10 March 2004 (1). The Agency’s main task is to enhance the
capability of the Community to prevent and respond to network
and information security problems by building on national and
Community efforts.

2.
Table 1 summarises the Agency’s competences and activi-
ties. Key data summarised from the financial statements drawn up
by the Agency for the financial year 2006 is presented in Tables 2,
3 and 4 for information purposes.

STATEMENT OF ASSURANCE

3.
This Statement is addressed to the European Parliament
and the Council in accordance with Article 185(2) of Council
Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 (2); it
was drawn up following an examination of the Agency’s accounts,
as required by Article 248 of the Treaty establishing the European
Community.

4.
The Agency’s accounts for the financial year ended
31 December 2006 (3) were drawn up by its Executive Director,
pursuant to Article 17 of Regulation (EC) No 460/2004, and sent
to the Court, which is required to give a statement of assurance
on their reliability and on the legality and regularity of the under-
lying transactions.

The Court conducted its audit in accordance with the IFAC
5.
and INTOSAI International Auditing Standards and Codes of Eth-
ics, insofar as these are applicable in the European Community
context. The audit was planned and performed to obtain reason-
able assurance that the accounts are reliable and that the under-
lying transactions are legal and regular.

Reliability of the accounts

The Agency’s accounts for the financial year ended 31 Decem-
ber 2006 are, in all material respects, reliable.

Legality and regularity of the underlying transactions

The transactions underlying the Agency’s annual accounts,
taken as a whole, are legal and regular.

The observations which follow do not call the Court’s State-
ment into question.

OBSERVATIONS

7.
The implementation of the Agency’s budget for the finan-
cial year 2006 shows a utilisation rate of 90 % of commitment
appropriations and 76 % of payment appropriations. There was
a concentration of transactions in the last quarter of the year. Fur-
thermore, the weaknesses of the procedures for establishing the
budget, led to a high number of transfers (4). Thus, the budgetary
principles of annuality and specification were not strictly
observed.

8.
The general accounting software used by the Agency
makes it possible to amend entries without leaving an audit trail.
Furthermore, a system for recording invoices that ensures the
accuracy of the financial information in the final accounts, has
not been established.

The internal control procedures required by the Financial
9.
Regulation to ensure transparency and sound financial manage-
ment have not yet all been documented. The Management Board
did not formally adopt standards for internal control and the code
of professional ethics. Written instructions for archiving support-
ing documentation of transactions were missing. A financial
irregularities panel was not established.

This report was adopted by the Court of Auditors in Luxembourg at
27 September 2007.

its meeting of

For the Court of Auditors
Hubert WEBER
President

(1) OJ L 77, 13.3.2004, p. 1.
(2) OJ L 248, 16.9.2002, p. 1.
(3) These accounts were drawn up on 1st July 2007 and received by the

Court on 5th July 2007.

(4) During 2006, more than 45 transfers were made.

European Network and Information Security Agency (Heraklion)

Table 1

Competences of the Agency
(Council Regulation (EC) No 460/2004 of 10 March 2004)

Governance

Resources made available
to the Agency

Products and services supplied

.

1
9
1
2
2
0
0
7

.

Areas of Community competence

The representatives of the Mem-
ber State governments have, by
common agreement, adopted a
statement on the creation of a
European Network and Informa-
tion Security Agency. The
Agency should operate as a
point of reference and establish
confidence by virtue of its inde-
pendence,
the
advice it delivers and the infor-
mation it disseminates,
the
transparency of its procedures
and methods of operating, and
its diligence in performing the
tasks assigned to it.
(Council Decision of 19 Febru-
ary 2004, taken on the basis of
Article 251 of the Treaty).

the quality of

States

Objectives
1. The Agency enhances the
capability of the Community,
the Member States and the
business community to pre-
vent, address and respond to
network and information secu-
rity problems.
2. The Agency
provides
assistance and delivers advice
to the Commission and the
Member
on issues
related to network and infor-
mation security falling within
its competencies.
3. The Agency develops a
high level of expertise and uses
to stimulate
this
broad cooperation between
actors from the public and pri-
vate sectors.
4. The Agency assists the
called
Commission, when
upon, in developing Commu-
nity legislation in the field of
network and information secu-
rity.

expertise

Tasks
The Agency:
(a)

collects information on cur-
rent and emerging risks that
could produce an impact on
electronic
communications
networks;
provides the European Parlia-
ment, the Commission and
European bodies or compe-
tent national bodies with
advice and assistance;
enhances cooperation between
actors in its field;
facilitates
cooperation on
common methodologies to
address network and informa-
tion security issues;
contributes to awareness rais-
ing on network and informa-
tion security issues for all
users;
assists the Commission and
the Member States in relations
with industry;
tracks standards;
advises the Commission on
research in the area of net-
work and information;
promotes
assessment
risk
activities, on prevention solu-
tions;
contributes
with third countries.

to cooperation

(b)

(c)

(d)

(e)

(f)

(g)
(h)

(i)

(j)

Source:

Information supplied by the Agency.

three

three

1. Management Board
It is composed of one rep-
1.
resentative of each Member
State,
representatives
appointed by the Commission,
and
representatives,
without the right to vote, each
of whom represents one of the
following groups:
(a)

information and commu-
nication
technologies
industry;
consumer groups;
(b)
(c)
academic experts.
2. Board members may be
replaced by alternates.

2. Executive Director
1. The Agency is managed by
its Executive Director, who is
independent
in the perfor-
mance of his duties.
2. The Executive Director is
appointed for a term of office
of up to five years.

3. External audit
Court of Auditors.

4.
Internal audit
The Commission’s
Auditor.

Internal

5. Discharge authority
Parliament on a recommenda-
tion from the Council.

figures on 31 Decem-

2006 final budget:
6,9 (6,3) million euro (100 % Com-
munity subsidy).
Staff
ber 2006:
44 (38) posts according to the
establishment plan
posts occupied: 38 (35)
8 (15) other staff
Total staff: 46 (50)
assigned to the following duties:
operational: 24 (22)
administrative: 22 (28)

Working groups
Three Working Groups on (a) Risk
management/Risk Assessment,
(b) CERTS
and (c) Regulatory Aspects of Network &
Information Security (RANIS).

Publications
Annual report,
ENISA Quarterly (four Issues)
— Who’s Who on NIS database.
— 1 CD-ROM ‘ENISA inventory of CERT

activities in Europe’

— 1 CD-ROM ‘Raising Awareness in Infor-
mation Security, Insight and Guidance
for Member States’

— Six Fact Sheets on ENISA and its activi-

ties

— 30 press releases
— The Permanent Stakeholders Group’s
(PSG) ‘Vision for ENISA’ –document
— The Draft ENISA Strategy 2008-2011
processed by the PSG and Management
Board

— A Guide on how to set up a CERT
— A report on CERT co-operation
— ‘A Users’ Guide: How to Raise Informa-

tion Security Awareness’

— Package ‘Information Security Aware-
ness Programmes in the EU — Insight
and Guidance for Member States’
— Collection of Best Practices — the

‘ENISA Knowledgebase’

— Study on security and anti-spam mea-

sures of providers

Cooperation with Member States and
other institutions
— 15 joint events with Member States
— eight responses to requests by Member

States and Institutions

E
N

O

f
f
i
c
i
a
l

J
o
u
r
n
a
l

o
f

t
h
e

E
u
r
o
p
e
a
n
U
n
o
n

i

C
3
0
9
/
3

European Network and Information Security Agency (Heraklion) — Implementation of the budget for the financial year 2006

Table 2

Source of revenue

Revenue

Revenue entered
in the final budget
for the financial year

Revenue collected

Allocation of expenditure

Community subsidies

6 940

Other revenue

12

6 600

12

Total

6 952

6 612

Title I
Staff

Title II
Administration

Title III
Operating activities

Expenditure

Final budget appropriations

(1 000 euro)

Appropriations carried over
from previous financial year(s)

entered

committed

paid

carried
over

cancelled

entered

committed

paid

cancelled

4 249

3 989

3 728

253

268

257

257

178

79

859

779

653

126

80

1 065

1 065

863

202

1 844

Total

6 952

1 542

6 310

989

5 370

538

917

317

665

790

790

271

2 112

2 112

1 312

519

800

Source: Data supplied by the Agency — These tables summarise the data provided by the Agency in its annual accounts. Revenue collected and payments are estimated on a cash basis.

Table 3

Table 4

European Network and Information Security Agency (Heraklion)
— Economic outturn account for the financial years 2006 and 2005

European Network and Information Security Agency (Heraklion)
— Balance sheet at 31 December 2006 and 2005

Operating revenue
Community subsidies
Other revenues

Operating expenditure
Staff expenditure
Fixed asset related expenditure
Other administrative expenditure
Operational expenditure

Total (a)

Total (b)
Surplus /(deficit) from operating activities (c = a – b)

Financial operations revenue (e)
Financial operations expenditure (f)

Surplus /(deficit) from non-operating activities (g = e – f)
Economic result for the year (h = c + g)

(1 000 euro)

2006

2005

5 476
12
5 488

3 100
103
1 515
1 236
5 954
– 466
—
– 2
– 2
– 468

4 251
—
4 251

1 040
31
1 563
518
3 152
1 099
—
– 1
– 1
1 098

Non-current assets
Intangible fixed assets
Tangible fixed assets
Current assets
Short-term receivables
Cash and cash equivalents

Current liabilities
Provisions for risks and charges
Accounts payable

Net assets
Accumulated surplus/deficit
Economic result for the year

Total assets

Total liabilities

Total net assets
Total liabilities and net assets

(1 000 euro)

2006

2005

33
312

56
2 519
2 920

66
2 224
2 290

1 098
– 468
630
2 920

12
332

13
2 510
2 867

45
1 724
1 769

—
1 098
1 098
2 867

Source: Data supplied by the Agency — These tables summarise the data provided by the Agency in its annual accounts: these accounts are drawn up on an accrual basis.

C
3
0
9
/
4

E
N

O

f
f
i
c
i
a
l

J
o
u
r
n
a
l

o
f

t
h
e

E
u
r
o
p
e
a
n
U
n
o
n

i

.

1
9
1
2
2
0
0
7

.

19.12.2007

EN

Official Journal of the European Union

C 309/5

THE AGENCY’S REPLIES

Being in its first full year of operation, the Agency inten-
7.
sified its activity in the second half of the year resulting in having
many transactions in the last quarter. Also, in 2006, the position
of budget officer remained vacant for more than five months
which affected the ability of the Agency to optimise planning and
minimize the transfers for the year.

8.
ENISA has already applied for ABAC, the Commission’s
accounting software since 2005. Based on the schedule of

the Commission the project will be launched early in 2008. The
system for recording invoices was revised before the preparation
of the final accounts and is being applied since.

9.
ENISA will present to its Management Board for adoption
standards for internal control as well as a code of ethics. The
executive director will put in place the organisational structure
and all
the procedures and controls necessary to their
implementation.