Resolution of the European Parliament of 22 April 2008 with observations forming an integral part of the decision on discharge in respect of the implementation of the budget of the European Network and Information Security Agency for the financial year 2006
Date: 2008-04-22
Institutions: European Parliament
Subjects: European Union Agency for Cybersecurity, budgetary discharge, financial year, implementation of the budget

L 88/218

EN

Official Journal of the European Union

31.3.2009

RESOLUTION OF THE EUROPEAN PARLIAMENT

of 22 April 2008

with observations forming an integral part of
the
implementation of the budget of the European Network and Information Security Agency for the
financial year 2006

the decision on discharge in respect of

THE EUROPEAN PARLIAMENT,

— having regard to the final annual accounts of the European Network and Information Security Agency

for the financial year 2006 (1),

— having regard to the Court of Auditors' report on the final annual accounts of the European Network and
Information Security Agency for the financial year 2006, together with the Agency's replies (2),

— having regard to the Council's recommendation of 12 February 2008 (5843/2008 — C6-0084/2008),

— having regard to the EC Treaty, and in particular Article 276 thereof,

— having regard to Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial
the European Communities (3), and in particular

Regulation applicable to the general budget of
Article 185 thereof,

— having regard to Regulation (EC) No 460/2004 of the European Parliament and of the Council of
10 March 2004 establishing a European Network and Information Security Agency (4), and in particular
Article 17 thereof,

— having regard to Commission Regulation (EC, Euratom) No 2343/2002 of 19 November 2002 on the
framework Financial Regulation for the bodies referred to in Article 185 of Council Regulation (EC,
Euratom) No 1605/2002 (5), and in particular Article 94 thereof,

— having regard to Rule 71 of and Annex V to its Rules of Procedure,

— having regard to the report of the Committee on Budgetary Control (A6-0119/2008),

A. whereas the Court of Auditors stated that it has obtained reasonable assurance that the annual accounts

for the financial year 2006 are reliable, and the underlying transactions are legal and regular,

B.

whereas on 24 April 2007 Parliament granted the Executive Director of the European Network and
Information Security Agency discharge in respect of the implementation of the Agency's budget for the
financial year 2005 (6), and in its resolution accompanying the discharge decision, inter alia:

— noted that the implementation of the budget for the financial year 2005 was marked by a low rate
of commitment (70 %) and a substantial rate of carry-over (more than 40 % overall and up to
almost 80 % for operating expenditure), and that this situation was in part due to problems
inherent in the Agency's start-up period and to the fact that it did not become operational until the
second half of 2005,

(1) OJ C 261, 31.10.2007, p. 23.
(2) OJ C 309, 19.12.2007, p. 1.
(3) OJ L 248, 16.9.2002, p. 1.
(4) OJ L 77, 13.3.2004, p. 1.
(5) OJ L 357, 31.12.2002, p. 72.
(6) OJ L 187, 15.7.2008, p. 176.

31.3.2009

EN

Official Journal of the European Union

L 88/219

— noted that no activity-based management had been brought in, despite the Agency's financial
regulation making provision for it, along the lines of that applied to the general budget, with a view
to improving the monitoring of performance;

General points which relate to horizontal issues affecting the EU agencies and which therefore
also have a bearing on the discharge procedure for each individual agency

1. Notes that the budgets of the 24 agencies and other satellite bodies audited by the Court of Auditors
totalled EUR 1 080,5 million in 2006 (the biggest being that of the European Agency for Reconstruction
at EUR 271 million and the smallest being that of
the European Police College (CEPOL) at
EUR 5 million);

2.

Points out that the range of external EU bodies subject to audit and discharge now includes not only
traditional regulatory agencies but also executive agencies set up to implement specific programmes, and
will in the near future also extend to joint undertakings set up as public-private partnerships (joint
technology initiatives);

3. Observes as regards the Parliament that the number of agencies subject to the discharge procedure has
evolved as follows: financial year 2000: 8; 2001: 10; 2002: 11; 2003: 14; 2004: 14; 2005: 16; 2006: 20
regulatory agencies and two executive agencies (not including two agencies which are audited by the
Court of Auditors but subject to an internal discharge process);

4.

5.

6.

7.

8.

Concludes therefore that the auditing/discharge process has become cumbersome and disproportionate
compared to the relative size of the agencies'/satellite bodies' budgets; instructs its competent committee
to undertake a wide-ranging review of the discharge process as regards agencies and satellite bodies with
a view to devising a simpler and more rational approach, bearing in mind the ever-growing number of
bodies each requiring a separate discharge report in future years;

Fundamental considerations

Requests that the Commission provide clear explanations regarding the following elements before the
creation of a new agency or reform of an existing agency: agency type, objectives of the agency, internal
governance structure, products, services, key procedures, target group, clients and stakeholders of the
agency, formal relationship with external actors, budget responsibility, financial planning, and personnel
and staffing policy;

Requests that each agency be governed by a yearly performance agreement which is formulated by the
agency and the responsible DG and which should contain the main objectives for the coming year, a
financial framework and clear indicators to measure performance;

Requests that the performance of the agencies be regularly (and on an ad-hoc basis) audited by the Court
of Auditors or another independent auditor; considers that this should not be limited to traditional
elements of
financial management and the proper use of public money, but should also cover
administrative efficiency and effectiveness and should include a rating of the financial management of
each agency;

Takes the view that in the case of agencies which are continually overestimating their respective budget
needs, technical abatement should be made on the basis of vacant posts; is of the opinion that this will
lead in the long run to less assigned revenue for the agencies and therefore also to lower administrative
costs;

L 88/220

EN

Official Journal of the European Union

31.3.2009

9. Notes that it is a serious problem that a number of agencies is criticised for not following rules on public
procurement, the Financial Regulation, the Staff Regulations, etc.; considers that the principal reason for
this is that most regulations and the Financial Regulation are designed for bigger institutions and that
most of the small agencies do not have the critical mass to be able to cope with these regulatory
requirements; therefore asks the Commission to look for a rapid solution in order to enhance the
effectiveness by grouping the administrative functions of various agencies together, in order to achieve
this critical mass (taking into consideration the necessary changes in the basic regulations governing the
agencies and their budgetary independence), or urgently to draft specific rules for the agencies (in
particular implementing rules for the agencies) which allow them to be in full compliance;

10.

Insists that the Commission, when drafting the Preliminary Draft Budget, take into consideration the
results of budget implementation by the individual agencies in former years, in particular in year n-1, and
revise the budget requested by the particular agency accordingly; invites its competent committee to
respect this revision and, if not undertaken by the Commission, to revise itself the budget in question to a
realistic level matching the absorption and implementation capacity of the agency in question;

11. Recalls its decision on discharge in respect of the financial year 2005, in which it invited the Commission
to present every five years a study on the added value of every existing agency; invites all relevant
institutions in the case of a negative evaluation of the added value of an agency to take the necessary
steps by reformulating the mandate of that agency or by closing it; notes that there has not been one
single evaluation undertaken by the Commission in 2007; insists that the Commission should present at
least five such evaluations before the decision on discharge in respect of the financial year 2007, starting
with the oldest agencies;

12.

Is of the opinion that recommendations of the Court of Auditors should be promptly implemented and
the level of subsidies paid to the agencies should be aligned with their real cash requirements; considers
further that the amendments to the general Financial Regulation should be incorporated into the
agencies' framework financial regulation and into their various specific financial regulations;

Presentation of reporting data

13. Notes that there is no standard approach among the agencies with regard to the presentation of their
activities during the financial year in question and of their accounts and reports on budgetary and
financial management, nor to the question as to whether a declaration of assurance should be drawn up
by the agency's director; observes that not all agencies clearly distinguish between (a) presenting the
agency's work to the public; and (b) technical reporting on budgetary and financial management;

14. Notes that while the Commission's standing instructions for the preparation of activity reports do not
expressly require the agency to draw up a declaration of assurance, many directors have none the less
done so for 2006, in one case including an important reservation;

15. Recalls its resolution of 12 April 2005 (1), inviting the directors of the agencies from now on to
accompany their annual activity report, which is presented together with financial and management
information, with a declaration of assurance concerning the legality and regularity of operations, similar
to the declarations signed by the Directors-General of the Commission;

16. Asks the Commission to amend its standing instructions to the agencies accordingly;

(1) All resolutions regarding the agencies were published in OJ L 196, 27.7.2005.

31.3.2009

EN

Official Journal of the European Union

L 88/221

17. Suggests in addition that the Commission should work with the agencies towards producing a
harmonised model applicable to all agencies and satellite bodies clearly distinguishing between:

— an annual report
achievements,

intended for a general readership on the body's operations, work and

— financial statements and a report on implementation of the budget,

— an activity report along the lines of the activity reports of the Directors-General of the Commission,

— a declaration of assurance signed by the body's director, together with any reservations or
observations which he considers it appropriate to draw to the attention of the discharge authority;

General findings by the Court of Auditors

18. Notes the Court's finding (Annual Report, paragraph 10.29 (1)) that the disbursement of subsidies paid
by the Commission from the Community budget is not based on sufficiently justified estimates of the
agencies' cash requirements and that this, combined with the size of carry-overs, leads them to hold
sizeable cash balances; notes further the Court's recommendation that the level of subsidies paid to the
agencies should be in line with their real cash requirements;

19. Notes that at the end of 2006 14 agencies had still to implement the ABAC accounting system (Annual

Report, footnote to paragraph 10.31);

20. Notes the Court's remark (Annual Report, paragraph 1.25) concerning accrued charges for untaken leave
which are accounted for by some agencies; points out that the Court of Auditors has qualified its
statement of assurance in the case of three agencies (European Centre for the Development of Vocational
Training (Cedefop), CEPOL and the European Railway Agency) for the financial year 2006 (2005:
Cedefop, European Food Safety Authority, European Agency for Reconstruction);

Internal audit

21. Recalls that in accordance with Article 185(3) of the Financial Regulation the Internal Auditor of the
Commission is also the internal auditor of the regulatory agencies receiving grants charged to the EU
budget; points out that the Internal Auditor reports to each agency's management board and director;

22. Draws attention to the reservation entered in the Internal Auditor's Annual Activity Report for 2006 as

follows:

‘The Internal Auditor of the Commission is not in a position to properly fulfil his obligation assigned by
Article 185 of the Financial Regulation as internal auditor of the Community bodies due to a lack of staff
resources.’;

23. Notes, however, the Internal Auditor's remark in his activity report for 2006 that as from 2007, with the
additional staff resources granted by the Commission to the Internal Audit Service (IAS), all regulatory
agencies in operation will be subject to internal audit work on an annual basis;

24. Notes the ever-growing number of regulatory and executive agencies and joint undertakings required to
be audited by the IAS under Article 185 of the Financial Regulation; asks the Commission to inform its
competent committee as to whether the staff resources at the IAS's disposal will be sufficient to conduct
an annual audit of all such bodies in the coming years;

(1) OJ C 273, 15.11.2007, p. 1.

L 88/222

EN

Official Journal of the European Union

31.3.2009

25. Observes that Article 72(5) of Regulation (EC, Euratom) No 2343/2002 requires each agency to send
each year to the discharge authority and the Commission a report drawn up by its director summarising
the number and type of internal audits conducted by the internal auditor, the recommendations made
and the action taken on these recommendations; asks the agencies to indicate whether this is done and, if
so, how;

26. Takes note, as regards internal audit capability, especially in relation to the smaller agencies, of a proposal
made by the Internal Auditor before Parliament's competent committee on 14 September 2006 that
smaller agencies should be authorised to buy in internal audit services from the private sector;

Evaluation of agencies

27. Recalls the joint statement by the Parliament, the Council and the Commission (1) negotiated at the
conciliation before the Ecofin budget Council of 13 July 2007 calling for (i) a list of agencies which the
Commission intends to assess; and (ii) a list of the agencies already assessed, together with a summary of
the major findings;

Disciplinary procedures

28. Notes that, because of their size, individual agencies have difficulty in setting up ad-hoc disciplinary
boards composed of staff at the appropriate career grade and that the Commission's IDOC (Investigation
and Disciplinary Office) is not competent for agencies; calls on the agencies to consider an inter-agency
disciplinary board;

Draft Interinstitutional Agreement

29. Recalls the draft Interinstitutional Agreement on the operating framework for the European regulatory
agencies presented by the Commission (COM(2005) 59), which was intended to create a horizontal
framework for the creation, structure, operation, evaluation and control of the European regulatory
agencies; notes that the draft represents a useful initiative in the effort to rationalise the creation and
running of agencies; notes the statement in the Commission's 2006 synthesis report (paragraph 3.1,
COM(2007) 274) that although progress in negotiations stalled after publication of the draft, discussions
on substance were relaunched in the Council at the end of 2006; regrets that it has not been possible to
make further progress towards adoption;

30. Welcomes therefore the Commission's commitment to bring forward a communication on the future of

the regulatory agencies during the course of 2008;

Self-financed agencies

31. Recalls that for the two self-financing agencies, discharge is given to the director by the administrative
board; notes that both have significant accumulated surpluses from fee income carried over from
previous years figures, as follows:

— Office for Harmonization of the Internal Market cash and cash equivalents: EUR 281 million (2),

— Community Plant Variety Office cash and cash equivalents: EUR 18 million (3);

(1) Council document DS 605/1/07 Rev1.
(2) Source: report on the annual accounts of the Office for Harmonization in the Internal Market for the financial year

2006, together with the Office's replies (OJ C 309, 19.12.2007, p. 141).

(3) Source: report on the annual accounts of the Community Plant Variety Office for the financial year 2006, together with

the Office's replies (OJ C 309, 19.12.2007, p. 135).

31.3.2009

EN

Official Journal of the European Union

L 88/223

Specific points

32. Notes the Court of Auditors' observation in its 2006 report that the implementation of the Agency's
budget for the financial year 2006 showed a utilisation rate of 90 % of commitment appropriations and
76 % of payment appropriations, with a concentration of transactions in the last quarter of the year;
furthermore, the weaknesses of the procedures for establishing the budget led to a high number of
transfers, so that the budgetary principle of specification was not strictly observed;

33. Expresses concern at the Court's finding that the general accounting software used by the Agency makes
it possible to amend entries without leaving an audit trail, and that the Agency has not established a
system for recording invoices that ensures the accuracy of the financial information in the final accounts;

34. Draws attention to the Court's further findings that:

— the internal control procedures required by the Financial Regulation to ensure transparency and

sound financial management have not yet all been documented,

— the management board did not formally adopt standards for internal control, nor a code of

professional ethics,

— written instructions for archiving supporting documentation to transactions were missing,

— a financial irregularities panel was not established;

35. Acknowledges the Agency's reply that, 2006 being in its first full year of operation, it intensified its
activities in the second half of the year, with the result that many transactions took place in the last
quarter; moreover, the position of budget officer remained vacant for more than five months in 2006,
which affected the ability of the Agency to optimise planning and minimise transfers for the year;

36. Notes from the Agency's economic outturn account that in 2006 its total operating revenue amounted
to EUR 5,48 million, with total expenditure of EUR 5,95 million, giving an economic result (deficit) for
the year of EUR 460 000;

37. Notes that the budget outturn account includes EUR 1,1 million under pre-financing which is still open

and to be returned by the Agency to the Commission in 2007;

38. Points out that Agency's annual activity report, pursuant to Article 40 of Regulation (EC, Euratom)
No 2343/2002, contains a declaration of assurance by the authorising officer, together with reservations;

39.

Is aware of an evaluation of the Agency carried out on behalf of the Commission in 2007 by external
evaluators which concluded that:

— the Agency's achievements were insufficient to produce the added value and impact initially hoped

for,

— the size of the management board and its extensive powers over the Agency make for difficult

governance,

— operational staff was below the critical mass needed to be effective;

L 88/224

EN

Official Journal of the European Union

31.3.2009

40. Takes note of and rejects the Commission's proposal

(COM(2007) 699) to transfer the Agency's
responsibilities to a new European Telecom Marketing Authority whose tasks from 2010 would include:

— ensuring that the 27 national regulators work as an efficient team on the basis of common guiding

principles,

— delivering opinions and assisting in preparing the single market measures of the Commission for

the telecoms sector,

— addressing network and information security issues.