Communication from the Commission to the European Parliament and Council - Annual report to the discharge authority on internal audits carried out in 2007 {SEC(2008) 2361 final}
Date: 2008-07-30
Institutions: European Commission
Subjects: European Commission, activity report, audit, budgetary discharge, financial regulation, management accounting

EN 

EN 

1 

   EN 

COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 30.7.2008 
COM(2008) 499 final 

Communication from the Commission to the European Parliament and Council 

ANNUAL REPORT TO THE DISCHARGE AUTHORITY  

ON INTERNAL AUDITS CARRIED OUT IN 2007 

{SEC(2008) 2361 final} 

EN 

2 

   EN 

 
  
 
 
TABLE OF CONTENTS 

1. 

2. 

Introduction .................................................................................................................. 0 

Working environment and audit plan........................................................................... 0 

2.1.  Working environment .................................................................................................. 0 

2.2. 

2.3. 

2.4. 

3. 

4. 

Developments in the Internal Audit Process................................................................ 1 

Implementation of the IAS audit plan.......................................................................... 2 

Acceptance of recommendations and views of auditees and stakeholders .................. 5 

Main Findings and Recommendations......................................................................... 5 

Conclusions .................................................................................................................. 9

EN 

3 

   EN 

Annual Report 

TO THE DISCHARGE AUTHORITY  

ON INTERNAL AUDITS CARRIED OUT IN 2007 

1. 

INTRODUCTION 

This report informs the Discharge Authority about the work carried out by the Commission's 
Internal  Audit  Service  (IAS),  in  accordance  with  Article  86(4)  of  the  Financial  Regulation 
(FR). It is based on the report of the IAS according to Article 86(3) of the FR on key audit 
findings  and,  in  accordance  with  professional  standards,  on  significant  risk  exposures  and 
control issues and corporate governance issues. 

This  report  is  based  on  IAS  audit  and  consulting  reports  finalised  in  2007.  This  report 
concerns audit and consulting work related to Commission DGs and Services and executive 
agencies only. It does not cover the IAS work on other agencies or bodies. 

The  Commission's  reactions  to  the  findings  and  conclusions  of  the  Internal  Auditor  are 
covered in the synthesis report on the annual activity reports of the Directors-General. In this 
synthesis  report,  adopted  at  the  same  time,  the  Commission  takes  a  position  on  the  cross-
cutting  issues  raised  by  the  Internal  Auditor,  the  European  Court  of  Auditors  and  the 
Discharge  Authority,  or  identified  by  the  Audit  Progress  Committee  and  by  the  Director-
General for Budget in his overview report. This means that certain views or opinions in this 
report are not necessarily fully shared by the Commission. The difference of views reflects the 
normal process of dialogue between the institution and its Internal Auditor. 

2. 

WORKING ENVIRONMENT AND AUDIT PLAN 

2.1.  Working environment 

As  part  of  the  Commission's  reform,  24  Internal  Control  Standards  and  related  "baseline 
requirements"  had  been  introduced  in  2000.  These  Standards  were  revised  in  2007  with  a 
view  to  moving  from  compliance  to  effectiveness,  simplifying  the  language  and  making  all 
staff aware of the Standards and also of non-financial issues. The revised Standards came into 
effect  on  1  January  2008,  and  DGs/Services  are  now  asked  to  select,  based  on  a  risk 
assessment  process,  which  standards  they  wish  to  prioritise  in  order  to  demonstrate 
effectiveness. 

The  second  report  on  the  progress  of  the  Commission  Action  Plan  towards  an  Integrated 
Internal  Control  Framework  concluded  that  progress  has  been  made  in  terms  of  the 
assessment  of  management  and  control  systems  in  the  structural  funds,  the  definition  and 
assignment of control responsibilities in shared management and the presentation of assurance 
in DGs' Annual Activity Reports. 

2007 is the first year of operation of the 2007-2013 financial framework, with a new control 
approach in the area of research and a new programming process for structural funds based on 

EN 

   EN 

 
 
 
common standards for financial management, control and evaluation (e.g. Member States to 
provide summaries of available audits and declarations).  

In  2007,  the  accounts  were  signed  off  for  the  first  time  by  the  Commission's  Accounting 
Officer  pursuant  to  the  amended  FR.1  Significant  progress  was  achieved  in  developing  the 
ABAC  IT  system.  The  delegations'  imprest  accounts  were  fully  integrated  into  ABAC  in 
January 2007, an updated project plan for the migration of the European Development Fund 
accounts to ABAC was prepared and the Commission was working towards "going live". 

The  Commission  further  implemented  its  business  continuity  provisions.  All  Commission 
DGs  submitted  validated  business  continuity  plans.  Some  DGs  have  already  started  testing 
their individual plans. A corporate business continuity communication exercise and testing of 
the  overall  business  continuity  plan  were  carried  out  in  2007.  Efforts  are  now  focused  on 
awareness raising, training and further exercises to share the lessons learned. 

A  new,  dynamic  approach  to  fraud  proofing  was  introduced.2  The  previous  upstream 
consultation  process  on  draft  legislation  introduced  in  2001  will  remain  available,  but  in 
addition  more  input  will  be  provided  to  the  Commission  by  OLAF,  resulting  from  its 
investigative  activities.  OLAF  will  make  a  structured  and  multidisciplinary  analysis  of  its 
investigative  activities,  but  it  will  also  base  the  new  fraud  proofing  activity  on  a  large 
information  pool,  including  audit  findings  by  the  IAS  and  by  Internal  Audit  Capabilities 
(IACs). 

The  IAS  continued  to  have  the  full  support  of VP  Kallas  and  the  APC,  which  enabled  it  to 
remain independent and objective in pursuit of its functions. In June 2007, a revised charter of 
the APC was adopted. 

Following  a  recommendation  made  in  the  2006  Report  of  the  Internal  Auditor  the 
Commission issued a governance statement in 22 languages. 

2.2. 

Developments in the Internal Audit Process 

The Commission updated the mission charter of the IAS and introduced a model charter for 
the  IACs.  The  main  points 
independence,  objectivity  and 
include  accountability, 
responsibilities.  This  ties  in  with  a  conclusion  in  the  2006  annual  report  of  the  Internal 
Auditor  that  the  efficiency  and  robustness  of  the  internal  audit  architecture  should  be 
improved.  The  IAS  will  also  give  an  annual  overall  opinion  on  the  internal  controls  in  the 
Commission starting with 2009, the final year of the current audit planning. 

Following  the  IAS  report  on  the  quality  review  of  all  IACs,  2007  was  the  first  year  of  the 
2007-2009  strategic  audit  planning  cycle,  with  common  IACs/IAS  planning  and  risk 
assessment in favour of a single audit approach. This firmly consolidates the audit universe, 
strengthens  IACs'  independence  and  further  fosters  cooperation  between  IACs  and  the  IAS. 
This  cooperation  has  been  further  strengthened  through  the  Auditnet  (IAC  model  charter, 
audit opinions and annual IAC opinion). 

1 

2 

Council Regulation (EC, EURATOM) No 1995/2006 of 13 December 2006 amending Regulation (EC, 
Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European 
Communities, OJ L 390, 30.12.2006, p. 1. 
See COM(2007)806 of 17 December 2007. 

EN 

   EN 

 
 
                                                 
The  second  external  quality  assessment  of  the  IAS  was  launched.  This  will  be  finalised  in 
2008  with  an  independent  opinion  on  the  compliance  of  the  IAS  with  the  internationally 
recognised standards of the Institute of Internal Auditors (IIA). The result of a pre-assessment 
was that the IAS generally complies with the IIA standards, with the exception of Resource 
management  (high  turnover  of  staff,  audit  v.  non-audit  functions)  and  Quality  of 
communications  (time  lag  between  the  end  of  field  work  and  the  final  report;  discussion  of 
findings with the auditee), where the IAS partially complies. 

the  profession  at 

The Internal Auditor and IAS staff played an active part in cooperation between the EC and 
the  UN  in  the  field  of  administration  and  financial  management.  They  also  contributed  to 
meetings  of 
the 
Representatives  of  Internal  Audit  Services  of  the  United  Nations  Organisations  and 
Multilateral  Financial  Institutions  conference  and  the  second  specialised  conference  for 
Internal  Auditors  in  Central  Europe.  The  IAS  was  also  represented  at  the  meeting  of 
"coordinated organisations". 

the  IIA  world  conference, 

international 

level: 

The  annual  IAS  conference  provided  more  food  for  thought  in  relation  to  the  overall  audit 
opinion.  The  IAS  has  now  included  a  blueprint  in  its  2008  annual  management  plan  with  a 
view to issuing its first overall opinion at the end of implementation of the strategic audit plan 
covering 2007-2009. 

2.3. 

Implementation of the IAS audit plan 

The  strategic  2007-2009  IAS  audit  plan,  drawn  up  in  close  cooperation  with  IACs,  was 
endorsed by the APC on 2 February 2007. 

The 2007 work programme was implemented to 95%: 68 reports (41 audit reports, 25 follow-
up reports, and 2 management letters) were finalised in 2007. Executive summaries of these 
reports are annexed. 

DG/Service 

Engagement 

Issue date 

Administrative and other support systems 

SG/BUDG/REGIO/ 
EMPL/RTD/ 
ADMIN/DIGIT/INFSO/ 
JLS/AIDCO 

ADMIN  

BUDG 

BUDG 

COMM 

AAR Assurance Process 

21 January 20083 

Follow-up human resources management phase I 

13 December 

ABAC - implementation of accrual based accounting 

3 May 

the  Accruals-Based 
Comparative  Analysis 
Accounting  Systems  and  Financial  Reporting  as 
Implemented  by  the  European  Commission  and  some 
Member States 

of 

26 April 

Examination  of  the  purchase  of  office  buildings  in 
Cyprus 

14 September 

3 

One  report  per  DG.  Although  these  reports  were  only  finalised  in  January  2008,  the  majority  of  the 
audit work was carried out in 2007 and the IAS considers their results important enough already to be 
reported in the 2007 Annual Report. 

EN 

   EN 

 
 
 
 
 
 
 
                                                 
COMM 

DGT 

DGT 

DIGIT 

EPSO 

ESTAT 

ESTAT 

OIB 

OIB 

OIB 

OIB 

OIB 

OIL 

PMO 

SCIC 

Internal policies 

COMP 

EAC 

EAC 

EACEA 

ENTR 

ENTR 

ENTR 

ENV 

ENV 

ENV 

INFSO 

JRC 

MARKT 

RTD 

Special  report on  tendering procedures for  transmission 
services in DG COMM 

14 December 

Management of translation demand 

Follow-up  of  IAS  validation  of  self-assessment  of  the 
IAC of DGT 

13 June 

14 December 

IT procurement and service delivery in DG DIGIT 

5 December 

Follow-up on limited review of the selection process as 
managed by EPSO 

18 December 

Second follow-up audit of the in-depth audit of Eurostat 

9 March 

IT procurement and service delivery  

20 November 

Management of procurement contracts in OIB 

3 April  

Management of buildings procurement contracts by OIB 

3 April 

Follow-up  on  buildings  infrastructure  managed  by  the 
European Commission 

8 February 

Follow-up on transaction testing 

Evaluation of targeted ICS 

Management of procurement contracts  

Controls over payment of pensions 

Follow-up  of  validation  of  self-assessment  of  the  SCIC 
IAC 

20 April 

4 October 

3 April 

7 September 

29 November 

Follow-up report on the audit of IT controls  

ABAC - implementation of accrual-based accounting in 
DG EAC/2006 closing 

16 May 

18 July 

Follow-up report on the implementation of ABAC  

18 July 

Implementation  of  the  financial  circuits  for  operational 
budget of the EAC executive agency 

19 March 

Management letter ex-post controls 

Follow-up  report  on  the  financial  management  of  the 
innovation relay centre (IRC) network 

20 April 

23 October 

Follow-up  of  validation  of  self-assessment  of  the  DG 
ENTR IAC 

18 December 

Monitoring the implementation of EC law 

Second  follow-up  audit  of  DG  ENV's  2004  in-depth 
audit 

22 January  

29 March 

Grant management of non-life programmes 

18 September 

Ex-post controls 

20 February 

Second follow-up of in-depth audit of the JRC of 2004 

21 September 

Follow-up report on DG MARKT financial management 
and financial circuits 

18 January 

Follow-up  report  on  the  in-depth  audit  of  DG  RTD 
(2003)  and  the  audit  on  financial  circuits  &  financial 

16 March 

EN 

   EN 

 
 
RTD 

TAXUD 

TREN 

TREN 

management in DG RTD (2005) 

IT procurement and service delivery  

IT procurement and service delivery  

Follow-up  report  on  the  audit  of  financial  management 
and financial circuits in DG TREN 

30 November 

18 October 

20 March 

Follow-up  report  of  "Audit  of  local  IT  management 
process" 

7 September 

TREN-IEEA 

TREN executive agency 

TREN 

Follow-up of validation of self-assessment of DG TREN 
IAC 

Structural Measures and Common Agricultural Policy 

30 January 

20 December 

AGRI 

AGRI 

AGRI 

EMPL 

EMPL  

FISH 

REGIO 

REGIO 

REGIO 

External Policies 

AIDCO 

AIDCO 

AIDCO 

AIDCO 

ECHO 

ECHO 

Local IT systems of DG AGRI feeding into ABAC 

25 May 

Interventions in agricultural markets 

23 November 

Follow-up 
GUIDANCE 

report  on  structural 

funds 

-  EAGGF 

22 November 

Prevention and detection of fraud in the structural funds 

19 December 

Implementation  of  programmes  in  the  new  Member 
States 

12 December 

Follow-up  audit  report  on  structural  fund  -  financial 
instrument for fisheries guidance 

20 July 

Implementation  of  programmes  in  the  new  Member 
States 

13 November 

Follow-up on the ERDF - audit of the implementation of 
Article 38 of Council Regulation 1260/1999 

14 December 

Prevention and detection of fraud in the structural funds 

19 December 

Eligibility of costs under the financial and administrative 
framework  agreement  with  the  United  Nations  by  DG 
AIDCO 

19 June 

Ex-post control activities  

Follow-up audit on NGOs funding  

18 July 

31 July 

Financial  Management  of  Main  Programmes 
Directorate D 

in 

20 December 

Follow-up audit on NGOs funding  

Monitoring and supervision tools  

6 June 

23 November 

ECHO, ADMIN 

Management letter on security Issues in DG ECHO 

29 November 

ELARG 

RELEX 

Follow-up  audit  report  on  the  in-depth  audit  of  DG 
ELARG 

15 March 

Follow-up  audit  of  the  audit  on  handling  of  classified 
information  and  communication  among  the  delegations 
and DG RELEX 

4 July 

EN 

   EN 

 
 
TRADE 

Implementation of selected internal control standards  

13 June 

2.4. 

Acceptance of recommendations and views of auditees and stakeholders 

In  2007,  the  rate  of  acceptance  of  audit  recommendations  by  auditees  was  99%,  with  1% 
rejected. 

Commission and executive agency audits 

Recommendations  Accepted  Rejected  % 

Total 

Critical  

Very 
important  

Important 

Desirable 

% 

Total 

5 

111 

129 

20 

99 

265 

1 

0 

3 

0 

1 

4 

2 

6 

41 

111 

49 

132 

8 

20 

269 

Auditees'  feedback  on  the  scope  and  conduct  of  the  audit  yielded  an  average  result  of  1.86 
(previous years: 1.95 for 2006 and 1.82 for 2005) on a scale of 1 (highest) to 4 (lowest). In a 
new stakeholder survey, 80.5% thought that the IAS had a clear audit strategy (compared with 
the previous result of 75%), 82.9% that audits were performed with honesty, objectivity and 
fairness  (85.7%  in  2006)  and  48.8%  that  the  IAS  recommendations  are  useful  (previously 
60.7%).  Overall,  however,  80.5%  (previously  55.4%)  considered  that  the  IAS  work 
contributes to the quality of management and control systems in the Commission. 

3. 

MAIN FINDINGS AND RECOMMENDATIONS 

AAR assurance process 

The engagements assessed the effectiveness of the Annual Activity Report (AAR) assurance 
process,  which  is  a  key  component  of  the  Commission's  governance  architecture  and 
represents  best  practice  worldwide.  They  covered  six  operational  DGs  plus  four  horizontal 
services.  The  AAR  process  is  being  continuously  improved  (e.g.  peer  reviews  and  revised 
standing  instructions).  As  a  result  of  the  audit  the  standing  instructions  issued  by  the 
Secretariat  General  have  already  been  revised  along  the  lines  of  the  IAS  proposals:  more 
explicit  guidance  on  how  the  different  components  feed  the  assurance,  including  an 
explanation of how the IAC opinion has contributed to the assurance; a precise definition of 
the  control  strategy;  systematic  and  mandatory  use  of  key  indicators  on  the  functioning  of 
control systems;  reconciliation with  findings  by the European Court  of Auditors (ECA)  and 
explanations  of  delays  in  the  implementation  of  critical  and  very  important  internal  audit 
recommendations. A more extensive peer review is planned, aiming at a more complete and 
consistent  synthesis  report.  While  DGs  can  report  major  non-financial  deficiencies  in  their 

EN 

   EN 

 
 
 
 
 
 
AAR, the IAS drew attention to the limitations of the management declarations of assurance, 
given that they cover neither non-financial nor systemic responsibilities. 

Handling of sensitive/classified data and physical security 

The data security risks need more attention. The IAS issued recommendations on a formalised 
security clearance policy and the need to reinforce database security controls in order to avoid 
any leaks of sensitive information or access by unauthorised persons. On occasions, internal 
instructions  do  not  encourage  the  use  of  the  Commission's  classification  rules  and  their 
enforcement is not always proportionate to the specific security risks. Departments accepted 
that  DG-specific  rules  for  dealing  with  sensitive  information  (unauthorised  disclosure  of 
which  would  cause  harm  to  the  EU)  or  other  security  issues  should  be  coordinated  with 
central security services so as to ensure a coherent approach to security. In terms of physical 
security this concerns in particular staff who by the nature of their work are exposed to a high 
risk  in  the  area  of  external  aid.  As  regards  the  handling  of  classified  information  in 
delegations, three critical recommendations from an earlier audit were being implemented to 
enable delegations to exchange classified information electronically and to be fully compliant 
with security rules.  

Monitoring the implementation of EC law 

The  Commission  communication  on  monitoring  EC  law,4  which  describes  what  action  the 
Commission will take to improve the application of Community law, takes into account most 
of the main recommendations issued by the IAS in its consolidated report of December 2006.  

The  last  of  this  series  of  audits  concerned  environmental  legislation.  Weaknesses  were 
detected in the pro-active monitoring of EC law. In particular, no assurance could be obtained 
that all directives are being transposed correctly and on time in all Member States. The most 
important  IAS  recommendations  have  been  taken  into  account  in  a  draft  Commission 
Communication on the implementation of EC environmental law and the DG-specific action 
plan provided for implementation of all recommendations by December 2007 except for two 
recommendations, the last of which is to be implemented by December 2009. 

Ex-post controls (EPC) 

The series of audits of EPC in the research family was completed with an audit in DG INFSO. 
As  a  follow-up  to  the  recommendations  made,  the  DGs  of  the  research  family  decided  to 
implement detailed action plans which are regularly monitored by the APC. 

Further  EPC  audits  were  carried  out  in  two  DGs  to  assess  the  compliance,  efficiency  and 
effectiveness  of  EPC,  which  are  instrumental  for  a  positive  declaration  of  assurance. 
Recommendations to increase the ex-post audit coverage, the integration of EPC into control 
chains  and  the  increased  use  of  key  performance  indicators  (KPIs)  were  accepted  and  are 
being implemented. 

Fraud prevention in Structural Funds 

Following  audits  on  the  European  Social  Fund  and  the  European  Regional  Development 
Fund, a specific joint fraud prevention strategy for Structural Funds will be set up with the co-

4 

COM(2007)502 of 5 September 2007 

EN 

   EN 

 
 
                                                 
operation  of  OLAF  and  will  subsequently  be  reviewed  on  an  annual  basis.  The  quality  and 
accuracy  of  information  on  fraud  cases  and  the  assessment  and  monitoring  of  controls 
exercised by Member States in relation to fraud will also be improved, for instance by setting 
up a hotline in the Member States. All recommendations were accepted with completion dates 
up to the end of 2008. 

Procurement 

As part of the wider audit work on IT procurement and service delivery in the Commission, 
four  DGs  were  audited  for  compliance  with  Commission  rules  and  effectiveness  and 
efficiency.  Limited  residual  risks  were  identified  in  three  DGs,  these  relating  to  an 
insufficiently  precise  description  of  services  to  be  provided,  time  reporting  by  external 
providers,  the  late  start  of  the  procedure  to  renew  contracts  and  insufficient  recording  of 
exceptions. 

Following  the  IAS  audit,  a  new  buildings  procurement  procedure  was  developed  which, 
among other things, will improve the documentation of the decision-making process, ensure 
that key information is circulated at an appropriate stage, introduce a risk management system 
for  all  building  procurement  projects  and  incorporate  long-term  strategic  management  with 
clearly  separated,  but  interacting,  policy  definition  and  implementation  processes.  For 
procurement  contracts  other  than  for  buildings  the  DG  concerned  decided  to  develop  a 
module  to  ensure  the  effective  follow-up  of  steps  in  the  procurement  procedure,  to  create  a 
register  containing  all  correspondence  related  to  complaints  and  to  produce,  for  important 
tenders,  a  strategy  document  which  will  include  cost-benefit  analyses  and  will  also  cover 
needs. 

Controls over payments of pensions 

This audit assessed the adequacy and effective application of the internal control system and 
risk management in relation to the determination and payment of pensions to retired staff. An 
outdated  computer  system  makes  manual  controls  necessary.  While  there  are  sound  ex-ante 
controls  in  place,  targeted,  risk-based  ex-post  controls  will  be  carried  out  in  future,  thereby 
reducing the risks of, for instance, incorrect payments, loss of paper files and incorrect manual 
adjustments. 

Implementation of ABAC 

As  the  introduction  phase  of  ABAC,  closely  accompanied  by  European  Court  of  Auditors 
(ECA) audits, is being completed, the IAS is reducing its audit activity in this area. Following 
an adverse opinion on the closing of accounts for 2005 in DG EAC, a closing accounts audit 
of DG EAC and its executive agency for 2006 (in cooperation with the ECA) was carried out 
and  a  qualified  reasonable  assurance  was  given,  although  there  was  a  finding  of  limited 
reconciliation  between  local  and  central  accounting  systems  and  incomplete  documentation. 
The implementation of ABAC was also the subject of IAC audits. 

Executive agencies 

The  IAS  audited  two  executive  agencies  with  reasonable  assurances  regarding  the  business 
objectives being given in both cases. 

Some  of  the  issues  highlighted  related  to compliance  with  the  Commission  Decision  on  the 
Security  of  Information  Systems  and  with  the  Personal  Data  Protection  Regulations, 

EN 

   EN 

 
 
procedures  regarding  year-end  transactions,  harmonisation  and  simplification  of  checklists 
and workflows and a comprehensive approach to ex-post controls. 

Other newly created executive agencies (European Research Council Executive Agency and 
Research Executive Agency) may benefit from the experience gained by existing agencies on 
how best to implement all the necessary steps in the start-up phase. 

FAFA (Financial and Administrative Framework Agreement with the UN) 

Following last year's audit on compliance with the FAFA and the capacity to obtain assurance 
regarding the use made of EU funds, the APC invited the IAS to assess the materiality of the 
residual  risks  with  regard  to  indirect  costs  in  particular,  and  in  association  with  the  overall 
controls  on  EC/UN  funding  within  the  FAFA  and  the  UN  financial  control  system.  The 
additional  audit  work  confirmed  that  the  design  of  FAFA  is  appropriate,  but  also  that  the 
control mechanisms still need to be effectively and further implemented. The DGs concerned 
have  accepted  all  the  recommendations  and  have  already  undertaken  several  initiatives  to 
increase the use of FAFA control tools on direct and indirect costs. 

Financial and grant management 

Financial  audits  were  carried  out  in  the  areas  of  Asian  delegations  and  for  environmental 
programmes. 

The  audit  of  the  management  of  the  main  financial  programmes  in  Asian  delegations 
identified a number of areas for improvement that management intends to implement by the 
end  of  2008:  lines  of  responsibility  between  Delegations  and  line  DGs  to  be  more  clearly 
defined;  headquarters  to  play  a  greater  support  and  guidance  role  for  delegations  to  ensure 
coherent  and  efficient  operation  across  delegations;  improved  project  and  portfolio 
monitoring and an enhanced training strategy. 

An  assessment  of  the  functioning  of  the  process  of  grant  management  for  environmental 
projects  revealed  the  need  to  improve  documentation  for  controls  of  beneficiaries'  actual 
costs; to refine the ex-post control strategy to cover smaller beneficiaries; to ensure timeliness 
of approval of technical reports; and to issue specific guidelines for ex-post controls that are 
subcontracted to external audit firms. 

A  considerable  number  of  grant  or  financial  management  audits  were  also  carried  out  by 
IACs. 

Follow-up 

The  timely  follow-up  of  audit  recommendations  is  crucial  for  the  effectiveness  of  internal 
audit and for the continuous improvement of internal control. Some progress has been made, 
leading to a decrease in the total number of outstanding recommendations made before 2006. 
In the IAS's view more than 80% of the recommendations have been implemented. However, 
there  are  still  significant  delays  in  the  implementation  of  critical  and  very  important 
recommendations, revealing weaknesses in DGs' implementation of action plans, particularly 
in  relation  to  older  recommendations.  More  than  25%  of  outstanding  critical  and  very 
important  recommendations  are  overdue  by  more  than  six  months  (although  this  is  a 
considerable  improvement  compared  to  more  than  50%  a  year  ago).  In  an  effort  to  remedy 
this situation, the IAS proposed that the DGs/Services which did not take steps to implement 
overdue critical and very important recommendations be reminded of the importance of doing 

EN 

   EN 

 
 
so and also, where appropriate, to give the reasons for delays in the Annual Activity Reports. 
The  APC  pays  particular  attention  to  the  follow-up  of  recommendations  and  fostered 
implementation by deciding that letters will be sent by the APC Chair to the Commissioners 
concerned,  to  draw  their  attention  to  critical  and  very  important  recommendations  that  are 
more than six months overdue. 

4. 

CONCLUSIONS 

On the basis of the Commission audits and reviews finalised in 2007, and other related work, 
the  Internal  Auditor  of  the  Commission  drew  the  following  conclusions  (the  Commission's 
position  is  contained  in  the  synthesis  report  on  the  annual  activity  reports  of  the  Directors-
General). 

IAS conclusion 1: Overall progress made, but more improvements needed 

In  the  course  of  its  audit  work,  the  IAS  noted  further  improvements  in  the  Commission's 
internal control systems. The number of critical IAS recommendations issued decreased from 
twelve in 2006 to six in 2007 and the number of audits with adverse IAS opinions dropped 
from nine in 2006 to six in 2007. However, further improvements are still needed, for instance 
in the areas of grant management, ex-post controls, procurement and implementation of data 
protection provisions. 

IAS conclusion 2: Information Security 

Ensuring that sensitive information held in the Commission (both at Headquarters and in the 
Delegations)  is  protected  against  unauthorised  disclosure  and  access  is  of  paramount 
importance  for  the  Commission's  effectiveness  and  reputation.  All  DGs  and  services 
concerned should pay particular attention to information security and should coordinate with 
and seek validation of all their security measures by the corporate security service. 

IAS  conclusion  3:  Policy  Directorates-General  have  front-line  responsibility  for  fraud 
prevention 

The Commission has recently adopted a new approach to fraud proofing. OLAF plays a key 
role  in  fraud  investigations  and  contributes  to  developing  methods  of  fighting  fraud  on  the 
basis  of  its  experience.  However,  in  the  Commission,  Directors-General  -  as  Authorising 
Officers by Delegation - have, front-line responsibility for the prevention of fraud in their area 
of responsibility (in which they will be supported by OLAF) and for the follow-up to OLAF 
investigations (recoveries etc.). 

IAS conclusion 4: AAR assurance process steadily being improved 

The ultimate aim of both the AAR assurance process and the synthesis report is to support the 
political responsibility of the Commissioners to manage the Commission. The foundation of 
the  assurances  given  will  be  improved  by  a  better  definition  of  the  underlying  control 
strategies,  backed  by  indicators  for  key  controls  and  by  better  "reconciliation"  of  the 
assurances with the results of the ECA's work. 

IAS conclusion 5: Some progress in follow-up, but also some areas lagging behind 

EN 

   EN 

 
 
Follow-up of audit recommendations has improved recently, but still takes too long in some 
areas. Also some issues raised in previous annual reports still require continued attention, e.g. 
a  human  resources  strategy  that  is  fully  aligned  on  the  strategic  planning  process  and  the 
development of shared services and improvements in IT governance. 

EN 

   EN