Commission staff working document - Annex to the communication from the Commission to the Council and the European Parliament - Annual Report to the Discharge Authority on Internal Audits Carried out in 2007 (Article 86 (4) of the Financial Regulation) {COM(2008)499 final}
Date: 2008-07-30
Institutions: European Commission
Subjects: European Commission, activity report, audit, budgetary discharge, financial regulation, impact study, management accounting

EN 

EN 

   EN 

 
 
COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 30.7.2008 
SEC(2008) 2361 final 

COMMISSION STAFF WORKING DOCUMENT 

Annex to the  

COMMUNICATION FROM THE COMMISSION 
TO THE COUNCIL AND THE EUROPEAN PARLIAMENT 

Annual Report  
to the Discharge Authority  
on Internal Audits Carried out in 2007 

(Article 86 (4) of the Financial Regulation) 

{COM(2008)499 final} 

EN 

   EN 

 
 
 
  
 
 
 
 
 
 
 
 
TABLE OF CONTENTS 

Introduction ................................................................................................................................ 5 

1. 

1.1. 

1.2. 

1.3. 

1.4. 

1.5. 

1.6. 

1.7. 

1.8. 

1.9. 

ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS ................................. 8 

SG/BUDG/REGIO/EMPL/RTD/INFSO/JLS/AIDCO/ADMIN/DIGIT - AAR 
Assurance Process........................................................................................................ 8 

ADMIN - Follow-up of the Review of DG ADMIN Human Resources Management 
– Phase 1 ...................................................................................................................... 9 

BUDG - ABAC - Implementation of Accrual-Based Accounting............................... 9 

BUDG – Comparative Analysis of the Accruals Based Accounting Systems and 
Financial Reporting as implemented by the European Commission and some 
Member States............................................................................................................ 11 

COMM – Examination of the purchase of office buildings in Cyprus ...................... 12 

COMM – Special report on tendering procedures for transmission services in DG 
COMM ....................................................................................................................... 13 

DGT – The Management of Translation Demand ..................................................... 14 

DGT – Follow-up of IAS validation of self-assessment of the IAC of DGT ............ 15 

DIGIT – IT procurement and service delivery in DG DIGIT.................................... 15 

1.10. 

EPSO – Follow-up of the Limited Review on the selection process as managed by 
EPSO .......................................................................................................................... 16 

1.11. 

ESTAT – 2nd Follow-up Audit of the In-depth Audit of ESTAT .............................. 17 

1.12. 

ESTAT – IT Procurement and Service Delivery in ESTAT...................................... 17 

1.13.  OIB –Management of procurement contracts in OIB ................................................ 18 

1.14.  OIB –Management of buildings procurement contracts ............................................ 19 

1.15.  OIB – Follow-up on buildings infrastructure managed by the European Commission20 

1.16.  OIB – Follow-up on transaction testing ..................................................................... 21 

1.17.  OIB – Evaluation of targeted Internal Control Standards in OIB.............................. 21 

1.18.  OIL – Management of Procurement Contracts in OIL .............................................. 22 

1.19. 

PMO – Controls over Payment of Pensions............................................................... 23 

1.20. 

SCIC – Follow-up of validation of self-assessment of the SCIC IAC....................... 25 

2. 

2.1. 

2.2. 

INTERNAL POLICIES ............................................................................................. 25 

COMP - Follow-up report on the Audit of IT Controls ............................................. 25 

DG EAC – ABAC-Implementation of Accruals Based Accounting in DG EAC/2006 
Closing ....................................................................................................................... 25 

EN 

2 

   EN 

 
2.3. 

2.4. 

2.5. 

2.6. 

2.7. 

2.8. 

2.9. 

DG EAC – Follow-up Audit Report on the Implementation of ABAC in DG EAC. 27 

EACEA – Implementation of the Financial Circuits for Operational Budget of the 
Education, Audiovisual and Culture Executive Agency (EACEA)........................... 27 

DG ENTR – Management Letter Ex-Post Controls (no report) ................................ 29 

DG ENTR - Follow-up report on the financial management of the innovation relay 
centre (IRC) network.................................................................................................. 29 

DG ENTR - Follow-up Audit Report on the IAS Validation of Self-Assessment of 
Internal Audit Capability (IAC) of DG ENTR .......................................................... 29 

DG ENV – Monitoring of the Implementation of EU Law ....................................... 30 

DG ENV – Second Follow-up audit of DG ENV's 2004 In-depth audit ................... 31 

2.10.  DG ENV – Grant management under the non-LIFE-programmes ............................ 31 

2.11.  DG INFSO – Ex-Post Controls.................................................................................. 32 

2.12. 

JRC – Second Follow-up of In-Depth Audit of JRC of 2004 .................................... 33 

2.13.  DG MARKT - Financial Management and Financial Circuits .................................. 34 

2.14.  DG RTD - Follow-up report on the in-depth audit of DG RTD (2003) and the audit 

on financial circuits & financial management in DG RTD (2005)............................ 34 

2.15.  DG RTD - IT procurement and service delivery in DG RTD.................................... 34 

2.16.  DG TAXUD - IT procurement and service delivery in DG TAXUD........................ 35 

2.17.  DG TREN - Follow-up report on the audit of financial management and financial 

circuits in DG TREN.................................................................................................. 36 

2.18.  DG TREN - Follow-up Audit Report on "Audit de processus de gestion de 

l'informatique locale" ................................................................................................. 37 

2.19. 

TREN-IEEA - Audit of the Intelligent Energy Executive Agency............................ 37 

2.20.  DG TREN - Follow-up of validation of self-assessment of DG TREN IAC............. 39 

3. 

3.1. 

3.2. 

3.3. 

3.4. 

3.5. 

3.6. 

STRUCTURAL MEASURES AND COMMON AGRICULTURAL POLICY....... 39 

AGRI - Local IT systems of DG AGRI feeding into ABAC..................................... 39 

AGRI - Final Audit Report on DG AGRI – Interventions in Agricultural Markets .. 40 

AGRI - Follow-up Audit Report on Structural Funds – DG AGRI EAGGF-
GUIDANCE............................................................................................................... 41 

EMPL – Prevention and detection of fraud in the Structural Funds .......................... 42 

EMPL – Implementation of Programmes in the New Member States ...................... 43 

FISH – Follow-up Final Audit Report on Structural Funds - Financial instrument for 
Fisheries Guidance (FIFG)......................................................................................... 44 

3.7. 

REGIO – Implementation of programmes in the new Member States ...................... 44 

EN 

3 

   EN 

 
3.8. 

REGIO – Follow-up Audit Report on the European Regional Development Fund 
(ERDF) – Audit of the Implementation of Article 38 of Council Regulation 
1260/1999 in DG REGIO........................................................................................... 45 

3.9. 

REGIO – Prevention and detection of fraud in the Structural Funds ........................ 45 

4. 

4.1. 

4.2. 

4.3. 

4.4. 

4.5. 

4.6. 

4.7. 

4.8. 

4.9. 

EXTERNAL POLICIES ............................................................................................ 46 

AIDCO - Eligibility of Costs under the Financial and Administrative Framework 
Agreement with the United Nations by DG AIDCO ................................................. 46 

AIDCO - Ex-Post Control Activities in DG AIDCO................................................. 48 

AIDCO - Follow-up Audit Report on NGO funding in DG AIDCO ........................ 49 

AIDCO - Financial management main programmes in Directorate D ...................... 50 

ECHO - Follow-up audit of NGO funding in DG ECHO.......................................... 51 

ECHO - Monitoring and supervision tools in DG ECHO.......................................... 51 

ECHO, ADMIN – Management letter on security issues in DG ECHO (no report) . 53 

ELARG - Follow-up Audit Report on the In-depth Audit of DG ELARG ............... 53 

RELEX - First Follow-up audit of the Audit on Handling of classified information 
and communication among the Delegations and DG RELEX................................... 53 

4.10. 

TRADE - Implementation of selected Internal Control Standards in DG TRADE... 54 

EN 

4 

   EN 

 
 
INTRODUCTION 

This Annex is based on the original executive summaries (reflecting the state of play at the 
time  when  the  audits  were  finalised)  of  audit  engagements  finalised  by  the  IAS  in  2007. 
Each  summary  underwent  the  applicable  standard  professional  validation  and  contradictory 
procedures between auditor and auditee at the time of finalisation. 

The tables on implementation status contain both the auditees' view and the IAS view, where 
available. 

For 2007 audits, more detailed follow-up reporting will be covered in the Annual Report for 
2008. 

DG/Service 

Engagement 

Issue date 

Administrative and other support systems 

SG/BUDG/REGIO/EMPL
/RTD/INFSO/JLS/AIDCO
/ADMIN/DIGIT 

AAR Assurance Process 

21 January 2008 

ADMIN  

BUDG 

BUDG 

COMM 

COMM 

DGT 

DGT 

DIGIT 

EPSO 

ESTAT 

ESTAT 

OIB 

OIB 

OIB 

Follow-up human resources management phase I 

13 December 

ABAC-implementation  of  accrual-based  accounting 
(parts 1 and 2) 

3 May 

Comparative Analysis of the Accrual-Based Accounting 
Systems and Financial Reporting as Implemented by the 
European Commission and some Member States 

26 April 

Examination  of  the  purchase  of  office  buildings  in 
Cyprus 

14 September 

Special  report on  tendering procedures for  transmission 
services in DG COMM 

14 December 

The management of translation demand 

Follow-up  of  IAS  validation  of  self-assessment  of  the 
IAC of DGT 

13 June 

14 December 

IT procurement and service delivery in DG DIGIT 

5 December 

Follow-up  of  limited  review of  the  selection  process  as 
managed by EPSO 

18 December 

Second follow-up audit of the in-depth audit of Eurostat 

9 March 

IT procurement and service delivery in ESTAT 

20 November 

Management of procurement contracts in OIB 

3 April 

Management of buildings procurement contracts by OIB 

3 April 

Follow-up  on  buildings  infrastructure  managed  by  the 
European Commission 

8 February 

EN 

5 

   EN 

 
 
 
 
 
 
 
 
OIB 

OIB 

OIL 

PMO 

SCIC 

Internal policies 

COMP 

EAC 

EAC 

EACEA 

ENTR 

ENTR 

ENTR 

ENV 

ENV 

ENV 

INFSO 

JRC 

MARKT 

RTD 

RTD 

TAXUD 

TREN 

TREN 

Follow-up on transaction testing 

Evaluation of targeted ICS 

Management of procurement contracts in OIL 

Controls over payment of pensions 

Follow-up  of  validation  of  self-assessment  of  the  SCIC 
IAC 

20 April 

4 October 

3 April 

7 September 

29 November 

Follow-up  report  on  the  audit  of  IT  controls  in  DG 
COMP 

16 May 

ABAC - implementation of accrual-based accounting in 
DG EAC/2006 closing 

18 July 

Follow-up  report  on  the  implementation  of  ABAC  in 
DG EAC 

18 July 

Implementation of the financial circuits for operational 
budget of the EAC executive agency 

19 March 

Management letter on ex-post controls 

Follow-up  report  on  the  financial  management  of  the 
Innovation Relay Centre (IRC) network 

20 April 

23 October 

Follow-up  of  validation  of  self-assessment  of    DG 
ENTR IAC 

18 December 

Monitoring the implementation of EC law 

Second  follow-up  audit  of  DG  ENV's  2004  in-depth-
audit 

22 January  

29 March 

Grant management of non-life-programmes 

18 September 

Ex-post controls 

20 February 

Second follow-up of in-depth audit of the JRC of 2004 

21 September 

Follow-up 
report 
management and financial circuits 

on  DG  MARKT 

financial 

18 January 

Follow-up  report  on  the  in-depth  audit  of  DG  RTD 
(2003)  and  the  audit  on  financial  circuits  &  financial 
management in DG RTD (2005) 

16 March 

IT procurement and service delivery in DG RTD 

30 November 

IT Procurement and service delivery in DG TAXUD 

18 October 

Follow-up report on the audit of financial management 
and financial circuits in DG TREN 

20 March 

Follow-up  report  of  "Audit  de  processus de  gestion de 
l'informatique locale" 

7 September 

TREN-IEEA 

TREN executive agency 

TREN 

Follow-up  of  validation  of  self-assessment  of  DG 
TREN IAC 

30 January 

20 December 

Structural Measures and Common Agricultural Policy 

AGRI 

Local IT systems of DG AGRI feeding into ABAC 

25 May 

EN 

6 

   EN 

 
AGRI 

AGRI 

EMPL 

EMPL  

FISH 

REGIO 

REGIO 

REGIO 

External Policies 

AIDCO 

AIDCO 

AIDCO 

AIDCO 

ECHO 

ECHO 

Interventions in agricultural markets 

Follow-up  report  on  structural  funds  -  DG  AGRI 
EAGGF GUIDANCE 

23 November 

22 November 

Prevention  and  detection  of  fraud  in  the  Structural 
Funds 

19 December 

Implementation  of  programmes  in  the  new  Member 
States 

12 December 

Follow-up  audit  report  on  Structural  Funds  -  financial 
instrument for fisheries guidance 

20 July 

Implementation  of  programmes  in  the  new  Member 
States 

13 November 

Follow-up  on  the  ERDF  -  audit  of  the  implementation 
of Article 38 of Council Regulation 1260/1999 

14 December 

Prevention  and  detection  of  fraud  in  the  Structural 
Funds 

19 December 

Eligibility  of  costs  under  DG  AIDCO's  financial  and 
administrative  framework  agreement  with  the  United 
Nations 

19 June 

Ex-post control activities in DG AIDCO 

Follow-up audit on NGOs funding in DG AIDCO 

18 July 

31 July 

Financial  Management  of  Main  Programmes 
Directorate D 

in 

20 December 

Follow-up audit on NGOs funding in DG ECHO 

6 June 

Monitoring and supervision tools in DG ECHO 

23 November 

ECHO, ADMIN 

Management letter on security issues in DG ECHO 

29 November 

ELARG 

RELEX 

TRADE 

Follow-up  audit  report  on  the  in-depth  audit  of  DG 
ELARG 

15 March 

Follow-up  audit  of  the  audit  on  handling  of  classified 
information and communication among the delegations 
and DG RELEX 

4  July 

Implementation of selected internal control standards in 
DG TRADE 

13 June 

EN 

7 

   EN 

 
1.  ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS 

1.1.  SG/BUDG/REGIO/EMPL/RTD/INFSO/JLS/AIDCO/ADMIN/DIGIT 

-  AAR 

Assurance Process 

Objectives and Scope 

The main objective of the audit was to assess the effectiveness of the Annual Activity Report 
(AAR) assurance process as a whole and, in particular, the extent to which it provides a sound 
basis  to  support  the  reasonable  assurance  given  by  management  to  the  Commission  on  the 
functioning  of 
the  Directors 
General/Heads  of  Services  provide  the  basis  for  the  Synthesis  Report  of  the  Commission, 
which is its main accountability instrument in terms of taking political responsibility for the 
management  of  the  Commission.  These  accountability  instruments  were  introduced  in  2000 
and are key components of the Commission's Reform. 

internal  control  systems.  These  assurances  from 

its 

This audit engagement looked at the control systems and procedures set up in selected DGs 
and  families  of  DGs,  aimed  at  building  the  necessary  assurances,  together  with  a 
consideration of the central co-ordination and guidance roles exercised by both the Secretariat 
General  and  DG  BUDG.  The  audit  has  focused  only  on  the  parts  of  the  AAR  process 
concerned  with  the  specific  management  and  control  assurances  provided  in  the  annual 
declaration, rather than on those linked to the achievement of political objectives defined in 
the  AMP.  Moreover,  it  has  not  covered  the  completeness  and  accuracy  of  the  financial 
information (accounts) provided by DGs in their AARs. 

In  the  present  engagement,  the  IAS  has  aimed  at  identifying  possible  improvements  in  the 
AAR  assurance  building  processes,  together  with  best  practices  amongst  individual  DGs 
and/or  families  of  DGs.  In  this  way,  this  engagement  is  also  expected  to  contribute  to  the 
Commission objective leading up to a positive Declaration of Assurance (DAS). 

As  defined  in  the  IAS  strategic  audit  plan  2007-2009,  endorsed  by  the  APC  on  2  February 
2007, the present engagement has covered for the reporting year 2006: 

•  The Structural Funds "family" (DG REGIO/DG EMPL), 

•  The Research "family" (DG RTD/DG INFSO), 

•  DG JLS, 

•  SG & DG BUDG (in particular as co-ordinators of the AAR process). 

In order to help maximise the coverage and to cover all management modes, AIDCO has also 
been included as part of the analysis. 

EN 

8 

   EN 

 
 
 
 
1.2.  ADMIN - Follow-up of the Review of DG ADMIN Human Resources Management 

– Phase 1 

Objectives and Scope 

The  objective  of  this  first  follow-up  engagement  is  to  assess  the  progress  made  in 
implementing  the  issues  accepted  for  consideration  that  resulted  from  the  Review  of  DG 
ADMIN  Human  Resources  Management  –  Phase  1  –  carried  out  in  2005  (date  of  the  Final 
Report: 7 April 2006). 

In line with IAS follow-up policy, this follow-up engagement does not result in an assessment 
of the adequacy of controls as a whole, but focuses on the specific issues for consideration in 
the original review. 

1.3.  BUDG - ABAC - Implementation of Accrual-Based Accounting 

Objectives 

As from 1 January 2005, the general accounts of the European Communities are maintained 
according to the principles of accruals based accounting. The new accounting system of the 
Commission, hereafter called ABAC, serves as the technical and operational platform for the 
new  accounting  framework.  According  to  the  Financial  Regulation  (FR),  the  Accounting 
Officer  of  the  Commission  in  DG  BUDG  is  responsible  for  the  maintenance  of  the  overall 
accounting  framework,  including  an  effective  system  of  accounting  controls,  while  the 
authorising  officers  are  responsible  for  implementing  the  budget  in  accordance  with  the 
principles of sound financial management and for ensuring compliance with the requirements 
of legality and regularity. The scope and nature of those responsibilities can be found under 
different articles in the FR and its Implementing Rules (IR). 

The objective of the present audit was to assess the current status of the systems and controls 
put in place centrally by DG BUDG in order to ensure the quality of the accounting data – in 
terms  of  their  integrity,  completeness  and  accuracy  –  and  the  financial  information  derived 
from such data.  

The  term  'accounting  data'  means  data  entered  into  ABAC  Workflow,  either  directly  or 
through  the  local  systems  in  the  DGs  and,  thereafter,  transferred  via  interface  to  the  central 
accounting system (SAP), its General Ledger or any of the other modules that are part of it. 
Financial information means, primarily, the year-end accounts and financial statements of the 
Commission.  

The present audit does not assess the quality of the accounting data provided by the DGs via 
their local systems or manually encoded into ABAC Workflow. 

The  present  audit  included  a  follow-up  of  one recommendation  classified  as  very  important 
and which was issued in 2005 as a result of an audit follow-up of three different IAS audits 
targeting DG BUDG and performed during 2002-2003. 

EN 

9 

   EN 

 
 
 
 
Scope 

The  scope  of  the  audit  consisted  of  three  different  parts,  namely  Accountancy  (Part  1), 
Supporting  IT-systems  (Part  2)  and  Comparative  analysis  of  the  accounting  systems  as 
implemented by the European Commission and some Member States (Part 3). 

The  present  audit  report  includes  the  results  in  the  form  of  an  audit  opinion,  findings  and 
recommendations related to Parts 1 and 2.  

The results of Part 3 are not included in this audit report and will be reported separately. This 
is due to the different nature of the exercise, which was to make a comparative analysis, at a 
general  level,  of  the  current  status  of  accruals  based  accounting  and  financial  reporting 
between  three  Member  States  –  United  Kingdom,  Sweden  and  Finland  –  and  the  European 
Commission. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

8 

13 

3 

24 

8 

100 

11 

84,62 

3 

100 

22 

91,66 

0 

2 

0 

2 

0 

15,38 

0 

8,33 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Desirable 

Total 

8 

11 

3 

22 

3 

7 

3 

37,50 

63,64 

100 

13 

59,10 

5 

4 

0 

9 

62,50 

36,36 

0 

40,90 

EN 

10 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
1.4.  BUDG  –  Comparative  Analysis  of  the  Accruals  Based  Accounting  Systems  and 
Financial  Reporting  as  implemented  by  the  European  Commission  and  some 
Member States 

Purpose and Objective 

This comparative analysis was carried out as part of an audit performed by the Internal Audit 
Service  of  the  European  Commission.  The  audit  targeted  the  new  accounting  system  of  the 
Commission, effective as from 1 January 2005 and based on the International Public Sector 
Accounting Standards (IPSAS). 

The purpose of the analysis was to make a comparison between the accruals based accounting 
systems  and  related  financial  reporting  as  implemented  by  four  different  actors,  namely  the 
European  Commission  and  the  Governments  of  the  United  Kingdom,  Sweden  and  Finland. 
Our choice of the three countries was based – apart from the fact that they are members of the 
European  Union  –  on  their  record  as  forerunners  among  the  public  administrations  which 
have made the transition into accruals based accounting and financial reporting. 

The  objective  of  the  analysis  was  to  gain  understanding,  at  a  general  level,  of  the  current 
status  of implementation of accruals based accounting and financial reporting in these three 
Member  States  as  well  as  in  the  Commission  –  including  the  principal  developments 
preceding the transition – and to share these experiences with the participants by means of an 
overview report. 

More  specifically,  our  objective  was  to  identify  both  the  similarities  and  differences  in  the 
approach taken by the four actors participating in the review, which might in turn prove to be 
useful input for them as their respective systems evolve. The report does not seek to make any 
qualitative  assessments  on 
it  make  any 
recommendations. 

the  respective  approaches.  Neither  does 

Scope and Methodology 

Within  the  scope  of  our  analysis  we  contacted,  and  subsequently,  met  with,  eight  different 
bodies representing the European Commission and the three Member States, as follows: 

(1) European Commission / Directorate-General for Budget  

(2) HM Treasury / UK 

(3) National Audit Office / UK 

(4) Ministry of Finance / Sweden 

(5) Swedish National Financial Management Authority / Sweden 

(6) National Audit Office / Sweden 

(7) Ministry of Finance / Finland 

(8) State Audit Office / Finland 

EN 

11 

   EN 

 
 
 
 
The  factual  details  underlying  the  observations  contained  in  this  report  have  been  checked 
with the bodies concerned after our meetings with them.  

To support the review process both prior to and after the meetings/interviews, we reviewed a 
significant amount  of documentation such as the legal basis underpinning the framework of 
accounting and financial reporting which has been set up by each of the four actors concerned 
and descriptions of systems and procedures. 

We  also  reviewed  examples  of  annual  reports  and  accompanying  financial  statements  of 
Government departments/agencies as well as reports at a consolidated level. The aim of our 
review  of  this  material  was  simply  to  gain  a  general  understanding  of  the  principles 
underlying the preparation of such reports, their contents and general presentation. 

1.5.  COMM – Examination of the purchase of office buildings in Cyprus 

The  annual  Work  Programme  2007  of  the  IAC  of  DG  COMM  included  an  audit  on  Asset 
Management. The objectives and scope were to: 

1. 

2. 

3. 

Review, test and evaluate the internal controls over the asset management within the 
Representations and in Headquarters units; 

Review and evaluate the implementation of ABAC Assets; 

Identify  and  analyse  the  processes  within  DG  COMM  used  for  the  (co)purchase  of 
buildings, including those located in Member States' capital cities. 

In order to share the knowledge acquired by the IAS in previous audits in the area, the IAS 
was asked to participate in the audit mission to Cyprus in June 2007 to specifically cover (3) 
above in respect of the (co)purchase of the Commission's Representation building in Nicosia. 

The  aim  of  the  present  note  is  to  outline  the  main  findings  resulting  from  the  IAS's 
examination,  together  with  a  list  of  recommendations  on  how  to  address  the  weaknesses 
identified.  As  was  agreed,  the  IAS's  findings  will  be  incorporated  into  the  overall  reporting 
and validation process. The IAS will not issue a separate report itself to DG COMM, but of 
course we are available, where necessary, to discuss the points raised with DG COMM. 

Objective and scope 

The  objective  was  to  identify  and  assess  the  controls  put  in  place  by  DG  COMM  for  the 
(co)purchase of the Commission's Representation building in Cyprus (Nicosia). 

Acceptance 
Status 

Yes 

No 

EN 

12 

   EN 

 
 
 
 
 
 
 
 
 
Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

2 

1 

3 

2 

1 

3 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Total 

2 

1 

3 

2 

1 

3 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.6.  COMM – Special report on tendering procedures for transmission services in DG 

COMM 

Objectives and Scope 

The  Audit  on  the  Tendering  Procedures  for  Transmission  Services  in  DG  COMM  was 
performed at the request of the Director-General of DG COMM.  

The  objective  of  this  audit  was  to  assess  whether  the  call  for  tenders  PO/2006-26/C1  –  as 
mentioned  in  the  scope  below  –  complied  with  the  Financial  Regulation  (FR)  and  its 
Implementing  Rules  (IR)  and  with  the  "Public  Procurement  Vade-Mecum",  issued  by  DG 
BUDG and to review specific allegations made concerning this contract. 

The scope of this audit was the call for tender PO/2006-26/C1 concerning an open procedure 
for the supply of transmission services.1 The call for tender contained the following lots: 

Lot  I:  Provision  of  the  technical  infrastructure  necessary  for  the  transmission  of  television 
services via satellite. 

Lot  II:  Ad  hoc  provision  of  transmission  bandwidth  and  supporting  services  for  TV 
transmissions. 

Lot III: Permanent bidirectional video link between Luxembourg and Brussels. 

1 See Contract Notice: 2006/S128-136072, published in the OJEU S128 on 08/07/2006. 

EN 

13 

   EN 

 
 
 
 
 
 
 
                                                 
In order to be able to interpret the tendering specifications included in this call for tender, the 
previous  contract  –  the  negotiated  procedure  PN/2001-41/B3  concerning  the  supply  of 
satellite transmission services (and especially its lot I)2 – was also analysed. 

The following were not covered in this audit: 

•  Commission policies (e.g. Europe by Satellite (EbS) objectives).  
•  Data protection issues. 
•  Document access issues. 

No scope limitations were identified. 

1.7.  DGT – The Management of Translation Demand 

Objectives and Scope 

In  accordance  with  the  IAS  audit  plans  2006-2007,  this  audit  covered  the  management  of 
translation  demand  within  DGT,  from  the  planning  to  the  delivery  of  the  requested 
translations. Some aspects of the translations directly managed by other Commission Services 
with no or little involvement from DGT were also addressed. 

The scope did not include the management of web translation. 

The  objectives  of  this  audit  were  to  assess  the  adequacy,  efficiency  and  effectiveness  of 
internal  control  systems  related  to  the  management  of  translation  demand  within  the 
Commission. 

There is no reservation in the AAR concerning the areas/processes audited. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Total 

4 

1 

5 

4 

1 

5 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2 Negotiated Procedure PN/2001-41/B3 concerning the supply of satellite transmission services, Lot I: Provision 
of the technical infrastructure necessary for the transmission of a television service via satellite; Lot II: Ad-hoc 
provision of transmission bandwidth and supporting services and equipment for TV transmissions to and from 
any part of the world, at short notice. 

EN 

14 

   EN 

 
 
 
 
 
 
 
 
                                                 
Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Total 

4 

1 

5 

4 

1 

5 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.8.  DGT – Follow-up of IAS validation of self-assessment of the IAC of DGT 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted3 recommendations that resulted from the IAS Validation of Self-Assessment of the 
Internal Audit Capability (IAC) of DGT, which was carried out from February tol June 2006.  

1.9.  DIGIT – IT procurement and service delivery in DG DIGIT 

Objectives and Scope 

This  audit  is  part  of  a  wider  audit,  the  objective  of  which  was  to  assess  the  adequacy  and 
effective  application  of  the  internal  control  system  (ICS),  risk  management  and  governance 
processes  related  to  IT  procurement  and  the  delivery  of  IT  services  to  the  European 
Commission. 

The  purpose  of  the  audit  was  to  assess  whether  the  ICS  provides  reasonable  assurance 
regarding: 

•  Compliance with the Commission rules on IT procurement, the Financial Regulation and 
the appropriate Commission Internal Control Standards. The issue of compliance with the 
provisions  of  Regulation  (EC)  45/2001  on  the  protection  of  personal  data  was  also 
considered. 

•  Effectiveness and efficiency of the procurement and service delivery processes. The IAS 
examined whether DIGIT is making the best use of all type of IT human resources and the 
way in which the follow-up and management of IT activities provides assurance that the 
Commission is obtaining the right service at the right price. In this respect, we also took 
into account the need to simplify internal administrative rules and procedures. 

The audit of DG DIGIT's IT procurement and service delivery is part of the overall IAS audit 
objective  to  provide  an  audit  opinion  on  IT  procurement  and  service  delivery  in  the 
Commission.  After  having  audited  a  sample  of  DGs,  an  overview  report  will  be  produced 
containing the consolidated results and conclusions on the above-mentioned audits and on the 
crosscutting observations and recommendations.  

3 The following recommendation was not accepted by DGT: IAS-2006-DGT-001: 8 standard 2410: criteria for 
communicating  "The  IAC  should  ensure  the  timely  communication  of  action  plans  related  to  its  audit 
engagements after having assessed their reasonableness". 

EN 

15 

   EN 

 
 
 
 
 
                                                 
As a result of the desk review and the interviews in the preliminary survey (which took into 
account the work already performed by the IAC, the European Court of Auditors and the IAS) 
the  scope  of  the  audit  engagement  in  DG  DIGIT  focused  on  the  following  aspects  of  the 
internal  control  system,  risk  management  and  governance  of  IT  procurement  and  service 
delivery: 

•  Contract preparation process, from the identification of the business needs to the signing 
of  the  contracts  and  specific  contracts.  This  can  include  all  types  of  IT  expenditure 
(equipment and services). 

•  Management  and  monitoring  of  these  contracts  with  external  contractors.  The  audit 
included  the  monitoring  of  services  agreed  to  under  "fixed-price"  or  "time-and-means" 
contracts, as well as the measures taken to ensure continuity of business on the expiry of 
the contracts. The management of certain services and equipment was not included insofar 
as  these  are  already  covered  by  other  IAS  audits  (data  centre,  telecommunications  or  
ABAC  ASSETS),  However,  information  systems  developed  and  maintained  by  external 
suppliers were included in the scope. 

DIGIT's 2006 Annual Activity Report raised the following issue specifically in relation to the 
area covered by the scope of this audit: 

"The lack of necessary staff (due to the absence of EUR-12 AD IT reserve list) with technical 
ICT  and  project  management  competences  has  put  DIGIT  in  difficulties  to  deliver  foreseen 
outputs".  

No scope limitations were identified. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

1 

8 

2 

1 

8 

2 

100 

100 

100 

11 

11 

100 

0 

0 

0 

0 

0 

0 

0 

0 

1.10. EPSO – Follow-up of the Limited Review on the selection process as managed by 

EPSO 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
issues  accepted  for  consideration  that  resulted  from  "The  Limited  Review  on  the  selection 
process as managed by EPSO" carried out in 2005 (date of the Final Report: 7 April 2006).  

EN 

16 

   EN 

 
 
 
 
 
 
This  follow-up  does  not  result  in  an  assessment  of  the  adequacy  of  controls  as  a  whole  but 
focuses on the specific issues raised in the original limited review. 

1.11. ESTAT – 2nd Follow-up Audit of the In-depth Audit of ESTAT 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from the in-depth audit of ESTAT carried out in 2003 
(final report dated 19 March 2003) and that were outstanding at the time of the first follow-up 
audit conducted in 2005 (final report dated 5 October 2005). 

In line with IAS policy, this follow-up audit does not result in an assessment of the adequacy 
of controls as a whole but focuses on the 16 recommendations assessed as still being open at 
the time when the first follow-up audit was completed. 

1.12. ESTAT – IT Procurement and Service Delivery in ESTAT 

Objectives and Scope 

This audit forms part of a wider audit, the objective of which was to assess the adequacy and 
effective  application  of  the  internal  control  system  (ICS),  risk  management  and  governance 
processes  related  to  IT  procurement  and  the  delivery  of  IT  services  to  the  European 
Commission. 

In particular, the audit assessed whether the ICS provides reasonable assurance as regards: 

(cid:121)  Compliance with the Commission rules on IT procurement, the Financial Regulation and 
the  appropriate  Commission  Internal  Control  Standards.  We  also  looked  at  compliance 
with the provisions of Regulation (EC) 45/2001 on the protection of personal data. 

(cid:121)  Effectiveness and efficiency of the procurement and service delivery processes. The IAS 
examined whether ESTAT makes the best use of all type of IT human resources and the 
way  in  which  the  follow-up  and  management  of  IT  activities  provides  assurance  that  it 
obtaining the right service at the right price. In this respect, we also took into account the 
need to simplify internal administrative rules and procedures. 

The audit of IT procurement and service delivery of ESTAT is part of the overall IAS audit 
objective  to  provide  an  audit  opinion  on  IT  Procurement  and  Service  Delivery  in  the 
Commission.  After  having  audited  a  sample  of  DGs,  an  overview  report  will  be  produced 
containing the consolidated results and conclusions on the above-mentioned audits and on the 
crosscutting observations and recommendations.  

EN 

17 

   EN 

 
 
 
 
 
As a result of the desk review and the interviews in the preliminary survey (which took into 
account the work already performed by the IAC, the European Court of Auditors and the IAS) 
the scope of the audit engagement in ESTAT focused on the following aspects of the internal 
control  system,  risk  management  and  governance  processes  of  IT  procurement  and  service 
delivery: 

(cid:121)  Contract preparation process, from the identification of the business needs to the signing 
of  the  contracts  and  specific  contracts.  This  process  included  all  types  of  IT  expenses 
(equipment and services). 

(cid:121)  Management  and  monitoring  of  these  contracts  with  external  contractors.  The  audit 
included the monitoring of services agreed to as "fixed-price" or "time-and-means" as well 
as the measures taken to ensure business continuity on the expiry of contracts. 

There  are  no  observations/reservations  in  the  Annual  Activity  Report  that  relate  to  the  area 
audited.  

No scope limitations were identified. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

3 

5 

1 

9 

3 

5 

1 

9 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

1.13. OIB –Management of procurement contracts in OIB 

Objectives and Scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  effectiveness  of  OIB's  internal 
control  system  with  respect  to  the  "Regularity  of  Financial  Management"  of  the 
procurement process. The present report focuses on OIB's procurement arrangements with 
respect to non-buildings contracts. The audit focused principally on procurement contracts 
completed during the period 2005-2006.  

EN 

18 

   EN 

 
 
 
 
 
 
 
 
The  audit  includes  the  follow  up  of  the  former  audit  engagement  conducted  in  2004  on 
transaction testing (IAS-2004-OIB-OOl Risk Assessment OIB - OIB Transaction Testing), 
which will be covered in a separate report. 

A reservation was made in the AAR 2005 in this area, due to the difficulties in keeping to 
the  timetable  of  the  calls  for  tenders  and,  as  a  consequence  of  this,  the  need  to  conclude 
negotiated procedures for extensions of the contracts. 

It should be noted that at present four cases are currently under investigation by OLAF. On 
these cases, OLAF has been consulted. This has not resulted in any scope limitations in the 
context of this audit. 

Acceptance 
Status 

Yes 

No 

Priority 

Critical 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

1 

6 

7 

0 

6 

7 

100 

100 

100 

14 

13 

92,86 

1 

0 

0 

1 

100 

0 

0 

7,14 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

6 

7 

13 

4 

7 

66,67 

100 

11 

84,62 

2 

0 

2 

33,33 

0 

15,38 

1.14. OIB –Management of buildings procurement contracts 

Objectives and Scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  effective  application  of  OIB's 
internal control system with respect to the "Regularity of Financial Management". The present 
report  focuses  on  buildings  procurement  contracts  and  related  issues,  such  as  the  policy 
development  process,  the  governance  structure,  the  decision  making  process,  portfolio 
management and long term planning of the buildings policy. OIB's procurement arrangements 
in  respect  of  non-buildings  contracts  have  been  examined  separately  and  addressed  in  a 
separate  report.  The  audit  focused  mainly  on  Buildings  Procurement  Projects  completed 
during the period 2005-2006. 

EN 

19 

   EN 

 
 
 
 
 
 
 
 
 
 
The results of the audit of in 2002 (IAS Task 01/1B/01) on the buildings infrastructure were 
the subkect of a follow-up, which will be covered in a separate report. 

There are no observations/reservations in the AAR 2005 that relate to the specific buildings 
procurement area audited, even though there is a general reservation regarding "deficiency in 
OIB's contracts and procurement management". 

Acceptance 
Status 

Yes 

No 

Priority 

Critical 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

1 

6 

4 

1 

6 

4 

100 

100 

100 

11 

11 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Critical 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

1 

6 

4 

11 

1 

6 

2 

9 

100 

100 

50 

81,82 

0 

0 

2 

2 

0 

0 

50 

18,18 

1.15. OIB  –  Follow-up  on  buildings  infrastructure  managed  by  the  European 

Commission 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the Audit of Buildings Infrastructure  managed 
by the European Commission, carried out in 2002. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

EN 

20 

   EN 

 
 
 
 
 
 
 
 
 
 
 
1.16. OIB – Follow-up on transaction testing 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted  recommendations  that  resulted  from  the  Audit  of  Transaction  testing  carried  out  in 
2004. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

1.17. OIB – Evaluation of targeted Internal Control Standards in OIB 

Objectives and Scope 

The objective of the audit was to assess the adequacy and effectiveness of the implementation 
of  Internal  Control  Standards  n°s  15  (Documentation  of  procedures),  16  (Segregation  of 
duties),  17  (Supervision)  and  24  (Annual  review  of  internal  control)  within  OIB.  Previous 
IAS  audits  of  OIB  have  indicated  a  need  to  look  at  these  specific  standards  in  OIB  and 
consider the scope for making improvements. 

The Internal Control Standards specify the requirements, actions and expectations which are 
necessary  to  build  an  effective  system  of  internal  control  and  which  provide  reasonable 
assurances as to the achievement of objectives. The Director of OIB (as delegated authorising 
officer) is responsible for ensuring that these standards are met within his service. 

The  audit  focused  on  the  operational  and  administrative  operations  and  did  not  cover  the 
financial  operations.  The  latter  were  covered  by  the  IAS  audits  on  the  management  of 
procurement contracts and by the follow-up of transaction testing and IAC's audit of financial 
circuits.  

It should be noted that the European Court of Auditors covered 17 DGs (including OIB) and 
the ICS n°s 11, 12, 14, 17, 18, 20, 21 and 22 in its DAS 2006 exercise; the IAC also reported 
on  the  ICS  n°s  5,  11,  12,  18,  19,  20  in  its  draft  audit  report    "Audit  sur  l'application  d'une 
selection des standards de contrôle internes". 

OIB did not express any reservations in the AAR 2006 that relate to the ICS 15,16, 17 and 24 
(see page 30 of the AAR 2006). 

In its Readiness Assessment 2006, OIB states that it is fully compliant with all the baseline 
requirements of the ICS 15, 16, 17 and 24, except for n°s 3 and 5 of  ICS 15 (n° 3: appropriate 
documentation of administrative and operational procedure and n° 5 : review and update of all 
procedures in order to be compliant with relevant regulations, the Financial Regulations and 
its implementing rules). 

EN 

21 

   EN 

 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Total 

2 

1 

3 

2 

1 

3 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Total 

2 

1 

3 

2 

1 

3 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.18. OIL – Management of Procurement Contracts in OIL 

Objectives and Scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  effectiveness  of  OIL's  internal 
control system with respect to the "Regularity of Financial Management" of the Procurement 
Process. The present report focuses on OIL's procurement arrangements with respect to non-
buildings contracts. The audit focused mainly on Procurement Contracts completed during the 
period 2005-2006. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

7 

6 

1 

7 

5 

1 

100 

83,33 

100 

0 

1 

0 

0 

16,67 

0 

EN 

22 

   EN 

 
 
 
 
 
 
 
 
 
 
  
 
 
 
 
 
 
Total 

14 

13 

92,86 

1 

7,14 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Desirable 

Total 

7 

5 

1 

13 

4 

2 

0 

6 

57,14 

40 

0 

46,15 

3 

3 

1 

7 

42,86 

60 

100 

53,85 

1.19. PMO – Controls over Payment of Pensions 

Objectives and Scope 

The objective of the audit was to assess the adequacy and effective application of the internal 
control system and risk management with respect to the design and the implementation of the 
financial  circuits  and  procedures  relating  to  the  determination  and  payment  of  individual 
rights of retired Commission staff (post active). 

In  particular,  its  objective  was  to  assess  whether  the  internal  control  system  (ICS)  provides 
reasonable assurance regarding: 

•  compliance  (legality  and  regularity)  with  the  FR  and  its  IR,  including  the  effective 

implementation of the financial circuits; 

the safeguarding of assets; 

the reliability of financial information; 

the  efficiency  and  effectiveness  of  financial  processes  ("sound  financial  management", 
Art. 27 of the FR). 

• 

• 

• 

The audit did not cover procedures related to the determination and payment of sickness and 
accident insurance cover, the invalidity pensions/allowances, the current financing scheme for 
pensions  or  the  transfers  of  pensions  from  the  Member  States.  Nor  did  it  cover  the 
functionality of the underlying system for processing the payments of entitlements, known as 
"Nouvelle Application de Paie" (NAP). 

The scope of the audit has focused on the adequacy of the design and implementation of the 
procedures involved in the decision to grant a retirement pension; the evaluation and payment 

EN 

23 

   EN 

 
 
 
 
 
 
 
 
of individual rights of retired staff, as well as the biennial declarations (life certificate) and the 
procedure in case of pensioner death. All of the above are under the responsibility of PMO-4 
(Pensions, and transfers of pension rights). 

There are no reservations in the 2006 AAR that relate to the specific area audited. However, 
PMO made the following observations in relation to its overall functioning: 

•  The  permanent  number  (stock)  of  files  of  transfer  of  pension  rights  remained  at  a  very 
high level (6,255 files at the end of 2006), which is approximately twice as high as in the 
years  preceding  the  reform  of  the  Staff  Regulations.  Also,  despite  a  reduction  in  its 
personnel, PMO has seen a considerable increase in its general workload. In 2005 some  
3,376  recalculations  were  made  pursuant  to  Article  26  §§  5  and  6  of  Annex  XIII  of  the 
Staff Regulations (page No 5) 

•  The reviews that were conducted internally, and confirmed by the external audits, detected 

the same structural weaknesses:  

a)  PMO does not have sufficient numbers of qualified staff; 

b)  The computer system is too out of date to be able to include automated controls. 

• 

 The Office is therefore heavily dependent on manual controls which, while they help to 
ensure  the  regularity  and  effectiveness  of  operations,  are  not  always  the  most  efficient 
(pages No 22 and 23). 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

5 

5 

2 

5 

5 

2 

100 

100 

100 

12 

12 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Desirable 

5 

5 

2 

5 

5 

2 

100 

100 

100 

Total 

12 

12 

100 

0 

0 

0 

0 

0 

0 

0 

0 

EN 

24 

   EN 

 
 
 
 
 
 
 
 
 
1.20. SCIC – Follow-up of validation of self-assessment of the SCIC IAC 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  IAS  Validation  of  Self-Assessment  of  the 
Internal Audit Capability of DG SCIC carried out from February to June 2006.  

2. 

INTERNAL POLICIES 

2.1.  COMP - Follow-up report on the Audit of IT Controls 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted4  recommendations  that  resulted  from  the  Audit  of  IT  Controls  of  DG  COMP  IT 
carried out in 2003. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

2.2.  DG EAC – ABAC-Implementation of Accruals Based Accounting in DG EAC/2006 

Closing 

Scope and objectives 

The audit covered the year-end 2006 closing of the accounts in Directorate-General Education 
and Culture (DG EAC) and the Executive Agency (EACEA). 

For  2006  "combined"  financial  statements  were  issued  by  DG  EAC  and  EACEA  giving  a 
comprehensive  overview  of  the  "Education  and  Culture"  activities  managed  jointly  by  both 
audited  entities.  This  was  due  to  the  fact  that  the  different  financial  data  (pre-financing, 
invoices, etc.) had not been adequately allocated between the cost centres of DG EAC and the 
Executive Agency.  

The objective of the audit was to obtain a reasonable assurance that:  

•  the  accounting  systems  and  procedures  established  locally  by  DG  EAC  and  by  the 
Executive Agency in the context of the implementation of accrual accounting are effective 
in  ensuring  the  reliability  of  the  financial  information  (including  compliance  with  the 
Commission's  accounting  rules),  both  local  and,  following  transmission  of  the  year-end 
closing data to DG BUDG, consolidated at the level of the Commission. 

•  the controls integrated into the accounting environment (including supporting IT systems) 
locally  in  DG  EAC  and  in  EACEA  are  adequate  and  effective  enough  to  ensure  the 

4  For  the  purpose  of  this  report,  all  subsequent  references  to  "accepted  recommendations"  include  two 
recommendations  which  were  originally  rejected  by  DG  COMP,  but  for  which  actions  have  been  in  fact 
implemented in practice 

EN 

25 

   EN 

 
 
 
                                                 
integrity of the financial information and the true and fair view of their financial position 
and their financial performance. 

The audit was performed in co-operation with the European Court of Auditors, which will use 
its results as part of the DAS audit of 2006. 

The audit consisted of three different parts, namely: 

-  Follow-up of the implementation of the recommendations issued last year by the IAS (for 

which a separate follow-up audit report has been issued);  

-  Review  of  the  accounting  procedures  and  the  supporting  IT  systems,  including  systems 
and procedures to collect and consolidate accounting data for the year-end closing, cut-off 
and validation of opening balances; 

-  Substantive  testing  of  the  closing  balances  (as  of  31/12/2006)  based  on  transaction 
samples  of  "pre-financing  and  related  guarantees"  and  "invoices  received  but  not  yet 
settled".  

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

1 

3 

4 

8 

1 

3 

4 

8 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Desirable 

Total 

1 

3 

4 

8 

0 

2 

2 

4 

0 

66,67 

50 

50 

1 

1 

2 

4 

100 

33,33 

50 

50 

EN 

26 

   EN 

 
 
 
 
 
 
 
 
 
 
 
2.3.  DG EAC – Follow-up Audit Report on the Implementation of ABAC in DG EAC 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the audit of the "Implementation  of  ABAC in 
DG EAC" carried out in 2006. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

2.4.  EACEA – Implementation of the Financial Circuits for Operational Budget of the 
Education, Audiovisual and Culture Executive Agency (EACEA) 

Objectives and Scope 

The  overall  objective  of  this  audit  is  to  issue  an  opinion  on  the  compliance  with  the 
Commission  rules  and  on  the  effectiveness  and  efficiency  of  operations  regarding  the 
implementation of Financial Circuits set up by the Agency to support its operational budget, 
and  the  related  aspects  of  the  financial  management  (i.e.  management  of  financial  roles; 
administration of sub-delegations; design of ex-post control structures; monitoring functions 
and internal reporting) and the Agency's reporting to its parent DGs.  

The scope of the audit was further defined in the preliminary phase taking into account two 
fundamental  aspects:  First  the  Agency  is  to  some  extent  still  in  its  start-up  phase  as  its 
operational  work  began  on  1  January  2006  and  the  Agency  became  administratively 
autonomous  from  24  July  2006.  Secondly,  the  audit  engagement  reflects  the  co-ordinated 
approach between the IAS and the Agency's IACs aiming at complementary coverage of the 
audit plans while targeting the most stable aspects of the Agency's activities. 

Accordingly, the following areas were excluded from the scope: 

•  The administrative budget as the Agency only became administratively autonomous as of 

July 2006. 

•  The  accounting  system  and  the  Agency's  financial  reporting,  including  the  IAS 
recommendations issued following the audit of the implementation of ABAC in DG EAC5 
. Due to the fact that the Agency's IT systems are the same as those used by DG EAC (i.e. 
APPFIN,  Sincom2  and  ABAC),  the  IAS  findings  are,  in  principle,  applicable  to  the 
Agency. The IAS, in coordination with the Court of Auditors, will carry out an audit in 
2007 on the closure of accounts process which will cover DG EAC and the consolidation 
process which will include the Agency's accounting for the operational budget.  
Information Technology (IT) and Human Resources (HR) as they will be covered by the 
Agency's IAC either directly (HR) or with the assistance of external experts (IT).  

• 

5  Audit Report IAS-2006-EAC-002 dated 30/06/06. 

EN 

27 

   EN 

 
 
 
 
                                                 
•  When the Agency was set up it inherited a backlog of 183 ex-post audits from DG EAC 
all of which required detailed follow-up by the Agency6.  However the present audit did 
not  include  substantive  tests  on  the  implementation  of  these  audits,  as  its  scope  was 
limited to the design of the new ex-post control function. 

•  Finally, some (parts of) programmes managed by the Agency are not relevant to the audit 
scope (i.e. Procedure B of Leonardo Da Vinci7 and Non-closed projects corresponding to 
Media II-1996-20008). 

With regard to evolving aspects, such as ex-post control structures and the Agency's reporting 
to its Parent DGs, the aim of this audit is to identify potential areas of improvement for the 
near future. 

Following  the  transfer  of  part  of  DG  EAC's  and  DG  INFSO's  activities  to  the  Agency  and 
owing  to  its  impact  on  the  Agency's  financial  management,  this  audit  engagement  also 
assesses  the  progress  made  in  implementing  eight  IAS  recommendations  (1  critical,  2  very 
important,  4  important  and  1  desirable)  which  resulted  from  the  IAS  in-depth  audit  of  DG 
EAC carried out in 20049 and followed up in 200510. The remaining IAS recommendations, 
in particular the aspects related to the abnormal RAL, were not part of the scope. 

In line with the project to amend the Commission Decision setting up the Executive Agency, 
the  Agency's  mandate  is  very  likely  to  be  extended11.  This  extension  would  increase  the 
Agency's  operations  with  the  next  generation  of  programmes  currently  managed  by  the 
Agency (e.g. Life Long Learning) but also other new programmes (e.g. EU/USA cooperation 
in the field of higher education and vocational training) or activities, following the takeover of 
the  Eurydice  European  Unit.  Therefore,  this  audit  may  provide  a  good  overview  of  the 
situation prior to this expansion, which will both be quantitative (i.e. in terms of both budget 
and  staff)  and  qualitative  (i.e.  more  diversity  in  the  type  of  activities  under  the  Agency's 
responsibility). 

The Agency was set up in January 2005 and its first Agency Annual Activity Report (AAR), 
for the 2005 financial year, was adopted by the Steering Committee in February 2006. As the 
Agency's activities did not really start until January 2006, the AAR contained no reservations 
or Declaration of Assurance. 

6  Source:  EACEA  audit  database:  State of play  at  2006  year  end: Out of  the  183  inherited  audits,  137  remain 
open:  90  have  reached  the  reporting  phase;  36  are  awaiting  the  Draft  report  and  11  (6%  of  the  total)  have 
outstanding fieldwork. 
7 Management of procedure B is decentralised to National Agencies and the Agency's task is only to coordinate 
the  selection  of  beneficiaries  which  is  carried  out  by  outsourced  experts.  Those  experts  are  paid  not  from  the 
Agency's operational budget but from the administrative budget, which is excluded from the scope. 
8 Media II was created before the Commission's requirements on financial circuits were defined and applicable. 
9 Audit Report IAS-2004-EAC-001 dated 21/09/04. 
10 Follow-up audit report IAS-2004-EAC-001 dated 22/12/05. 
11  "Projet  de  Décision  de  la  Commission  modifiant  la  décision  2005/56/CE  instituant  l'Agence  exécutive 
'Éducation, audiovisuel et culture' pour la gestion de l'action communautaire dans las domaines de l'éducation, de 
l'audiovisuel  et  de  la  culture,  en  application  du  règlement  (CE)  n°58/2003  du  Conseil"  CISNet,  consultation 
[EAC]D(2006)/R/11593. 

EN 

28 

   EN 

 
 
 
                                                 
Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

4 

10 

14 

4 

100 

10 

100 

14 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very important 

Important 

Total 

4 

10 

14 

4 

5 

9 

100 

50 

64,29 

0 

5 

5 

0 

50 

35,71 

2.5.  DG ENTR – Management Letter Ex-Post Controls (no report) 

2.6.  DG ENTR - Follow-up report on the financial management of the innovation relay 
centre (IRC) network 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the joint IAS-IAC DG ENTR final audit report 
on  the  Financial  Management  of  the  Innovation  Relay  Centre  (IRC)  Network  dated  6  April 
2006.  

This follow-up audit does not present an assessment of the adequacy of controls as a whole, 
but focuses more on the specific recommendations in the original audit. 

2.7.  DG ENTR - Follow-up Audit Report on the IAS Validation of Self-Assessment of 

Internal Audit Capability (IAC) of DG ENTR 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted  recommendations  that  resulted  from  the  IAS  Validation  of  Self-Assessment  of  the 
Internal Audit Capability of DG ENTR which was carried out from February until June 2006.  

EN 

29 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
2.8.  DG ENV – Monitoring of the Implementation of EU Law  

Objectives and Scope 

Monitoring the application of EU law is one of the Commission's core activities laid down in the Treaty. 
It  is  a  very  broad  and  multi-faceted  issue  which  covers  a  whole  range  of  activities.  The 
objective  of  the  engagement  is  to  provide  an  opinion  on  the  management,  efficiency  and 
effectiveness of the pro-active and ex-post monitoring of EU law for the years 2003 – 2005, in 
particular relating to the transposition of directives and complaints and infringements. 

The scope of the audit includes:  

1) 

2) 

3) 

4) 

5) 

Assessing  the  efficiency  and  effectiveness  of  DG ENV's  processes  for  pro-active 
monitoring  of  the  timely,  correct  and  complete  implementation  of  EU  law  (Treaty 
provisions and directives) - mainly for the years 2003 to 2005 - against the (success) 
criteria/factors  defined  for  the  different  phases  of  proposing,  negotiating  and 
transposing  a  directive  and  the  measures  proposed  in  the  2002  Communication  on 
Better Monitoring. 

Assessing DG ENV's handling of complaints and infringements related to directives, 
regulations and the Treaty, for the period 2003 to 2005, with respect to efficiency and 
effectiveness which includes, inter alia compliance with the Manual of Procedures12.  

Assessing the management of the EU law monitoring function (pro-active as well as 
ex-post) during 2003 – 2005 against relevant Commission Internal Control Standard 
baseline requirements. 

Assessing potential areas for simplification of procedures. 

Assessing  compliance  with  the  provisions  of  Regulation  (EC)  45/2001  on  the 
protection of personal data. 

As of 31 December 2005, there have been no observations/reservations in the AAR 
that relate to the area/process audited. 

Acceptance 
Status 

Yes 

No 

# 

# 

% Total 

# 

% Total 

2 

7 

2 

2 

7 

2 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Total 

11 

11 

100 

Priority 

Critical 

Very important 

Important 

12Manual  of  Procedures —  SEC(2005)254/2 —  Version  of  13/12/2005:  Monitoring  the  application  of 
Community law: Manual of procedures. 

EN 

30 

   EN 

 
 
 
 
 
 
 
                                                 
Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Critical 

Very important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

2 

7 

2 

11 

1 

1 

0 

2 

50 

14,29 

0 

18,18 

1 

6 

2 

9 

50 

85,71 

100 

81,82 

2.9.  DG ENV – Second Follow-up audit of DG ENV's 2004 In-depth audit 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  in-depth  audit  report  dated  19 September 
2004 and from the first follow-up audit report dated 9 February 2006.  

In line with the IAS follow-up policy, this follow-up audit does not result in an assessment of 
the  adequacy  of  controls  as  a  whole,  but  focuses  on  the  specific  recommendations  in  the 
original audit. 

2.10. DG ENV – Grant management under the non-LIFE-programmes 

Objectives and Scope 

The audit of the grant management by DG ENV under the non-LIFE programmes is included 
in the 2007 work programme of the IAS. This follows an audit risk assessment carried out in 
2006 on DG ENV as part of the preparation of the IAS's Strategic Audit Plan for 2007-2009, 
which  was  endorsed  by  the  Audit  Progress  Committee  (APC)  in  February  2007.  A  new 
programme  entitled  LIFE+  will  become  the  EU's  single  financial  instrument  on  the 
environment from 2007. It will group together most of the current support programmes for the 
environment except for Civil Protection and Marine Pollution. 

The audit focused on the assessment of the adequacy and effective functioning of the internal 
control  systems  in  relation  to  DG  ENV's  grant  management  process  under  the  non-LIFE 
programmes during the 2004 - 2006 period, as follows: 

– 

– 

Programmes without a basic act: Development of New Initiatives and General call for 
proposals, 

Programmes with a basic act: Civil Protection, NGOs and Forest Focus. 

EN 

31 

   EN 

 
 
 
 
 
 
 
The audit assessed whether the internal control systems comply with the specific legal basis 
of  the  programmes  selected  and  with  the  Financial  Regulation  and  its  Implementing  Rules, 
and the efficient and effective implementation of the programmes. 

There are no reservations in the AAR that relate to the process audited. However, DG ENV 
has however associated itself with the reservation expressed by DG ENTR under centralised 
direct  management  relating  to  over-declarations  of  cost  claims  due  to  the  problem  of  the 
eligibility of the costs incurred by European Standardisation Organisations, such as CEN and 
CENELEC, with whom the DG has a number of open action grants. 

Of necessity, audits are a "snapshot" of the situation as it exists within the time-frame covered 
by the audit. In some cases, auditees have subsequently taken actions or have plans for future 
actions  which  are  designed  to  improve  the  control  system.  However,  as  these  have  not  yet 
been audited, the efficacy of these changes will be assessed as part of the IAS follow-up audit 
work. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

4 

9 

1 

4 

9 

1 

100 

100 

100 

Total 

14 

14 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

4 

9 

1 

14 

2 

5 

0 

7 

50 

55,56 

0 

50 

2 

4 

1 

7 

50 

44,44 

100 

50 

2.11. DG INFSO – Ex-Post Controls 

Objectives and Scope 

In accordance with its Audit Plan 2006, the IAS has assessed the effectiveness and efficiency 
of  the  ex  post  controls  put  in  place  by  DG  INFSO  to  obtain  assurance  on  the  legality  and 
regularity  of  the  transactions  covered  by  the  Research  Programmes  and  on  sound  financial 
management.  

EN 

32 

   EN 

 
 
 
 
 
 
 
 
 
It should be noted that, from 2002 to 2004, DG INFSO included in its AAR a reservation on 
the "correctness" or "frequency of errors" in "multi-annual cost declarations and payments". 
In 2005, the reservation related only to FP5 cost claims and payments. 

Acceptance 
Status 

Yes 

No 

# 

# 

% Total 

# 

% Total 

1 

7 

3 

1 

7 

3 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Total 

11 

11 

100 

Priority 

Critical 

Very Important 

Important 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Critical 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

1 

7 

3 

11 

0 

1 

0 

1 

0 

14,29 

0 

9,09 

1 

6 

3 

100 

85,71 

100 

10 

90,91 

2.12. JRC – Second Follow-up of In-Depth Audit of JRC of 2004 

Objectives and Scope 

The objective of the follow-up engagement is to assess progress made in implementing the 
accepted  recommendations  that  resulted  from  the  In-depth  Audit  of  DG  JRC,  carried  out 
from April to October 2004. 

A  first  follow-up  audit  was  carried  out  from  October  2005  until  February  2006.  The  Final 
Report  on  the  Interim  Follow-up  Audit  of  JRC,  dated  09/02/2006,  considered  ten 
recommendations as fully implemented and the other eleven as still in progress. 

This second follow-up audit does not result in an assessment of the adequacy of controls as a 
whole  but  focuses  on  the  specific  recommendations  in  the  original  audit,  and  more 
specifically on the eleven recommendations still open after the first follow-up audit. 

EN 

33 

   EN 

 
 
 
 
 
 
 
 
 
 
 
2.13. DG MARKT - Financial Management and Financial Circuits 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted  recommendations  that  resulted  from  DG  MARKT's  Financial  Management  and 
Financial Circuits. The final report was issued on 21 December 2005.  

This follow-up audit does not result in an assessment of the adequacy of controls as a whole, 
but focuses on the specific recommendations in the original audit. 

2.14. DG RTD - Follow-up report on the in-depth audit of DG RTD (2003) and the audit 
on financial circuits & financial management in DG RTD (2005) 

Objectives and Scope 

The objective of the follow-up engagement is to assess progress made in implementing the 
accepted  recommendations  that  resulted  from  the  In-depth  Audit  of  DG  RTD,  carried  out 
from April to November 2003, and the Audit on Financial Circuits / Financial Management 
of DG RTD, carried out from April to October 2005.  

This follow-up audit does not result in an assessment of the adequacy of controls as a whole, 
but focuses on the specific recommendations in the original audit. 

2.15. DG RTD - IT procurement and service delivery in DG RTD 

Objectives and Scope 

This audit of IT procurement is part of a wider audit, the objective of which was to assess the 
adequacy and effective application of the internal control system (ICS), risk management and 
governance  processes  related  to  IT  procurement  and  the  delivery  of  IT  services  to  the 
European Commission. 

The  purpose  of  the  audit  was  to  assess  whether  the  ICS  provides  reasonable  assurance 
regarding: 

•  Compliance with the Commission rules on IT procurement, the Financial Regulation and 
the  Commission  Internal  Control  Standards.  Compliance  with  the  provisions  of 
Regulation (EC) 45/2001 on the protection of personal data was also taken account of; 

•  Effectiveness and efficiency of the procurement and service delivery processes. The IAS 
examined whether the Commission makes the best use of all type of IT human resources 
and  how  the  follow-up  and  management  of  IT  activities  ensures  that  the  Commission 
obtains the right service at the right price. In this respect, the need for simplifying internal 
administrative rules and procedures was also taken account of. 

The audit of the IT procurement and service delivery process in DG RTD is part of the overall 
IAS objective to provide an audit opinion on the IT procurement and service delivery cycle in 
the Commission. Once our audit work is completed in a sample of DGs, an overview report 

EN 

34 

   EN 

 
 
 
will be produced containing the consolidated results and conclusions of these audits, as well 
as crosscutting observations and recommendations. 

As a result of the desk review and the interviews in the Preliminary Survey, the scope of this 
audit engagement in DG RTD focused on the following aspect of the internal control system, 
risk management and governance processes of IT procurement and service delivery: 

•  Management and monitoring of contracts with external contractors. The audit included 
the monitoring of services agreed to on a "fixed-price" or "time-and-means" basis as well 
as the measures taken to ensure continuity of business once the work contracted has been 
completed.  

The IAS decided not to include the tendering phase of the procurement process in this audit, 
as RTD mainly uses the IT framework contracts of DG DIGIT. Aspects closely linked to the 
project  management  of  IT  systems  are  covered  by  the  IAS  audit  on  IT  systems  in  the 
Research family, and therefore these are also excluded from the scope of the present audit.  

There are no observations/reservations in the 2006 AAR that relate to the area audited.  

No scope limitations were identified. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

2.16. DG TAXUD - IT procurement and service delivery in DG TAXUD 

Objectives and Scope 

This  audit  is  part  of  a  wider  audit,  the  objective  of  which  was  to  assess  the  adequacy  and 
effective  application  of  the  internal  control  system  (ICS),  risk  management  and  governance 
processes  related  to  IT  procurement  and  the  delivery  of  IT  services  to  the  European 
Commission. 

The  purpose  of  the  audit  was  to  assess  whether  the  ICS  provides  for  reasonable  assurance 
regarding the following: 

•  Compliance with the Commission rules on IT procurement, the Financial Regulation and 
the  Commission  Internal  Control  Standards.  The  compliance  with  the  provisions  of 
Regulation (EC) 45/2001 on the protection of personal data was also taken account of; 

•  Effectiveness and efficiency of the procurement and service delivery processes. The IAS 
examined whether the Commission makes the best use of all type of IT human resources 
and  how  the  follow-up  and  management  of  IT  activities  ensures  that  the  Commission 

EN 

35 

   EN 

 
 
 
 
 
 
obtains the right service at the right price. In this respect, the need for simplifying internal 
administrative rules and procedures was also taken account of. 

The  audit  of  the  IT  procurement  and  service  delivery  process  in  DG  TAXUD  is  part  of  the 
overall IAS objective to provide an audit opinion on the IT procurement and service delivery 
cycle in the Commission. After a sample of DGs has been audited, an overview report will be 
produced, containing the consolidated results and conclusions on the above-mentioned audits 
and on the crosscutting observations and recommendations. 

As a result of the desk review and the interviews in the Preliminary Survey (which took into 
account the work already done by the IAC, the European Court of Auditors and the IAS), the 
scope  of  this  audit  engagement  in  DG  TAXUD  focused  on  the  following  aspects  of  the 
internal control system, risk management and governance processes of  IT procurement and 
service delivery: 

•  Management and monitoring of contracts with external contractors. The audit included 
the monitoring of services agreed to as "fixed-price" or "time-and-means" as well as the 
measures taken to ensure business continuity at the expiry of contracts.  

There are no observations/reservations in the 2006 AAR that relate to the area audited.  

No scope limitations were identified. 

Acceptance 
Status 

Yes 

No 

Priority 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

2 

1 

3 

2 

1 

3 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2.17. DG TREN - Follow-up report on the audit of financial management and financial 
circuits in DG TREN 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations resulting from the Audit of Financial Management and Financial 
Circuits in DG TREN carried out on 22 July 2005. 

In line with IAS policy, this follow-up audit does not result in an assessment of the adequacy 
of controls as a whole but focuses on the specific recommendations in the original audit. 

EN 

36 

   EN 

 
 
 
 
 
 
 
 
 
2.18. DG  TREN  -  Follow-up  Audit  Report  on  "Audit  de  processus  de  gestion  de 

l'informatique locale" 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  "Audit  de  processus  de  gestion  de 
l'informatique locale – DG TREN" carried out on 10 May 2005.  

This follow-up audit does not result in an assessment of the adequacy of controls as a whole, 
but focuses on the specific recommendations in the original audit. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

3 

3 

3 

3 

100 

100 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

3 

3 

3 

3 

100 

100 

0 

0 

0 

0 

The  recommendations  shown  in  the  tables  are  new  recommendations  issued  in  the 
framework of the follow-up audit. 

2.19. TREN-IEEA - Audit of the Intelligent Energy Executive Agency 

Objectives and Scope 

The objective of this audit was to survey the adequacy and effective application of the internal 
control system (ICS), risk management and governance processes in the IEEA. In particular 
the audit assessed whether the ICS provides for reasonable assurance regarding: 

•  Compliance  with  the  Commission  rules  regarding  the  executive  agencies,  the  Financial 

Regulation and the Commission Internal Control Standards. 

EN 

37 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
•  The reliability of financial and non-financial information. 

•  The effectiveness and efficiency of operations.  

As  a  result  of  the  desk  review  in  the  preliminary  survey,  which  took  into  account  the  work 
already done by the IAC of the Agency, the scope of this audit engagement was limited to the 
following  aspects  regarding  the  internal  control  system,  risk  management  and  governance 
processes within the IEEA:  

A.  The overall organisation of the agency (including governance issues, data protection and 

the performance of the IAC). 

B.  The regularity of financial management and the implementation of financial circuits (with 

the emphasis on grant management and procurement). 

C.  The  accounting  system  (with  the  emphasis  on  the  administrative  budget),  including  the 
accounting  organisation,  accounting  for  fixed  assets,  salaries,  purchases  and  the  closing 
procedures. 

D.  The relations between the agency and other Commission services (focusing on the service 

level agreements) and with external service providers. 

E.  Monitoring by DG TREN as parent DG. 

In November 2006, the European Court of Auditors (ECA) started a performance audit that is 
complementary  to  this  audit.  The  Court's  audit  has  two  main  planks:  (1)  performance  audit 
(i.e. the effectiveness and efficiency) of the Intelligent Energy Programme itself, and (2) the 
management  implementation  structure,  including  the  cost/benefit  of  the  Agency  and  the 
programme;  the  management  information  for  the  programme  with  special  attention  on  the 
indicators. These aspects have been taken into account in establishing the scope of this audit. 
Thus, once the ECA has completed its audit, the main aspects of the Agency's business will 
have been audited. 

Acceptance 
Status 

Yes 

No 

# 

# 

% Total 

# 

% Total 

1 

3 

10 

2 

16 

1 

3 

100 

100 

10 

100 

2 

100 

16 

100 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

Priority 

Critical 

Very Important 

Important 

Desirable 

Total 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Critical 

Very Important 

# 

# 

% Total 

# 

% Total 

1 

3 

0 

0 

0 

0 

1 

3 

100 

100 

EN 

38 

   EN 

 
 
 
 
 
 
 
 
Important 

Desirable 

Total 

10 

2 

16 

1 

0 

1 

10 

0 

6,25 

9 

2 

90 

100 

15 

93,75 

2.20. DG TREN - Follow-up of validation of self-assessment of DG TREN IAC 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted  recommendations  that  resulted  from  the  IAS  Validation  of  Self-Assessment  of  the 
Internal Audit Capability of DG TREN which took place from February to April 2006. 

3. 

STRUCTURAL MEASURES AND COMMON AGRICULTURAL POLICY 

3.1.  AGRI - Local IT systems of DG AGRI feeding into ABAC 

Objectives 

The objective of the present audit was to assess the adequacy of the systems and controls put 
in place by DG AGRI to ensure the integrity of the accounting-related data as processed by 
the local IT systems. 

Accounting-related data can be defined as the data entered into ABAC Workflow through the 
local  systems  of  DG  AGRI  and,  thereafter,  transferred  to  the  central  accounting  system 
(SAP), its General Ledger or any of the other modules that form part of it. 

Scope  

Based on a preliminary risk analysis, the two major local IT systems, which processed € 55.7 
billion of payments in 2006 - were chosen for the audit scope: 

−  AGREX2,  which  provides  data  for  the  detailed  budgetary  follow-up  related  to  the 
implementation  of  the  Common  Agricultural  Policy  in  respect  of  measures  financed  by 
the  Guarantee  section  of  the  European  Agricultural  Guidance  and  Guarantee  Fund 
(EAGGF); 

−  GFO,  which  is  used  to  manage  the  financial  data  of  the  EAGGF  Guidance  section, 
SAPARD and the new Rural Development Financial Instrument for the EU 10. Although 
this system is hosted in DG AGRI, DG EMPL is the system supplier and is responsible for 
development and maintenance (it is a copy of their SEA system). 

This  audit  also  covers  the  management  of  ABAC  Workflow  local  users,  which  is  sub-
delegated by DG BUDG to DG AGRI. 

The IAS adopted a three-step approach: 

EN 

39 

   EN 

 
 
 
 
1.  Assess  general  controls  ensuring  the  integrity  of  the  IT  systems  (e.g.  user  access 
management, change management, completeness and regular analysis of audit trails…); 

2.  Assess  application  controls:  the  monitoring  controls  applied  manually  and  controls 

performed automatically by AGREX2 and GFO; 

3.  Assess the integrity of the data transmitted from AGREX2 and GFO to ABAC Workflow. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

2 

12 

14 

2 

100 

12 

100 

14 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

2 

12 

14 

1 

50 

12 

100 

13 

92,86 

1 

0 

1 

50 

0 

7,14 

3.2.  AGRI - Final Audit Report on DG AGRI – Interventions in Agricultural Markets 

Objectives and Scope 

The  audit  focused  on  Market  Intervention  Measures,  and  in  particular  Export  Refunds  and 
Import Tariff Quota. The objective of the audit was to assess the adequacy and effectiveness 
of the control systems in place to ensure the legality and regularity of operations in the area, 
while having due regard to effectiveness and efficiency. In order to assess the adequacy of the 
systems in place, two sectors were selected for further scrutiny, namely the Cereals sector and 
the Meat sector. 

The audit included the impact of IT-systems on operations, but did not include an assessment 
of reliability, completeness and integrity of the data in these systems, as this is included in the 
IT-audit currently being carried out by the IAC of DG AGRI. 

Wherever  possible,  in  order  to  avoid  waste  of  scarce  audit  resources,  use  was  made  of 
previous  audits  conducted  by  either  the  IAC  of  DG  AGRI  or  by  the  European  Court  of 
Auditors. 

There are no observations/reservations in the AAR that relate to the area/process audited. 

EN 

40 

   EN 

 
 
 
 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

1 

8 

9 

1 

8 

9 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

1 

8 

9 

1 

8 

9 

100 

100 

100 

0 

0 

0 

0 

0 

0 

3.3.  AGRI  -  Follow-up  Audit  Report  on  Structural  Funds  –  DG  AGRI  EAGGF-
GUIDANCE 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted  recommendations  that  resulted  from  the  audit  of  the  Structural  Funds  -  DG  AGRI 
EAGGF-Guidance - in 2005 (date of the Final Report: 5 December 2005). 

This follow-up audit does not produce an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit.  

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

EN 

41 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

3.4.  EMPL – Prevention and detection of fraud in the Structural Funds 

Objectives and Scope 

In  accordance  with  its  Audit  Plan  2007,  the  IAS  has  examined  the  measures  taken  by  DG 
EMPL on the prevention and detection of fraud in the European Social Fund. 

The main objective of the audit is to assess whether the policy and procedures implemented 
by DG EMPL contribute effectively to the fight against fraud in the field of Structural Funds, 
in  accordance  with  the  competencies  of  the  Commission,  as  defined  by  Article  280  of  the 
Treaty,  and  the  definition  of  responsibilities  set  out  in  Commission  Decision  SEC(1995) 
249/1 concerning the fight against fraud, and Regulation (EC) N° 1073/1999 of the European 
Parliament  and  of  the  Council  concerning  investigations  conducted  by  the  European  Anti-
Fraud  Office  (OLAF),  as  well  as  Council  Regulation  (EC)  N°  1260/1999  laying  down 
general provisions on the Structural Funds. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

5 

5 

5 

5 

100 

100 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

5 

5 

5 

5 

100 

100 

0 

0 

0 

0 

EN 

42 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3.5.  EMPL – Implementation of Programmes in the New Member States 

Objectives and Scope 

In  accordance  with  the  IAS  strategic  audit  plan  2007-2009,  this  audit  covered  the 
implementation  by  the  Commission  of  the  ESF  programmes  in  the  New  Member  States 
(namely the EU-10 countries that acceded on 1 May 2004: Czech Republic, Cyprus, Estonia, 
Hungary, Latvia, Lithuania, Malta, Poland, Slovakia and Slovenia). 

The scope did not include the Community initiative, EQUAL, or Innovative Measures under 
Article  6,  as  these  are  subject  to  different  procedures.  The  focus  was  on  ESF  mainstream 
programmes. 

The objectives of this audit were to assess how some risks related to the implementation of 
programmes in the New Member States identified in a management letter by the IAS (2003), 
and  other  risk  assessments  conducted  by,  in  particular,  DG  EMPL,  have  been  mitigated  by 
management, and whether new risks are emerging that the management should be aware of. 

There is a reservation in the AAR 2006 related to the areas/processes audited concerning the 
management  and  control  systems  of  the  ESF  in  Latvia,  Slovenia  and  Slovakia.  The 
reservation  concerns  deficiencies  in  the  management  and  control  systems,  most  notably  the 
segregation of duties (Art. 4 of Reg 438/2001), selection  of projects, first level verifications 
(Art.  4),  audit  trail  (Art.  7),  and  certification  process  (Art.  9  of  Regulation  438/2001).  In 
addition, DG EMPL has assessed that 16 programmes in the EU-10 countries (in total 64% of 
the total number of the EU-10 programmes) "work well, but need improvements" according 
to  the  audit  results.  The  main  problems  with  these  programmes  have  been  related  to  the 
checks under Art. 4, Art. 7 and Art. 9, the lack of a sufficient audit trail and (in the case of 
Poland) the IT system. However, as far as the latter category is concerned, these deficiencies 
have not resulted in a reservation in the AAR 2006, because DG EMPL has determined that 
the  weaknesses  are  under  control  and  has  agreed  action  plans  with  the  Member  States  to 
implement the Commission's recommendations. 

Considering  the  above  mentioned  reservation  and  qualified  opinions,  and  in  order  to  avoid 
unnecessary duplication of effort in line with the single audit approach, the IAS has decided 
to  focus  on  additional  aspects  related  to  the  effective  and  efficient  implementation  of  the 
2004-2006 programmes in the new Member States.  

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

2 

2 

2 

2 

100 

100 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

2 

2 

100 

0 

0 

EN 

43 

   EN 

 
 
 
 
 
 
 
Total 

2 

2 

100 

0 

0 

3.6.  FISH – Follow-up Final Audit Report on Structural Funds - Financial instrument 

for Fisheries Guidance (FIFG) 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from the Structural Funds - Financial instrument for 
Fisheries Guidance (FIFG) audit carried out in 2005 (date of the Final Report: 10 November 
2005). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit.  

3.7.  REGIO – Implementation of programmes in the new Member States 

Objectives and Scope 

In  accordance  with  the  IAS  strategic  audit  plan  2007-2009  this  audit  covered  the 
implementation  by  the  Commission  of  the  ERDF  programmes  in  the  New  Member  States 
(EU-10  countries  with  the  accession  date  of  1/5/2004:  Czech  Republic,  Cyprus,  Estonia, 
Hungary, Latvia, Lithuania, Malta, Poland, Slovakia, Slovenia). 

The  scope  did  not  include  Community  initiatives  (INTERREG)  nor  interventions  by  the 
Cohesion Fund as these are subject to different procedures. The focus was on the mainstream 
programmes. 

The  objectives  of  this  audit  were  to  assess  how  some  risks  related  to  implementation  of 
programmes in the New Member States identified in a management letter by the IAS (2003) 
and  other  risk  assessments  by,  in  particular,  DG  REGIO,  have  been  mitigated  by 
management, and whether new risks are emerging which management should be aware of. 

There  are  no  reservations  in  the  AAR  related  to  the  areas/processes  audited.  However,  the 
AAR  2006  does  mention  that  "the  opinion  was  qualified  in  relation  to  material  deficiencies 
affecting  key  elements  of  the  system"  for  the  following  EU-10  countries:  Czech  Republic, 
Latvia, Lithuania and Slovakia. For Slovenia, the opinion was qualified due a limitation of the 
scope.  Finally,  in  the  case  of  Poland,  the  opinion  was  adverse  for  one  programme  (SOP 
Competitiveness), qualified for two programmes (IROP and SOP Transport) and there was no 
opinion on one programme (Technical Assistance). The above opinions have not resulted in 
reservations  in  REGIO's  2006  AAR,  taking  into  account  the  fact  that  "the  arrangements  in 
place  for  the  performance  of  DG  Regional  Policy's  supervisory  role  under  the  system  of 
shared  management  provide  for  actions  to  be  taken  in  a  timely  way  in  response  to  the 
detection of deficiencies in management and control systems". 

Considering  the  abovementioned  qualified  and/or  adverse  opinions  on  six  of  the  ten  new 
Member States, and in order to avoid unnecessary duplication of effort in line with the single 

EN 

44 

   EN 

 
 
 
audit approach, the IAS has decided to focus on additional aspects related to the effective and 
efficient implementation of the 2004-2006 programmes in the new Members States. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

2 

2 

2 

2 

100 

100 

0 

0 

0 

0 

3.8.  REGIO  –  Follow-up  Audit  Report  on  the  European  Regional  Development  Fund 
(ERDF)  –  Audit  of  the  Implementation  of  Article  38  of  Council  Regulation 
1260/1999 in DG REGIO 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted  recommendations  resulting  from  the  following  audit  carried  out  in  2005  at  DG 
REGIO: "European Regional Development Fund - Audit of the implementation of Article 38 
of Council Regulation 1260/1999". 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

3.9.  REGIO – Prevention and detection of fraud in the Structural Funds 

Objectives and Scope 

In  accordance  with  its  Audit  Plan  2007,  the  IAS  has  examined  the  measures  taken  by  DG 
REGIO to prevent and detect fraud in the European Regional Development Fund. 

The main objective of the audit is to assess whether the policy and procedures implemented 
by DG REGIO effectively contribute to fighting fraud in the field of the Structural Funds, in 
accordance  with  the  competencies  of  the  Commission,  as  defined  by  Article  280  of  the 
Treaty  and  the  definition  of  responsibilities  set  out  by  Commission  Decision  SEC  (1995) 
249/1 concerning the fight against fraud, and Regulation (EC) N° 1073/1999 of the European 
Parliament  and  of  the  Council  concerning  investigations  conducted  by  the  European  Anti-
Fraud  Office  (OLAF)  and  Council  Regulation  (EC)  N°  1260/1999  laying  down  general 
provisions on the Structural Funds. 

Acceptance 
Status 

Yes 

No 

EN 

45 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Total 

4 

1 

5 

4 

1 

5 

100 

100 

100 

0 

0 

0 

0 

0 

0 

4. 

EXTERNAL POLICIES 

4.1.  AIDCO - Eligibility of Costs under the Financial and Administrative Framework 

Agreement with the United Nations by DG AIDCO 

Objectives and Scope 

On  28  July  2006,  the  IAS  issued  its  final  audit  report13  on:  "The  Implementation  of  the 
Financial  and  Administrative  Framework  Agreement  with  the  United  Nations  by  DGs 
AIDCO & ECHO". This report was presented to the Audit Progress Committee (APC) at its 
meeting of 5 October 2006. 

As noted in the minutes  of  that meeting, "the APC  considers that the audit findings did not 
sufficiently  substantiate  the  IAS'  unsatisfactory  opinion.  The  APC  further  notes  the 
clarification  from  the  IAS  that  the  opinion  is  not  contrary  to  the  DGs  declarations  of 
assurance.  With  regard  to  indirect  costs,  the  APC  considers  that  the  audit  process  did  not 
enable  it  to  assess  the  materiality  of  recommendations  N°4  and  N°5.  The  APC  therefore 
invited  the  IAS,  in  its  follow-up  audit,  to  assess  the  materiality  of  the  residual  risks with 
regard to indirect costs in particular, associated with the overall controls on EC-UN funding in 
the  framework  of  the  Financial  and  Administrative  Framework  Agreement  (FAFA)  and  the 
UN financial control system". 

In response to this APC request, the IAS adapted its 2006 audit plan to "supplement the up-
coming  DG  AIDCO  audit  with  work  on  the  control  system  for  verifying  the  eligibility  of 
costs  including  the  testing  of transactions".  This  plan  was  communicated  to  the  APC  on  19 
October 2006.  

Regarding  the  eligibility  of  direct  costs  and  indirect  costs,  DGs  AIDCO  and  ECHO 
commented on the July 2006 IAS report13 stating that:  

"Although  the  report  concludes  that  there  is  a  "lack  of  control  of  indirect  costs",  the  report 
does not address the way costs are actually controlled by DGs AIDCO and ECHO according 
to  the  system  put  in  place  under  Articles  3  and  4  of  the  FAFA.  The  principle  in  the  EC 
financial rules is that the only costs that are inter alia: 

13IAS 2005 - AIDCO/ECHO – 001 dated 28 July 2006. 

EN 

46 

   EN 

 
 
 
 
                                                 
•  Necessary to carry out the action and mentioned in the grant agreement 

• 

In  compliance  with  the  principles  of  sound  financial  management  (including  value  for 
money and cost effectiveness) 

•  Actually incurred in the implementation period 

•  Recorded in the accounts 

• 

Identifiable, backed by originals of supporting documents and verifiable 

will be considered as being eligible for support by the Commission ("direct costs tests").  

In addition to this, the Commission, when negotiating the FAFA, agreed that it would add up 
to  7%  to  cover  any  indirect  costs  that  could  have  been  attributed  to  the  action  but  are 
administratively difficult and costly to identify. The 7% figure was based on past experience 
and  on  the  advice  of  the  Financial  Controller.  This  is  also  reflected  in  Article  181  of  the 
Implementing Rules."  

The approach of the IAS audit work, as presented in the July 2006 report, consisted primarily 
of a systems review with walkthrough testing. The audit work contained in this present IAS 
report  focuses  more  specifically  on  the  eligibility  of  the  direct  costs  and  related  control 
activities,  and  thus  addresses  both  DG  AIDCO's  concern  and  the  APC  request  as  described 
above. In this context, the IAS: 

•  Reviewed  35  contracts  (299,9  Mio  EUR)  out  of  the  total  population  of  286  contracts 
(1540 Mio EUR) as reported by DG AIDCO on 19 October 2005 as being signed by the 
UN bodies under the FAFA. The primary focus was on payments and controls performed 
by AIDCO. This sample represented 12.2% of the total number of contracts and 19.4% of 
the total amount of the population. 

•  Reviewed the reports of the verification missions performed in 2005-2006; and 

•  Analysed the survey conducted by AIDCO in October 2006 on the explicit application of 

Article 4.514 FAFA. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

4 

4 

4 

4 

100 

100 

0 

0 

0 

0 

14 Article 4.5: "Where the rates applied in accordance with United Nations' governing bodies decisions exceed 
7%,  the  United  Nations  may  recover  the  balance  as  direct  eligible  costs,  subject  to  the  provisions  governing 
direct eligible costs referred to in Article 3 being fulfilled". 

EN 

47 

   EN 

 
 
 
 
 
                                                 
Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

4 

4 

2 

2 

50 

50 

2 

2 

50 

50 

4.2.  AIDCO - Ex-Post Control Activities in DG AIDCO 

Objectives and Scope 

This engagement is part of a series of audits that the IAS conducted on the Ex-Post Control 
(EPC) activities in the RELEX Family - i.e. in DG AIDCO, DG ELARG and DG RELEX.  

The main purpose is to assess the effectiveness and efficiency of EPC and their contribution 
to  the  overall  assurance  on  the  legality  and  regularity  of  the  transactions  and  on  sound 
financial  management.  The  period  covered  in  the  present  audit  was  2005  and  2006.  EPC 
activities are a complementary and an additional layer of control activities, and this audit did 
not  attempt  to  analyse  or  call  into  question  the  other  control  layers.  It  should  be  noted  that 
verification missions related to joint management (in particular on the implementation of the 
FAFA agreement with the UN) were included in the scope of prior IAS audit work and are 
therefore  not  included  in  the  scope  of  the  present  audit.  Moreover,  not  all  the  verification 
missions related to FAFA were EPC activities. 

In  conducting  this  audit,  the  IAS  covers  the  control  components  linked  to  the  EPC,  mainly 
(organisational  structure,  staff,  etc.)  and  "Information  & 
"Control  Environment" 
Communication"; and the two main EPC processes in DG AIDCO,  i.e.: 

•  Transactional  Ex-Post  Controls,  which  are  centralised  controls  that  focus  on  the 
effectiveness  of  the  controls  performed  by  DG  AIDCO's  staff  in  the  payment  control 
chains; 

•  Financial Audits, which are financial and financial/system audits managed by DG AIDCO 
and are included in their Annual Audit Plan. They cover projects and are performed on the 
spot in the premises of the Beneficiaries/Contractors. 

There  are  no  observations/reservations  in  the  2006  AAR  of  DG  AIDCO  for  these  two  EPC 
processes. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

4 

4 

100 

0 

0 

EN 

48 

   EN 

 
 
 
 
 
 
 
 
 
Important 

Desirable 

Total 

4 

1 

9 

4 

1 

9 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

4 

4 

1 

9 

4 

4 

1 

9 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

4.3.  AIDCO - Follow-up Audit Report on NGO funding in DG AIDCO 

Objectives and Scope 

The objective of the follow-up engagement is to assess the progress made in implementing the 
accepted recommendations that resulted from the audit of NGOs' funding carried out in DG 
AIDCO in 2005 (final report dated 6/07/2005). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

EN 

49 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Very Important 

Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

4.4.  AIDCO - Financial management main programmes in Directorate D 

Objectives and Scope 

The overall objective of this audit is to provide an opinion on compliance with Commission 
rules and on effectiveness and efficiency of devolved operations regarding: 

•  The  implementation  of  Financial  Circuits  and  specific  related  aspects  of  financial 
management (i.e. management of financial roles and administration of sub-delegations) in 
Asian Delegations; 

•  Monitoring and supervisory activities by HQ (i.e. Directorate D) of the Asian Delegations 

and 

•  Directorate D and Asian Delegations' reports (SDAO report and Delegations' EAMRs). 

This audit was selected on the basis of the IAS Strategic audit plan for 2007-2009 which took 
into  account  a  co-ordinated  approach  between  the  IAS  and  the  IAC  aimed  at  ensuring 
complementary coverage of the audit plans while targeting the highest risks. The scope was 
further  defined  in the  IAS  risk  assessment, conducted in the  preliminary phase of  the audit. 
For details on the areas excluded from the scope of the audit see section 2.1.2. 

The Asian Delegation network belonging to AIDCO D consists of 12 Delegations. AIDCO D 
plans  to  carry  out  four  accompanying  missions  (a  review  of  the  internal  control  systems  of 
AIDCO-related activities in the Delegations) of which two were finalised at the time the IAS 
fieldwork was completed. Applying the principle of representativeness, the IAS selected three 
from  the  remaining  population,  i.e.  seven  Delegations.  These  three  Delegations  represent  a 
coverage of 32% and 34% respectively of open contracts and commitments as at April 2007. 
Taking  the  results  of  the  two  completed  AIDCO  D  accompanying  missions  into 
consideration, the overall coverage amounts to 60% and 45%. 

Although  the  scope  of  the  IAS  audit  did  not  include  all  Delegations,  the  IAS  believes  the 
findings  for  the  three  Delegations  could  be  applicable  to  the  remaining  Delegations.  As 
Delegations  are  not  homogeneous,  there  may  well  be  risks  that  are  specific  to  particular 
Delegations which are not covered in the IAS sample. However, the analysis of the EAMRs 
of  the  12  Delegations  by  the  IAS  did  not  identify  any  additional  issue  not  disclosed  in  the 
present report. 

There are no observations/reservations in the AAR that relate to the area/process audited. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

EN 

50 

   EN 

 
 
 
 
 
 
Very Important 

Important 

Total 

7 

11 

18 

7 

100 

11 

100 

18 

100 

0 

0 

0 

0 

0 

0 

4.5.  ECHO - Follow-up audit of NGO funding in DG ECHO 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  audit  of  NGOs  funding  in  DG  ECHO 
conducted in 2005 (final report dated 5/10/2005). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Total 

1 

1 

0 

0 

0 

0 

1 

1 

100 

100 

4.6.  ECHO - Monitoring and supervision tools in DG ECHO 

Objectives and Scope 

EN 

51 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
In  past  audit  engagements  in  DG  ECHO,  the  IAS  followed  a  "partners'  approach" 
successively  auditing  the  main  types  of  partners/beneficiaries,  i.e.  NGOs  and  the  UN,  who 
absorb approximately 95% of DG ECHO's budget. 

In  addition,  recent  IAC  engagements  have  covered  important  functional  aspects  such  as  the 
management  of  ECHO  offices,  financial  circuits  and  IT  systems.  Finally,  the  ECA  recently 
examined  "supervisory  and  control  systems  of  ECHO"  in  the  context  of  the  DAS  2006  as 
reported in its Annual Report for 2006; this work focused on DG ECHO's system for auditing 
its NGO partners.  

The IAS' prior audit work resulted in a high level of coverage in terms of ECHO operations 
and  budget.  Subsequently,  the  IAS  determined  that  in  terms  of  coverage  and  risk 
considerations resulting from the IAS strategic plan 2007-2009, the remaining major area to 
be audited should be DG ECHO's monitoring tools. However, it should be noted that the IAS 
audit plans are based on annually updated risk assessments and that additional audit work will 
be  considered  if  the  new  risks  emerge.  The  main  purpose  of  this  audit  was  to  assess  the 
effectiveness  and  efficiency  of  the  Monitoring  Tools  and  their  contribution  to  DG  ECHO's 
overall management assurance. 

There  are  no  observations/reservations  in  the  AAR  that  relate  to  the  area/process  audited. 
Nevertheless, the AAR clearly outlines the main features of the internal control structure and 
process, as well as the main risks inherent to humanitarian operations. 

Acceptance 
Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

1 

5 

1 

7 

1 

5 

1 

7 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

1 

5 

1 

7 

1 

3 

1 

5 

100 

60 

100 

71,43 

0 

2 

0 

2 

0 

40 

0 

28,57 

EN 

52 

   EN 

 
 
 
 
 
 
 
 
 
 
4.7.  ECHO, ADMIN – Management letter on security issues in DG ECHO (no report) 

4.8.  ELARG - Follow-up Audit Report on the In-depth Audit of DG ELARG 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted15 recommendations that resulted from the "In-depth audit" of DG ELARG carried 
out in 2003 (final report dated 22/12/2003). The "In-depth audit" focused on financial control 
activities related to pre-accession assistance under the Decentralised Implementation System 
(DIS), Financial Circuits and Management Reporting Systems. 

An  interim  follow-up  audit  conducted  at  the  end  of  2004  (final  report  dated  14/01/2005) 
validated  the  implementation  of  four  recommendations  (out  of  23).  This  second  follow-up 
was carried out because, in 2006, DG ELARG reported that all recommendations were now 
implemented. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

4.9.  RELEX - First Follow-up audit of the Audit on Handling of classified information 
and communication among the Delegations and DG RELEX 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
recommendations  that  resulted  from  the  "Audit  on  handling  of  classified  information  and 
communication among the Delegations and DG RELEX" carried out in 2005.  

In line with IAS follow-up policy, this follow-up audit does not result in an assessment of the 
adequacy of controls as a whole but focuses on the specific recommendations in the original 
audit.  In  July  2006,  the  IAS  performed  a  desk  review  at  the  request  of  the  APC  to  assess 
progress  made  by  DG  RELEX  in  implementing  the  action  plan.  This  2006  desk  review 
confirmed  the  implementation  of  two  of  the  15  recommendations  in  the  Action  Plan.  Thus, 
the scope of the present IAS follow-up engagement focused on the 13 recommendations that 
were "Not Implemented" as of July 2006. Of the 13 recommendations, two recommendations 
(one Critical and one Very Important) had implementation dates that were not yet due. These 
were included in the scope of this follow-up audit, as they represent a high risk and in order to 
see whether the deadlines are likely to be met. 

15The scope of this follow-up audit also includes recommendations which had been formally rejected (13 and 23) 
or partly rejected (8, 11 and 14), but which nevertheless have been followed-up entirely (8 and 11) or partly 
(14), as reflected in the Issue-Track database and for which implementation had been reported. 

EN 

53 

   EN 

 
 
 
 
 
                                                 
4.10. TRADE - Implementation of selected Internal Control Standards in DG TRADE 

Objectives and Scope 

The main purpose of the audit is to assess the effective implementation of the selected Internal 
Control Standards ('ICS') by DG TRADE, i.e. 

•  whether the DG complies with the respective baseline requirements issued by DG BUDG 

and with other relevant rules applicable to DG TRADE (compliance objective); 

•  whether  the  main  measures  taken  to  implement  these  standards  are  effective,  efficient 
and  adequate  in  terms  of  the  specific  mission  of  DG  TRADE  (efficiency  and 
effectiveness objective) and, in doing this,  
to identify good practices and areas for potential simplification. 

• 

Considering the work already done (or currently being done) both by DG TRADE's Internal 
Audit Capability (IAC) and by the IAS, the IAS chose to focus on the implementation of the 
ICS linked to: 

•  Risk Management (4 standards: 11, 19, 20, 24),  
• 
• 

the DG's Management Information Systems ('MIS') and 
selected standards linked to "internal communication and control" (five standards: 12 to 
15 and 17). 

The ICS linked to the following were not part of the scope: 

• 

the programming cycle (ICS 2, and 7 to 10, already included in the scope of a completed 
IAS engagement at Commission level); 

•  Human Resources management (ICS 1 to 6 and 10, partly covered by the IAC audit of 

• 
• 

• 

Directorate B, final report dated 11/12/2006); 
ICS 16 - segregation of duties, which was audited by the IAC in 2004; 
the IAS validation of the self assessment of the IAC of DG TRADE (final report dated 
17/05/2006), which covered ICS 21 and 22; 
ICS 18 "Recording Exceptions", currently covered by the IAC's Audit of DG TRADE's 
Financial Transactions Circuit. Therefore, the IAS does not express an audit opinion on 
the implementation of this particular standard. 

There are no observations or reservations in the Annual Activity Report 2005 of DG TRADE 
that relate to the area/process audited. 

Acceptance 
Status 

Yes 

No 

EN 

54 

   EN 

 
 
 
 
 
 
 
 
 
 
Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

1 

6 

1 

8 

1 

6 

1 

8 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

# 

# 

% Total 

# 

% Total 

Very Important 

Important 

Desirable 

Total 

1 

6 

1 

8 

1 

5 

1 

7 

100 

83,33 

100 

87,5 

0 

1 

0 

1 

0 

16,67 

0 

12,5 

EN 

55 

   EN