Report on the annual accounts of the European Network and Information Security Agency for the financial year 2007 together with the Agency's replies
Date: 2008-09-18
Institutions: European Court of Auditors
Subjects: European Court of Auditors, European Union Agency for Cybersecurity, administration of the Institutions, financial control, implementation of the budget, powers of the institutions (EU), report

5.12.2008

EN

Official Journal of the European Union

C 311/13

REPORT

on the annual accounts of the European Network and Information
Security Agency for the financial year 2007 together with the Agency’s
replies

(2008/C 311/03)

CONTENTS

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

STATEMENT OF ASSURANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

OBSERVATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1-2

3-6

7-11

Tables 1 to 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The Agency’s replies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14

14

14

16

19

Paragraph

Page

C 311/14

EN

Official Journal of the European Union

5.12.2008

INTRODUCTION

The Court has thus obtained a reasonable basis for the

6.
Statement set out below:

The European Network and Information Security Agency
1.
(hereinafter
the Agency) was created by Regulation (EC)
No 460/2004 of the European Parliament and of the Council of
10 March 2004 (1). The Agency’s main task is to enhance the
Community’s capability to prevent and respond to network and
information security problems by building on national and Com-
munity efforts.

2.
Table 1 summarises the Agency’s competences and activi-
ties. Key data taken from the financial statements drawn up by the
Agency for the financial year 2007 are presented in Tables 2, 3
and 4 for information purposes.

Reliability of the accounts

The Agency’s accounts for the financial year ended 31 Decem-
ber 2007 are, in all material respects, reliable.

Legality and regularity of the underlying transactions

The transactions underlying the Agency’s annual accounts,
taken as a whole, are legal and regular.

The observations which follow do not call the Court’s State-
ment into question.

STATEMENT OF ASSURANCE

OBSERVATIONS

3.
This Statement is addressed to the European Parliament
and the Council in accordance with Article 185(2) of Council
Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 (2); it
was drawn up following an examination of the Agency’s accounts,
as required by Article 248 of the Treaty establishing the European
Community.

7.
The Agency’s 2007 budget amounted to 8,3 million euro
compared to 7,0 million euro the previous year. The implemen-
tation of operational activities (Title III) was concentrated in the
last quarter of 2007. About 40 % of the commitments and more
than 50 % of the payments under Title III were executed in
November and December 2007 due to the late release of funds.
For small Agencies with limited resources, releasing funds at the
end of the year jeopardises the implementation of operational
activities.

The Agency’s accounts for the financial year ended
4.
31 December 2007 (3) were drawn up by its Executive Director,
pursuant to Article 17 of Regulation (EC) No 460/2004, and sent
to the Court, which is required to give a Statement of Assurance
on their reliability and on the legality and regularity of the under-
lying transactions.

The appropriations carried over did not always correspond
8.
to legal commitments in four cases (5). Moreover, more accurate
financial information needs to be prepared by the operational
departments (6) to minimise the risks of errors in the accounts.

5.
The Court conducted its audit in accordance with the IFAC
and ISSAI (4) International Auditing Standards and Codes of Eth-
ics, insofar as these are applicable in the European Community
context. The audit was planned and performed to obtain reason-
able assurance that the accounts are reliable and that the under-
lying transactions are legal and regular.

(1) OJ L 77, 13.3.2004, p. 1.
(2) OJ L 248, 16.9.2002, p. 1.
(3) These accounts were drawn up on 25 June 2008 and received by the

Court on 4 July 2008.

(4) International Federation of Accountants (IFAC) and International Stan-

9.
The inventory of fixed assets was managed using a spread-
sheet, which did not guarantee the integrity of the data, and no
exhaustive physical inventory was made.

Recurrent weaknesses were noted in the procurement
10.
procedures: the pre-selections of bids were not justified, the evalu-
ation documents were not signed by the evaluation committee,
and the files were not structured and were incomplete. In one case
relevant information could not be found. This situation was at
odds with the principle of transparency.

(5) Total value of 121 500 euro.
(6) Errors of about 105 000 euro of accrued liabilities were identified and

dards of Supreme Audit Institutions (ISSAI).

corrected during the audit.

5.12.2008

EN

Official Journal of the European Union

C 311/15

According to article 27 of the founding regulation, the
11.
Agency’s mandate expires on 13 March 2009. Given the finan-

cial and organisational impact on the Agency’s activities, a deci-
sion should be taken.

This report was adopted by the Court of Auditors in Luxembourg at
18 September 2008.

its meeting of

For the Court of Auditors
Vítor Manuel da SILVA CALDEIRA
President

Table 1

European Network and Information Security Agency (Heraklion)

Areas of Community competence

Competences of the Agency
(Regulation (EC) No 460/2004 of the European Parliament and of the Council)

Governance

Resources made available to
the Agency
(Data for 2006)

Products and services supplied

the
The representatives of
MemberState
governments
have, by common agreement,
adopted a statement on the
creation of a European Net-
work and Information Secu-
rity Agency. The Agency
should operate as a point of
reference and establish confi-
dence by virtue of its indepen-
dence, the quality of the advice
it delivers and the information
it disseminates, the transpar-
ency of
its procedures and
methods of operating, and its
diligence in performing the
tasks assigned to it.

(Council Decision of 19 Febru-
ary 2004, taken on the basis of
Article 251 of the Treaty).

Objectives

— The Agency enhances the
capability of the Commu-
nity,
the Member States
and the business commu-
nity to prevent, address
and respond to network
and information security
problems.

— The Agency provides assis-
tance and delivers advice to
the Commission and the
Member States on issues
related to network and
information security falling
within its competencies.

— The Agency develops a
high level of expertise and
uses this expertise to stimu-
late
cooperation
between actors from the
public and private sectors.

broad

— The Agency assists

the
Commission, when called
upon, in developing Com-
munity legislation in the
field of network and infor-
mation security.

Tasks

The Agency:

(a)

collects information on current
and emerging risks that could
have an impact on electronic
communications networks;

(b) provides the European Parlia-
ment,
the Commission and
European bodies or competent
national bodies with advice and
assistance;

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

enhances cooperation between
actors in its field;

facilitates cooperation on com-
mon methodologies to address
network and information secu-
rity issues;

contributes to awareness raising
on network and information
security issues for all users;

assists the Commission and the
Member States in relations with
industry;

tracks standards;

advises
the Commission on
research in the area of network
and information;

promotes risk assessment activi-
ties, on prevention solutions;

contributes to cooperation with
third countries.

Source:

Information supplied by the Agency.

1. Management Board

Final budget:

1.
It is composed of one repre-
sentative of each MemberState,
three representatives appointed
by the Commission, and three
representatives, without the right
to vote, each of whom represents
one of the following groups:

(a)

(b)

(c)

information and communi-
cation technologies indus-
try;

consumer groups;

academic experts.

2. Board members may be
replaced by alternates.

2. Executive Director

1. The Agency is managed by
its Executive Director, who is
independent in the performance
of his duties.

2. The Executive Director
is
appointed for a term of office of
up to five years.

3. External audit

Court of Auditors.

4.

Internal audit

Commission’s

The
Auditor.

Internal

5. Discharge authority

Parliament acting on recommen-
dation from the Council.

8,3 (6,9) million euro (100 %
Community subsidy)

figures on 31 Decem-

Staff
ber 2007:

— 44 posts according to the
establishment plan. Posts
occupied 42;

— Other posts: 11 Contract
Agents, 2 SNEs, 2 Trainees.

The Agency produced 22 reports on various NIS topics
including:

— Security awareness initiatives and measurement of effec-

tiveness Security policies;

— Certification and accreditation schemes;

— Security measures implemented by service providers;

— Internal market of eCommunications;

— Inventory of risk management methods;

— Business continuity methods;

Total staff: 56

operational: 31 (35)

— Governance;

— Emerging risks;

administrative and policy: 25 (26)

— Technological developments;

— Applications and technologies;

— Good practice;

— Contacts directory;

— Authentication levels;

— CSIRT cooperation.

The Agency organised 8 Workshops on various NIS topics
including Awareness Raising, technological developments,
authentication, CSIRT.

The Agency updated its web site.

The Agency issued a newsletter on a quarterly basis.

The Agency delivered over 40 presentations in various NIS
events and conferences.

The Agency dealt with seven requests for advice and assis-
tance: five by MemberStates (two from Austria, two from
Greece and one from Bulgaria) and two requests from the
Commission.

The Agency developed contacts with specialised organs of
OECD and International Telecommunication Union in order
to identify possible synergies and to report on their activities
to the Agency’s stakeholders.

C
3
1
1
/
1
6

E
N

O

f
f
i
c
i
a
l

J
o
u
r
n
a
l

o
f

t
h
e

E
u
r
o
p
e
a
n
U
n
o
n

i

.

.

5
1
2
2
0
0
8

.

.

5
1
2
2
0
0
8

European Network and Information Security Agency (Heraklion) — Implementation of the budget for the financial year 2007

Table 2

Source of revenue

Revenue

Revenue entered in
the final budget for
the financial year

Revenue collected

Allocation of expenditure

Expenditure

Final budget appropriations

(1 000 euro)

Appropriations carried over from previous financial
year(s)

entered

commit-
ted

paid

carried
over

cancelled

entered

commit-
ted

paid

cancelled

Community subsidies

8 000

Other revenue

417

7 900

417 (1)

Total

8 417

8 317

Title I
Staff

Title II
Administration

Title III
Operating activities

4 190

4 082

3 953

129

108

1 135

1 103

883

220

32

3 092

8 417

3 043

8 228

1 351

6 187

1 692

2 041

49

189

Total

253

126

538

917

253

243

126

121

538

917

496

860

11

5

42

58

(1) The amount includes the re-use of 234 528 euro.
Source: Data supplied by the Agency — this table summarises the data provided by the Agency in its annual accounts. Revenue collected and payments are estimated on a cash basis.

E
N

O

f
f
i
c
i
a
l

J
o
u
r
n
a
l

o
f

t
h
e

E
u
r
o
p
e
a
n
U
n
o
n

i

C
3
1
1
/
1
7

C 311/18

EN

Official Journal of the European Union

5.12.2008

European Network and Information Security Agency (Heraklion) — Economic outturn account for the
financial years 2007 and 2006

Table 3

Operating revenue

Community subsidies

Other revenues

Operating expenditure

Staff expenditure

Fixed asset related expenditure

Other administrative expenditure

Operational expenditure

Total (a)

Total (b)

Surplus /(deficit) from operating activities (c = a – b)

Financial operations revenue (e)

Financial operations expenditure (f)

Surplus /(deficit) from non-operating activities (g = e – f)

Economic result for the year (h = c + g)

(1 000 euro)

2007

2006

7 988

203

8 191

3 573

126

1 477

2 199

7 375

816

—

3

– 3

813

5 476

12

5 488

3 100

103

1 515

1 236

5 954

– 466

—

2

– 2

– 468

Source: Data supplied by the Agency — this table summarises the data provided by the Agency in its annual accounts: these accounts are

drawn up on an accrual basis.

European Network and Information Security Agency (Heraklion) — Balance sheet at 31 December 2007
and 2006

Table 4

(1 000 euro)

2007

2006

Non-current assets

Intangible fixed assets

Tangible fixed assets

Current assets

Short-term receivables

Cash and cash equivalents

Current liabilities

Provisions for risks and charges

Accounts payable

Reserve

Accumulated surplus/deficit

Economic result for the year

36

337

101

2 379

2 853

155

1 255

1 410

1 443

630

813

Total assets

Total liabilities

Net assets

Net capital

1 443

33

312

56

2 519

2 920

66

2 224

2 290

630

1 098

– 468

630

Source: Data supplied by the Agency — this table summarises the data provided by the Agency in its annual accounts: these accounts are

drawn up on an accrual basis.

5.12.2008

EN

Official Journal of the European Union

C 311/19

THE AGENCY’S REPLIES

Indeed external factors such as the late release of funds partially affected the implementation of opera-
7.
tional activities. In the meantime the Agency has closely planned and follows up the execution of 2008 budget.

8.
In certain cases with a significant number of variables, the appropriations carried over were calculated
with some degree of approximation. The Agency is aware of this risk and strives to ensure to the highest degree
possible the accuracy of appropriations carried over.

9.
Fixed assets are managed in the accounting software of the Agency. The administrative inventory is
managed in spreadsheets due to the limited number of items. The Agency intends to use ABAC Assets in 2009.

The Agency recognises some shortcomings in three procurement files. The Agency takes measures to

10.
eliminate these administrative shortcomings including the hiring of an experienced Procurement Officer.

The European Commission has proposed an extension of the mandate of the Agency and legislators

11.
have agreed on a three-year extension.