Communication from the Commission to the European Parliament, the Council and the Court of Auditors - Towards a common understanding of the concept of tolerable risk of error {SEC(2008) 3054}
Date: 2008-12-16
Institutions: European Commission
Subjects: EU expenditure, European Court of Auditors, audit, budgetary control, cost analysis, financial management, general budget (EU)

EN 

EN 

   EN 

 
COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 16.12.2008 
COM(2008) 866 final 

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN 
PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS 

Towards a common understanding of the concept of tolerable risk of error 

{SEC(2008) 3054} 

EN 

   EN 

 
 
  
COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN 
PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS 

Towards a common understanding of the concept of tolerable risk of error 

1. 

BACKGROUND 

When  presenting  its  Annual  Report  on  the  2007  financial  year,  the  European  Court  of 
Auditors reported that it found "a material level" of errors in budget areas representing 54% of 
the EU budget. More precisely, the Court found error rates above their 2% threshold in "Rural 
development", "Environment", "Cohesion", "Research", Energy", "Transport", "External aid", 
"Development aid", "Enlargement", "Education" and "Citizenship". 

As a result, the budgetary authority and the general public are left with the impression that the 
EU is unable to adequately manage a majority of its flagship policies. The Court's report puts 
"yellow" and "red" flags on some of the likely future spending priorities of the EU budget, in 
the context of the budget review and a global financial and economic crisis. The Commission 
has made great efforts to address the situation, and significant and tangible progress has been 
made over the past four years. 

Increased and improved controls at all levels would obviously help. Legislative simplification 
will  also  address  the  high  proportion  of  error  that  can  be  attributed  to  final  beneficiaries 
overstating  costs,  misunderstanding  or  misapplying  the  often  complex  rules  and  regulations 
that govern EU funds. 

But as the Court also points out, the way EU funds are disbursed to millions of beneficiaries 
across the Union, based on self-declaration of those who receive the funds, is inherently risky. 
And  beyond  the  Union  borders,  Europe  is  active  in  development  co-operation  and 
humanitarian efforts and other global challenges, often in difficult and risky environments, yet 
widely supported by the European public.  

These  political  imperatives  must  be  acted  upon  and  delivered  with  cost-efficient  controls. 
While  there  is  zero  tolerance  for  fraud,  political  decision-makers  understand  that  some 
schemes  are  inherently  risky.  Political  decision-makers  are  used  to  assess  and  assume  such 
risks, accepting that some errors will occur, to be corrected only after detection. 

Currently, the Court uses a 2% threshold, as do many Supreme Audit Institutions, essentially 
for the materiality of the accounting statements. This uniform benchmark, which does not take 
account of the different risk profiles of policies, is also used by the Court to conclude on the 
legality  and  regularity  of  the  underlying  transactions.  It  is  perfectly  conceivable  that  the 
budgetary  authority  would  set  a  different  threshold,  if  jointly  considering  the  political 
imperatives,  the  benefits  of  a  policy  (also  non-financial),  the  inherent  risk,  the  potential  for 
further  simplification  and  the  additional  cost  associated  with  reducing  error  rates  through 
more controls.  

The  concept  of  "tolerable  risk  of  error"  is  the  practical  implementation  of  this  political 
approach to audit, and it is a debate long overdue for the EU budget. 

EN 

2 

   EN 

Indeed, the concept of tolerable risk of error was first introduced at EU level by the European 
Court of Auditors in its “single audit opinion” 2/20041. The Court reasoned that ‘any control 
system is a trade-off between the cost of operating the defined intensity of checks on the one 
hand  and  the  benefit  these  procedures  bring  on  the  other.  In  the  Community  context  the 
benefit involves reducing the risk that funds are wasted and containing the risk of error to a 
tolerable level’.  

The  Court  further  states,  in  line  with  international  auditing  standards,  that  underlying 
transactions can rarely be absolutely free of error, and a degree of tolerance in their accuracy 
is therefore acceptable2. This tolerance is reflected by the 2% materiality level applied by the 
Court for all policy areas for assessing the legality and regularity of underlying transactions3. 
Thus,  an  extrapolated  error  rate  of  more  than  2%  based  on  the  Court’s  sample  leads  to  a 
qualified or adverse opinion. 

In its Opinion, the Court further concluded that ‘it is likely that the level of tolerable error or 
irregularity  would  vary  between  different  budgetary  areas  depending  on  both  the  cost  of 
controls as well as the inherent risk’. To balance the costs and benefits of control, the Court 
has  indicated  that  the  2%  level  is  not  necessarily  the  right  benchmark  for  judging  the 
Commission’s management of risk in some areas of the budget. It therefore called for rates of 
tolerable risk of error to be proposed by the Commission and decided at political level. The 
Commission  included  the  Court’s  suggestions  on  tolerable  risk  in  its  2006  Action  Plan 
towards an Integrated Internal Control Framework (Action 4) and launched a data collection 
exercise on the costs of controls (Action 10)4. 

Following the Court’s single audit opinion, the Council concluded in November 2005 ‘that it 
should  reach  an  understanding  with  the  European  Parliament  regarding  the  risks  to  be 
tolerated in the underlying transactions, having regard to the cost benefits of controls for the 
different policy areas and the value of expenditure concerned’5. In line with this the Slovenian 
Presidency  stated  in  June  2008  that  ‘the  Presidency  believes,  in  line  with  the  2005  Council 
conclusions  [..]  that  a  common  understanding  between  the  European  Parliament  and  the 
Council  should  be  reached  regarding  the  residual  risk  to  be  tolerated  in  the  underlying 
transactions, having regard to the costs and benefits of controls for the different policy areas 
and the value of the expenditure concerned’6. 

The  European  Parliament  has  also  consistently  supported  the  implementation  of  a  tolerable 
risk approach (notably in its 2003 to 2006 discharge decisions), and in April 2008 tolerable 
risk was the subject of a working document7 by the Chairman of Parliament’s Committee on 
Budgetary  Control.  The  document  suggested  that  ‘a  political  recognition  of  the  calculated 

1 

2 

3 

4 

5 
6 

7 

Opinion 2/2004 of the Court of Auditors of the European Communities on the single audit model (and a 
proposal for a Community internal control framework) (OJ C107, 30.4.2004, p. 1). 
The DAS methodology, European Court of Auditors, available on 
http://eca.europa.eu/portal/page/portal/audit/StatementofAssurance, 7.10.2008. 
The threshold of 2% is derived from auditing standards relating to financial audits in the private sector 
and was originally set as a benchmark by the Court itself in the absence of a comparable international 
standard for the audit of underlying transactions or any indication to the contrary at political level. Also 
some supreme audit institutions in the Member States apply a 2% materiality threshold. 
Commission  Action  Plan  towards  an  Integrated  Internal  Control  Framework  -  COM(2006)  9, 
17.1.2006. 
Press release 2688th Council Meeting Economic and Financial Affairs, 8.11.2005, paragraph 17. 
Council  of  the  European  Union,  note  from  the  Presidency  to  the  delegations–  An  improved  sound 
financial management of EU funds 10284/08 FIN 217, 3.6.2008. 
Working document No 2 on the budget review, “Tolerable risk of error”, MEP Herbert Bösch, 8.4.2008. 

EN 

3 

   EN 

                                                 
 
risks  involved  in  EU  actions  be  encouraged’  and  that  ‘precise  and  reliable  information  as 
regards the present situation be provided’. 

The  Court  of  Auditors  recommended  in  its  Annual  Report  on  20078  that  the  legislative 
authorities and the Commission make progress in taking forward the concept of tolerable risk. 
In the light of their stated positions, the Commission considers that there is common ground 
between  the  Institutions  on  the  need  to  move  towards  a  tolerable  risk  approach,  which 
provides transparency on the risks involved in different EU policies and the cost of managing 
these  to  a  given  level.  Any  decision  on  a  tolerable  risk  level  must  be  based  on  a  joint 
consideration  of  the  political  imperatives,  the  benefits  of  a  policy  (also  non-financial),  the 
inherent  risk,  the  potential  for  further  simplification  and  the  additional  cost  associated  with 
reducing error rates through more control. 

This  Communication  defines  tolerable  risk  and  describes  the  approach  used  to  illustrate  the 
concept (section 2); provides illustrative examples in key spending areas ("red lights" in 2006 
and  2007  according  to  the  Court), exploiting  the  results  of  the data  collection  exercise  on  a 
first estimation of the costs of controls (section 3), and proposes a way forward for formally 
setting tolerable risk levels (section 4). 

2. 

DEFINITION AND APPROACH USED FOR THIS COMMUNICATION 

2.1. 

Definitions 

Tolerable  risk  is  the  level  of  undetected  error  accepted  or  tolerated,  once  inherent  risk  has 
been mitigated by cost-effective controls: 

Tolerable risk = Inherent risk – risk mitigated by cost-effective controls  

In this equation, inherent risk is the risk linked to the activity itself. Inherent risk indicators 
for  Commission  activities  include  complexity  of  legislation;  the  management  framework, 
such  as  agencies,  national  administrations  (for  example  under  shared  management)  and 
national implementing bodies; the stability of the policy environment; the number and types 
of beneficiaries and the nature of actions. For example, complex rules and eligibility criteria 
are  sometimes  necessary  to  achieve  targeted  policy  results  whose  benefits  are  considered 
valuable, even if these may themselves render transactions prone to error. In other words well 
designed rules and regulations which are clear to interpret and simple to apply decrease the 
risk of errors. 

Internal  control  systems  are  set  up  to  reduce  or  mitigate  the  inherent  risk  of  error  to  an 
acceptable level. Control provisions in legislation influence the likelihood of preventing and 
detecting  errors  -  for  example  minimum  control  levels  set  for  Agriculture  or  the  Structural 
Funds.  The  choices  made  by  the  legislator  on  control  strategies  and  the  implementation  of 
these by the Commission and the Member States, and the degree of compliance of Member 
States authorities with the regulatory control requirements under shared management have a 
direct impact on the level of risk.  

8 

Annual Report of the Court of Auditors on the implementation of the budget concerning the financial 
year 2007 (OJ C 286, 10.11.2008, p. 1). 

EN 

4 

   EN 

                                                 
The Court defines two types of financial error – those directly affecting the amount to be paid, 
and  those  having  no  direct  impact  on  the  payment  but  which  imply  a  financial  risk  and/or 
could  lead  to  financial  corrections.  It  is  important  to  note  that  none  of  these  errors  is  an 
indicator of fraud.  

Likely error rates can be limited by more and/or better controls but such investment must be 
balanced by the benefits which ensue, measured largely by financial error likely to be detected 
and  corrected.  Building  on  the  above  equation,  the  risk  remaining  after  the  application  of 
controls can be considered acceptable or tolerable provided it can be shown that all measures 
have been taken to limit the inherent risk within the bounds of sound financial management. 
Adopting a “tolerable risk” approach would mean defining the levels to which it is reasonable 
to expect the Commission and its implementation partners, including the Member States, to 
reduce errors while using control resources cost-effectively. This decision is one which should 
be taken at political level. 

This Communication illustrates the "tolerable risk" approach using available data on types of 
error and error rates, current control costs and control populations. The data on errors is taken 
from  the  Court  of  Auditors'  2006  Declaration  of  Assurance  (DAS)  or  from  Member  State 
control results. Data on control costs and the control population is partly based on surveys and 
partly estimated.  

2.2. 

Illustrating tolerable risk of error 

2.2.1.  The approach used 

The  Commission  recognises  that  there  is  scope  to  further  improve  current  levels  of 
compliance and the quality of controls, for example by the Commission and Member States 
providing  further  guidance  and  training  for  management  bodies  at  all  levels  (national, 
regional, sectorial etc) and to beneficiaries, focusing on areas where errors are most prevalent. 
The possible degree of improvement would depend on how effectively the Commission and 
its  implementing  partners,  for  example  in  the  Member  States,  apply  such  measures9  and  on 
the resources they invest in controls.  

Following this improvement of existing controls at no significant cost, any further reduction 
in the error rate could only be achieved through increased intensity of first level management 
controls, including both desk checks and on-the-spot controls. Additional on-the-spot controls 
tend  to  be  costly  in  view  of  the  large  numbers  of  beneficiaries  of  Community  programmes 
that would have to be checked.  

To illustrate the trade off between the cost of controls and their benefits, a simple model can 
be  used.  This  model  aims  to  determine  the  theoretical  level  of  tolerable  risk  (the  "tolerable 
risk point"), where the marginal cost of an additional control equals the marginal benefit of 
that control.  

9 

Example: a first level check on an operation in a Structural Funds programme carried out on the spot by 
the managing authority in a Member State could have been improved if the control tools (eg relevant 
guidance and adequate checklists) had been available and had been used effectively during the check. 

EN 

5 

   EN 

                                                 
The model is based on the following two coordinates: 

–  point (A): the current error rate at the estimated current cost of control10. 

–  point (B): a theoretical point where the coordinates are the estimated current cost of control 
plus the estimated cost of controlling all projects on the spot annually, assuming that this 
would yield a zero error rate.  

On the basis of the two coordinates a trend line was drawn between points A and B.  

This  approach  is  simplified  as  it  assumes  that  each  element  of  the  population  has  the  same 
risk characteristics, which is unlikely to be true in Community programmes. A better model of 
the real-life situation can therefore be achieved by deriving a curve from the line to represent 
more clearly a population with varying characteristics.  

A tangent at 135° is drawn to touch the curve to identify the point at which the marginal cost 
of  controls  equals  the  marginal  benefit.  We  call  this  point  the  tolerable  risk  point.  Each 
control before this point on the curve would be likely to detect and correct errors of a value 
higher than the cost of the additional control. Increasing controls beyond this point would cost 
more than the error likely to be detected and recovered, and a cost-efficient control strategy 
would therefore lead to the fixing of a tolerable rate of error at this point. 

Further details of the approach are set out in the annexed working document.  

10 

For ERDF (see section 3.1) the error rate at point A is the lower error limit in the Court's 2006 DAS 
sample  reduced  by  the  estimated  impact  of  improved  quality  of  ex  ante  controls.  For  agro-
environmental measures (see section 3.2), point A represents the average error rate reported by Member 
State Paying Agencies. 

EN 

6 

   EN 

 
                                                 
2.2.2.  The assumptions made 

The approach makes certain assumptions given that analysis at this stage has been limited to 
readily available and easily quantifiable data. The following assumptions and simplifications 
could potentially cause the tolerable risk point to be overestimated:  

–  controls have a dissuasive effect11, but this is difficult to measure: in this model, cost and 

benefits of controls are set out in purely quantifiable financial terms.  

–  all  (100%)  projects  need  to  be  controlled  annually  on  the  spot  to  ensure  0%  error:  the 
model  excludes  the  effect  of  additional  training  and  guidance  and  the  extrapolation  of 
errors whereby corrections of systematic errors are applied to non-audited projects. 

–  the cost of controls axis assumes that each control costs the same amount and that there are 
no  economies  of  scale  from  simultaneous  checking  of  several  projects  for  the  same 
beneficiary or checking several years’ expenditure in a single control. 

–  the  population  of  projects  is  assumed  to  be  homogeneous  in  size  and  in  terms  of  risk  of 
error while in reality controls would be directed towards higher risk areas thereby reducing 
risk of undetected error at a lower cost.  

–  the multiannual corrective mechanisms in place (e.g. for cohesion policy) impact the error 
rate,  since  many  of  the  projects  audited  in  the  Court's  annual  sample  will  not  have  been 
subject to the full set of controls required by legislation over the lifespan of programmes12. 
The  (annual)  tolerable  risk  point  in  this  illustrative  example  is  therefore  totally  distinct 
from the error level at the closure of each individual (multi-annual) programme and from 
the  declarations  of  assurance  in  the  Annual  Activity  Reports  of  Commission  services 
which are based on an appreciation of systems' capacity to detect and correct errors over a 
number of years. 

The  following  further  assumptions  in  the  model  could  potentially  cause  the  tolerable  risk 
point to be underestimated: 

–  improving existing ex ante controls to adjust the minimum error rate reported by the Court 
in  2006,  for  example  through  better  guidance  and  training  by  the  Commission  to  the 
Member States and by the Member States to their authorities and beneficiaries, is assumed 
to have zero (or no significant) cost. 

–  audit risk is not taken into account: controls carried out are assumed to identify and correct 

all errors in a project.  

In addition, the examples provided were based on a single year and it is assumed that this year 
is  representative.  The  combined  (upward  and  downward)  effect  of  these  assumptions  may 
balance  each  other  out.  Moreover,  the  introduction  of  more  sophisticated  mathematical 

11 

12 

This may include the possibility of being controlled and the preventive effect resulting from continuous 
system  improvements. For example the effectiveness of IACS under CAP can partly  be explained by 
the dissuasive effect of sanctions coupled with a reasonable likelihood of being checked by the national 
authorities. 
Programme implementation may span 9 years and thus final closure declarations on each programme - 
which confirm the legality and regularity of underlying transactions, or any qualifications to it - may be 
submitted up to 10 years after the programme launch. 

EN 

7 

   EN 

                                                 
approaches (using parabolic and logarithmic functions and the concept of opportunity cost), 
was  found  to  produce  comparable  results,  and  the  method  is  therefore  believed  to  be 
reasonably reliable (see Annex). 

Clearly,  some  of  the  above  assumptions  are  quite  far-reaching,  and  with  the  benefit  of  an 
extensive  analysis  of  financial  transactions  and  error  rates13  accompanied  by  an  extensive 
collection and analysis of detailed data, at project level, the model could be further developed 
to take account of: 

–  the nature of projects, to identify the inherent levels of risk for different types of projects; 

–  the  different  risk  levels  of  different  activities  and  beneficiary  types,  to  ensure  that  the 

highest risk ones are controlled first; 

–  the size of projects, so that at a given level of risk the largest ones could be prioritised for 

control, thus using control resources efficiently; and 

–  the duration of projects, so that controls can be timed to permit the maximum amount of 

funds to be controlled.  

However,  since  developing  this  advanced  version  of  the  model  would  imply  a  time-
consuming  and  costly  data  collection  exercise  in  Member  States,  the  option  is  not  further 
pursued at this juncture. 

3. 

ILLUSTRATIVE EXAMPLES OF COST OF CONTROL AND RISK OF ERROR 

Using the simple model set out above, the following section looks at particular parts of two 
policy areas for which the Court concluded in its Annual Reports for both 2006 and 2007 that 
the error rate is high14. The underlying assumptions are simple and provide indicative results. 
In both cases, the basic model is adapted to accommodate the specificities of data available 
for each area. The results are not therefore comparable between the two areas. In both cases, 
the monetary amounts and percentages presented are rounded given their approximate nature. 

3.1. 

European Regional Development Fund (ERDF) 

In  the  2000-2006  programme  period,  ERDF  co-financed  an  estimated  700,000  individual 
projects.  The  Fund  is  implemented  under  shared  management  with  implementation  tasks, 
including  the  control  of  beneficiaries,  delegated  to  Member  States  at  national,  regional  and 
local level. Sectoral legislation sets out control structures and minimum levels of controls for 
managing authorities, paying/certifying authorities and audit bodies, and stipulates that errors 
and  irregularities  have  to  be  prevented,  detected  and  corrected  in  the  first  instance  by  the 
Member  States15.  The  Commission  supervises  these  management  and  control  systems  and 
DGs  draw  conclusions  on  their  effectiveness  in  their  Annual  Activity  Reports.  In  February 
2008 the Commission adopted an Action Plan to strengthen its supervisory role under shared 
management of structural actions16. 

13 
14 
15 
16 

The Court's assistance in error definition and sampling methodology could add value to this exercise. 
Structural actions (ERDF) and Agriculture (rural development-agro-environmental measures). 
Article 39.1 of Council Regulation (EC) No 1260/1999. 
COM(2008) 97 final. 

EN 

8 

   EN 

                                                 
The  Commission's  own  control  strategies  and  practices  are  based  on  a  multi-annual 
approach17.  The  control  and  correction  mechanisms  in  the  Member  States  are  also  multi-
annual,  comprising  first  level  verifications  (desk  reviews  and  on-the-spot  controls)  before 
declaring  expenditure  to  the  Commission;  on-the-spot  ex  post  controls  on  operations  after 
declaration of expenditure to the Commission; systems audits, and a closure declaration by an 
independent winding-up body.  

Due  to  the  annuality  of  the  DAS  enshrined  in  the  Treaty,  the  following  calculation  of  a 
possible  tolerable  risk  point  is  annual,  and  is  based  on  the  Court's  DAS  2006  and  the  error 
definitions and findings reported by the Court.  

In 2006 and 2007, structural actions (including ERDF)18 received a negative assessment from 
the Court of Auditors, which quoted an error rate in reimbursements for all Structural Funds 
of at least 12% and 11% respectively on the basis of its sample.  

Using  the  current  minimum  error  rate  found  by  the  Court  of  Auditors  and  reducing  this  to 
around  9%,  to  take  account  of  the  estimated  benefits  of  improving  the  existing  ex  ante 
controls  at  limited  or  no  significant  additional  cost,  the  Commission  determined  the  annual 
cost of controls, together with the tolerable risk point as set out in section 2.2.1 above. 

Based on data from the Member States, the Commission has made a preliminary estimate that 
the total cost of control for the ERDF in 2006 was some €215 million, around 0.7% of total 
public expenditure on activities co-financed by the ERDF in that year.  

The following graph illustrates the theoretical relationship between error rates and the cost of 
control for ERDF (see annex for further details): 

)

%

(
e
t
a
r

r
o
r
r
E

9%

8%

7%

6%

5%

4%

3%

2%

1%

0%

- 

 215 Mio; 9%

Tolerable 
Risk Point

996 Mio; 4%

1.695 Mio; 2%

250 

500 

750 

1.000 

1.250 

1.500 

1.750 

2.000 

2.250 

2.500 

Total cost of controls (Mio €)

17 

18 

The multi-annual approach is reflected in the declarations of assurance in Commission services’ annual 
activity reports. 
Structural  actions  in  2006  included  Directorates  General  REGIO,  EMPL,  AGRI  (EAGGF  Guidance) 
and MARE (FIFG). 

EN 

9 

   EN 

 
 
 
                                                 
Based  on  estimated  figures  for  the  amount  of  expenditure  /number  of  projects  controlled  in 
2006, the cost of achieving a theoretical zero error rate by controlling all expenditure/projects 
on  the  spot  control  annually  would  be  €2.25  billion  (equival ent  to  8%  of  total  public 
expenditure  on  activities  co-financed  by  the  Fund).  On  this  basis,  a  curve  was  derived  to 
illustrate the possible relationship between error rates and the cost of control19. 

The point on the curve where the amount at which any supplementary Euro spent on control 
yields exactly one Euro more in expected error detected was then calculated to determine the 
tolerable  risk  point  (where  the  marginal  cost  of  control  equals  the  marginal  benefit).  This 
point could lie at an error rate of around 4% and a cost of control of €996 million, equivalent 
to 3.5% of total public expenditure. This would indicate that spending more on control of the 
ERDF  would  be  cost  effective  up  to  the  point  of  achieving  an  error  rate  of  some  4%.  A 
political decision on this would need to take account of  capacity to  increase expenditure on 
controls  and  could  result  in  a  target  level  of  tolerable  risk  between  the  Court's  current 
minimum error rate adjusted to 9% (to take account of the estimated benefit of improved ex 
ante controls at no significant cost) and the 4% theoretical target identified above. 

As the information provided by the Member States was not always complete and consistent,20 
the Commission assessed how the calculation would be affected by a possible underestimate 
of  the  cost  of  controls.  If  these  were  50%  higher  than  estimated  by  the  Member  States,  the 
tolerable  risk  point  would  increase  by  1  percentage  point  (to  5%).  This,  together  with  the 
results  of  a  sensitivity  analysis  using  more  sophisticated  statistical  techniques  based  on  the 
same data, showed limited variation in the tolerable risk point (see Annex). 

It  should  also  be  noted  that  the  data  used  above  relate  to  Structural  Funds  expenditure 
governed  by  2000-2006  legislation.  The  rules  governing  the  2007-2013  programme  period 
include reinforced and clearer control provisions for national authorities, which are intended 
to  help  reduce  error  rates.  This  effect  should  be  accentuated  by  the  preventive  activities  in 
relation to the 2007-2013 period being carried out under the Action Plan.  

Additional  simplifications  have  also  been  proposed  recently  to  the  legislative  authority  and 
these  are  also  likely  to  have  an  impact  on  the  error  rate  and  therefore  on  the  tolerable  risk 
point. However, the majority of Structural Funds expenditure will not be governed by 2007-
2013  legislation  until  2010  onwards.  Until  then,  the  majority  of  expenditure  declared  by 
Member States to the Commission will be covered by the 2000-2006 legal framework21. As 
any further, more detailed, analysis of tolerable risk would need to incorporate the effect of 
the  2007-2013  legislation  and  of  the  Action  Plan,  this  would  need  to  be  based  on  2010 
implementation data and therefore could be available as from 2011 (see section 4.1 below). 

Key observations 

–  the  tolerable  risk  level  is  above  2%  and  could  lie,  according  to  a  simple 
theoretical  cost/benefit  approach,  around  4%.  This  would  imply  imply  a 
fivefold increase in the current control outlay from 0.7% to some 3.5% of total 

19 

20 

21 

It should be noted that both x and y axes were prepared originally with the same scale (€ million) to 
facilitate analysis, and percentage error rates are shown in the graph for ease of reference. 
Some  Member  States  provided  data  on  only  some  types  of  control.  Data  collection  was  often 
decentralised  within  the  Member  States  leading  to  inconsistent  interpretation  of  the  methodology 
defined by the Commission for evaluating costs of control. 
The impact of the Action Plan on the error level in 2000-2006 programmes is only likely to be seen at 
closure. 

EN 

10 

   EN 

                                                 
public expenditure. Accordingly, on the basis of the illustrative figures, €100 
million  extra  spending  on  controls  above  the  current  levels  could  yield  a  net 
estimated benefit of some €285 million of detected errors.  

–  achieving  a  2%  error  rate  would,  on  the  basis  of  the  illustrative  figures, 
require  an  eightfold  increase  in  control  expenditure  to  nearly  6%  of  total 
public expenditure on the Fund. 

–  because  of  the  significant  additional  control  costs  to  be  borne  by  Member 
States  to  reach  the  theoretical  tolerable  risk  point,  a  medium-term  objective 
could be fixed to evolve from the Court's minimum error rate towards a target 
of around 5%.  

3.2. 

European Agricultural Fund for Rural Development (EAFRD) 

EAFRD accounts for some 20% of total agricultural expenditure over the period 2007-2013. 
Its control framework is very close to that for European Agricultural Guarantee Fund (EAGF) 
expenditure.  The  Court  concludes  that  rural  development  accounts  for  a  disproportionately 
large part of the overall 2% to 5% error rate for agriculture, whereas for EAGF expenditure 
the value of the error rate is estimated to be slightly below 2%22.The higher error rate in rural 
development  is  mainly  due  to  the  high  incidence  of  errors  in  agro-environmental  measures. 
Special  report  No  3/2005  of  the  Court  of  Auditors  on  the  control  of  environmental 
expenditure in agriculture concludes that this expenditure is not only risky by its  nature  but 
that it is not possible to obtain assurance in this area at a reasonable cost. 

The following illustrative exercise therefore looks specifically at these measures. In doing so, 
the Commission also responds to the discharge resolution of 22 April 200823.  

It is not possible to estimate an error rate for agro-environmental measures on the basis of the 
Court's  DAS  exercise  but  the  Commission  requested  Member  States  to  provide  statistics  on 
the  results  of  on-the-spot  controls  in  financial  year  2007  for  several  rural  development 
measures,  including  agro-environmental  measures.  Member  States  provided  the  requested 
data which however was not verified and validated by the certification bodies – and in some 
cases  was  also  incomplete.  The  data  nevertheless  confirmed  that  error  rates  for  agro-
environmental  measures  were  higher  than  for  other  measures  in  rural  development  and 
indicated an error rate of around 4% for agro-environmental measures in 2007. 

The Commission also requested Member States to provide information on their control costs 
for agro-environmental measures. On the basis of data received, these control costs presented 
for agro-environmental measures are roughly estimated at € 360 million, equivalent to 13% of 
total  public  expenditure  on  the  measures  in  2005.  It  is  worth  noting  that  this  is  three  times 
more  than  for  agricultural  measures  in  general  (around  4%  of  total  public  expenditure). 

22 

23 

The Commission estimates that the Court's findings in 2007 indicate an error rate in rural development 
above 5%. The higher incidence of errors for EAFRD is also highlighted by some Member States. 
“[…] invites the Commission to thoroughly investigate and assess the possible costs and benefits in the 
area  of  agro-environmental  measures,  as  well  as  the  connection  to  other  areas  of  spending,  and  to 
present  this  analysis  to  the  Council,  Parliament  and  the  ECA  as  a  minimum  basis  for  discussing  the 
need for reform”. The attached Commission Staff Working document provides a first rough estimation 
of  their  costs  of  control  of  agro-environmental  measures  together  with  an  overview  of  their  widely-
recognised benefits. 

EN 

11 

   EN 

 
                                                 
Controls on agro-environmental measures also contribute to achieving the policy objective of 
protecting  and  improving  the  environment.  These  environmental  benefits  have  not  been 
quantified in this exercise. 

)

%

(
e
t
a
r

r
o
r
r
E

30,0%

25,0%

20,0%

15,0%

10,0%

5,0%

0,0%

Tolerable Risk Point: 
80 Mio; 8% 

current level of control:
362 Mio; 4%

0

200

400

600

800

1.000

1.200

1.400

Costs of Controls (Mio. €)

The cost of controlling all beneficiaries annually was estimated at some €1.4 billion. A curve 
was derived from these data to illustrate the possible relationship between error rates and the 
cost of control24. 

Key observations 

–  An  increase  in  control  costs  above  the  present  level  (13%)  would  not  be  cost-
effective, because a marginal increase of the number of on-the-spot controls by 
1% of the beneficiaries would yield savings of irregular expenditure amounting 
to only around 10% of the costs of these additional controls. 

–  Reducing the level of error from the current 4% to the Court’s materiality level 
of 2%25, would increase the cost of control from around 13% to almost 30% of 
total public expenditure on the measures, and would not be cost-effective. 

–  Agro-environmental  measures  contribute  significantly  to  the  overall  error  rate 

for rural development. 

–  As it would not be cost-effective to increase controls, the tolerable risk level for 

rural development measures is clearly above 2% and may lie above 5%. 

24 

It should be noted that both x and y axes were prepared originally with the same scale (€ million) to 
facilitate analysis, and percentage error rates are shown in the graph for ease of reference. 

EN 

12 

   EN 

 
 
 
 
 
                                                 
4. 

THE WAY FORWARD 

4.1. 

Preliminary conclusions 

It is important to stress that agreeing on a tolerable risk of error would not imply accepting 
inadequate management and control systems at the Commission or in the Member States. For 
all  policy  areas,  the  Commission  and  its  implementation  partners  would  need  to  remain 
vigilant and achieve the best possible control within given resources. Where weaknesses are 
found, these need to be addressed and the causes analysed to effectively prevent, detect and 
correct these. 

The  Commission  also  recognises  that,  in  some  sectors,  control  systems  for  Community 
programmes,  including  those  operated  by  the  Member  States,  could  prevent,  detect  and 
correct errors more effectively within the current cost. It is taking action to achieve this26. 

Investment in controls beyond the current levels would detect and  correct  more errors.  Any 
increase  in  controls  would  require  additional  resources  to  be  made  available  by  the 
Commission and/or by the Member States and decisions on the level of increase would need 
to be based on the expected benefits in terms of reduced error rates.  

The Court of Auditors' assessments show that there is a real difference in error rates between 
policy  areas.  The  above  analysis  confirms  the  view  that  the  2%  materiality  level  for  the 
annual  Statement  of  Assurance  (DAS)  is  not  an  appropriate  measure  of  a  cost  effective 
control  strategy  for  some  policies.  As  a  result  the  tolerable  risk  of  error  would  need  to  be 
analysed and decided separately per policy area at Community level. 

This  tolerable  risk  level  set  by  the  political  authorities  would  lie  between  the  current  error 
rate,  as  adjusted  to  take  account  of  possible  improvements  in  existing  controls,  and  the 
theoretical  tolerable  risk  point.  The  simple  model  set  out  in  this  Communication,  based  on 
available data and estimates, gives a first indication of these levels:  

–  For Cohesion policy, the Budgetary Authority could consider that for the purposes of the 
annual  DAS  exercise,  as  a  first  indication,  the  tolerable  risk  level  may  lie  on  an  annual 
basis around 5%; and 

–  For  rural  development,  on  the  basis  of  available  data,  the  Budgetary  Authority  could 
consider  that  any  further  controls  to  reduce  errors  would  not  be  cost  effective.  The 
Commission estimates in a first analysis that the tolerable risk level for this area is around 
5%. 

While this Communication has concentrated on two areas where the Court of Auditors gave a 
negative  assessment  in  2007,  the  approach  could  also  be  applied  to  other  policy  areas 
including  internal  policies,  in  particular  research  where  intensified  auditing  has  provided 
accurate data on errors and where costs of control are readily measurable, and external actions 
which, while enjoying strong political and public support, operate in often risky and difficult 
environments.  Elements  of  simplification  in  both  areas  would  be  taken  into  account  where 

25 

26 

This is the result of a calculation based on the hypothesis that the error rate decreases in a linear manner 
when the rate of controls increases and excluding any extra dissuasive effect of more controls.  
For  example,  the  'Commission  Action  plan  towards  an  integrated  internal  control  framework'  - 
COM(2006)  9  -  and  'An  action  plan  to  strengthen  the  Commission's  supervisory  role  under  shared 
management of structural actions' - COM(2008) 97. 

EN 

13 

   EN 

                                                                                                                                                         
these have an effect on risk of error and costs of control. The tolerable  risk analysis  is  also 
relevant  for  areas  already  covered  by  a  positive  assessment  by  the  Court  of  Auditors.  For 
Administration  expenditure,  for  example,  the  Commission  will  examine  whether  the  low 
inherent  risk  and  the  effective  controls  already  put  in  place  justify  a  tolerable  risk  of  error 
below the current 2% materiality threshold. 

For  cohesion  policy  the  model  could  be  made  more  robust  to  allow  for  differences  in  risk 
between members of the population. This would require a more extensive and costly analysis 
which could be completed at the earliest at the end of 2010, while still being based on 2000-
2006  legislation.  In  the  Commission's  view,  this  option  is  neither  necessary,  nor  cost-
effective.  On  the  other  hand,  revised  data  for  the  area  of  cohesion  policy,  based  on  actual 
implementation  of  the  new  legal  framework  for  2007-2013,  including  newly  proposed 
simplifications, could prove useful. This would need to be based on 2010 data, by which time 
the  new  programmes  will  be  well  under  way,  and  the  results  (which  would  be  available  in 
2011) could be used to review and refine the tolerable risk point in this area.  

4.2. 

Possible steps towards an agreement on implementing a tolerable risk approach 

The implementation of a tolerable risk approach would in the Commission’s view be a sound 
investment and would provide a firm basis for the Discharge Authority to judge the quality of 
the Commission’s management of risk. Clearly, as the auditee, the Commission cannot itself 
fix the levels of risk to be tolerated. 

The major steps for moving to a tolerable risk approach could be as follows: 

–  re-launch the Inter-institutional debate with Council, Parliament and the Court of Auditors 
on the basis of the present communication and position taken by the Budgetary Authority 
on the levels of risk to be tolerated in Cohesion Policy and Rural Development based on 
the analysis above; 

–  should the conclusions of this debate allow, the Commission will present further analyses 
of  tolerable  risk,  in  particular  for  research,  energy  and  transport  and  for  external  aid, 
development and enlargement, before mid-2010. 

EN 

14 

   EN