Commission staff working document accompanying the report from the Commission to the European Parliament and the Council - Annual Report to the Discharge Authority on Internal Audits Carried out in 2008 (Article 86 (4) of the Financial Regulation) {COM(2009) 419}
Date: 2009-08-05
Institutions: European Commission
Subjects: European Commission, activity report, audit, budgetary discharge, financial regulation, management accounting

EN 

COMMISSION OF THE EUROPEAN COMMUNITIES 

Brussels, 5.8.2009 
SEC(2009) 1102 final 

COMMISSION STAFF WORKING DOCUMENT 

Accompanying the  

REPORT FROM THE COMMISSION 
TO THE EUROPEAN PARLIAMENT AND THE COUNCIL 

Annual Report  
to the Discharge Authority  
on Internal Audits Carried out in 2008 

(Article 86 (4) of the Financial Regulation) 

{COM(2009) 419} 

 
 
 
 
 
 
 
 
 
TABLE OF CONTENTS 

Introduction........................................................................................................................................................... 4 

1. ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS......................................................................... 6 

1.1 ADMIN, INFSO, OIB, RTD, SG, TRADE: Ethics in the Commission.......................................................... 6 
1.2 BUDG: Management letter on Ethics in the Commission............................................................................ 6 
1.3 AIDCO, BUDG, EAC, EACEA, INFSO, LS: Recoveries.............................................................................. 6 
1.4 Management Letter on IT Procurement and Service Delivery in the Commission ...................................... 7 
1.5 Follow-up on IAS Validation of self-assessment of Internal Audit Capabilities (IACs)............................... 8 
1.6 ADMIN: Monitoring of Security as managed by ADMIN-DS ...................................................................... 9 
1.7 DGT: Follow-up demand management ........................................................................................................ 9 
1.8 DIGIT: Corporate data network infrastructures and services ................................................................... 10 
1.9 ECFIN: Implementation of selected Internal Control Standards ............................................................... 11 
1.10 ECFIN: Follow-up on ECFIN local IT management ............................................................................... 12 
1.11 EPSO: Facilitated Self-Assessment of a Proposed Organigramme ......................................................... 12 
1.12 ESTAT: Follow-up local IT management................................................................................................. 13 
1.13 Legal Service: Local IT ............................................................................................................................ 13 
1.14 OIB: Follow-up on evaluation of targeted Internal Control Standards ................................................... 14 
1.15 OIB: Follow-up on management of procurement contracts..................................................................... 14 
1.16 OIL: Evaluation of targeted Internal Control Standards ......................................................................... 14 
1.17 OLAF: Anti-fraud information system (AFIS).......................................................................................... 15 
1.18 OPOCE: Procurement ............................................................................................................................. 16 
1.19 PMO: Follow-up on regularity of financial management and implementation of financial circuits ....... 17 
1.20 PMO: Missions......................................................................................................................................... 17 
1.21 SCIC: Follow-up financial management and procurement...................................................................... 18 

2. INTERNAL POLICIES.................................................................................................................................. 19 

2.1 COMP: Follow-up on the effectiveness and efficiency of the strategic planning and programming cycle and 
activity-based management .............................................................................................................................. 19 
2.2 COMP: Recovery of Fines ......................................................................................................................... 19 
2.3 EAC Second follow-up on the in-depth audit ............................................................................................. 20 
2.4 EACEA: Grant management awarding and contracting............................................................................ 20 
2.5 EACI: Follow-up on the Intelligent Energy Executive Agency .................................................................. 21 
2.6 ENV: CITL Management at DG ENV ........................................................................................................ 21 
2.7 INFSO: Management of research information systems.............................................................................. 22 
2.8 INFSO: Follow-up on ex-post Controls (2006).......................................................................................... 23 
2.9 JLS: Follow-up on IT management ............................................................................................................ 23 
2.10 JLS: Grants under shared management of the European Refugee Fund ................................................. 23 
2.11 JLS: IT procurement................................................................................................................................. 24 
2.12 MARKT: Follow-up on local IT management process.............................................................................. 25 

 
2.13 PHEA: Public Health Executive Agency .................................................................................................. 25 
2.14 RTD: Management of research information systems ............................................................................... 26 
2.15 RTD, INFSO, TREN, ENTR: DIGIT: Management letter on the inter-FP 7 IT governance.................... 27 
2.16 RTD: Follow-up ex-post controls (2006) and financial circuits and financial management (2007) ....... 27 
2.17 SANCO: Follow-up on effectiveness and efficiency of the SPP/ABM Cycle ............................................ 28 
2.18 SANCO: Follow-up large IT systems ....................................................................................................... 28 
2.19 SANCO: Grant management in the food safety, animal health and welfare and plant health activity .... 28 
2.20 TREN-TEN-T: Audit of the TREN-TEN-T executive agency .................................................................... 29 
2.21 TREN: Follow-up on the effectiveness and efficiency of the implementation of SPP/ABM cycle ............ 30 

3. STRUCTURAL MEASURES AND COMMON AGRICULTURAL POLICY ........................................ 31 

3.1 EMPL: Review on financial corrections and recoveries in the Structural Funds Area ............................. 31 
3.2 EMPL: Internal control system for managing the new Structural Funds programming period - Phase I . 31 
3.3 REGIO: Review on financial corrections and recoveries in the Structural Funds Area............................ 32 
3.4 REGIO: Internal control system for managing the new Structural Funds programming period - Phase I 33 
3.5 REGIO: Follow-up financial corrections in Cohesion fund (2006) ........................................................... 34 

4. EXTERNAL POLICIES ................................................................................................................................ 34 

4.1 AIDCO/ECHO: Follow-up on FAFA implementation ............................................................................... 34 
4.2 AIDCO: Second Follow-up on the in-depth audit ...................................................................................... 34 
4.3 AIDCO: Financial Management procedures of Directorate C related to its devolved delegations........... 35 
4.4 AIDCO: Financial Management of Regional Projects .............................................................................. 36 
4.5 AIDCO: Financial Management of main Programmes in Directorate В................................................... 37 
4.6 ELARG: Follow-up on ex-post control activities ....................................................................................... 38 
4.7 ELARG: Readiness assessment/phasing-in of delegations in Balkans ....................................................... 38 
4.8 RELEX: Follow-up on ex-post control activities........................................................................................ 39 

- 3 - 

 
INTRODUCTION 

This Annex is based on the original executive summaries (reflecting the state of play at the 
time when the audits were finalised) of audit engagements finalised by the IAS in 20081. Each 
summary  underwent  the  applicable  standard  professional  validation  and  contradictory 
procedures between auditor and auditee at the time of finalisation. 
This  Annex  also  contains  statistical  information  for  the  acceptance  status  and,  where 
available, for the implementation status (the latter as of 30 January 2009). 

List of finalised IAS reports 

DG/Service 

Engagement 

Issue date 

ADMIN, OIB, INFSO, 
RTD, SG, TRADE 
BUDG 
BUDG, LS, AIDCO, EAC, 
INFSO, EACEA 
SG, BUDG, ADMIN, 
DIGIT 
ADMIN, AGRI, AIDCO, 
BUDG, COMM, COMP, 
DEV, EAC, ECFIN, 
ECHO, ELARG, EMPL, 
ENV, ESTAT, INFSO,  
JLS, JRC, LS, MARE, 
MARKT, OLAF, OPOCE,  
REGIO, RELEX, RTD, 
SANCO, SG, TAXUD, 
TRADE 
ADMIN 
DGT 
DIGIT 
ECFIN 

ECFIN 
EPSO 
ESTAT 
LS 
OIB 

OIB 
OIL 
OLAF 
OPOCE 
PMO 

PMO 
SCIC 

Administrative and other support systems 

Ethics in the Commission 

Management letter on Ethics in the Commision 
Recoveries 

Management letter on IT procurement and service 
delivery in the Commission 
Follow-up on IAS validation of self-Assessment of the 
Internal Audit Capability 

12.12. 

19.12. 
7.10. 

19.12. 

various dates 

Monitoring of Security as managed by ADMIN-DS 
Follow-up demand management 
Corporate data network infrastructures and services 
Implementation of selected Internal Control Standards in 
DG ECFIN* 
Follow-up on ECFIN local IT management* 
Facilitated self-assessment of a proposed organigramme 
Follow-up local IT management* 
Local IT 
Follow-up on evaluation of targeted internal control 
standards  
Follow-up on management of procurement contracts 
Evaluation of targeted internal control standards  
Anti-fraud information system (AFIS) 
Procurement* 
Follow-up on regularity of financial management and 
implementation of financial circuits 
Missions 
Follow-up financial management and procurement 

11.12. 
17.12. 
17.10. 
11.4. 

27.6. 
9.4. 
26.2. 
11.12. 
22.1.09 

23.1.09 
19.5. 
21.1.09 
7.5. 
22.12. 

11.7. 
3.12. 

1 Some reports drafted in 2008, but finalised at the beginning of 2009 have been included in the scope. 

 
 
 
 
 
 
 
                                                 
COMP 

COMP 
EAC 
EACEA 
EACI 
ENV 
INFSO 
INFSO 
JLS 
JLS 

JLS 
MARKT 
PHEA 
RTD 
RTD, INFSO, TREN, 
ENTR, DIGIT 
RTD 

SANCO 

SANCO 
SANCO 

TREN-TEN-T 
TREN 

EMPL 

EMPL 

REGIO 

REGIO 

REGIO 

AIDCO and ECHO 
AIDCO 
AIDCO 

AIDCO 
AIDCO 

ELARG 
ELARG 

Internal policies 
Follow-up on the effectiveness and efficiency of the 
SPP/ABM cycle and activity-based management 
Recovery of fines 
2nd follow-up on the in-depth audit 
Grant management awarding and contracting 
Follow-up on the EACI 
CITL management at DG ENV* 
Management of research information systems 
Follow-up on ex-post controls (2006) 
Follow-up on IT management 
Grants under shared management of the European 
Refugee Fund 
IT procurement 
Follow-up on local IT management process 
Public Health Executive Agency 
Management of research information systems 
Management letter on the inter-DG FP7 IT governance 

Follow-up ex-post controls (2006) and financial circuits 
and financial management (2007) 
Follow-up on the effectiveness and efficiency of the 
SPP/ABM Cycle 
Follow-up large IT systems 
Grant management in the food safety, animal health and 
welfare and plant health activity 
Audit of the TREN-TEN-T executive agency 
Follow-up on the effectiveness and efficiency of the 
SPP/ABM cycle 

Structural Measures 
Review on financial corrections and recoveries in the 
Structural Funds area 
Internal control system for managing the new Structural 
Funds programming period - Phase I 
Review on financial corrections and recoveries in the 
Structural Funds area 
Internal control system for managing the new Structural 
Funds programming period - Phase I 
Follow-up financial corrections in Cohesion Fund 
(2006) 

External Policies 

Follow-up on FAFA implementation 
Second follow-up on the in-depth audit 
Financial management procedures of Directorate C 
related to its devolved delegations* 
Financial Management of Regional Projects  
Financial management of main programmes in 
directorate B 
Follow-up of ex-post control activities 
Readiness assessment/phasing-in of delegations in 
Balkans 
Follow-up ex-post control activities 

29.5. 

13.11. 
25.4. 
11.12. 
18.4. 
10.7. 
31.3. 
8.12. 
14.7. 

4.11. 
17.11. 
17.6. 
24.1. 
22.4. 
26.5. 

11.12. 

1.4. 

21.1.09 
30.1.09 

16.12. 
11.4. 

14.11. 

19.11. 

14.11. 

19.11. 

12.12. 

22.1.09 
20.6. 
30.6. 

18.7. 
22.12. 

18.7. 
17.12. 

RELEX 
* Joint audit/follow-up with the Internal Audit Capability (IAC) of the service concerned. 

23.1.09 

- 5 - 

 
1. ADMINISTRATIVE AND OTHER SUPPORT SYSTEMS 

1.1 ADMIN, INFSO, OIB, RTD, SG, TRADE: Ethics in the Commission2 

Objectives and Scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  overall  design  of  the  ethics 
framework  of  the  Commission;  and  to  assess  whether  the  Commission's  ethics  framework 
has  been  implemented  effectively  in  selected  DGs.  The  scope  covered  key  aspects  of  the 
design of the ethics framework, for which SG and DG ADMIN are responsible: completeness, 
the  extent  to  which  it  covered  all  staff,  clarity  of  rules,  and  the  adequacy  of  guidance, 
monitoring,  supervision  and  enforcement.  The  application  of  these  design  aspects  was  also 
evaluated  in  selected  operational  DGs,  i.e.  INFSO,  RTD,  OIB,  TRADE.  As  the  ethics 
framework of the College of Commissioners was assessed in 2007, it was excluded from the 
scope of the audit. However, members of cabinet were included in the scope of the audit, as 
they are subject to the Staff Regulations applicable to Commission staff. 

Total of all six ethics 
audits 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

15 

7 

22 

15 

7 

22 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.2 BUDG: Management letter on Ethics in the Commission 

Following  the  Audit  on  Ethics  in  the  Commission,  the  IAS  brought  to  the  attention  of  DG 
BUDG two issues for consideration which were identified during the audit. 

The first issue concerns differences between the provisions of the Financial Regulation and 
the Staff Regulations, with respect to the reporting and management of conflicts of interest 
(art. 52 FR, art. 34 IR) and of instructions received from the superior that are considered 
irregular (art. 60.6 FR). 

The second issue is about the Financial Irregularities Panel. 

1.3 AIDCO, BUDG, EAC, EACEA, INFSO, LS: Recoveries3 

Objectives and Scope 

The  overall  objective  of  this  audit  was  to  provide  an  opinion  on  the  management  of  the 
recovery  of  sums  unduly  paid  in  the  context  of  the  centralised  management  of  Community 
funds  and  of  the  recovery  of  conditionally  reimbursable  loans  (related  to  the  MEDIA 
projects). In particular, this audit assessed the internal control systems implemented locally 
(in the Operational DGs) or centrally (in DG BUDG and Legal Service) in order to identify 

2  Six  reports  were  issued,  in  the  present  Annex  only  the  executive  summary  of  the  DG  ADMIN  report  is 
included. 
3 A consolidated report was issued for the entire Recovery process.  It includes six annexes (one per DG) with 
the specific issues identified. 

- 6 - 

 
 
 
 
 
 
 
                                                 
unduly paid funds (Phase 1), issue the Recovery orders (Phase 2) and effectively recover or 
offset  them  (Phase  3)  and  to  monitor  the  recovery  process.  The  support  provided  by  DG 
BUDG and LS was also assessed. 

The scope of the audit, conducted in a sample of Operational DGs/Executive Agencies and in 
two  horizontal  DGs  (DG  BUDG  and  LS),  covered  the  activities  performed  by  the  actors 
involved in each of the three phases of the recovery process as well as the monitoring/follow 
up activities implemented both in the Operational and in the horizontal DGs. The cooperation 
and communication among actors was also included in the scope of the audit. 

All six audits on 
recoveries 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

32 

30 

6 

68 

32 

30 

6 

68 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

32 

30 

6 

68 

32 

30 

6 

68 

37,50 

63,64 

100 

59,10 

0 

0 

0 

0 

0 

0 

0 

0 

1.4 Management Letter on IT Procurement and Service Delivery in the Commission 

Objectives and Scope 

Following a risk assessment, the IT Procurement and Service Delivery process was identified 
by  the  IAS  as  a  high-risk  area  and  included  in  its  2007  -  2009  Strategic  Plan,  which  was 
endorsed by the APC in February 2007. The IAS audited several DGs in 2007 and 2008 as 
follows: DIGIT (including IDABC previously part of DG ENTR), ESTAT, DG TAXUD, DG 
RTD and DG JLS, the latter recently finalised. 

The  scope  of  the  audits  included  the  contract  preparation  process  starting  from  the 
identification of the business needs to the signing  of  the  contracts  and  the  management  and 
monitoring of these contracts with a greater focus on information systems development. 

The  objective  of  these  audits  was  to  assess  the  adequacy  and  effective  application  of  the 
internal control system (ICS), risk management and governance processes and, in particular, 
they  assessed  whether  the  internal  control  systems  provide  reasonable  assurance  regarding 
compliance  with  the  Commission's  rules  and  the  effectiveness  and  efficiency  of  the 
procurement and service delivery processes. 

- 7 - 

 
 
 
 
 
 
 
 
 
The  purpose  of  this  overview,  following  the  completion  of  the  individual  audits,  is  to 
summarise the main common issues identified, draw conclusions at the Commission level and 
present issues for consideration to the central services concerned. In this overview, we have 
also taken into account the findings in this area identified in several other IAS and IAC audits. 

1.5 Follow-up on IAS Validation of self-assessment of Internal Audit Capabilities (IACs)  
DG ADMIN4 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  IAS  Validation  of  Self-Assessment  of  the 
Internal Audit Capability of DG ADMIN which was carried out in 2006. 

This  follow-up  does  not  result  in  an  opinion  on  the  lAC's  compliance  with  the  IIA 
Professional  Practice  Framework.  Neither  does  it  lead  to  a  re-assessment  of  the  compliance 
with individual standards. 

The  results  of  this  follow-up  exercise  are  limited  to  assessing  whether  specific  actions 
have  been  implemented  and  do  not  necessarily  have  a  bearing  on  assessments  of 
compliance  undertaken  as  part  of  future  external  assessments/validations.  Similarly, 
although it may be possible to conclude on whether specific actions have been implemented, it 
is not always possible to determine their effective application at this date, mainly as a result of 
the  time  needed  for  lACs  to  embed  those  actions.  Future  external  reviews  should  provide  a 
more concrete basis for this. 

Similarly,  certain  issues  are  impacted  by  central  initiatives  such  as  the  development  of  a 
common methodology for the audit of governance and ethics. Again, future external reviews 
should provide the basis for assessing whether these have been effectively applied in practice. 

Even where, as a result of the follow-up, the IAS has assessed that the agreed actions have 
been implemented as intended, this does not permit the IAC to use the phrase "Conducted in 
accordance  with  the  Standards",  as  IIA  Standard  1330  permits  this  only  when  an  external 
assessment  has  demonstrated  that  this  is  the  case.  As  noted  above,  the  present  follow-up 
exercise does not result in a re-assessment of compliance. 

4 Follow-ups on IAS Validation of self-assessment of Internal Audit Capabilities (IACs) were 
also carried out in the following DGs: AGRI, AIDCO, BUDG, COMM, COMP, DEV, EAC, 
ECFIN, ECHO, ELARG, EMPL, ENV, ESTAT, INFSO, JLS, JRC, LS, MARE, MARKT, 
OLAF, OPOCE, REGIO, RELEX, RTD, SANCO, SG, TAXUD, TRADE. As the objective, 
scope and methodology was the same for all follow-up reports on the validation of IAC self-
assessments this text is only shown once. 

- 8 - 

 
 
 
 
                                                 
1.6 ADMIN: Monitoring of Security as managed by ADMIN-DS 

Objectives and Scope 

The objective of the audit was to assess the adequacy and effective application of the Internal 
Control  System  (ICS)  relating  to  the  coordination,  supervision  and  monitoring  role  of  the 
Security Directorate (ADMIN-DS) in the Commission. 

The scope of the audit focused on the design and implementation of the monitoring system of 
security  in  the  Commission  under  the  main  responsibility  of  the  Security  Directorate  and 
other parties involved. The three main areas covered were protection of staff, information and 
assets. 

Safety  and  hygiene  matters  and  the  security  of  the  Regulatory  Agencies  and  Executive 
Agencies were excluded from the scope of this audit. Whilst the specific issue of IT security 
has already been covered in other IAS audits, the broader issue of information security has 
been included. 

This audit is based on the current security architecture in the Commission and has not taken 
into  account  the  potential  impact  in  this  area  of  the  future  creation  of  an  External  Action 
Service. 

There  are  no  observations  and/or  reservations  in  the  AAR  2007  related  to  the  process 
audited. 

It  should  be  noted  that  the  effective  implementation  of  some  of  the  very  important 
recommendations  made  in  this  report  may  require  the  cooperation  of  the  operational  DGs 
concerned. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

7 

4 

11 

7 

4 

11 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.7 DGT: Follow-up demand management 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  Audit  of  the  management  of  translation 
demand carried out from October 2006 to June 2007. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

- 9 - 

 
 
 
 
 
 
1.8 DIGIT: Corporate data network infrastructures and services 

Objectives and Scope 

The  Corporate  Data  Network  Infrastructure  and  Services  (S-Net)  (hereinafter  referred  to  as 
"corporate  data  network")  have  been  identified  as  critical  for  the  entire  Commission  in  the 
context  of  the  establishment  of  Business  Continuity  Plans.  They  present  an  overall  inherent 
reputation,  business  and  financial  risk  to  effectively  and  efficiently  support  the  current  and 
future needs of the Commission's activities. 

In  this  context,  the  overall  objective  of  the  present  audit  was  to  analyse  and  evaluate  the 
internal  control  systems  put  in  place  to  provide  an  adequate  and  effective  corporate  data 
network in the Commission. The scope of the audit included : 

the operation and management of the corporate data network, including the monitoring of 

1. 
outsourced services; 

2.  logical  security  arrangements,  in  particular  the  effectiveness  of  the  external  perimeter 
protection,  the  effectiveness  of  intrusion  prevention/detection  capabilities  and  incident 
handling and the adequacy of corporate data network access procedures. 

The audit covered the activities, which are under the responsibility of DG DIGIT, and of the 
ADMIN/DS directorate; it did not cover the responsibilities of the local informatics services. 
When  assessing  the  Technology  framework,  the  audit  approach  did  not  evaluate  the 
technological choices made nor the engineering work done by the experts, but examined the 
process of using expertise to make proposals to be validated by management. 

The  main  actors  playing  an  active  role  in  this  domain  are  DG  DIGIT  (and  in  particular 
Directorate  C, 
and 
telecommunication  services)  and  the  Security  Directorate  of  DG  ADMIN  (mainly  Unit 
ADMIN/DS.5  responsible,  among  others,  to  provide  guidance  in  the  field  of  IT  and 
communication security). 

infrastructure 

information 

responsible 

technology 

for 

all 

The  audit  was  conducted  using  the  CObIT  framework,  and  specifically  the  processes 
belonging to the domains "Acquire & Install" (AI) and "Deliver & Support" (DS), as well as 
the Commission's regulatory framework applicable to this domain. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

5 

9 

14 

5 

9 

14 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

5 

9 

14 

5 

9 

14 

100 

100 

100 

0 

0 

0 

0 

0 

0 

- 10 - 

 
 
 
 
 
 
 
 
 
 
1.9 ECFIN: Implementation of selected Internal Control Standards 

Objectives and Scope 

The main purpose of this joint audit with the IAC of DG ECFIN is to assess the compliance, 
effectiveness and efficiency of the implementation of the revised Internal Control Standards 
(SEC 2007 1341) in those parts (units/directorates) of DG ECFIN that deal with activities of 
policy-making, i.e. directorates A, C, D, E, F and G. This entails assessing: 

•  Whether the DG complies with the respective ICS requirements issued by DG BUDG, 

and with other relevant rules applicable to DG ECFIN (compliance objective); 

•  Whether the main measures taken to implement these standards are effective, efficient 
and adequate, taking into account the specificities of policy-making processes in DG 
ECFIN. 

Based  on  their  relevance  to  policy-making  activities  and  considering  the  work  already 
performed  (or  underway)  both  by  DG  ECFIN's  Internal  Audit  Capability  (IAC)  and  by  the 
IAS, the IAS fully covered the implementation of the following standards: Mission (ICS 1), 
Staff  allocation  and  mobility  (ICS  3),  Objectives  and  performance  indicators  (ICS  5),  Risk 
Management  process  (ICS  6),  Processes  and  procedures  (ICS  8),  Management  Supervision 
(ICS 9), Evaluation of activities (ICS 14) and Assessment of Internal Control Systems (ICS 
15). 

The following standards were partially covered: 

•  Ethical and organizational values (ICS 2), where the audit focused on staff awareness 

about sensitive information; 

•  Operational Structure (ICS 7), focus on sensitive functions; 

•  Business continuity (ICS 10), where business continuity planning was excluded; 

•  Document management (ICS 11), focus on handling of sensitive information; 

• 

Information  and  communication  (ICS  12),  focus  on  management  information  tools 
and quality and timeliness of incoming and outgoing information. 

The following standards were fully excluded from the scope: 

•  Staff evaluation and development (ICS 4), as the evaluation process is not specifically 
relevant to policy-making and the DG's training policy is currently being audited by 
the DG's IAC; 

•  Accounting and Financial Reporting (ICS 13), as risks related to financial operations 

in DG ECFIN have been subject to past coverage by the IAC; 

• 

Internal Audit Capability (ICS 16), as the IAS has already carried out an IAC Quality 
Review in 2006. 

One  of  the  residual  risks  and  weaknesses  disclosed  in  the  DG's  Annual  Activity  Report  of 
2006  relates  to  the  "shortage  of  human  resources,  which  was  already  raised  in  previous 
Annual Activity Reports [and] has not been resolved in 2006". Itis further mentioned that "as 
a result, the DG still encounters difficulties in meeting its objectives, in particular as regards 
economic surveillance and policy coordination." This weakness was considered not to have an 
impact on the declaration of assurance.  

- 11 - 

 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

3 

4 

7 

3 

4 

7 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

3 

4 

7 

3 

4 

7 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.10 ECFIN: Follow-up on ECFIN local IT management 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted  from the  audit of DG ECFIN local IT management 
carried out in 2005. This follow-up audit does not result in an assessment of the adequacy of 
controls  as  a  whole  but  focuses  on  the  specific  recommendations  in  the  original  audit. 

1.11 EPSO: Facilitated Self-Assessment of a Proposed Organigramme 

Summary 

Participants identified the strengths and obstacles associated with EPSO to date. The purpose 
of this exercise was to appreciate what worked well and not to unintentionally undermine it 
but ensure future actions address the obstacles. The second part of the workshop focused on a 
proposed  organigramme,  participants  voted  on  22  assertions  (positive  statements  grouped 
under three modules) registering their level of agreement on a scale of 1-7 where 1 indicated 
strong  disagreement  and  7  strong  agreement.  After  voting  on  each  module  the  participant 
discussed  strengths  and  identified  conceras/obstacles,  see  the  Averages  of  Votes  by  Criteria 
graph. 

Overall  the  participants  reacted  positively  to  the  new  Organigramme,  given  this  positive 
reaction  the  facilitators  emphasised  drawing  out  concerns  so  as  to  provide  input  into  the 
planning  and  implementation  process  that  will  be  part  of  management's  next  steps.  It  was 
clear to all that the Organigramme is only one element of realising the mission and objectives 
of  EPSO  and  that  focus  on  processes  and  the  people-side  of  change  will  continue  to  be  a 
critical  part  of  the  next  steps.  There  was  some  discussion  of  "what  functions  should  be  in 
which box". However, this will be pursued separately. 

- 12 - 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
1.12 ESTAT: Follow-up local IT management 

Background 

During  the  period  September  to  December  2006,  the  IAS  and  the  IAC  of  DG  Eurostat 
(ESTAT) conducted a risk analysis of the local IT management, which focused on three major 
processes, namely: 

Planning & Organisation; Project Management; Security. 

Given the nature of the engagement, the final report (issued on 14/12/2006) included a list of 
observations  and  associated  risks,  but  no  recommendations.  Accordingly,  the  IAS  had  not 
required an action plan from the auditee. 

However, given the significance of the identified risks, the management of ESTAT planned a 
series of mitigating actions, whose implementation was mainly foreseen from February 2007 
to January 2008 (with some actions planned for 2009 and beyond). 

Objectives and Scope 

The objectives of the follow-up audit engagement, performed jointly by the IAS and the IAC 
of ESTAT, were 

to assess the progress made by ESTAT in implementing actions defined in response to 

a) 
accepted observations; 

to  assess  the  level  of  residual  risk  in  cases  where  corrective  actions  were  not  fully 

b) 
implemented or were not planned. 

This follow-up engagement is not an assessment of the adequacy of controls as a whole, but 
focuses on the observations made in the original engagement. 

1.13 Legal Service: Local IT 

Objectives and Scope 

The purpose of the engagement was to analyse and evaluate the internal control systems put 
in place by the Legal Service (hereafter referred to as LS) to ensure an adequate and effective 
management of its local IT. 

The scope of the audit included the following processes: 

•  Plan & Organise: IT architecture definition, organisation definition, risk management and 
IT project management activities; 

•  Acquire & Implement: application software development, change and release 
management; 

•  Deliver & Support: logical and physical security, incident management, problem 
management, operations management and data management. 

The  audit  focused  in  particular  on  the  activities  performed  by  unit  DDG.003  (Informatics). 
Other services (DDG.002 - Information and documentation) and representatives of IT system 
users and owners were also consulted regarding their respective responsibilities, in particular 
for the management of IT projects. 

- 13 - 

 
There are no observations/reservations in the AAR that relate to the processes audited. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

4 

17 

4 

25 

4 

17 

4 

25 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

1.14 OIB: Follow-up on evaluation of targeted Internal Control Standards 

Objectives and Scope 

The objective of the follow-up engagement was to assess progress made in implementing the 
accepted  recommendations  that  resulted  from  the  audit  of  Evaluation  of  targeted  Internal 
Control Standards in OIB carried out in June - October 2007. The final report was issued on 8 
October 2007. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but  focuses  on  the  specific  recommendations  in  the  original  audit  related  to  the  ICS  15 
"Documentation"; ICS 17 "Supervision" and ICS 24 "Annual review of internal control". 

1.15 OIB: Follow-up on management of procurement contracts 

Objectives and Scope 

The objective of the follow-up engagement was to assess progress made in implementing the 
accepted  recommendations  that  resulted  from  the  audit  "Management  of  Procurement 
Contracts in OIB" (Final Report issued on 03 April 2007). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

1.16 OIL: Evaluation of targeted Internal Control Standards 

Objectives and Scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  effectiveness  of  the 
implementation of selected Internal Control Standards ("ICS") in OIL. 

The  basis  for  the  audit  are  the  Internal  Control  Standards  that  were  in  force  until  31 
December 2007. Based on the preliminary survey, the following Internal Control Standards 
were selected for review: n0 15 (Documentation of procedures), 16 (Segregation of duties), 
17  (Supervision),  18  (Recording  exceptions),  21  (Audit  reports)  and  24  (Annual  review  of 
internal control). 

- 14 - 

 
 
 
 
 
 
 
 
In view of the recent introduction of the revised Internal Control Standards , applicable as of 
1  January  2008,  the  audit  also  linked  the  former  Internal  Control  Standards  selected  and 
relating findings to the revised Internal Control Standards. 

Revised Internal Control Standards 
8 - Processes and procedures 

9 - Management supervision 

15 - Assessment of Internal Control Systems 

Former Internal Control Standards 

15  - Documentation of procedures 
16  - Segregation of duties 
18 - Recording of exceptions 
17 - Supervision 
21 - Audit reports 
24 - Annual review of internal control 

Although the audit covered both financial and operational activities, its focus was mainly on 
operational activities. It did not focus on procedures and control activities specifically linked 
to  the  procurement  process,  which  has  been  audited  by  the  IAS  (IAS-2006-OIL-001),  IAC 
(negotiated procedures) and ECA during the last two years. The IAS procurement audit also 
covered the financial transactions concerning commitments, payments and recoveries. 

There are no reservations in the AAR 2007 that relate to the process audited. However, OIL 
reports  that  there  are  weaknesses  concerning  the  documentation  of  procedures  (former  ICS 
15). The AMP 2008 indicated that OIL will focus on the improvement of revised ICS 4 (Staff 
competence),  revised  ICS  8  (Documentation  of  procedures)  and  revised  ICS  16  (Internal 
Audit Capability). 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

5 

7 

1 

13 

5 

7 

1 

13 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

5 

7 

1 

13 

5 

7 

1 

13 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

1.17 OLAF: Anti-fraud information system (AFIS) 

Objectives and Scope 

The OBJECTIVE of the audit was to assess the governance, project management, change management 
and security of IT systems supporting the OLAF in terms of integrity and confidentiality. 

- 15 - 

 
 
 
 
 
 
 
 
 
 
 
As  a  result  of  the  Preliminary  Survey  and  a  CobiT  risk-based  analysis  performed  by  the  IAS,  the 
SCOPE of this audit engagement focused on the Anti-Fraud Information System (AFIS). Therefore, IT 
processes and procedures not directly linked to AFIS and to the audit objectives were not assessed. 

During the audit, no scope limitations were identified. 

There  are  no  observations/reservations  in  the  Annual  Activity  Report  2007  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 12 December 2008. All observations and recommendations relate to 
the situation as of that date. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

4 

3 

7 

4 

3 

7 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.18 OPOCE: Procurement 

Objectives and Scope 

The  objective  of  this  joint  IAS  and  IAC-OPOCE  audit  was  to  assess  whether  the  internal  control 
system provides reasonable assurance regarding: 

• 

• 

the compliance (legality and regularity) with the Commission procurement rules, the Financial 
Regulation,  its  Implementing  Rules  and  the  appropriate  Commission  Internal  Control 
Standards; 
the  efficiency and effectiveness  in terms of sound financial management (Art 27 of FR) and 
for procurement activities in general.   

The  audit  mainly  focused  on  procurement  procedures  related  to  contracts  managed  by  the 
Publications  Office  and  still  in  force  during  the  period  2006-2007,  i.e.  it  did  not  cover  framework 
contracts  used  by  the  Office  where  the  procurement  process  was  carried  out  by  other  Institutions 
and/or DGs. The CORDIS information system was excluded from the scope. 
A total of nine finalised calls for tender and seventeen related contracts were reviewed. Of these, 15 
contracts had starting dates between 2004 and 2007 and 2 started prior to 2004 (as they were linked to 
two of the 15 selected contracts). The  sample tested took into account value considerations and the 
non-homogenous  nature  of  the  contract  population,  to  provide  breadth  and  coverage  over  the  main 
types  of  items  linked  directly  to  the  publication  activities  across  the  three  Directorates  of  OPOCE. 
Contracts  that  came  into  force  as  from  2004  were  selected  as  the  procedures  related  to  the  process 
prior to that year had already been audited (2003 IAC audit report on the procurement process). 
In conducting this joint audit, the results of the audit performed by the Publications Office's IAC in 
2007 on "outsourced activities and the use of framework contracts", have been taken into account in 
order  to  avoid  duplication  of  effort.  The  final  report,  dated  28  June  2007,  contained  3  Critical,  11 
Very  Important  and  8  Important  recommendations,  all  accepted  by  management,  with  action  plans 
including target dates for implementation, with some exceptions, by the end of 2007. According to the 
Publications Office, most of these recommendations have already been implemented. 
There are no observations/reservations in the 2007 AAR that relate to the process audited. 

- 16 - 

 
 
 
 
 
 
 
 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

4 

7 

11 

4 

7 

11 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.19  PMO:  Follow-up  on  regularity  of  financial  management  and  implementation  of 

financial circuits 

Objectives and Scope 

The objective of the follow-up engagement was to assess progress made in implementing the 
accepted  recommendations  that  resulted  from  "The  Regularity  of  financial  management  and 
implementation  of  financial  circuits  in  PMO"  audit  carried  out  in  2006  (date  of  the  Final 
Report 8 December 2006). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

1.20 PMO: Missions 

Objectives and Scope 

The objective of the audit was to assess the adequacy and effective application of the internal 
control system and risk management with respect to the design and the implementation of the 
financial circuits and procedures related to authorisation and payment of mission expenses. 

In  particular,  the  audit  assessed  whether  the  internal  control  system  provides  reasonable 
assurance regarding: 

•  compliance (legality and regularity) with the Commission procurement rules, the Financial 
Regulation,  its  Implementing  Rules  and  the  appropriate  Commission  Internal  Control 
Standards; 

•  efficiency and effectiveness in terms of sound financial management (Art 27 of FR) and 

for procurement activities in general. 

The  audit  did  not  cover  procedures  related  to  the  calculation  and  payment  of  experts'  fees. 
Neither  did  it  cover  the  functionality  of  the  underlying  IT  system  for  processing  the 
calculation and payment of mission expenses. 

The audit mainly focused on missions managed by PMO during 2007. Supporting documents 
were reviewed for a sample of 50 settlements of mission expenditure. 

There  are  no  observations  and/or  reservations  in  the  AAR  2007  that  relate  to  the  process 
audited. 

- 17 - 

 
 
 
 
 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

2 

6 

8 

2 

6 

8 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

2 

6 

8 

2 

6 

8 

100 

100 

100 

0 

0 

0 

0 

0 

0 

1.21 SCIC: Follow-up financial management and procurement 

Objectives and Scope 

The objective of this follow-up engagement was to assess progress made in implementing the 
accepted  recommendations  that  resulted  from  the  IAS  audit  of  Financial  Management  and 
Procurement in DG SCIC, carried out in 2006 (Final Report dated 22 September 2006). The 
follow-up had originally been planned to be conducted within the normal period of one year 
following  the  final  report,  but  in  view  of  the  fact  the  implementation  of  many  of  the 
recommendations  would  be  dependent  on  the  re-negotiation  of  the  Convention  which 
underpins DG SCIC's procurement of interpretation services and that this only came into force 
in September 2008, it was neither practical nor useful to conduct it any earlier. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

- 18 - 

 
 
 
 
 
 
 
 
 
 
2. INTERNAL POLICIES 

2.1  COMP:  Follow-up  on  the  effectiveness  and  efficiency  of  the  strategic  planning  and 

programming cycle and activity-based management 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the Audit on the Effectiveness and Efficiency of 
the  Strategic  Planning  and  Programming  Cycle  and  Activity-Based  Management  in  DG 
COMP carried out on 25 July 2006. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

2.2 COMP: Recovery of Fines 

Objectives and Scope 

The  overall  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  process  of  the 
recovery  of  fines  imposed  by  DG  COMP  in  conducting  its  mission  of  reinforcement  of 
competition rules. 

The following detailed audit objectives were defined: 

•  Effectiveness of the operations; 

•  Compliance with applicable rules and regulations; 

•  Reliability and integrity of financial and operational information. 

The scope of the audit covered the activities performed by DG COMP, DG BUDG and Legal 
Service  in  the  field  of  recovery  of  fines  from  the  Commission  decision,  leading  to  the 
subsequent issuance of notifications by the Secretariat General and to its effective recovery. 
The audit included also the monitoring activities implemented by the different actors involved 
in this process. 

The  Secretariat  General  was  consulted  in  order  to  obtain  an  understanding  of  the  whole 
process and for gathering additional information. 

Acceptance 
Status 

Yes 

No 

Priority 

Important 

Total 

# 

# 

% Total 

# 

% Total 

2 

2 

2 

2 

100 

100 

0 

0 

0 

0 

- 19 - 

 
 
 
 
 
 
2.3 EAC Second follow-up on the in-depth audit 

Objectives and Scope 

The  objective  of  this  second  follow-up  engagement  is  to  assess  progress  made  in 
implementing  the  accepted  recommendations  that  resulted  from  the  In-depth  audit  of  DG 
EAC  carried  out  in  2004  (final  report  dated  21  September  2004)  and  that  were  still 
outstanding  as  a  result  of  the  first  follow-up  audit  conducted  in  2005  (final  report  dated  22 
December 2005). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the 17 recommendations assessed as still being open at the time when the first 
follow-up audit was completed. 

7 recommendations were confirmed as implemented (3 VI and 4 I), 6 remain in-progress (1 
VI  and  5  I)  and  are  now  more  than  one  year  past  due  from  the  original  target  date.  Four 
recommendations (3 C and 1 VI) were closed and the residual actions are addressed in two 
new recommendations (VI) on an "Integrated Supervision Strategy" and "Validation of local 
systems by the Accounting Officer of the Commission". 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Total 

# 

# 

% Total 

# 

% Total 

2 

2 

2 

2 

100 

100 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Total 

# 

# 

% Total 

# 

% Total 

2 

2 

0 

0 

0 

0 

2 

2 

100 

100 

2.4 EACEA: Grant management awarding and contracting 

Objectives and Scope 

The  EACEA  was  established  in  2006.  Its  mission  is  to  implement  a  number  of  strands  of 
certain  Community  programs  in  the  fields  of  education  and  training,  culture,  audiovisual, 
citizenship and youth. The Agency's mandate was extended to new actions in 2007 and 2008. 
The management of grants constitutes one of the main tasks of the Agency. 

The  objective  of  this  audit,  which  was  jointly  conducted  by  IAS  and  EACEA  IAC,  was  to 
assess if the controls provide reasonable assurance on the compliance and effectiveness of the 
internal  control  system  regarding  the  Agency's  overall  selection  procedure  for  grant 
management, awarding and contracting. 

Based  on  the  preliminary  survey,  the  scope  of  the  audit  focused  on  Call  for  proposal: 
the  grant 
terms  of  reference  and  publication;  selection  procedure  of 
preparation, 

- 20 - 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
beneficiaries;  awarding  of  the  grant  beneficiaries;  contracting  with  the  grant  beneficiaries; 
procedures and manuals; supervision, monitoring and reporting. 

The audit also took into consideration still open recommendations from a previous DG EAC 
IAC  audit  covering  the  selection  procedure  before  the  Agency  was  set  up.  The 
recommendations  covered  the  use  of  е-tools  in  the  EACEA  for  the  submission  of  the 
applications,  the  selection  of  experts,  the  communication  process,  the  archives  and  internal 
procedures. On the basis of the work done, these recommendations are either implemented or 
closed because the related current risks and the remaining actions are mainly related to some 
of the recommendations issued by the present IAS/IAC joint audit report. For further details 
please refer to the specific follow up report issued by the Agency's IAC. 

The programming managed directly by DGs, including the Comitology, was out of the audit 
scope. Also, in order to avoid overlapping with other audits either completed or planned by 
the IAS, the  IAC or  the ECA, the financial circuits, IT and  human  resources and Euridyce 
were out of the audit scope. 

There  are  no  observations/reservations  in  the  2007  AAR  that  relates  to  the  area/process 
audited. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

3 

6 

6 

3 

6 

6 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2.5 EACI: Follow-up on the Intelligent Energy Executive Agency 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  Audit  of  the  Intelligent  Energy  Executive 
Agency carried out on 30 January 2007. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

2.6 ENV: CITL Management at DG ENV 

Objectives and Scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  design  of  the  internal  control 
system put in place by DG ENV to ensure the proper functioning of the CITL (Community 
Independent Transaction Log) IT system, related to the Community greenhouse gas emission 
trading scheme (ETS). Specific key processes have been selected based on the risk assessment 
completed during the preliminary survey. In addition, the audit has assessed the adequacy of 
the  reporting  to  the  management  concerning  the  performance  and  availability  of  the  CITL 
application. The engagement was carried out as a joint audit between the IAS and the IAC of 
DG ENV. 

- 21 - 

 
 
 
 
 
 
 
 
Based  on  the  results  of  the  preliminary  survey,  it  was  decided  to  focus  the  audit  on  the 
following processes: 

•  Quality management and quality assurance. 

•  Change management and testing. 

•  Management of third parties (contractors supporting the IT activities related to CITL). 

•  Security,  focusing  on  logical  security  and  compliance  with  the  relevant  Commission 

legislation. 

Hosting  of  the  system  (outsourced  to  DIGIT),  business  continuity  planning  and  network 
security were not included in the scope of the audit. 

The audit methodology is based on the fourth edition of Control Objectives for Information 
and related Technology (COBIT),  which  is directly inspired by COSO and has increasingly 
become  the  standard  for  "Good  IT  Governance"  at  the  international  level.  This  framework 
identifies 34 basic processes and proposes more than 200 controls. 

There  are  no  observations/reservations  in  the  AAR  2007  that  relate  to  the  area/processes 
audited. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

4 

3 

7 

4 

3 

7 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2.7 INFSO: Management of research information systems 

Objectives and Scope 

The IAS audit of "Research information systems" consists of three reports: two audit reports 
on the management of the local IT systems (DG RTD and DG INFSO) and one review report 
(primarily a consulting engagement) on the governance and the project management at Inter-
DG level. 

Based on the results of the preliminary survey' the IAS decided to assess the adequacy and the 
effectiveness of the internal control system put in place for the management of the local IT 
systems within DG INFSO. This audit scope consisted of the following domains: 

-  Planning  and  Organisation  of the IT  function  (IT  governance):    addressing all 

information systems owned by DG INFSO which support the grant management process. 

-  Project management of the following information systems: 

o  the PHOENIX system which is used for managing research contracts and payments for 

the 6th and 7th Framework Programs (FP6 and FP7). 

- 22 - 

 
 
 
 
 
 
o  the security module (APUS) for managing users access rights. 

-  Security: focusing on the logical security, continuity of operations and compliance with 

the relevant Commission legislation. 

The audit methodology is based on the fourth edition of Control Objectives for Information 
and  related  Technology  (COBIT),  which  is  directly  inspired  by  the  COSO  and  has 
increasingly  become  the  standard  for  "Good  IT Governance"  at  the  international  level.  This 
framework identifies 34 basic processes and proposes more than 200 controls. 

There  are  no  observations/reservations  in  the  AAR  2006  that  relate  to  the  area/process 
audited. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

6 

8 

14 

6 

8 

14 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2.8 INFSO: Follow-up on ex-post Controls (2006) 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  Audit  of  Ex-Post  Controls  carried  out  in 
2006. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audits. 

2.9 JLS: Follow-up on IT management 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the Audit on IT Management in DG JLS carried 
out on 8 June 2006. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

2.10 JLS: Grants under shared management of the European Refugee Fund 

Objectives and Scope 

The objective of the audit was to assess the adequacy and effective application of the internal 
control system (ICS), risk management and governance processes related to the Grants Under 
Shared Management of the European Refugee Fund (ERF) (II and III), managed by DG JLS. 
In  particular,  the  audit  assessed  whether  the  ICS  provided  reasonable  assurance  regarding: 

- 23 - 

 
 
 
 
 
 
compliance with legislation, effectiveness and efficiency of the processes and the reliability of 
financial  information  (with  special  focus  on  the  eligibility  of  expenses  and  financial 
corrections). 

The scope of this audit focussed on the following sub-processes: Preparation, implementation, 
financial  follow-up  &  closure;  Ex-post  audit;  Suspension  &  financial  correction.  The  grants 
under direct management of the ERF were not part of the scope of this audit. 

The  following  observations/reservations  have  been  made  in  the  2007  AAR  concerning 
specifically the processes under the scope of this audit. 

1)  Weaknesses  in  the  management  and  control  systems  of  the  ERF  in  Italy  for  the 

programming periods 2000-2004 and 2005-2007. 

2) 

Limited guarantee on the operations put in force by 14 Member States for ERF II (2005-
2007). 

In  2008,  DG  JLS  took  appropriate  actions,  i.e.  they  launched  the  procedure  for  a  financial 
correction of the grants paid for ERF I (2000-2004) and the suspension of payments for ERF 
II  (2005-2007)  is  in  preparation;  and  the  remaining  monitoring  visits  for  ERF  II  were 
outsourced in the first semester of 2008. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

7 

8 

1 

16 

7 

8 

1 

16 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

2.11 JLS: IT procurement 

Objectives and Scope 

The objective of this audit was to assess the adequacy of the design and effective application 
of the internal control system (ICS), risk management and governance processes related to IT 
Procurement Preparation process by DG JLS. 

The scope of this audit focused on the IT contract preparation process, starting from the needs 
analysis  and  planning  phase  to  the  budgetary  and  legal  commitment  phase.  It  included  all 
types of IT expenses (equipment and services). 

This audit forms part of a series of audits being carried out by the IAS, which will result in the 
issuance of a consolidated report on crosscutting issues on IT procurement at the Commission 
level in the 2nd half of 2008. 

There  are  no  observations/reservations  found  in  the  2007  AAR  that  relate  to  the  process 
audited. 

- 24 - 

 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

3 

2 

1 

6 

3 

2 

1 

6 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

2.12 MARKT: Follow-up on local IT management process 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the DG MARKT Local IT Management process 
audit carried out in 2006. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

2.13 PHEA: Public Health Executive Agency 

Objectives and Scope 

The objective of this audit was to assess the adequacy and effective application of the internal 
control system (ICS) in the Public Health Executive Agency (PHEA). In particular, the audit 
assessed whether the ICS provides for reasonable assurance regarding: 

• 

• 

• 

The  compliance  with  the  Financial  Regulation  regarding  the  accounting  procedures 
related to the administrative budget. 

The  reliability  of  financial  and  non-financial  information  related  to  the  administrative 
budget. 

The effectiveness and efficiency of operations related to the administrative budget. 

As  a  result  of  the  contacts  with  the  Director  of  the  PHEA  and  to  add  greater  value  to  the 
Agency before the first closure of the accounts, part of the audit normally to be performed in 
2009, was brought forward to the end of 2007. Therefore, the scope of this audit engagement 
was limited to the following aspects regarding the internal control system of the PHEA: 

A.  The  Accounting  Procedures  related  to  the  Administrative  Budget,  including  the 
accounting  organization,  the  accounting  for  fixed  assets,  salaries,  purchases  and 
the year-end closing procedures. 

B.  Compliance with the rules for "data protection". 

No scope limitations were identified. 

The  fieldwork  was  finalized  on  30  November  2007.  All  observations  and  recommendations 
relate to the situation as of that date. 

- 25 - 

 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

3 

5 

8 

3 

5 

8 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

3 

5 

8 

0 

0 

0 

0 

0 

0 

3 

5 

8 

100 

100 

100 

2.14 RTD: Management of research information systems 

Objectives and Scope 

The  IAS  audit  of  "Research  information  systems"  is  composed  of  two  audit  reports  on  the 
management of the local IT systems (DG RTD and DG INFSO) and one management letter 
addressing the main issues regarding the governance and the project management at Inter-DG 
level. 

Based on the results of the preliminary survey the IAS decided to assess the adequacy and the 
effectiveness of the internal control system put in place for the management of the local IT 
systems within DG RTD. 

This audit scope consisted of the following domains: 
-  Planning  and  Organisation  of the  IT  function  (IT  governance):   addressing all 
information systems owned by DG RTD which support the grant management process. 

-  Project management of the following information systems: 

o   the Contract and Project Management (CPM) system which is used for managing 
research contracts for the 6th and 7th Framework Programs (FP6 and FP7).   
o   the security module (SECUNDA) for managing users access rights. 

-  Security: focusing on the logical security and compliance with the relevant Commission 

legislation. 

The audit methodology is based on the fourth edition of Control Objectives for Information 
and  related  Technology  (COBIT),  which  is  directly  inspired  by  the  COSO  and  has 
increasingly  become  the  standard  for  "Good  IT Governance"  at  the  international  level.  This 
framework identifies 34 basic processes and proposes more than 200 controls. 

- 26 - 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

10 

6 

16 

10 

6 

16 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2.15  RTD,  INFSO,  TREN,  ENTR:  DIGIT:  Management  letter  on  the  inter-FP  7  IT 

governance 

INTRODUCTION  

As part of the audits on the Research Information systems at DG RTD and DG INFSO, the 
IAS has identified several preliminary findings regarding the FP7 IT Governance structure at 
the inter-DG level that is progressively being implemented.  
Taking into account the importance of the information systems that will support the FP7, the 
IAS considered it useful to already present these preliminary findings in the research family 
as a "limited review", keeping in mind that the other two Research DGs namely DG TREN 
and DG ENTR were not included in the scope of the Audit on the Management of Research 
Information Systems.  

OBJECTIVES AND SCOPE  

The main objective of the limited review consists of assessing the design of the IT governance 
structure.    In  addition  to  the  analysis  of  the  IT  governance  structure,  the  IAS  reviewed  the 
project management of the following information systems:  
-  The  system  for  the  contract  and  grant  preparation  forms  (CPF/GPF)  in  support  of  the 
negotiation process called NEF which is being developed jointly by DG INFSO and DG 
RTD;  
 The  unique  registration  facility  module  whose  main  goal  is  to  provide  a  unique 
registration  service  for  grant  beneficiaries  in  order  to  avoid  redundant  requests  for 
information and ensure that information is always up-to-date. This module is called URF-
PDM and is being developed by DG DIGIT.  

- 

2.16  RTD:  Follow-up  ex-post  controls  (2006)  and  financial  circuits  and  financial 

management (2007) 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted  recommendations  that  resulted  from  the  Audit  of  Ex-Post  Controls  carried  out  in 
2006 and the Follow-up Report on Financial Circuits & Financial Management carried out in 
2007. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audits. 

- 27 - 

 
 
 
 
 
 
 
 
 
 
 
2.17 SANCO: Follow-up on effectiveness and efficiency of the SPP/ABM Cycle 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the Audit on the Effectiveness and Efficiency of 
the SPP/ABM Cycle in DG SANCO carried out on 6 April 2006. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

2.18 SANCO: Follow-up large IT systems 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the Audit on Large IT Systems at DG SANCO 
carried out in 2006 (Final Report dated 8 December 2006). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

The fieldwork was finalised on 7 January 2009. Any mitigating actions taken by the auditee 
after this date were not included in the IAS evaluation and assessment of the adequacy and 
effectiveness of the actions taken. 

During the follow-up audit, no scope limitations were identified. 

2.19  SANCO:  Grant  management  in  the  food  safety,  animal  health  and  welfare  and 

plant health activity  

Objectives and Scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  effective  application  of  the 
internal  control  system  (ICS),  risk  management  and  governance  processes  in  DG 
SANCO,  regarding  the  Food  Safety,  Animal  Health,  Animal  Welfare  and  Plant  Health 
activities,  implemented  through  grants  and  cost  reimbursements  during  the  years  2007 
and  2008.  In  particular,  the  audit  assessed  whether  the  ICS  provided  reasonable 
assurance regarding compliance with the relevant legislation, effectiveness and efficiency 
of  the  processes  regarding  cost  reimbursements  and  grants  management  and  the 
reliability of financial information. 

The scope of this audit focussed on the following sub-processes: 

•  Preparation, implementation, financial follow-up & closure; 

•  Ex post audit; Suspension & financial correction. 

There  are  no  observations/reservations  in  the  2007  AAR  that  relate  to  the  area/process 
audited. 

- 28 - 

 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

5 

5 

10 

5 

5 

10 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2.20 TREN-TEN-T: Audit of the TREN-TEN-T executive agency 

Objectives and Scope 

The objective of the audit was to assess the adequacy and effective application of the internal 
control system (ICS), risk management and governance processes of the administrative budget 
in  the  Trans-European  Transport  Network  Executive  Agency  (TEN-TEA).  In  particular,  the 
audit  assessed  whether  the  ICS  provided  reasonable  assurance  regarding  compliance  with 
legislation,  effectiveness  and  efficiency  of  the  processes  and  the  reliability  of  financial  and 
non-financial information. 

As the Executive Agency became autonomous in April 2008 and this will be the first year in 
which  the  financial  statements  have  to  be  presented,  the  scope  of  this  audit  focused  on  the 
readiness for the first closure of the accounts. Therefore, the following aspects of the ICS, risk 
management and governance processes regarding the administrative budget were reviewed: 

1)  The overall organisation of the Agency (including governance issues). 

2)  The  accounting  system,  including  the  regularity  of  financial  management  and  the 
implementation of financial circuits, the accounting organisation, the accounting for fixed 
assets, salaries, purchases and the year-end closing procedures. 

3)  The treasury cycle including the management of the bank account. 

4)  The external relations of the Agency with other Commission services (i.e. the service level 

agreements). 

No scope limitations were identified. 

As 2008 is  the first year of the Agency's autonomy, no  Annual Activity Report is available 
yet. 

The  fieldwork  was  finalised  on  24  November  2008.  All  observations  and  recommendations 
relate to the situation as ofthat date. 

- 29 - 

 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

4 

6 

10 

4 

6 

10 

100 

100 

100 

0 

0 

0 

0 

0 

0 

2.21  TREN:  Follow-up  on  the  effectiveness  and  efficiency  of  the  implementation  of 

SPP/ABM cycle 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the Audit on the Effectiveness and Efficiency of 
implementation of SPP and ABM in DG TREN carried out on 10 April 2006. 
This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

- 30 - 

 
 
 
 
 
 
 
 
3. STRUCTURAL MEASURES AND COMMON AGRICULTURAL POLICY 

3.1 EMPL: Review on financial corrections and recoveries in the Structural Funds Area 

Objectives and Scope 

Following  the  ECA's  recommendations  in  its  2006  Annual  Report  for  improving  the 
effectiveness of the Commission's supervisory role for structural actions, DG REGIO and DG 
EMPL drew up a joint action plan, COM 2008(97), dated 19th February 2008 to  implement 
these  recommendations,  including  actions  designed  to  ensure  the  complete,  transparent, 
reliable and consistent reporting on financial corrections and recoveries. 

In response to a specific request by the APC and recognising that the implementation of the 
Action Plan is still very much an ongoing process, the LAS has reviewed the progress made 
by DG EMPL on a number of key actions related to the internal control systems for capturing 
and  processing  the  information  necessary  to  ensure  the  accurate  reporting  of  financial 
corrections  relating  to  Structural  Actions.  A  separate  review  of  the  progress  made  by  DG 
REGIO has been undertaken in parallel. 

Specifically, the IAS focused on actions 7.1 and 7.2 in relation to the Commission reporting 
processes, actions 1.3, 8.1 and 8.2 aimed at increasing the impact of the Commission's audit 
activity and the setting up of timing benchmarks and actions 6.1 and 6.2 linked to the Member 
States reporting processes. The responsibility for the last two actions falls to DG REGIO as 
Chef de File and hence they are not addressed in the present draft review report. Nevertheless, 
related  observations  regarding  these  actions,  which  have  been  agreed  with  DG  REGIO,  are 
annexed to the present final report. 

The  review  did  not  cover  directly  Member  States'  systems  and  processes  and  did  not  cover 
figures  prior  to  2007,  but  concentrated  on  the  measures  taken  late  2007/2008  to  improve 
consistency. In addition, the review did not re-examine the adequacy of the Commission DGs' 
audit processes giving rise to financial corrections/recoveries. 

There  are  no  observations/reservations  in  the  AAR  that  relate  to  the  area/process  audited. 
However,  the  2007  AAR  reservation  issued  by  DG  EMPL  has  an  indirect  impact  on  the 
suspension and financial correction procedures as noted in DG EMPL note to ABM steering 
group for the follow-up of AAR 2007 reservation as at 7 October 2008. 

Given  the  ongoing  nature  of  the  Action  Plan  and  the  fact  that  the  IAS  has  focused  on  the 
progress made, the main points are summarized below in terms of observations and issues for 
consideration, rather than firm recommendations, which the DG is invited to take on board as 
it continues its process of implementation. Consequently, there is no audit opinion provided 
on the state of internal controls in this area. The IAS also wishes to point out that the DG has 
confirmed it has already been implementing several issues that were raised for consideration 
in the draft review report. 

3.2  EMPL:  Internal  control  system  for  managing  the  new  Structural  Funds 

programming period - Phase I 

Objectives and Scope 

The  objective  of  this  audit  was  to  assess  the  adequacy  of  the  design  of  DG  EMPL's 
supervisory controls for gaining assurance on the set up of Member States' management and 

- 31 - 

 
control  systems  for  the  Structural  Funds  new  programming  period  2007-2013.  The  audit 
constitutes  the  first  phase  of  a  wider  IAS  objective  to  assess  DG  EMPL's  internal  control 
system,  with  the  current  emphasis  on  the  design  reflecting  the  fact  that  it  is  still  relatively 
early on in the new programming period. As part of a second phase, the IAS will consider the 
implementation of the current design. 

The  audit  included  the  DG's  controls  exercised  at  each  of  the  key  stages  leading  up  to  the 
point  at  which  payments  to  Member  States  are  triggered,  namely  the  National  Strategic 
Reference  Frameworks  (NSRFs),  Operational  Programmes  (OPs),  checks  on  Compliance 
Assessment Reports and on Audit Strategies. It also considered briefly the DG's preparations 
for  checking  Member  States'  obligations  regarding  the  need  to  establish  Communication 
Plans. Given that certain of these elements have already been finalised (NSRFs and OPs) and 
that  at  the  date  of  this  report,  certain  other  elements  are  still  in  the  process  of  being 
implemented (Communication Plans, Compliance Assessment Reports and Audit Strategies), 
this audit is forward looking to the extent it also considers possible improvements to the next 
programming period. 

It  should  be  noted  that  in  its  2007  AAR,  DG  EMPL  made  a  number  of  reservations 
concerning the management and control systems of certain Member States and, although these 
relate to the previous programming period, they are relevant to the extent that the scope of this 
audit specifically addresses the DG's preparations to implement new regulations designed in 
part to improve assurances on management and control systems in those Member States. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Total 

# 

# 

% Total 

# 

% Total 

2 

2 

2 

2 

100 

100 

0 

0 

0 

0 

3.3  REGIO:  Review  on  financial  corrections  and  recoveries  in  the  Structural  Funds 

Area 

Objectives and Scope 

Following  the  ECA's  recommendations  in  its  2006  Annual  Report  for  improving  the 
effectiveness of the Commission's supervisory role for structural actions, DG REGIO and DG 
EMPL drew up a joint action plan, COM 2008(97), dated 19th February 2008 to  implement 
these  recommendations,  including  actions  designed  to  ensure  the  complete,  transparent, 
reliable and consistent reporting on financial corrections and recoveries. 

In response to a specific request by the APC and recognizing that the implementation of the 
Action Plan is still very much an ongoing process, with a significant number of actions only 
due  for  implementation  by  31  December  2008,  the IAS  has  reviewed  the  progress  made  by 
DG REGIO on a number of key actions related to the internal control systems for capturing 
and  processing  the  information  necessary  to  ensure  the  accurate  reporting  of  financial 
corrections  relating  to  Structural  Actions.  A  separate  review  of  the  progress  made  by  DG 
EMPL has been undertaken in parallel. 

- 32 - 

 
 
 
 
 
 
Specifically, the IAS focused on actions 7.2 (due date, 30 September 2008), in relation to the 
Commission reporting processes, actions 1.3, 8.1 and 8.2 (due dates, 31 December 2008 for 
1.3 and 30 April 2008 for 8.1 and 8.2), aimed at increasing the impact of the Commission's 
audit activity and the setting up of timing benchmarks and actions 6.1 and 6.2 (due dates 30 
June and 31 December 2008 respectively), linked to the Member States reporting processes. 

The  review  did  not  cover  directly  Member  States'  systems  and  processes  and  did  not  cover 
figures  prior  to  2007,  but  concentrated  on  the  measures  taken  late  2007/2008  to  improve 
consistency. In addition, the review did not re-examine the adequacy of the Commission DGs' 
audit  processes  giving  rise  to  financial  corrections/recoveries,  which  has  been  audited  in 
2006. 

There  are  no  observations/reservations  in  the  AAR  that  relate  to  the  area/process  audited. 
However, the 2007 AAR reservation issued by DG REGIO has an impact on the suspension 
and financial correction procedures as noted in DG REGIO note to ABM steering group for 
the follow-up of AAR 2007 reservation as at 7 October 2008. 

Given  the  ongoing  nature  of  the  Action  Plan  and  the  fact  that  the  IAS  has  focused  on  the 
progress made, the main points are summarized below in terms of observations and issues for 
consideration, rather than firm recommendations, which the DG is invited to take on board as 
it continues its process of implementation. Consequently, there is no audit opinion provided 
on the state of internal controls in this area. 

3.4  REGIO:  Internal  control  system  for  managing  the  new  Structural  Funds 

programming period - Phase I 

Objectives and Scope 

The  objective  of  this  audit  was  to  assess  the  adequacy  of  the  design  of  DG  REGIO's 
supervisory controls for gaining assurance on the set up of Member States' management and 
control  systems  for  the  Structural  Funds  new  programming  period  2007-2013.  The  audit 
constitutes  the  first  phase  of  a  wider  IAS  objective  to  assess  DG  REGIO's  internal  control 
system,  with  the  current  emphasis  on  the  design  reflecting  the  fact  that  it  is  still  relatively 
early on in the new programming period. As part of a second phase, the IAS will consider the 
implementation of the current design. 

The  audit  included  the  DG's  controls  exercised  at  each  of  the  key  stages  leading  up  to  the 
point  at  which  payments  to  Member  States  are  triggered,  namely  the  National  Strategic 
Reference  Frameworks  (NSRFs),  Operational  Programmes  (OPs),  checks  on  Compliance 
Assessment Reports and on Audit Strategies. It also considered briefly the DG's preparations 
for  checking  Member  States'  obligations  regarding  the  need  to  establish  Communication 
Plans. Given that certain of these elements have already been finalised (NSRFs and OPs) and 
that  at  the  date  of  this  report,  certain  other  elements  are  still  in  the  process  of  being 
implemented (Communication Plans, Compliance Assessment Reports and Audit Strategies), 
this audit is forward looking to the extent it also considers possible improvements to the next 
programming period. 

It  should  be  noted  that  in  its  2007  AAR,  DG  REGIO  made  a  number  of  reservations 
concerning the management and control systems of certain Member States and, although these 
relate to the previous programming period, they are relevant to the extent that the scope of this 
audit specifically addresses the DG's preparations to implement new regulations designed in 
part to improve assurances on management and control systems in those Member States. 

- 33 - 

 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Total 

# 

# 

% Total 

# 

% Total 

2 

2 

2 

2 

100 

100 

0 

0 

0 

0 

3.5 REGIO: Follow-up financial corrections in Cohesion fund (2006) 

Objectives and Scope 

The  objective  of  the  follow-up  engagement  is  to  assess  progress  made  in  implementing  the 
accepted recommendations that resulted from the Audit of Financial Corrections in Cohesion 
fund carried out from April to November 2006. 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the specific recommendations in the original audit. 

4. EXTERNAL POLICIES 

4.1 AIDCO/ECHO: Follow-up on FAFA implementation 

Objectives and Scope 

The objective of this follow-up engagement is to assess progress made in implementing the 
accepted recommendations that resulted from the audit on the Implementation of the FAFA 
agreement with the UN by DGs AIDCO and ECHO carried out in 2006 (final report dated 28 
July 2006). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole, 
but focuses on the 8 recommendations made at the time of the original audit and accepted by 
DGs AIDCO and ECHO. 

Two recommendations were rejected at that time by the DGs and thus are excluded from the 
scope of this follow-up. The residual risk related to those two recommendations rejected, i.e. 
indirect costs, was covered by a special audit on the "Eligibility of Costs under the Financial 
and  Administrative  Framework  Agreement  with  the  United  Nations  by  DG  AIDCO"  carried 
out  in  2007  (final  report  dated  20  June  2007).  As  a  result  of  this  audit,  four  new 
recommendations,  accepted  by  DG  AIDCO,  were  issued  to  replace  the  2  recommendations 
originally rejected. The follow up of the 4 new recommendations will be carried out in 2009 
and  will 
their  effective 
implementation. 

to  selected  Delegations 

to  properly  assess 

include  visits 

4.2 AIDCO: Second Follow-up on the in-depth audit 

Objectives and Scope 

The  objective  of  this  second  follow-up  engagement  is  to  assess  progress  made  in 
implementing the accepted recommendations resulting from the In-depth audit of DG AIDCO 
carried out in 2004 (final report dated 26 April 2004) and that were still outstanding as a result 

- 34 - 

 
 
 
 
 
 
 
of the first follow-up audit conducted in 2006 (final report dated 22 February 2006), i.e. 22 
recommendations. This follow-up audit does not result in an assessment of the adequacy of 
controls as a whole but focuses on these 22 recommendations. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Total 

# 

# 

% Total 

# 

% Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

4.3 AIDCO: Financial Management procedures of Directorate C related to its devolved 

delegations 

The audit was conducted in co-operation with the IAS as part of a series of audits covering all 
of the AIDCO geographical Directorates. 

Directorate C and its devolved Delegations are responsible for expenditure under the Budget 
and under the various EDFs. 

The objective of the audit was to ensure that financial management and financial circuits in 
devolved Delegations was in compliance with instructions, together with the monitoring and 
supervision of Delegation activity, and reporting Duties, including those of Headquarters. 

The financial management of Directorate C is one of the critical systems of AIDCO because 
of the following risks: 

The magnitude of expenditure in relation to AIDCO's total expenditure.   

Reputational  risk  in  the  face  of  other  major  Donors,  working  in  critical  areas  of  the 
developing world.   

The  changes  in  the  procedures  and  systems  that  are  occasioned  by  the  migration  of 
information  held  in  the  EDF  financial  system  OLAS  into  the  CRIS  information  system.

The development of the 10th EDF procedures 

The  audit  worked  on  the  standard  that  the  procedures  should  ensure  financial  management 
systems  where  accounting  transactions  were  made  and  recorded  in  a  complete,  accurate, 
timely and transparent manner. 

No  recommendations  classed  as  critical  have  been  made  as  a  result  of  the  audit  work 
undertaken. Ten recommendations were made which have been classified as very important. 
These  are  listed  at  the  end  of  this  summary.  Each  of  these  recommendations  is  made  to 
improve  the  internal  controls  systems  in  place,  in  particular  to  ensure  that  there  is  adequate 
feed back to Headquarter units. It is important that managers at HQ have assurance that the 
instructions  and  procedures  that  they  have  issued  have  been  carried  out  or  properly 
implemented  by  Delegations.  Similarly,  during  times  of  change,  it  is  important  that  the 
performance of management systems is monitored, especially if they are used in a number of 
remote locations. In both cases information should be available so that rapid and appropriate 
corrective action can be taken, should it be needed. 

- 35 - 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

10 

6 

1 

17 

10 

6 

1 

17 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

4.4 AIDCO: Financial Management of Regional Projects 

Objectives and Scope 

The  objectives  and  scope  of  the  present  audit  on  "Financial  Management  of  Regional 
Programmes"  are  in  line  with  IAS'  audit  strategy  of  providing  management  with  an 
independent opinion on the current state of the Commissions control. 

This audit focuses on Delegations' (DELs) and HQ activities in the management of Regional 
Programmes,  understood  as  Multi  Country  Programmes,  and  covers  the  related  monitoring 
and  supervisory  activities  by  HQ  on  DELs  activities.  The  general  audit  objective  was  to 
assess  the  compliance,  effectiveness  of  the  coordination  and  the  division  of  responsibility 
between  the  various  actors  involved,  the  financial  and  operational  management  and  the 
monitoring and reporting activities. 

Programmes  implemented  through  joint  management  under  F  AFA  were  excluded  from  the 
scope of the present audit as they were covered under a previous IAS audit. In addition, the 
IAS did not visit projects in the field or Project Management Units and RAO as ECA covers 
these aspects. Rather, the present audit focused on control mechanisms set up by and available 
for  the  Commission.  The  IAS  liaised  with  ECA  on  the  project  sample  and  on  missions  to 
Delegations and to avoid a duplication of effort. Consequently, the IAS limited its sample in 
the Intra-ACP programmes in AIDCO HQ -Directorate C. 

There  are  no  observations/reservations  in  DG  AIDCO's  2007  AAR  that  relate  to  the  area 
audited. 

It  should  be  noted  that  currently  OLAF  is  investigating  two  cases  concerning  two 
organizations  involved  in  the  implementation  of  a  number  of  regional  projects  managed  by 
AIDCO HQ. In the case of one of these organisations, potential irregularities were reported in 
January 2007 to AIDCO's management by an external consultant recruited by a Member State 
and AIDCO's management informed OLAF. Moreover, concerning this organisation, AIDCO 
has  provided  the  IAS  with  draft  audit  reports  issued  by  external  auditors  in  February  2008 
identifying  potential  significant  irregularities,  currently  being  validated.  Based  on  the 
Memorandum  of  Understanding  between  OLAF  and  the  IAS,  we  have  sought  information 
from OLAF concerning the current status of these cases. However, given the nature of these 
investigations and the confidentiality requirements, as of the date of this report, no additional 
information has been obtained from OLAF yet. 

- 36 - 

 
 
 
 
 
 
 
 
 
 
 
Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

9 

3 

12 

9 

3 

12 

100 

100 

100 

0 

0 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

9 

3 

12 

9 

3 

12 

100 

100 

100 

0 

0 

0 

0 

0 

0 

4.5 AIDCO: Financial Management of main Programmes in Directorate В 

Objectives and Scope 

The  overall  objective  of  this  audit  is  to  provide  an  opinion  on  the  compliance  with  the 
Commission  rules  and  the  effectiveness  and  efficiency  of  devolved  operations  regarding: 

•  The  implementation  of  Financial  Circuits  and  specific  related  aspects  of  financial 

management in Latin America (LA) Delegations; 

•  The  monitoring  and  support  activities  by  HQ  (i.e.  Directorate  B)  of  the  LA 

Delegations' and 

•  Directorate В and LA Delegations' reporting duties. 

This audit was selected based on the IAS Strategic audit plan for 2007-2009, which took into 
account  a  co-ordinated  approach  between  the  IAS  and  the  IAC  aiming  at  complementary 
coverage of the audit plans while targeting the highest risks. The scope was further defined in 
the IAS Risk assessment, conducted in the preliminary phase of the audit. For details on the 
areas excluded from the scope of the audit, see section 2.1.2. 

The  LA  Delegations  network  belonging  to  AIDCO  В  consists  of  17  Delegations.  Applying 
the principle of representativeness, the IAS selected four Delegations. Three other significant 
Delegations  were  initially  shortlisted  but  finally  not  selected  due  to  overlapping  with  other 
audit  and  control  activities,  lack  of  Delegation's  reply  and  problems  of  Delegations'  staff 
availability, respectively. 

There are no observations/reservations in the AAR that relate to the area/process audited. 

The fieldwork cut off date when drafting this report was 31 October 2008. While requested 
by the IAS at the beginning of the fieldwork phase (June 2008), DG AIDCO provided us six 
months later (1st December 2008) with supporting documents on the ex-ante assessment in the 
context to the FR Arti 64 due to filing problems as explained by DG AIDCO. Although the 
cut-off  date  was  exceeded,  due  to  the  importance  of  the  issue,  the  IAS  analyzed, 

- 37 - 

 
 
 
 
 
 
 
 
 
 
 
exceptionally, the additional documents to provide a complete picture of this issue at the date 
of the final report (see further details in section 2.2, observation 1, point 1). 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

# 

% Total 

# 

% Total 

9 

7 

16 

9 

7 

16 

100 

100 

100 

0 

0 

0 

0 

0 

0 

4.6 ELARG: Follow-up on ex-post control activities 

Objectives and Scope 

The objective of this first follow-up engagement is to assess progress made in implementing 
the  accepted  recommendations  that  resulted  from  the  audit  of  ex-post  activities  in  DG 
ELARG carried out in 2006 (final report dated 20 December 2006). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but focuses on the 15 recommendations made at the time of the original audit. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Total 

# 

# 

% Total 

# 

% Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

Auditee's 
Assessment 

In Progress 

Completed 

Priority 

Very important 

Total 

# 

# 

% Total 

# 

% Total 

1 

1 

1 

1 

100 

100 

0 

0 

0 

0 

4.7 ELARG: Readiness assessment/phasing-in of delegations in Balkans 

Objectives and Scope 

The overall objective of this engagement was to assess the process of phasing-in the European 
Agency for Reconstruction (EAR) into DG ELARG and the four Delegations (DELs) in the 
Balkans (fYROM, ECLO/Kosovo under UN 1244/99, Serbia and Montenegro) as a result of 
its  closure  by  the  end  of  2008.  This  process  was  accompanied  with  the  devolution  of  the 
activities of the EAR operational centre's to the four Delegations. 

The  engagement  was  planned  in  accordance  with  the  2008  IAS  Audit  plan  and  follows  the 
IAS  audit  issued  on  27  May  2008  on  the  "Planned  Procedures  for  Winding  Down  the 
Operations of the EAR by the End of 2008". 

- 38 - 

 
 
 
 
 
 
 
 
 
 
 
 
 
The objectives for the current engagement were twofold: 

-  Short-term objective: to assess the readiness of the DELs to take over the contracts and to 

continue the implementation of the ongoing projects without major disruptions; 

-  Medium-term objective: to assess the general assurance mechanisms and Internal Control 
Standards  (ICS)  put  in  place  in  the  DELs  in  a  new  devolution  context;  changes  in 
management system for the HQ; new financial responsibilities for Delegations; post hand-
over and reporting mechanisms. 

The EAR was set up following a decision of the European Council in Cologne, Germany, on 
4 June 1999. The decision of the Council to extend the mandate of the EAR until the end of 
2008 was made in 2006. The phasing-out of the EAR and the phasing-in of the Delegations 
was  designed  as  a  gradual  process  in  order  to  facilitate  the  continuation  of  activities.  The 
number  of  ongoing  contracts  transferred  is  estimated  to  be  676.  The  closing-down  and 
phasing-in processes are the first exercises of this nature ever conducted by the Commission. 

Taking into account the objectives of the engagement as described above, the work covered 
DG  ELARG  HQ  units  (B2,  C2  and  C3  and  E)  involved  in  the  phasing-in  of  the  DELs,  the 
Task Force, and the four Delegations, of which three were visited. 

The  fieldwork  was  finalized  on  11  November  2008.  All  observations  and  recommendations 
relate to the situation as of that date. 

There  are  no  observations/reservations  in  DG  ELARG's  AAR  2007  that  relate  to  the 
area/process audited. 

Acceptance 
Status 

Yes 

No 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

# 

% Total 

# 

% Total 

5 

6 

1 

12 

5 

6 

1 

12 

100 

100 

100 

100 

0 

0 

0 

0 

0 

0 

0 

0 

4.8 RELEX: Follow-up on ex-post control activities 

Objectives and Scope 

The objective of the follow-up engagement was to assess the progress made in implementing 
the  accepted  recommendations  that  resulted  from  the  audit  of  Ex-Post  Control  (EPC) 
activities in DG RELEX carried out in 2006 (final report dated 22 December 2006). 

This follow-up audit does not result in an assessment of the adequacy of controls as a whole 
but  focuses  on  the  seven  (IC,  4VI,  21)  recommendations  made  at  the  time  of  the  original 
audit. 

- 39 -