COMMISSION STAFF WORKING DOCUMENT Implementation of recommendations and audit executive summaries
Date: 2012-09-28
Institutions: European Commission
Subjects: administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EUROPEAN 
COMMISSION 

Brussels, 28.9.2012  
SWD(2012) 283 final 

COMMISSION STAFF WORKING DOCUMENT 

Implementation of recommendations and audit executive summaries 

Accompanying the document 

Report from the Commission to the European Parliament and the Council 

Annual Report to the Discharge Authority 
on internal audits carried out in 2011 
(Article 86(4) of the Financial Regulation) 

{COM(2012) 563 final} 

EN 

   EN 

 
 
 
 
  
 
COMMISSION STAFF WORKING DOCUMENT 

Implementation of recommendations and audit executive summaries 

Accompanying the document 

Report from the Commission to the European Parliament and the Council 

Annual Report to the Discharge Authority 
on internal audits carried out in 2011 
(Article 86(4) of the Financial Regulation) 

EN 

2 

   EN 

 
TABLE OF CONTENTS 

1. 

2. 

Implementation of Recommendations ......................................................................... 9 

Executive summaries ................................................................................................. 10 

2.1. 

Governance ................................................................................................................ 10 

2.1.1.  Fraud .......................................................................................................................... 10 

2.1.1.1.  AGRI Fraud Prevention and Detection ...................................................................... 10 

2.1.2.  Ethics.......................................................................................................................... 11 

2.1.2.1.  COMP: Follow up on Handling of sensitive information and Ethics ........................ 11 

2.1.3.  Business Continuity management .............................................................................. 11 

2.1.3.1.  Consolidated: Follow up on Business Continuity Management ................................ 11 

2.2. 

Assessing the Commission's Performance................................................................. 12 

2.2.1.  ENTR & EACI: Performance Audit of the Entrepreneurship and Innovation 

Programme (EIP) managed by DG ENTR and the EACI.......................................... 12 

2.2.2.  ECHO: Performance of ECHO's operational activities ............................................. 13 

2.2.3.  MARKT: Monitoring by DG MARKT of the Application of Public Procurement 

Rules in the Member States........................................................................................ 15 

2.3. 

Control strategies ....................................................................................................... 16 

2.3.1.  Research Area ............................................................................................................ 16 

2.3.1.1.  INFSO: DG INFSO's Control Strategy for on-the-spot control and fraud prevention 

and detection .............................................................................................................. 16 

2.3.1.2.  RTD: DG RTD's Control Strategy for on-the-spot control and fraud prevention and 

detection ..................................................................................................................... 17 

2.3.2.  External Aid ............................................................................................................... 19 

2.3.2.1.  DEVCO: EDF Grants................................................................................................. 19 

2.3.3.  Rural Development .................................................................................................... 20 

2.3.3.1.  AGRI: Audit on the Internal Control System for managing the Instrument for Pre-

Accession Assistance for Rural Development in DG AGRI ..................................... 20 

2.3.4.  TEN-T EA.................................................................................................................. 21 

2.3.4.1.  TEN-T EA: Control strategy in the Trans-European Transport Network Executive 

Agency (TEN-T EA).................................................................................................. 21 

2.4. 

Global Navigation Satellite System Programs (GNSS) ............................................. 22 

2.4.1.  ENTR: Global Navigation Satellite System Programs (part: Governance, Risk 

management and Project Management) ..................................................................... 22 

EN 

3 

   EN 

 
2.4.2.  ENTR : Global Navigation Satellite System Programs (part: Actions, Grant & 

Procurement Management) ........................................................................................ 23 

2.4.3.  ENTR: Global Navigation Satellite System Programs (part: Financial Circuits, 

Financial Management and Accounting for Fixed Assets) ........................................ 25 

2.5. 

Financial Management Process.................................................................................. 26 

2.5.1.  Guarantees.................................................................................................................. 26 

2.5.1.1.  Consolidated: Management of Guarantees (BUDG, ELARG, DIGIT, EACI).......... 26 

2.5.1.2.  BUDG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI).................... 27 

2.5.1.3.  ELARG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI).................. 27 

2.5.1.4.  DIGIT: Management of Guarantees (BUDG, ELARG, DIGIT, EACI) .................... 28 

2.5.1.5.  EACI: Management of Guarantees (BUDG, ELARG, DIGIT, EACI)...................... 28 

2.5.2.  Procurement ............................................................................................................... 28 

2.5.2.1.  OIB: Management of Procurement in OIB ................................................................ 28 

2.5.2.2.  HR: Management of Procurement by DG HR ........................................................... 29 

2.5.2.3.  OIB: 2nd Follow-up Audit of the management of Procurement Contracts in OIB ... 29 

2.5.2.4.  JRC: Follow-up audit on Procurement in JRC........................................................... 29 

2.5.3.  Recoveries .................................................................................................................. 30 

2.5.3.1.  EAC: Follow-up audit on Recoveries ........................................................................ 30 

2.5.3.2.  BUDG: Follow-up audit on Recoveries..................................................................... 30 

2.5.3.3.  LS: Follow-up audit on Recoveries............................................................................ 30 

2.5.3.4.  INFSO: Follow-up audit on Recoveries..................................................................... 30 

2.5.3.5.  DEVCO: Follow-up audit on Recoveries .................................................................. 30 

2.5.3.6.  EACEA: Follow-up audit on Recoveries................................................................... 31 

2.6. 

Information Technologies .......................................................................................... 31 

2.6.1.  Local IT...................................................................................................................... 31 

2.6.1.1.  DG EMPL: Audit on Management of Local IT in DG EMPL .................................. 31 

2.6.2.  Security of IT environment in subcontracted projects IT .......................................... 32 

2.6.2.1.  REGIO: Audit on Security of IT environment in subcontracted projects IT in DG 

REGIO........................................................................................................................ 32 

2.6.3.  Management of the telecommunication infrastructure and services sTESTA........... 33 

2.6.3.1.  DIGIT: Audit on the Management telecommunication infrastructure and services 

sTESTA in DG DIGIT ............................................................................................... 33 

EN 

4 

   EN 

 
2.6.4.  Enterprise Europe Network IT tools .......................................................................... 34 

2.6.4.1.  EACI: Audit on Enterprise Europe Network IT tools in EACI ................................. 34 

2.6.5.  Follow-ups on IT audits ............................................................................................. 35 

2.6.5.1.  TAXUD: Follow-up audit on the large IT Systems in DG TAXUD ......................... 35 

2.6.5.2.  TAXUD: Follow-up audit on New IT Organisation and Contractual Framework .... 35 

2.6.5.3.  PMO: Follow-up audit on Management of Local IT ................................................. 35 

2.6.5.4.  LS: Follow-up audit on Management of Local IT ..................................................... 36 

2.6.5.5.  OLAF: Follow-up audit on the Anti-fraud Information System (AFIS).................... 36 

2.6.5.6.  INFSO: Follow-up Audit on the Management of Research Information Systems in 

DG INFSO ................................................................................................................. 36 

2.6.5.7.  RTD: Follow-up Audit on the Management of Research Information Systems in DG 

RTD............................................................................................................................ 36 

2.7. 

Other audits ................................................................................................................ 36 

2.7.1. 

JRC: Audit on Competitive Activities ....................................................................... 36 

2.7.2.  BUDG: Implementation of the Internal Control standard 13 on Accounting and 

Financial reporting ..................................................................................................... 38 

2.8. 

Follow-up audits (if not in the above categories)....................................................... 39 

2.8.1.  RTD: Follow-up audit on DG RTD's Internal Control System for managing FP7 – 

Design ........................................................................................................................ 39 

2.8.2.  REA: Follow-up audit on the set up of Internal Controls and Financial Management 

Systems – Design in REA .......................................................................................... 39 

2.8.3.  HR-DS: Follow-up audit on Monitoring of Security as managed by HR-DS ........... 39 

2.8.4.  AGRI: Follow-up audit on Rural Development......................................................... 39 

2.8.5. 

INFSO: Follow-up audit on DG INFSO's Internal Control System for managing FP7 
– Design ..................................................................................................................... 40 

2.8.6.  ERCEA: Follow-up audit on ERCEA on the set up of internal controls/financial 

management system – Design.................................................................................... 40 

2.8.7.  EMPL: Follow-up of the audit on the internal control systems for managing the new 

Structural Funds programming period – Phase II ...................................................... 40 

2.8.8.  REGIO: Follow-up of the audit on the internal control systems for managing the new 
Structural Funds programming period – Phase II ...................................................... 40 

2.8.9.  HOME: 2nd Follow-up audit on Grants under Shared management of the European 

Refugee Fund in DG HOME...................................................................................... 40 

2.8.10.  TEN-T EA: Joint IAS/TEN-T EA IAC Follow-up audit on Audit of the Management 
of the Operational Budget in TEN-T EA ................................................................... 40 

EN 

5 

   EN 

 
2.8.11.  ECHO: 2nd Follow-up audit of NGOs funding in DG ECHO .................................. 41 

2.8.12.  ELARG: 2nd Follow-up audit on "Ex-post control activities in DG ELARG" ......... 41 

2.8.13.  FPI: Follow-up audit on the financial management of the Common Foreign and 

Security Policy Budget............................................................................................... 41 

2.8.14.  OIL: Second follow-up audit on the Evaluation of targeted internal control standards 
in OIL ......................................................................................................................... 41 

2.8.15.  HR & OIB: 2nd Follow-up Audit of the Management of Building Procurement 

Contracts by DG HR and OIB ................................................................................... 41 

2.8.16.  EACI: Follow-up audit on the management of the Operational Budget of the EACI 42 

2.8.17.  MARKT: Follow-up audit on Monitoring the Implementation of EU law................ 42 

2.8.18.  ENV: Follow-up audit on Monitoring the Implementation of EU law...................... 42 

2.8.19.  SG: Follow-up audit of the Consolidated report on Monitoring the Implementation of 
EU law........................................................................................................................ 42 

2.8.20.  MARE: Follow-up audit on the European Fisheries Fund as managed by DG MARE

.................................................................................................................................... 42 

2.8.21.  OIB: Follow-up audit on the Inventory Process as managed by OIB........................ 42 

2.8.22.  OIL: Follow-up audit on the Inventory Process as managed by OIL ........................ 43 

2.8.23.  EPSO: Follow-up of the Limited Review on the selection process as managed by 

EPSO .......................................................................................................................... 43 

2.8.24.  SANCO: Second Follow-up on Grant management (Food & Feed) in DG SANCO 43 

2.8.25.  PMO: Follow-up audit on the activities of PMO/6 ISPRA........................................ 43 

2.8.26.  DEVCO: Follow-up audit of remaining recommendations on 2003 IAS In-depth 

Audit of DG AIDCO.................................................................................................. 43 

2.8.27.  EAC: Follow-up audit of remaining recommendations on 2004 IAS In-depth Audit 

of DG EAC................................................................................................................. 44 

2.8.28.  ELARG: Follow-up audit of remaining recommendations on 2003 IAS In-depth 

Audit of DG ELARG ................................................................................................. 44 

2.8.29.  ESTAT: Follow-up audit of remaining recommendations on 2003 IAS In-depth 

Audit of DG ESTAT .................................................................................................. 44 

EN 

6 

   EN 

 
1. 

IMPLEMENTATION OF RECOMMENDATIONS 

Table  1  sums  up  the  level  of  implementation  of  accepted  recommendations,  based  on  the 
auditees’  assessments,  for  IAS  recommendations  made  during  the  period  2007-20111.  The 
recommendations not yet implemented are broken down by period overdue on the right-hand 
side of the table. 

Year 

Priority 

Total 

Implemented 

In progress (by number of months overdue) 

No 

% 

No 

% 

No 
delay 

0-6 

6-12 

12+ 

Critical 

Very important 

2007 

Important 

Desirable 

Critical 

Very important 

2008 

Important 

Desirable 

Critical 

Very important 

2009 

Important 

Desirable 

Critical 

Very important 

2010 

Important 

Desirable 

Critical 

Very important 

2011 

Important 

Desirable 

4 

123 

159 

33 

319 

0 

138 

164 

13 

315 

2 

138 

144 

5 

289 

2 

126 

149 

4 

281 

0 

56 

101 

1 

158 

4 

121 

158 

32 

315 

0 

130 

154 

12 

296 

2 

127 

132 

5 

99% 

94% 

2 

1 

1 

4 

8 

10 

1 

19 

11 

12 

1% 

6% 

1 

1 

2 

266 

92% 

23 

8% 

2 

79 

104 

3 

188 

67% 

0 

6 

13 

1 

20 

47 

45 

1 

93 

50 

88 

18 

14 

25 

24 

4 

5 

1 

33% 

32 

49 

10 

44 

83 

6 

5 

13% 

138 

87% 

127 

11 

2 

1 

1 

4 

7 

9 

1 

17 

11 

12 

23 

2 

2 

TOTAL 2007-2011 

1362 

1085 

80% 

277 

20% 

161 

60 

10 

46 

Table 1. Level of implementation of recommendations based on auditees’ assessments 

1 

The  duplication  of  recommendations  resulting  from  DGs'  split  and  cut-off  consideration  to  classify 
recommendations by year explains the changes of figures compared to Table 1 in the 2010 report. 

EN 

7 

   EN 

 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
 
                                                 
2. 

EXECUTIVE SUMMARIES 

This working document also contains the original executive summaries (reflecting the state 
of play at the time when the audits were finalised) of audit engagements finalised by the 
IAS in 20112.  Each  summary  underwent the applicable standard professional validation and 
contradictory  procedures  between  auditor  and  auditee  at  the  time  of  finalisation.  It  also 
contains statistical information for the acceptance of the recommendations 

2.1. 

Governance 

2.1.1.  Fraud 

2.1.1.1.  AGRI Fraud Prevention and Detection 

a. Background 

DG AGRI budget finances the Common Agricultural Policy expenditure mainly through two 
shared  management  Funds,  the  European  Agricultural  Guarantee  Fund  (EAGF)  which  fully 
finances  EU  direct  aid  and  market  measures  (43,7  billion  €  in  2011)  and  the  European 
Agricultural  Fund  for  Rural  development  (EAFRD)  which  co-finances  rural  development 
programmes  (14,4  billion  €).  Expenditure  under  both  funds  is  managed  through  some  81 
national or regional paying agencies (sometimes through delegated bodies as well) in the 27 
Member States (MSs). The Commission performs a supervisory role over national systems to 
obtain  reasonable  assurance  on  the  effective  functioning  of  national  systems  and  assumes 
final responsibility for the implementation of the budget. 

b. Audit Objectives 

The  main  objective  of  the  audit  was  to  assess  the  adequacy  and  effective  application  of  the 
governance, risk management and internal control process for fraud prevention, detection and 
follow-up of fraud cases by DG AGRI in accordance with the competences established by the 
Commission. 

c. Audit Scope 

The scope of the audit has covered: 

• 

• 

DG  AGRI  internal  control  system  for  combating  fraud;  in  particular,  prevention, 
detection and corrective measures, including its supervisory role with respect to MSs 
in the framework of shared management; 

The division of competencies and the coordination between OLAF and DG AGRI. 

DG  AGRI's  Annual  Activity  Report  2010  included  one  reservation  concerning  serious 
deficiencies  in  the  Integrated  Administration  and  Control  Systems  (IACS)  in  Bulgaria, 
Romania and Portugal. 

2 

The reports finalised by 1 February 2011 and the ML on the split of the DGs finalised in March 2011, 
are included in the 2010 report and are, therefore, not included in the 2011 report. Likewise, the reports 
issued in 2011 but finalised by 31 January 2012 are included in the 2011 report. 

EN 

8 

   EN 

 
                                                 
The fieldwork was finalised at the end of June 2011. All observations and recommendations 
relate to the situation as of that date. The audit was finalised on 28 October. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

2.1.2.  Ethics 

# 

4 

0 

4 

# 

4 

0 

4 

% Total 

100 

0% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.1.2.1.  COMP: Follow up on Handling of sensitive information and Ethics 

The  objective  of  this  engagement  was  to  assess  the  progress  made  in  implementing  the 
remaining accepted recommendations addressed to DG COMP following the final audit report 
on handling of sensitive information and ethics in DG COMP issued in 2009.  

Based on the results of its follow-up audit, finalized on 27 June, the IAS assessed that they 
have  all  been  adequately  and  effectively 
important 
recommendation.  

implemented,  except  for  one 

2.1.3.  Business Continuity management 

2.1.3.1.  Follow up on Business Continuity Management 

In 2009 the IAS finalised the audit on Business Continuity Management (BCM). The overall 
objective  of  the  audit,  conducted  in  the  Secretariat-General  (in  its  central  role)  and  in  three 
operational  DGs  (DG  HR,  DG  JLS  and  DG  TAXUD),  was  to  assess  the  adequacy  and  the 
effectiveness  of  the  BCM  process  in  the  Commission.  At  that  time,  the  IAS  considered  the 
process of implementing and adapting BCM to be still evolving. Consequently providing an 
audit opinion was deemed more appropriate at the moment of following up the original audit, 
when the BCM process was expected to be more mature and the accepted recommendations 
addressed to the different DGs implemented. 

The in-depth follow-up evaluated the progress made by each of the Services in implementing 
the respective action plans (the results of which are described in individual notes, one per DG) 
and  re-assessed  the  adequacy  of  controls  as  a  whole,  to  provide  an  opinion  on  the  BCM 
process  in  the  Commission.  The  IAS  assessed  that  all  the  recommendations  addressed  to 
individual  DGs  had  been  adequately  and  effectively  implemented  (except  for  one 
recommendation  addressed  to  the  SG)  and  that  the  control  system  in  place  provides 
reasonable assurance regarding the achievement of the business objectives set up for the BCM 
process,  except  for  the  issue  relating  to  BCM  supervision.  The  re-assessment  of  the  control 
system  in  place  did  not  identify  any  additional  significant  (Critical  or  Very  Important) 
weaknesses. The follow-up audit was finalised on 31 January 2012. 

EN 

9 

   EN 

 
 
2.2. 

Assessing the Commission's Performance 

2.2.1.  ENTR  &  EACI:  Performance  Audit  of  the  Entrepreneurship  and  Innovation 

Programme (EIP) managed by DG ENTR and the EACI 

a.  Background 

In order to meet the objectives of the renewed Lisbon strategy, and thus stimulate growth and 
employment in Europe, a Competitiveness and Innovation Framework Programme (CIP) has 
been adopted for the period 2007-2013. It entered into force on the 9 November 2006 with a 
budget of € 3.6 billion. The Entrepreneurship and Innovation Programme (EIP) is the largest 
expenditure  component  within  the  CIP  with  €2.17  billion.  Its  aim  is  to  improve  the 
competitiveness  and  innovativeness  of  European  enterprises  and  particularly  small  and 
medium sized enterprises. The EIP comprises a wide variety of actions. It is managed by DG 
Enterprise  and  Industry  (ENTR),  DG  Economic  and  Financial  Affairs  (ECFIN)  (Financial 
Instruments),  DG  Environment  (ENV)  (Eco-Innovation)  and  the  Secretariat-General.  DG 
Information Society and Media (INFSO) and DG Energy (ENER), which participate in CIP, 
are not involved in EIP. The implementation of certain parts of the EIP has been delegated to 
the  European  Investment  Fund  (EIF)  (Financial  Instruments)  and  Executive  Agency  for 
Competitiveness  and  Innovation  (EACI)  (Eco-Innovation  market  replication  projects, 
Enterprise Europe Network and Intellectual Property Rights [IPR] projects). 

The  IAS  audit  took  place  in  a  context  of  growing  interest  in  programme  performance.  The 
current  Multiannual  Financial  Framework  (MFF)  2007-2013  will  soon  come  to  an  end  and 
intensive discussions are currently ongoing about the next Multiannual Financial Framework 
2014-2020,  the  new  legal  base  and  the  future  of  the  EIP.  Furthermore,  attention  in  the 
ongoing revision of the Financial Regulation and the discussions on the new legal bases will 
be put on simplification and efficiency gains. The Commission reiterated its commitment to 
simplification in its June 2011 Communication on the next Multiannual Financial Framework. 
The Secretary-General and the Director General of DG BUDG also recently issued guidance 
on simplification and performance measurement for post-2013 spending programmes. 

b. Audit Objectives 

The objective of the audit was to assess: 

• 

• 

• 

the  adequacy  of  the  policies  and  procedures  put  in  place  by  management  for 
promoting, monitoring and evaluating performance; 

the adequate and effective application of the internal control system (ICS) supporting 
this process, and 

the  risk  management  and  governance  processes  related  to  the  EIP  managed  by  DG 
ENTR,  DG  ENV  and  the  EACI.  In  particular,  the  audit  assessed  whether  the  ICS 
provides reasonable assurance regarding: 

– 

– 

compliance with the main rules and guidelines in use in the Commission; 

economy,  effectiveness  and  efficiency  of  the  processes  mentioned  in  the 
scope. In this respect, the need for simplifying internal administrative rules and 
procedures was taken into account; and 

EN 

10 

   EN 

 
– 

reporting of information on performance. The audit will focus on the internal 
control systems related to the reporting processes between DGs as well as with 
EACI  and  the  usefulness  of  the  milestones  and  indicators  in  place  for  an 
effective and efficient monitoring of the programme. 

c.  Audit Scope 

The scope of the audit included the Entrepreneurship and Innovation Programme (EIP) since 
it  is  the  largest  component  of  the  Competitiveness  and  Innovation  Programme  (CIP)  and 
because the successor of the current CIP under the new Multiannual Financial Framework will 
probably not include the two other programmes of the CIP. Only the parts of the EIP managed 
by DG ENTR and the EACI were included in the scope. The parts of the EIP managed by DG 
ECFIN  (financial  instruments)  were  excluded  from  the  scope,  because  they  are  managed 
under a different mode (joint management) and because the European Court of Auditors has 
recently  audited  them.  DG  ENV,  which  outsourced  almost  the  whole  management  of  Eco-
innovation to EACI, was consulted but not subjected to this audit. 

There are no observations/reservations in the respective DGs' and Agency's AARs that relate 
to the area/process audited. 

The fieldwork was finalised on 7 June 2011. All observations and recommendations relate to 
the situation as of that date. The audit was finalised on 19 October. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

2 

2 

4 

# 

2 

2 

4 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.2.2.  ECHO: Performance of ECHO's operational activities 

a. Background 

The  Directorate  General  for  Humanitarian  Aid and  Civil  Protection  (ECHO)  aims  at  saving 
and preserving life, preventing and alleviating human suffering and safeguarding the integrity 
and  human  dignity  of  populations  affected  by  natural  or  man-made  disasters.  It  provides 
humanitarian aid to the most vulnerable victims of disasters in their immediate aftermath and 
also  in  cases  of  complex  and  protracted  crises,  whenever  needs  arise  that  overwhelm 
capacities of authorities of the countries concerned. Beyond disaster response, ECHO strives 
to enhance disaster prevention and preparedness, both within the EU and beyond. 

In 2010, the Commission's commitments to new or protracted crises and disaster preparedness 
totalled €1.115 million. An important share of the funding was devoted to protracted crises in 
Africa.  Substantial  assistance  was  also  provided  in  South  West  Asia  (Afghanistan  and 
Pakistan) and the Caribbean Region (Haiti).  

ECHO  does  not  implement  assistance  programmes  itself.  It  fulfils  its  mission  by  funding 
actions through partners that have been screened in terms of financial and operational capacity 
and with which it has signed a Framework Partnership Agreement. In 2010, ECHO's budget 

EN 

11 

   EN 

 
 
for  humanitarian  actions  was  implemented  through  a  wide  range  of  implementing  partners, 
i.e. 50% by NGOs, 39% by UN Agencies and 11% by International Organisations.  

b. Audit Objectives 

One  of  the  objectives  of  the  IAS  is  to  carry  out  performance  audits  focussing  on  the 
effectiveness,  efficiency  and  economy  of  the  use  of  resources.  The  IAS  examines 
performance in the context of the "proper implementation of budgetary procedures", (Article 
85  FR)  that  include  the  concept  of  "sound  financial  management"  (Article  27  and  28a  FR), 
and  the  assessment  of  "the  performance  of  departments  in  implementing  policies, 
programmes and actions", (Article 86 FR).  

Taking into account ECHO's mission and objectives mentioned above, the general IAS audit 
objective was  to  reply  to the following question:  Is  ECHO  spending  on  humanitarian  crises 
used to best effect for preventing and alleviating the consequences of disasters?  

Detailed audit objectives included ECHO's: 

• 

• 

• 

• 

• 

• 

Preparedness to meet the needs of populations affected by disasters.  

Investment  in  DRR  and  disaster  preparedness  to  increase  the  resilience  of  regions 
recurrently affected by disasters.  

Rapidity  and  flexibility  of  procedures  to  ensure  that  the  delivery  of  aid  can  be 
executed within a reasonable period of time. 

Quality of the aid delivered.  

Visibility and communication policies.  

Sustainability of the aid through the implementation of strategies to ensure a smooth 
transition between relief, rehabilitation and development.  

c. Audit Scope 

The scope of this audit included the performance of ECHO's activities linked to emergency, 
protracted  and  forgotten  crises.  Disaster  preparedness  and  Disaster  Risk  Reduction  (DRR) 
strategies and Information and Communication activities have also been assessed.  

The fieldwork was finalised in October 2011. All observations and recommendations relate to 
the situation as of that date. The audit was finalised on 8 December. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

2 

5 

7 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

# 

2 

5 

7 

12 

   EN 

EN 

 
 
2.2.3.  MARKT: Monitoring by DG MARKT of the Application of Public Procurement Rules 

in the Member States 

a. Objectives and Scope 

The objective of the audit was to assess the effectiveness and efficiency of the monitoring by 
DG MARKT of the application of public procurement rules in the Member States (MS), with 
a particular attention for Directives 2004/17/EC and 2004/18/EC3. 

This audit was notably intended to contribute to the Commission's objective of achieving an 
increasingly positive DAS from the European Court of Auditors (EGA). Problems found by 
the EC A in the application of public procurement rules in MS have an important impact on 
the level of the error rate detected in the framework of its Declaration of Assurance (DAS), in 
particular as regards Cohesion Policy. There are a large number of national, regional and local 
authorities  involved,  which  may  explain  the  difficulties  in  transposing,  implementing  and 
monitoring the EU regulatory framework. 

In defining the scope of the present audit, the IAS took into account previous relevant audit 
work  by  the  IAS  and  the  EGA,  and  in  particular  the  IAS  audit  on  "Monitoring  the 
Implementation of EU Laws" and its follow-up audit. 

There are no observations/reservations in DG MARKT 2010 Annual Activity Report (AAR) 
that relate to the area/process audited. 

The fieldwork was finalised on 30 March 2011. All observations and recommendations relate 
to the situation as of that date. The audit was finalised on 16 May. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

3 

1 

4 

# 

3 

1 

4 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.3. 

Control strategies 

2.3.1.  Research Area 

2.3.1.1.  INFSO: DG INFSO's Control Strategy for on-the-spot control and fraud prevention 

and detection 

a. Background 

Together  with  the  other  Research  Commission  Services  (RCS),  DG  INFSQ  implements  EU 
research policy and supports the development of the European Research Area mainly through 
the Research Framework Programmes. Under the Seventh Framework Programme (FP7) for 
2007-2013, which is currently being implemented, DG INFSO's share is some EUR 10 billion 
in total. In 2010, DG INFSO's payments were EUR 1.23 billion for FP7 and EUR 150 million 
for  non-research  programmes.  Although  the  programming  period  for  the  Sixth  Framework 

EN 

13 

   EN 

 
 
Programme (FP6) for 2003-2006 has finished, DG INFSO made payments amounting to EUR 
160 million against cost claims during 2010 for on-going projects financed under FP6. 

In recent years there have been a range of initiatives aimed at addressing the difficulties which 
have  characterised  the  previous  programming  periods,  in  particular  the  development  of 
common control and audit strategies amongst the RCS and in particular a common FP7 audit, 
or  on-the-spot  control,  strategy  designed  to  test  the  veracity  of  cost  claims  submitted  by 
beneficiaries at different stages of the project cycle. 

In  line  with  the  increased  focus  on  fraud  prevention  and  detection  in  the  Commission,  and 
following  a  recommendation  made  by  the  IAS3,  DG  INFSO  has  developed  an  Anti-Fraud 
Control  Strategy.  This  document  outlines  its  anti-fraud  strategy  and  sets  out  existing  anti-
fraud controls, those being presently developed and outlines future developments. 

b. Audit Objectives 

The objective of the audit was to assess the internal controls underpinning DG INFSO's on-
the-spot  controls  processes  and  the  adequacy  and  effective  application  of  the  fraud 
governance,  risk  management  and  internal  control  processes  for  fraud  prevention  and 
detection. 

c. Audit Scope 

The audit of the on-the-spot control processes focused particularly on: 

– 

– 

– 

– 

– 

– 

the on-the-spot audit strategy and planning processes for ex-ante, interim and ex-post 
audits; 

the  methodology,  guidelines  and  procedures  and  the  coordination  with  the  other 
research DGs and executive agencies; 

the implementation/execution of the audit plan by the ex-post audit unit directly and 
by the external audit firms (outsourced audits); 

the monitoring and reporting arrangements; 

the measures to ensure the quality of the work undertaken; 

the follow-up given to audit results including the monitoring and implementation of 
corrective actions. 

The scope of the audit encompassed both fraud prevention and detection controls. Prevention 
encompasses  controls  to  reduce  opportunity  and  decrease  motive.  Detection  encompasses 
controls, which indicate possibility of fraud. The audit covered the different internal control 
system  components  as  defined  by  the  COSO  model:  control  environment,  risk  assessment, 
control  activities,  information  and  communication,  monitoring.  The  scope  included  the 
control  systems  to  the  extent  they  cover  FP6,  FP7  and  other  programmes  managed  by  DG 
INFSO (Non-research programmes). 

DG  INFSO  has  made  reservations  in  recent  years  on  the  rate  of  residual  errors  on  the 
accuracy  of  cost  claims  in  FP6.  Nevertheless  in  its  2010  AAR  there  is  no  reservation  that 
relates to the process audited on the grounds that the cumulative  residual error rate  for FP6 

EN 

14 

   EN 

 
(2.2%) is close to the materiality level and expected to fall below 2% in the course of 2011 
(once  all  ongoing  audits  are  closed  and  all  initiated  extrapolation  exercises  have  been 
completed). Therefore, the reservation regarding the accuracy of FP6 claims made in previous 
AARs was lifted. 

The fieldwork was finalised on 3 June 2011. All observations and recommendations relate to 
the situation as of that date. The audit was finalised on 6 October. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

1 

6 

7 

# 

1 

6 

7 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.3.1.2.  RTD: DG RTD's Control Strategy for on-the-spot control and fraud prevention and 

detection 

a. Background 

Together  with  other  Research  Commission  Services  (RCS),  DG  RTD  implements  EU 
research policy and supports the development of the European Research Area mainly through 
the Research Framework Programmes. Under the Seventh Framework Programme (FP7) for 
2007-2013, which is currently being implemented, DG RTD’s share is some EUR 25.2 billion 
in  total.  Although  the  programming  period  for  the  Sixth  Framework  Programme  (FP6)  for 
2003-2006 has finished, DG RTD made payments amounting to EUR 753 million against cost 
claims during 2010 for on-going projects financed by FP6. 

In recent years there have been a range of initiatives aimed at addressing the difficulties which 
have  characterised  the  previous  programming  periods,  in  particular  the  development  of 
common control and audit strategies amongst the RCS and in particular a common FP7 audit, 
or  on-the-spot  control,  strategy  designed  to  test  the  veracity  of  cost  claims  submitted  by 
beneficiaries at different stages of the project cycle. 

In  addition,  in  line  with  the  increased  focus  on  fraud  prevention  and  detection  in  the 
Commission, and following a recommendation made by the IAS, DG RTD has developed an 
Anti-Fraud  Control  Strategy.  This  strategy  has  resulted  in  an  action  plan  which  the  DG  is 
currently in the process of implementing. With such a key share of the overall research area 
spending  budget,  it  is  essential  that  DG  RTD  has  a  sound  and  credible  control  strategy  and 
robust approach to dealing with the possibility of beneficiary fraud. 

b. Audit Objectives 

The objective of the audit was to assess the internal controls underpinning DG RTD’s on-the-
spot controls processes and the adequacy and effective  application  of the fraud governance, 
risk management and internal control processes for fraud prevention and detection.  

c. Audit Scope 

The audit of the on-the-spot control processes focussed particularly on: 

EN 

15 

   EN 

 
 
• 

• 

• 

• 

• 

• 

• 

the on-the-spot audit strategy and planning processes; 

the  methodology,  guidelines  and  procedures  and  coordination  with  the  other 
research DGs and executive agencies; 

implementation of the audit plan by the ex-post audit units either directly or by 
the external audit firms (EAFs); 

monitoring and reporting arrangements; 

monitoring the effectiveness of the system of audit certification;  

measures to ensure the quality of the work undertaken; 

the  follow-up  given 
implementation of corrective actions. 

to  audit  results 

including 

the  monitoring  and 

The  scope  of  the  audit  encompassed  fraud  prevention  controls  aimed  at  reducing  the 
opportunity and motivation to commit fraud and detection measures to indicate the possibility 
of fraud. The audit covered the different internal control system components as defined by the 
COSO  model:  control  environment,  risk  assessment,  control  activities,  information  and 
communication, monitoring. 

the  REA,  ERCEA 

The  scope  included  the  control  systems  to  the  extent  they  cover  FP6,  FP7  and  other 
programmes managed by DG RTD (Research Fund for Coal and Steel). The control systems 
for 
included.  
It should be noted that as part of its 2010 AAR the DG made a reservation concerning the rate 
the  FP6.  
of 
The fieldwork was finalised on 21 June 2011. All observations and recommendations relate to 
the situation as of that date. The audit was finalised on 29 September. 

the  residual  errors  with  regard 

the  accuracy  of  cost  claims 

Joint  Undertakings  were 

and 

not 

the 

to 

in 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

2 

5 

7 

# 

2 

5 

7 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.3.2.  External Aid 

2.3.2.1.  DEVCO: EDF Grants 

a. Background 

The  European  Development  Fund  (EDF)  is  the  main  instrument  for  providing  EU 
development  and  cooperation  aid  to  the  African,  Caribbean  and  Pacific  (ACP)  States  and 
Overseas Countries and Territories (OCT). It is funded by Member States and governed by its 
own  financial  regulation.  The  European  Commission  is  responsible  for  the  financial 
implementation of operations funded by EDF resources, with DG DEVCO managing most of 

EN 

16 

   EN 

 
 
the programmes either from its Headquarters (HQ) in Brussels or through the EU Delegations 
(EUDs) in ACP countries. 

b. Audit Objectives 

The  objective  of  this  audit  was  to  asses  DG  DEVCO's  compliance  with  procedures  and  the 
effectiveness and efficiency of its controls on grants financed by the EDF in order to ensure 
that they support a control strategy that is able to provide assurance to the Director-General 
when signing off the Annual Activity Report. 

c. Audit Scope 

The  audit  focused  on  activities  carried  out  during  the  period  2008-2010  and  covered  the 
following main processes:  

• 

• 

• 

grants awarding,  

grants contracting, 

ex-post evaluation.  

In reviewing these processes, the audit also assessed the reliability and accuracy of financial 
and  operational  data  in  CRIS  and  the  effectiveness  of  HQ  supervision  for  the  assurance 
process. 

Other aspects of the grant management process (e.g. project implementation and monitoring, 
ex-post  controls),  as  well  as  regional  programmes,  grants  managed  under  decentralised 
management  within  the  imprest  component  of  Programme  Estimates,  and  grants  and 
contribution  agreements  with  the  United  Nations,  the  World  Bank  and  the  African  Union, 
were excluded from the scope of this audit. These have been covered in other audits already 
completed or are planned by the IAS and/or the Internal Audit Capability (IAC) of DEVCO.  

There are no observations/reservations in the 2010 Annual Activity Report that relate to the 
processes audited. 

The fieldwork was finalised on 8 July 2011. All observations and recommendations relate to 
the situation as at that date. The audit was finalised on 14 December. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

3 

7 

10 

# 

3 

7 

10 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

EN 

17 

   EN 

 
 
2.3.3.  Rural Development 

2.3.3.1.  AGRI:  Audit  on  the  Internal  Control  System  for  managing  the  Instrument  for  Pre-

Accession Assistance for Rural Development in DG AGRI 

a. Background 

Council  Regulation  (EC)  1085/2006  established  the  Instrument  for  the  Pre-Accession  (IPA) 
providing  the  basis  for  the  co-ordination,  management  and  implementation  of  the 
Commission's pre-accession strategy. 

the  Former  Yugoslav  Republic  of  Macedonia) 

IPARD,  one  of  the  five  IPA  components,  assists  the  Candidate  Countries(CCs)  (Croatia, 
the 
Turkey  and 
implementation  of  the  "acquis  communautaire"  of  the  Common  Agricultural  Policy  (CAP) 
and  alignment  to  EU  structures,  through  the  provision  of  financial  assistance  under  multi-
annual  rural  development  programmes.  These  programmes'  financial  envelope  is  1.145,8  € 
millions for the 2007-2013 period. 

in  preparing  for 

The  Commission  implements  IPARD  through  fully  decentralised  management  mode 
according  to  the  provisions  laid  down  in  the  Framework,  Sectoral  and  Multi-Annual 
Agreements between the Commission and the Candidate Country.  

b. Audit Objectives 

The  main  objective  of  the  audit  was  to  assess  the  adequacy  and  effective  application  of  the 
governance, risk assessment and internal control process for managing the Instrument for Pre-
Accession Assistance for Rural development (IPARD). 

c. Audit Scope 

The scope of the audit covered the preparation and implementation of IPARD programmes for 
the period 2007-2013 and the roles and responsibilities of DG AGRI's units involved. 

There are no observations/reservations in the AAR that relate to the process audited. 

The  fieldwork  was  finalised  on  25  November  2011.  All  observations  and  recommendations 
relate to the situation as of that date. The audit was finalised on 20 January 2012. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

2 

1 

3 

# 

2 

1 

3 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

EN 

18 

   EN 

 
 
2.3.4.  TEN-T EA 

2.3.4.1.  TEN-T  EA:  Control  strategy  in  the  Trans-European  Transport  Network  Executive 

Agency (TEN-T EA) 

a. Background 

The  Trans-European  Transport  Network  Executive  Agency  (TEN-TEA)  was  created  by  the 
European  Commission  in  2006  and  is  responsible  for  managing  the  technical  and  financial 
implementation of the Trans-European Transport Network Programme (TEN-Т). The projects 
funded under the TEN-Т Programme cover all transport modes plus logistics and intelligent 
transport systems, and involve all EU Member States. More than 300 projects amounting to 
more  than  7  billion  EUR  (out  of  a  budget  of  more  than  8  billion  EUR)  have  already  been 
launched under the 2007-2013 financial perspective. The Agency also manages more than 60 
ongoing  projects  set  up  under  the  previous  financial  perspectives,  which  represents  290 
million EUR. 

The IAS-IAC joint-audit on The Control Strategy in the Trans-European Transport Network 
Executive  Agency  (TEN-TEA)  was  included  in  the  IAS/TEN-TEA  coordinated  2011  Audit 
Work Programme because of the relative importance of the operational budget of the Agency 
and the audit will therefore contribute to the IAS Overall Opinion. 

b. Audit Objectives 

The objective of the audit was to assess the adequacy and effective application of the internal 
control  system  (ICS),  risk  management  and  governance  processes  related  to  the  Control 
Strategy of the operational budget in TEN-Т E A 

In  particular,  the  audit  assessed  whether  the  ICS  provided  reasonable  assurance  regarding 
compliance  with  the  relevant  legislation,  the  reliability  of  financial  and  management 
information  and  the  effectiveness  and  efficiency  of  the  processes  mentioned  in  the  scope 
below. 

c. Audit Scope 

As a result of the desk review and the interviews carried out during the Preliminary Survey, 
the scope of this audit focussed on the following processes: 

• 

• 

Ex-ante  financial  controls  in  the  Agency  regarding  commitments,  payments 
(prefinancing  -  interim  payments  -  final  payments),  recoveries  and  decommitments 
of the operational budget. 

Ex-post  controls  (external  audit)  and  on-the-spot  audit  strategy  regarding  the 
operational budget. 

There were no observations/reservations made in the 2010 AAR of  DG MOVE  and TEN-T 
EA concerning the processes under the scope of this audit: 

During the audit, no scope limitations were identified. 

EN 

19 

   EN 

 
The fieldwork was finalised on 20 October 2011. All observations and recommendations relate 
to the situation as at that date and do not consider improvements introduced since then. The 
audit was finalised on 3 January 2012. 

Acceptance Status 

Yes 

No 

Priority 

Important 

Total 

# 

7 

7 

# 

7 

7 

% Total 

100% 

100% 

# 

0 

0 

% Total 

0% 

0% 

2.4. 

Global Navigation Satellite System Programs (GNSS) 

2.4.1.  ENTR:  Global  Navigation  Satellite  System  Programs  (part:  Governance,  Risk 

management and Project Management) 

a. Objectives and Scope 

The objective of the audit was to assess the adequacy and effective application of the internal 
control  system  (ICS),  risk  management  and  governance  processes  related  to  the  Global 
Navigation Satellite System (GNSS), managed by DG ENTR. In particular, the audit assessed 
whether  the  ICS  provided  reasonable  assurance  regarding  compliance  with  the  relevant 
legislation, and the effectiveness and efficiency of the processes mentioned in the scope below. 

As a result of the desk review and the interviews carried out during the Preliminary Survey, 
three sub-engagements were decided, covering: 

• 

• 

• 

Governance, Risk Management and Project Management 

Financial circuits, financial management and accounting for Fixed Assets 

Grants (under indirect centralised management) and Procurement 

This  part  deals  with  the  conclusions  of  the  first  sub-engagement  "Governance,  Risk 
Management and Project Management". The scope of the audit focussed on the governance 
structure  of  GNSS,  including  the  compliance  with  legal  bases,  roles  and  responsibilities  of 
each Institution and body and the oversight and supervision function of the Commission, the 
risk  management,  including  the  methodology,  monitoring  and  reporting,  and  the  project 
management, including change management, monitoring and reporting. 

There were no observations/reservations made in the 2009 AAR of DG TREN concerning the 
processes under the scope of this audit. 

During the audit, no scope limitations were identified. 

The  fieldwork  was  finalised  on  21  December  2010.  All  observations  and  recommendations 
relate  to  the  situation  as  at  that  date  and  do  not  consider  several  improvements  introduced 
since then (e.g. the appointment of a Deputy Director General). The audit was finalised on 13 
April. 

EN 

20 

   EN 

 
 
Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

6 

5 

11 

# 

6 

5 

11 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.4.2.  ENTR  :  Global  Navigation  Satellite  System  Programs  (part:  Actions,  Grant  & 

Procurement Management) 

a.  Background 

EGNOS'  and  Galileo's  aim  is  to  provide  a  state-of-the-art  global  and  high-accuracy 
positioning  system  upon  which  European  Union  can  rely  independent  from  the  Russian 
GLONASS and US GPS systems, whose full services are limited to military applications and 
which can be disabled for public applications in times of conflict. The fully deployed system 
will consist of 30 satellites and the associated ground infrastructure. In 2007-2008, the Galileo 
programme  was  reorganised  with  a  new  planning,  a  new  funding  scheme,  and  a  new 
governance model involving notably the Commission as Programme Manager, the European 
Space  Agency  (ESA)  as  Project  Manager  and  the  Member  States  through  different  bodies. 
The current total budget amounts to EUR 7,5 billion. 

The  audit  on  The  Global  Navigation  Satellite  System  (GNSS)  was  included  in  the  IAS 
coordinated  Audit  Work  Programmes  for  2010  and  2011  because  it  was  assessed  as  a  high 
risk area. 

This  part  deals  with  the  conclusions  of  the  third  sub-engagement  "Grant  and  Procurement 
Management", mentioned under point IV.1.  

b. Audit Objectives 

The objective of the audit was to assess the adequacy and effective application of the internal 
control  system  (ICS)  relating  to  Grant  (under  indirect  centralised  management)  and 
Procurement Management for GNSS. 

In  particular,  the  audit  assessed  whether  the  ICS  provided  reasonable  assurance  regarding 
compliance  with  the  relevant  legislation,  the  reliability  of  financial  and  management 
information  and  the  effectiveness  and  efficiency  of  the  processes  mentioned  in  the  scope 
below. 

c. Audit Scope 

As a result of the desk review and the interviews carried out during the Preliminary Survey, 
the scope of this audit focussed on the following processes:  

– 

Actions  (Grants  under  indirect  centralised  management):  the  payments  from  the 
Commission to the European Space Administration (ESA) following the Delegation 
Agreement.  

EN 

21 

   EN 

 
 
– 

Procurement management: needs analysis and planning – preparation of the contract 
(call  for  tenders,  evaluation  of  tenders,  award  of  contract,  and  budgetary  and  legal 
commitment) – payments (prefinancing, deliveries, intermediate payments, and final 
payment) and ex-post controls. 

The following reservation was made in the 2010 AAR of DG ENTR concerning the processes 
under the scope of this audit: 

"Reservation  concerning  the  reliability  of  the  financial  reporting  by  the  European  Space 
Agency  (ESA) for  its own costs(*)  about  the  joint  implementation of the space component of 
the Global Monitoring for Environment and Security (GMES) and about the implementation 
of the EU satellite navigation (EGNOS and Galileo) programme."  

(*)  It  should  be  noted  that  the  above reservation  relates  to ESA  entitlement to be  reimbursed  for  its own  costs 
incurred in the implementation of the delegated tasks and not the industrial procurement expenditure. 

During the audit, no scope limitations were identified. 

The fieldwork was finalised on 9 May 2011. All observations and recommendations relate to 
the  situation  as  at  that  date  and  do  not  consider  improvements  introduced  since  then.  The 
audit was finalised on 14 October. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

3 

6 

9 

# 

3 

6 

9 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.4.3.  ENTR:  Global  Navigation  Satellite  System  Programs  (part:  Financial  Circuits, 

Financial Management and Accounting for Fixed Assets) 

a. Background 

The  EGNOS',  and  Galileo  (projects,  which  form  together  The  Global  Navigation  Satellite 
System (GNSS) aim to provide a state-of-the-art global and high-accuracy positioning system 
upon  which  European  Union  can  rely  independently  from  the  Russian  GLONASS  and  US 
GPS  systems.  The  fully  deployed  system  will  consist  of  30  satellites  and  the  associated 
ground  infrastructure.  In  2007-2008,  following  a  key  reform  to  address  serious  project  cost 
overrun  and  delay  issues,  the  Galileo  programme  was  reorganised  with  a  new  planning  and 
funding  scheme,  as  well  as  a  governance  model  involving  the  Commission  as  Programme 
Manager,  the  European  Space  Agency  (ESA)  as  Project  Manager,  and  the  Member  States 
through different bodies. The governance reform accordingly entrusted the ownership of the 
infrastructure  from  the  Galileo  and  EGNOS  programmes  to  the  Commission  and  made  it 
owner of the assets and responsible for managing these programmes. The current total budget 
amounts to EUR 7 billion. 

This  part  deals  with  the  conclusions  of  the  second  sub-engagement  “Financial  Circuits, 
Financial Management and Accounting for Fixed Assets, mentioned under point IV.1.  

EN 

22 

   EN 

 
 
b. Audit Objectives 

The audit was conducted in two parts:  

• 

• 

the DG’s accounting for fixed assets, 

the financial circuits and financial management. 

The IAS audit objectives for the accounting for fixed assets were:  

• 

• 

to assess the adequacy and effective application of the Internal Control System (ICS) 
in respect of the management of the transfer of EGNOS fixed assets from ESA to the 
Commission as of 1st April 2009; and 

to ensure the existence, completeness, security, and correct valuation and disclosure 
of  the  EGNOS  and  all  the  GNSS  Fixed  Assets  (including  those  to  be  replaced  or 
transferred in future financial periods under EGNOS and the IOC (Initial Operational 
Capability) and FOC (Full Operational Capability)) in the financial statements of the 
Commission. 

The  objective  of  the  audit  in  relation  to  financial  circuits  and  financial  management  was  to 
assess the adequacy and effective application of the DG’s internal control system (ICS) and 
financial  circuits  relating  to  the  GNSS  funds  managed  by  DG  ENTR  (together  with  the 
European Space Agency (ESA)).  

c. Audit Scope 

this  audit 

focused  on 

the  provisions  of 
the 
The  scope  of 
Regulation 683/2008 and the detailed requirements of the two Delegation Agreements agreed 
between the EC and ESA on the further implementation of these two programmes. In respect 
of  fixed  assets,  the  audit  scope  was  extended  to  cover  the  assets  acquired  under  standard 
(centralised procurement) Commission contracts for EGNOS, and those to be transferred from 
ESA. 

implementation  of 

The  audit  did  not  cover  expenditures  funded  under  the  Research  Programme  budget  of  the 
Commission or expenditures on the GMES programme. 

In respect of the audit on both financial circuits and financial management and accounting for 
fixed assets, the following reservation was made in the 2010 AAR of DG ENTR concerning 
the processes under the scope of this audit: 

"Reservation  concerning  the  reliability  of  the  financial  reporting  by  the  European  Space 
Agency (ESA) for its own costs about the joint implementation of the space component of the 
Global  Monitoring  for  Environment  and  Security  (GMES)  and  about  the  implementation  of 
the EU satellite navigation (EGNOS and Galileo) programme."  

During the audit, no scope limitations were identified. 

The fieldwork was finalised on 27 June 2011. All observations and recommendations relate to 
the  situation  as  at  that  date  and  do  not  take  account  of  any  improvements  introduced  since 
then. The audit was finalised on 17 November. 

EN 

23 

   EN 

 
Acceptance Status 

Priority 

Very Important 

Important 

Total 

# 

5 

5 

10 

Yes 

No 

# 

5 

5 

10 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.5. 

Financial Management Process 

2.5.1.  Guarantees 

2.5.1.1.  Consolidated: Management of Guarantees (BUDG, ELARG, DIGIT, EACI) 

a. Background 

Commission Services are required to ask for guarantees to protect the financial interests of the 
EU.  According  to  the  Financial  Regulation  (FR)  and  its  Implementing  Rules  (IR),  the 
contracting authority can ask tenderers and contractors to lodge a guarantee to avoid that bids 
will  not  be  withdrawn  (tender  guarantee),  to  ensure  full  performance  of  the  contract 
(performance  guarantee)  or  to  limit  the  financial  risks  connected  with  payment  of  pre-
financing  (pre-financing  guarantee).  Pre-financing  guarantees  can  also  be  asked  in  case  of 
grant agreements. 

DG BUDG, in its central role, provides instructions, interpretative notes and model contracts 
for guarantees  to  support the Commission Services in the correct implementation of  the  FR 
and its IR. In addition, it organises training courses and is responsible for the IT application 
for recording and managing guarantees in ABAC. Financial guarantees, as part of the annual 
accounts of the Commission, are recorded off-balance sheet. 

b. Audit objectives and audit scope 

The  overall  objective  of  this  audit  was  to  assess  the  compliance  of  the  management  of 
guarantees  with  the  FR  and  other  applicable  rules  and  regulations  and  its  effectiveness  and 
efficiency. In particular, the audit assessed the support and guidance provided by DG BUDG 
to operational Services, the internal control systems implemented in the Commission Services 
for managing guarantees and the adequacy of the related monitoring and reporting systems in 
place. 

The  scope  of  the  audit,  conducted  in  DG  BUDG  (in  its  central  role)  and  in  a  sample  of 
operational DGs and Executive Agencies (DG ELARG, DG DIGIT and the Executive Agency 
for  Competitiveness  and  Innovation  -  EACI),  covered  the  management  of  performance 
guarantees for procurement contracts and pre-financing guarantees for procurement contracts 
and grant agreements. The audits were finalised on 19 January 2012.  

Acceptance Status 

Yes 

No 

Priority 

# 

# 

% Total 

# 

% Total 

EN 

24 

   EN 

 
 
 
 
 
 
 
Very Important 

Important 

Total 

6 

16 

22 

5 

15 

20 

83% 

94% 

91% 

1 

1 

2 

17% 

6% 

9% 

2.5.1.2.  BUDG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI) 

Acceptance Status 

Priority 

Very Important 

Important 

Total 

Yes 

No 

# 

3 

7 

10 

# 

3 

7 

10 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

2.5.1.3.  ELARG: Management of Guarantees (BUDG, ELARG, DIGIT, EACI) 

Acceptance Status 

Priority 

Very Important 

Important 

Total 

# 

1 

5 

6 

Yes 

No 

# 

0 

4 

4 

% Total 

0% 

80% 

67% 

# 

1 

1 

2 

2.5.1.4.  DIGIT: Management of Guarantees (BUDG, ELARG, DIGIT, EACI) 

Acceptance Status 

Priority 

Very Important 

Important 

Total 

Yes 

No 

# 

1 

2 

3 

# 

1 

2 

3 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

2.5.1.5.  EACI: Management of Guarantees (BUDG, ELARG, DIGIT, EACI) 

Acceptance Status 

Priority 

# 

Very Important 

Important 

Total 

1 

2 

3 

EN 

Yes 

No 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

# 

1 

2 

3 

25 

% Total 

0% 

0% 

0% 

% Total 

100% 

20% 

33% 

% Total 

0% 

0% 

0% 

% Total 

0% 

0% 

0% 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
2.5.2.  Procurement 

2.5.2.1.  OIB: Management of Procurement in OIB 

a. Background 

Procurement is vital to OIB's core business, as most operational activities are made possible 
via a large number of procurement procedures and the signature of numerous contracts. 

b. Audit Objectives 

The objective of the audit was to assess the control measures implemented in order to ensure 
the  legality  and  regularity  of  the  public  procurement  process  managed  by  OIB.  In  addition, 
efficiency and effectiveness of internal procedures have also been addressed in this context. 

c. Audit Scope 

For the purpose of this audit, the procurement process was considered in the broad sense, i.e. 
including both the pre-award activities (from the needs analysis and planning to the signing of 
the  contract)  as  well  as  the  post-award  activities  (from  the  execution  of  the  contract  to  its 
monitoring, ex-post controls and the feedback on the procurement process). 

The specific area of Buildings Procurement was excluded from the scope of this audit, since 
the relevant framework is currently being revised.  

The  fieldwork  was  finalised  on  5  December  2011.  All  observations  and  recommendations 
relate to the situation as of that date. The audit was finalised on 17 January 2012. 

Acceptance Status 

Yes 

No 

Priority 

Very Important 

Important 

Total 

# 

1 

2 

3 

# 

1 

2 

3 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

2.5.2.2.  HR: Management of Procurement by DG HR 

a. Objectives and Scope 

The objective of the audit was to assess the legality and regularity of the public procurement 
process managed by DG HR. Aspects of efficiency and effectiveness of internal procedures 
were also considered in this context. 

For the purpose of this audit, the procurement process was considered in the broad sense, i.e. 
including both the pre-award activities (from the needs analysis and planning to the signing of 
the  contract)  and  the  post-award  activities  (from  the  execution  of  the  contract  to  its 
monitoring, ex-post controls and the feedback on the procurement process).  

EN 

26 

   EN 

 
 
The fieldwork was finalised on 20 May 2011. All observations and recommendations relate to 
the situation as of that date. The audit was finalised on 28 July. 

Acceptance Status 

Yes 

No 

Priority 

Important 

Total 

# 

5 

5 

# 

5 

5 

% Total 

100% 

100% 

# 

0 

0 

% Total 

0% 

0% 

2.5.2.3.  OIB: 2nd Follow-up Audit of the management of Procurement Contracts in OIB 

Based on the results of its follow-up engagement, finalised on 11 November, the IAS assessed 
that all the relevant recommendations addressed to OIB had been implemented, except for one 
recommendation,  of  which  the  effective  implementation  was  further  assessed  as  part  of  the 
wider on-going audit on procurement in OIB. 

2.5.2.4.  JRC: Follow-up audit on Procurement in JRC  

Based on the results of a follow-up audit, finalised on 23 September, the IAS concluded that 
all  the  recommendations  addressed  to  DG  JRC  that  resulted  from  the  audit  on  Procurement 
have  been  adequately  and  effectively  implemented,  except  for  the  recommendation  no  3, 
which remains open. However, the priority of recommendation 3 was downgraded from Very 
Important to Important as parts of the actions have been already implemented and the residual 
risk has been reduced. As the procurement planning tool is not yet fully operational, the risk 
of difficult retrieval of information in the units where procurement files are kept only on paper 
remains. The table below summarises the remaining actions to be implemented. 

2.5.3.  Recoveries 

The IAS performed in 2008 an audit on the Recovery process in the Commission. The audit 
was  conducted  in  DG  BUDG  and  LS  (it  their  central  role)  and  in  four  operational 
DGs/Agencies (DG AIDCO, EAC, INFSO and EACEA). The follow-up audits were finalised 
on 25 March 2011.  

2.5.3.1.  EAC: Follow-up audit on Recoveries 

According to Issue Track, the EAC considered all recommendations as implemented ("Ready 
for  review").  Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  they  had  all 
been adequately and effectively implemented, except for four recommendations. 

2.5.3.2.  BUDG: Follow-up audit on Recoveries 

According  to  Issue  Track,  DG  BUDG  considered  all  recommendations  as  implemented 
("Ready  for  review").  Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all 
accepted recommendations had been adequately and effectively implemented. 

EN 

27 

   EN 

 
 
2.5.3.3.  LS: Follow-up audit on Recoveries 

According  to  Issue  Track,  the  LS  considered  five  out  of  the  ten  recommendations  as 
implemented  ("Ready  for  review").  Based  on  the  results  of  its  follow-up  audit,  the  IAS 
assessed  that  all  five  recommendations  had  been  adequately  and  effectively  implemented. 
Furthermore, one recommendation, which had an "open" status in Issue Track, was assessed 
as being adequately implemented and could therefore be closed in the system.  

At  the  end  of  the  follow-up  engagement,  the  IAS  considered  the  remaining  four 
recommendations still open. These will be the subject of a second follow-up audit in line with 
the IAS methodology. 

2.5.3.4.  INFSO: Follow-up audit on Recoveries 

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  the  recommendations 
from the original audit have been adequately implemented and risks mitigated. 

2.5.3.5.  DEVCO: Follow-up audit on Recoveries 

According to Issue Track, DEVCO considered all recommendations as implemented ("Ready 
for  review").  Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  they  had  all 
been adequately and effectively implemented, except for one recommendation. 

Furthermore,  the  IAS  considered  one  recommendation  (Important)  as  implemented,  but 
nevertheless wanted to raise the DG's attention to the need to properly monitor its consistent 
implementation. 

2.5.3.6.  EACEA: Follow-up audit on Recoveries 

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  the  recommendations 
from the original audit had been adequately implemented and risks mitigated. 

2.6. 

Information Technologies 

2.6.1.  Local IT 

2.6.1.1.  DG EMPL: Audit on Management of Local IT in DG EMPL 

a. Background 

The  activities  of  DG  EMPL  depend  heavily  on  IT  systems.  Some  of  them  support  the 
operational and financial management of the projects financed by DG EMPL and other DGs, 
while  others  permit  to  interconnect  Member  States  and  other  stakeholders  to  exchange 
information, which makes the reputational risk especially relevant. 

The  DG  EMPL  IT  unit's  mission  is  to  provide  all users with a modem, secure and efficient 
informatics system to sustain and extend the strategies and objectives of DG EMPL. 

b. Audit Objectives and scope 

The overall objective of the audit was to assess the internal control system put in place by DG 
EMPL  to  ensure  an  adequate  and  effective  management  of  its  local  IT  activities,  with  a 
particular focus on the following areas: 

EN 

28 

   EN 

 
• 

• 

• 

IT Governance; 

Organization and management of the IT activities and projects; 

Physical and logical security arrangements 

The  audit  focused  in  particular  on  the  activities  performed  by  unit  EMPL  G4  (Information 
Technologies). Other units and key staff (G2 - Financial Resources, adviser of Directorate G) 
were also consulted regarding their respective responsibilities. The audit was finalised on 20 
January 2012. 

Acceptance Status 

Priority 

Very Important 

Important 

Total 

Yes 

No 

# 

4 

9 

13 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

# 

4 

9 

13 

2.6.2. 

Security of IT environment in subcontracted projects IT 

2.6.2.1.  REGIO:  Audit  on  Security  of  IT  environment  in  subcontracted  projects  IT  in  DG 

REGIO 

a. Background 

DG REGIO's activities are supported by, among other IT systems, WFS (for decisional and 
financial  procedures  related  to  the  programming  and  financial  execution  activity  phases  of 
Structural Funds programmes management) and SYS AUDIT (for monitoring audit activities 
in the context of the control of structural funds). 

The  DG  outsourced  their  evolutive  maintenance  to  an  external  IT  Consortium,  which 
performs its development activities mainly abroad. The servers are hosted by DG DIGIT, who 
is  also  responsible  for  their  administration  and  for  the  provision  of  a  secure  connection 
between the Commission network and the contractor's Data Centre. 

Because  WFS  and  SYSAUDIT  manage  and  store  sensitive  and  personal  data  and 
development activities are performed "extra-muros", an increased inherent risk of breaches in 
security and unauthorised access to sensitive and personal data exists. 

b. Audit Objectives 

The overall objective of the audit was to assess the internal control systems put in place by 
DG REGIO to provide adequate physical and logical security arrangements, as well as proper 
management  of  the  subcontracted  IT  development  activities  related  to  the  outsourced 
evolutive maintenance of WFS and SYSAUDIT. 

c. Audit Scope 

The engagement focused on the following priority areas and processes related to the evolutive 
maintenance of WFS and SYSAUDIT3: 

EN 

29 

   EN 

 
 
 
 
• 

• 

• 

Planning  and  organisation:  quality  management,  risk  assessment  and  project 
management 

Acquisition  and  implementation:  maintenance  of  application  software,  change 
management and testing and deployment in production of new developments 

Operations:  management  of  service  levels,  management  of  third  party  services  and 
systems (logical) security 

The audit covered DG REGIO's IT Unit (A4) in its capacity of defining security requirements 
and  monitoring  the  correct  implementation  of  the  contract  with  SEII  ,  and  the  contractor 
(SEII),  in  its  capacity  of  delivering  software  development,  project  management,  operational 
and technical support, user guidance and training services. 

DG REGIO did not include any reservations in its AAR that relate to the area/process audited. 

The fieldwork was finalised in March 2011. All observations and recommendations relate to 
the situation as of that date. The audit was finalised on 22 July. 

Acceptance Status 

Priority 

Very Important 

Important 

Desirable 

Total 

# 

6 

7 

1 

14 

Yes 

No 

# 

6 

7 

1 

14 

% Total 

100% 

100% 

100% 

100% 

# 

0 

0 

0 

0 

% Total 

0% 

0% 

0% 

0% 

2.6.3.  Management of the telecommunication infrastructure and services sTESTA 

2.6.3.1.  DIGIT:  Audit  on  the  Management  telecommunication  infrastructure  and  services 

sTESTA in DG DIGIT 

a. Background 

The  secured  Trans-European  Services  for  Telematics  between  Administrations  (sTESTA)  is 
the  largest  project  funded  by  the  ISA  programme,  the  objective  of  which  is  to  improve 
electronic cooperation among public administrations in EU Member States. 

This network, which is the successor of the previous TESTA I and TESTA II , is provided by 
the  Commission  to  European  Institutions,  European  Agencies  and  National  Administrations 
across  Europe  in  sectors  such  as  justice  and  home  affairs,  health,  consumer  protection  and 
statistics. 

sTESTA  is  based  on  a  dedicated  and  private  infrastructure  operated  by  a  consortium  which 
provides  the  network  infrastructure  and  supporting  services.  The  outsourced  activities  are 
monitored through regular quality and security audits conducted by specialised external service 
providers. 

EN 

30 

   EN 

 
 
 
 
DG DIGIT is the system owner of sTESTA. Its main responsibility is to ensure the provision 
of  high  quality  and  secure  networking  services  through  the  management  of  outsourcing 
contracts.  This  includes  defining  the  security  requirements  and  providing  technological 
directions to the project, controlling the providers' performances, following up the corrective 
actions  and  tracking  incidents.  Relations  with  the  stakeholders  and  dissemination  of 
information among them are also part of DG DIGIT responsibilities. 

The  main  inherent  risks  related  to  the  management  and  operation  of  the  sTESTA  network 
relate to possible breaches in the security (unauthorised disclosure, modification or destruction 
of information while being transported over the sTESTA network) and interruption of activity 
(due  to  failure  of  the  equipment/software,  external  attack  or  of  lack  of  diligence  in 
implementing and operating the sTESTA network systems). If not adequately mitigated, they 
might ultimately affect the provision of high quality and secure networking services and have a 
negative impact on the Commission's reputation. 

b. Audit Objectives 

The  overall  objective  of  the  audit  was  to  assess  the  internal  control  systems  put  in  place  by 
DIGIT  to  ensure  that  sTESTA  is  adequately  managed  and  monitored.  The  audit  focused  in 
particular  on  the  definition  of  the  service  requirements  and  on  the  definition  and 
implementation of a quality review and monitoring programme. 

c. Audit Scope 

The engagement covered the following priority areas (COBIT processes): 

• 

• 

• 

• 

DS1 : Define and manage service levels; 

DS2: Manage third-party services; 

MEI : Monitor and evaluate IT performance; 

ME3: Ensure compliance with external requirements. 

The audit covered the activities of Sector DIGIT.C2.002 (N1 - Network Infrastructure) in its 
capacity of defining sTESTA security and operational requirements and monitoring the correct 
implementation of the different related contracts. The audit was finalised on 6 December. 

Acceptance Status 

Priority 

Important 

Total 

Yes 

No 

# 

4 

4 

# 

4 

4 

% Total 

100% 

100% 

# 

0 

0 

% Total 

0% 

0% 

2.6.4.  Enterprise Europe Network IT tools 

2.6.4.1.  EACI: Audit on Enterprise Europe Network IT tools in EACI 

a. Objectives and Scope 

EN 

31 

   EN 

 
 
 
 
The  Enterprise  Europe  Network  (EEN)  is  a  network  of  contact  points  providing  information  and 
advice  to  EU  companies  on  EU  matters  regarding  developing  business  in  new  markets,  facilitating 
technology transfers and accessing EU funding. Initially developed by DG ENTR, it is now operated 
and further developed by the Executive Agency for Competitiveness and Innovation (EACI). The EEN 
has close to 600 member organisations from 48 countries using the system. 

EACI provides IT tools to support EEN activities. These IT tools are the bridge between EEN partners 
and  form  the  basis  of  their  collaboration.  Using  Europe's  largest  database,  containing  more  than 
13,000  profiles  of  cutting-edge  technologies,  the  EEN  brings  together  research  and  commercial 
applications. EACI decided to update EEN IT tools and launched the development project "Enterprise 
Europe Network 2.0 - Merlin". 

The  IT  audit  of  the  Audit  on  Enterprise  Europe  Network  IT  tools  is  included  in  the  2010  Work 
Programme of the IAS. This follows the audit risk assessment as part of the lAS's Strategic Audit Plan 
for 2010-2012. 

The audit was planned because of the visibility of the Enterprise Europe Network IT tools, which are 
used  by  a  number  of  users  outside  the  Commission  and  because  one  might  wonder  whether  an 
executive agency can manage a system of this size developed by another organisational entity. 

The objective of the EEN IT tools audit was to assess the adequacy and effective application of the 
internal  control  systems,  IT  governance,  IT  Project  Management  and  IT  Development  related  to  the 
EEN  IT  tools  in  EACI.  It  also  complements  previous  audits  performed  in  the  area  of  IT  Project 
Management and will help the audited agency to identify the areas for improvement to focus on. 

The  scope  of  this  audit  was  limited  to  the  Merlin  development  project  and  related  IT  processes  and 
procedures. During the audit, no scope limitations have been identified. 

The fieldwork was finalised on 15 April 2011. All observations and recommendations relate 
to the situation as of that date. The audit was finalised on 22 June. 

Acceptance Status 

Priority 

Very Important 

Important 

Total 

Yes 

No 

# 

4 

4 

8 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

# 

4 

4 

8 

2.6.5.  Follow-ups on IT audits 

2.6.5.1.  TAXUD: Follow-up audit on the large IT Systems in DG TAXUD 

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  three  remaining 
recommendations  addressed  to  DG  TAXUD  that  resulted  from  the  audit  "IAS  Audit  of  the 
large IT Systems in DG TAXUD" had been adequately and effectively addressed and could be 
closed. The follow-up audit was finalised on 23 June. 

EN 

32 

   EN 

 
 
 
 
2.6.5.2.  TAXUD: Follow-up audit on New IT Organisation and Contractual Framework 

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  the  recommendations 
addressed  to  DG  TAXUD  that  resulted  from  the  audit  on  New  IT  Organisation  and 
Contractual  Framework  had  been  adequately  and  effectively  implemented.  The  follow-up 
audit was finalised on 21 November. 

2.6.5.3.  PMO: Follow-up audit on Management of Local IT 

According to Issue Track, 19 out of 20 recommendations were considered as implemented by 
the  PMO,  while  for  one  recommendation  some  improvements  were  still  needed  and 
consequently remained open.  

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  the  recommendations 
considered  by  the  PMO  as  "Ready  for  review"  had  been  adequately  and  effectively 
implemented,  except  for  four  recommendations.  The  follow-up  audit  was  finalised  on  8 
February. 

2.6.5.4.  LS: Follow-up audit on Management of Local IT 

According to Issue Track, 16 out of 25 recommendations were considered as implemented by 
the LS. Based on the results of its follow-up audit, the IAS assessed that all of them had been 
adequately  and  effectively  implemented,  except  for  three  recommendations.  The  follow-up 
audit was finalised on 27 May. 

2.6.5.5.  OLAF: Follow-up audit on the Anti-fraud Information System (AFIS) 

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  the  recommendations 
addressed to OLAF that resulted from the audit on the Anti-Fraud Information System (AFIS) 
had  been  adequately  and  effectively  implemented,  except  for  one  recommendation.  The 
follow-up audit was finalised on 23 September. 

2.6.5.6.  INFSO:  Follow-up  Audit  on  the  Management  of  Research  Information  Systems  in 

DG INFSO 

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  the  recommendations 
addressed  to  DG  INFSO  that  resulted  from  the  audit  "IAS  Audit  on  the  Management  of 
Research  Information  Systems  at  DG  INFSO"  had  been  adequately  and  effectively 
implemented and could be closed. 

DG INFSO made progress in their controls over management of information systems and had 
reached the maturity level that IAS considered as sufficient for closing the recommendations. 
However, the IAS considered that improving further these controls would benefit DG INFSO. 
The follow-up audit was finalised on 7 July. 

2.6.5.7.  RTD: Follow-up Audit on the Management of Research Information Systems in DG 

RTD 

Based  on  the  results  of  its  follow-up  audit,  the  IAS  assessed  that  all  the  recommendations 
addressed  to  DG  RTD  that  resulted  from  the  audit  "IAS  Audit  on  the  Management  of 
Research Information Systems at DG RTD" had been adequately and effectively implemented 
and could be closed. The follow-up audit was finalised on 23 June. 

EN 

33 

   EN 

 
2.7. 

Other audits 

2.7.1. 

JRC: Audit on Competitive Activities 

The mission of the Joint Research Centre (JRC) is to provide customer-driven scientific and 
technical  support  for  the  conception,  development,  implementation  and  monitoring  of 
European Union policies. As a service of the European Commission, the JRC functions as a 
reference centre of science and technology for the Union. Close to the policy-making process, 
it  serves  the  common  interest  of  the  Member  States,  while  being  independent  of  special 
interests, whether private or national. In 2010, JRC's total budget for expenditure amounted to 
some  EUR  389  million  and  mainly  covered  the  implementation  of  direct  actions  under  the 
Framework  Programme  7  (FP7)  EC  and  Euratom  research  programmes,  together  with 
decommissioning activities. 

Its revenue budget in 2010 was EUR 72 million, mainly from Competitive Activities which is 
made up of work undertaken on behalf of third parties or providing assistance to Commission 
DGs.  Under  a  decision  from  Council,  JRC  is  required  to  earn  part  of  its  income  from 
additional 
scientific 
competitiveness. The target is currently 15% of the overall JRC budget and split between the 
various Institutes. In 2010, competitive cashed income amounted to EUR 62,5 million and the 
target for 2011 is set at EUR 65,1 million.  

through  Competitive  Activities 

to  demonstrate 

sources 

its 

The main objective is the development of added value to its institutional programme next to 
the acquisition/development of knowledge, increasing networks, benchmarking and ensuring 
scientific  excellence.  Under  the  Financial  Regulation,  any  revenue  of  competitive  activities 
will  be  used  to  provide  additional  expenditure  appropriations.  Expenditure  relates  to  the 
resources needed, such as goods and services and the major component, staff costs. 

a. Audit Objectives 

The overall objective of this engagement was to assess the internal controls underpinning the 
Competitive Activities processes. Specifically, the audit has assessed: 

• 

• 

• 

• 

• 

governance arrangements; 

internal controls and procedures exercised at the different stages of the process (from 
planning up to closure, monitoring and reporting);  

reliability of reporting on competitive activities; 

compliance with Financial Regulations and other applicable rules /regulations; 

effectiveness  and  efficiency  of  certain  aspect  of  the  procurement  process  when 
carried  out  exclusively  in  the  frame  of  competitive  activities.  More  specifically, 
whether the services/goods purchased were justified and adequately 'invoiced' (such 
as verification of needs identification, timely planning, cost aspects). 

b. Audit Scope 

The audit focussed in particular on key controls of the three types of competitive activities, 
for the following components of the internal control system:  

EN 

34 

   EN 

 
 
• 

Overall governance, strategic framework and overall planning:  

– 

Systems,  policies,  procedures  and  tools  required  for  an  effective  governance 
and organizational framework for competitive activities. 

– 

Planning of the overall competitive activities at corporate/institute level. 

• 

• 

• 

From initial request up to the closure of the competitive project: The complete cycle 
of activities, including identification of potential customers, selection and preparation 
of  proposals  or  participation  in  calls  for  proposals  for  indirect  actions,  contracting 
and project implementation.  

Debt  and  treasury  management:  Budgeting  and  cashing  of  competitive  income 
responsibilities performed by JRC. 

Overall monitoring and reporting: Specific procedures and monitoring arrangements, 
management scoreboards (or equivalent tools), KPI's and loop back to priorities and 
targets fixed, ex post controls, supporting tools. 

Excluded  from  the  scope  was  the  Management  and  Cost  Reporting  process  for  the  Indirect 
Actions element of Competitive Activities and the measures for hedging third party liability 
(e.g.  safety  and  legal  aspects,  insurance  policies),  as  these  are  subject  of  recently 
conducted/ongoing  audits  of  JRC  Internal  audit  Capability  (IAC).  There  were  no 
observations/reservations  made  by  JRC  in  its  2010  Annual  activity  Report  (AAR)  which 
related  to  the  processes  audited.  The  fieldwork  was  finalised  in  November  2011.  All 
observations  and  recommendations  relate  to  the  situation  as  of  that  date.  The  audit  was 
finalised on 22 December. 

Acceptance Status 

Priority 

Very Important 

Important 

Total 

Yes 

No 

# 

3 

5 

8 

% Total 

100% 

100% 

100% 

# 

0 

0 

0 

% Total 

0% 

0% 

0% 

# 

3 

5 

8 

2.7.2.  BUDG:  Implementation  of  the  Internal  Control  standard  13  on  Accounting  and 

Financial reporting 

An  audit  on  the  Implementation  of  Internal  Control  Standard  13  was  launched  in  January 
2011.  The  objective  of  the  audit  was  to  assess  the  internal  control  systems  and  the  related 
monitoring activities in place in the Commission to ensure reliability (accuracy, completeness 
and timeliness) of the accounting information provided by the DGs, and used by DG BUDG 
as a basis for the preparation of the Commission annual accounts. 

As a result of the preliminary review, the IAS identified that the main risks that may affect the 
reliability  of  the  accounting  data  and  the  key  controls  in  place  (centrally  and  locally)  are 

EN 

35 

   EN 

 
 
 
 
regularly  audited  by  the  Court  of  Auditors3  (in  the  context  of  the  Annual  Report  on  budget 
execution)  and  by  the  IACs  (when  reviewing  the  closure  and/or  cut-off  procedures  in  their 
DGs). 

On  the  basis  of  a  close  review  of  other  auditors  work  programmes  and  results,  the  IAS 
concluded that the main areas are adequately covered and decided to close the present audit 
without  performing  any  detailed  testing  on  the  internal  control  and  monitoring  systems 
implemented. The audit was finalised on 11 May. 

2.8. 

Follow-up audits (if not in the above categories) 

In addition to the follow-up audits carried out by the IAS, the latter also regularly reports to 
the  APC  on  the  state  of  play  regarding  implementation  of  IAS  audit  recommendations. 
Overall,  80%  of  the  recommendations  made  over  the  period  2007-2011  are  considered  by 
auditees as implemented as of 31 January 2012. 

2.8.1.  RTD:  Follow-up  audit  on  DG  RTD's  Internal  Control  System  for  managing  FP7  – 

Design 

Based on the results of its follow-up audit, finalised on 20 January 2012, the IAS assessed that 
the  recommendations  addressed  to  DG  RTD  that  resulted  from  the  original  audit  had  been 
implemented with the exception of two important recommendations. 

2.8.2.  REA: Follow-up audit on the set up of Internal Controls and Financial Management 

Systems – Design in REA 

The IAS made ten recommendations in total, eight of which were reported as implemented at 
the  date  of  the  follow-up  audit  finalised  on  19  January  2012.  Based  on  the  results  of  its 
follow-up  work,  the  IAS  assessed  that  six  out  of  these  had  been  implemented.  The  two 
remaining recommendations, for which a certain limited number of actions still needed to be 
finalised, were assessed as partially implemented.  

2.8.3.  HR-DS: Follow-up audit on Monitoring of Security as managed by HR-DS 

Based on the results of its follow-up audit, finalised on 19 January 2012, the IAS assessed that 
globally  all  the  recommendations  resulting  from  the  original  audit  which  were  reported  as 
"ready for review" by DG HR had been implemented 

2.8.4.  AGRI: Follow-up audit on Rural Development 

Based on the results of its follow-up audit finalised on 13 January 2012, the IAS assessed that 
all the recommendations addressed to DG AGRI that resulted from the original audit had been 
adequately and effectively implemented, except for one recommendation which was assessed 
partially implemented. 

3 

Concerning the ECA, their audits in the context of annual report on budget execution includes focus on 
"the control systems put in place by the Commission to ensure that accounting data is not affected by 
errors".  In  particular,  the  ECA  assessment  "is  mainly  based  on  the  evaluation  of  the  results  of  the 
[accounting quality] project’s implementation by the examined DGs in the different areas of controls by 
which it is made up." The Court assessed in particular the accounting control environment, the closing 
process and cut-off procedures.  

EN 

36 

   EN 

 
                                                 
2.8.5. 

INFSO: Follow-up audit on DG INFSO's Internal Control System for managing FP7 
– Design 

Based on the results of its follow-up audit finalised on 13 January 2012, the IAS assessed that 
all  the  recommendations  addressed  to  DG  INFSO  that  resulted  from  the  original  audit  had 
been implemented, with the exception of one important recommendation, which was assessed 
partially implemented. 

2.8.6.  ERCEA:  Follow-up  audit  on  ERCEA  on  the  set  up  of  internal  controls/financial 

management system – Design 

Based on the results of its follow-up audit finalised on 3 January 2012, the IAS assessed that 
seven out of eight recommendations addressed to ERCEA that resulted from the original audit 
had been adequately and effectively implemented.  

2.8.7.  EMPL: Follow-up of the audit on the internal control systems for managing the new 

Structural Funds programming period – Phase II 

Based on the results of its follow-up audit finalised on 22 December, the IAS assessed that all 
the  recommendations  addressed  to  DG  EMPL  that  resulted  from  the  audit  on  DG  EMPL's 
internal control systems for managing the new Structural Funds programming period - Phase 
II had been adequately and effectively implemented. 

2.8.8.  REGIO: Follow-up of the audit on the internal control systems for managing the new 

Structural Funds programming period – Phase II 

Based on the results of its follow-up audit finalised on 22 December, the IAS assessed that all 
the recommendations addressed to DG REGIO that resulted from the audit on DG REGIO's 
internal control systems for managing the new Structural Funds programming period - Phase 
II had been adequately and effectively implemented. 

2.8.9.  HOME: 2nd Follow-up audit on Grants under Shared management of the European 

Refugee Fund in DG HOME 

Based on the results of its second follow-up audit finalised on 16 December, the IAS assessed 
that all the recommendations addressed to DG HOME that resulted from the audit on Grants 
under  Shared  Management  of  the  European  Refugee  Fund  and  that  remained  open  after  its 
first follow-up had been adequately and effectively implemented. 

2.8.10.  TEN-T EA: Joint IAS/TEN-T EA IAC Follow-up audit on Audit of the Management of 

the Operational Budget in TEN-T EA 

The  objective  of  this  engagement  was  to  assess  the  progress  made  in  implementing  the 
remaining accepted recommendations addressed to DG MOVE and to TEN-T EA following 
the first follow-up of the "Audit of the Management of the Operational Budget in TEN-TEA” 
carried out in 2009. 

Based on the results of its follow-up audit finalised on 15 December, the IAS assessed that all 
the recommendations addressed to DG MOVE and TEN-T EA that resulted from the Audit of 
the Management of the Operational Budget in TEN-TEA had been adequately and effectively 
implemented,  except  for  two  recommendations  addressed  to  DG  MOVE  and  two 
recommendations addressed to TEN-T EA. 

EN 

37 

   EN 

 
2.8.11.  ECHO: 2nd Follow-up audit of NGOs funding in DG ECHO 

The  objective  of  this  engagement  was  to  assess  the  progress  made  in  implementing  the 
remaining accepted recommendations addressed to DG ECHO following the first follow-up of 
the audit carried out in 2007 (final report dated 6 June 2007).  

Based on the results of its follow-up audit finalised on 12 December, the IAS assessed that all 
the  recommendations  addressed  to  DG  ECHO  that  resulted  from  the  audit  had  been 
adequately and effectively implemented. 

2.8.12.  ELARG: 2nd Follow-up audit on "Ex-post control activities in DG ELARG" 

The  objective  of  this  engagement  was  to  assess  the  progress  made  in  implementing  the 
remaining accepted recommendations addressed to DG ELARG following the first follow-up 
carried out in 2008 (final report dated 18 July 2008).  

Based on the results of its follow-up audit finalised on 7 December, the IAS assessed that all 
the recommendations addressed to DG ELARG that resulted from the audit "Ex-post control 
activities"  and  from  the  first  follow-up  audit  had  been  adequately  and  effectively 
implemented. 

2.8.13.  FPI:  Follow-up  audit  on  the  financial  management  of  the  Common  Foreign  and 

Security Policy Budget 

According  to  Issue  Track,  10  out  of  11  recommendations  were  reported  as  implemented  by 
the auditee. One recommendation was not included in the scope of the follow-up as it was not 
ready for review at the time of the follow-up. 

Based on the results of its follow-up audit finalised on 6 December, the IAS assessed that all 
the  recommendations  addressed  to  the  former  DG  RELEX  and  now  transferred  to  FPI  that 
resulted  from  the  audit  on  the  financial  management  of  the  Common  Foreign  and  Security 
Policy  Budget  had  been  adequately  and  effectively  implemented,  except  for  four 
recommendations. 

2.8.14.  OIL: Second follow-up audit on the Evaluation of targeted internal control standards 

in OIL 

Based on the results of its follow-up audit finalised on 29 November, the IAS assessed that 
globally  all  the  recommendations  addressed  to  OIL  that  resulted  from  the  audit  on  the 
Evaluation of targeted Internal Control Standards in OIL had been implemented. 

2.8.15.  HR  &  OIB:  2nd  Follow-up  Audit  of  the  Management  of  Building  Procurement 

Contracts by DG HR and OIB 

Based on the results of its follow-up engagement finalised on 22 November, the IAS assessed 
that all the relevant recommendations addressed to DG HR and OIB which were reported as 
ready for review had been implemented. 

2.8.16.  EACI: Follow-up audit on the management of the Operational Budget of the EACI 

Based on the results of its follow-up audit finalised on 30 September , the IAS assessed that 
all  the  recommendations  addressed  to  EACI,  DG  MOVE,  DG  ENER,  DG  ENTR  and  DG 
ENV that resulted from the audit on 'Management of the Operational Budget of the Executive 

EN 

38 

   EN 

 
Agency  for  Competitiveness  and  Innovation'  in  2009  had  been  adequately  and  effectively 
implemented. 

2.8.17.  MARKT: Follow-up audit on Monitoring the Implementation of EU law 

Based on the results of its follow-up audit finalised on 6 September, the IAS assessed that all 
the recommendations addressed to DG MARKT that resulted from the audit on "Monitoring 
the Implementation of EU law" had been adequately and effectively implemented. 

2.8.18.  ENV: Follow-up audit on Monitoring the Implementation of EU law 

Based on the results of its follow-up audit finalised on 6 September, the IAS assessed that all 
the  recommendations  addressed  to  DG  ENV  that  resulted  from  the  audit  "Monitoring  the 
implementation of EU law" had been adequately and effectively implemented. 

2.8.19.  SG: Follow-up audit of the Consolidated report on Monitoring the Implementation of 

EU law 

Based on the results of its follow-up audit finalised on 6 September, the IAS assessed that all 
the  recommendations  addressed  to  SG  that  resulted  from  the  audit  "Consolidated  report  on 
Monitoring the implementation of EU law" had been adequately and effectively implemented. 

2.8.20.  MARE: Follow-up audit on the European Fisheries Fund as managed by DG MARE 

Based on the results of its follow-up audit finalised on 15 July, the IAS assessed that all the 
recommendations  addressed  to  DG  MARE  that  resulted  from  the  audit  on  the  European 
Fisheries Fund as managed by DG MARE had been adequately and effectively implemented. 

2.8.21.  OIB: Follow-up audit on the Inventory Process as managed by OIB 

This follow-up audit does not result in a re-assessment of the adequacy of controls as a whole, 
but  focuses  on  the  specific  recommendations  in  the  original  audit.  It  was  carried  out  in 
accordance with the IAS methodological guidelines.  

The  assessment  of  the  state  of  implementation  was  based  on  a  desk  review  of  evidence 
provided by OIB in Issue Track.  

Based on the results of the follow-up audit finalised on 12 July, the IAS assessed that all the 
recommendations  addressed  to  OIB  that  resulted  from  the  audit  have  been  adequately  and 
effectively implemented, although in some cases there is still room for improvement. The IAS 
would specifically like to invite OIB to consider the following points for attention: 

• 

• 

• 

due  to  IT-related  issues,  the  finalisation  of  the  tracking  exercise  analysis  has  been 
postponed by three months, and will not be completed before the end of September 
2011. While acknowledging OIB's efforts to perform this analysis, the IAS considers, 
based on the information received, that significant attention is still required in order 
to complete it in the best conditions (Recommendation 2); 

the report function from ABAC SAM (DG BUDG owner) has some weaknesses and 
is still in the process of being tested (Recommendation 2); 

OIB is invited to send a note and/or instruction for newly appointed GBIs, in order to 
raise their awareness on their responsibility to verify the items (tracking) on a timely 
and regular basis (Recommendation 4);  

EN 

39 

   EN 

 
• 

back-up arrangements have not yet been established to ensure business continuity for 
the  warehouse  management.  OIB  is  invited  to  include  them  in  its  Business 
Continuity Plan (Recommendation 7Based on the results of its follow-up audit, the 
IAS assessed that all the recommendations addressed to OIB that resulted from the 
audit had been implemented. 

2.8.22.  OIL: Follow-up audit on the Inventory Process as managed by OIL 

Based on the results of its follow-up audit finalised on 12 July, the IAS assessed that all the 
recommendations addressed to OIL that resulted from the audit on the Inventory process as 
managed by OIL, had been adequately and effectively implemented. 

2.8.23.  EPSO:  Follow-up  of  the  Limited  Review  on  the  selection  process  as  managed  by 

EPSO 

Based on the results of its follow-up engagement finalised on 12 July, the IAS assessed that 
all the relevant recommendations addressed to EPSO had been implemented. 

2.8.24.  SANCO: Second Follow-up on Grant management (Food & Feed) in DG SANCO 

This follow-up audit focused on the four outstanding recommendations of the first follow-up 
of the audit on Grant Management (Food & Feed) in DG SANCO in 2010.  

Based on the results of its second follow-up audit finalised on 12 July, the IAS assessed that 
all  the  recommendations  addressed  to  DG  SANCO  that  resulted  from  the  above  mentioned 
audit had been adequately and effectively implemented. 

2.8.25.  PMO: Follow-up audit on the activities of PMO/6 ISPRA 

Based  on  the  results  of  its  follow-up  audit  finalised  on  5  July,  the  IAS  assessed  that  all  the 
recommendations addressed to PMO that resulted from the audit on the activities of PMO/6 
ISPRA had been adequately and effectively implemented. 

2.8.26.  DEVCO:  Follow-up  audit  of  remaining  recommendations  on  2003  IAS  In-depth 

Audit of DG AIDCO 

Based on the results of its third follow-up, finalised on 28 June, to assess the implementation 
of the seven recommendations from the 2003 in-depth audit in ex-DG AIDCO that remained 
open  after  the  two  follow-ups  carried  out  in  2006  and  2008,  the  IAS  assessed  that  the 
recommendations  had  been  implemented,  except  for  one  recommendation  which  will  be 
followed  up  as  part  of  the  implementation  of  DG  DEVCO's  action  plan  in  response  to  the 
2007 and 2008 IAS audits on Financial Management of Directorates D and B respectively.  

2.8.27.  EAC: Follow-up audit of remaining recommendations on 2004 IAS In-depth Audit of 

DG EAC 

Based on the results of its third follow-up, finalised on 7 June, to assess the implementation of 
the ten recommendations from the 2004 in-depth audit in DG EAC that remained open after 
the  two  follow-ups  carried  out  in  2005  and  2008,  the  IAS  assessed  that  all  the 
recommendations  had  been  implemented,  except  for  six  recommendations  which  will  be 
followed-up as part of the implementation of DG EAC's action plan in response to the 2010 
IAS audit on Monitoring and Supervision of National Agencies by DG EAC. 

EN 

40 

   EN 

 
2.8.28.  ELARG: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit 

of DG ELARG 

Based  on  the  results  of  its  follow-up  review  finalised  on  7  June,  the  IAS  assessed  that  the 
recommendation had been implemented. 

2.8.29.  ESTAT: Follow-up audit of remaining recommendations on 2003 IAS In-depth Audit 

of DG ESTAT 

Based  on  the  results  of  its  follow-up  review  finalised  on7  June,  the  IAS  assessed  that  the 
recommendations had been implemented. 

EN 

41 

   EN