COMMISSION STAFF WORKING DOCUMENT Summary of Executive Summaries Internal audit engagements finalised by the IAS in 2012 Accompanying the document Report from the Commission to the European Parliament and the Council Annual Report to the Discharge Authority on Internal Audits carried out in 2012 (Article 99 (5) of the Financial Regulation)
Date: 2013-08-29
Institutions: European Commission
Subjects: EU control, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit













EUR-Lex - 52013SC0314 - EN











|



52013SC0314

COMMISSION STAFF WORKING DOCUMENT Summary of Executive Summaries Internal audit engagements finalised by the IAS in 2012 Accompanying the document Report from the Commission to the European Parliament and the Council Annual Report to the Discharge Authority on Internal Audits carried out in 2012 (Article 99 (5) of the Financial Regulation) /* SWD/2013/0314 final */









Table
of Contents
1.     Level of implementation of
recommendations (auditee's assessment)................................ 5
2.     Summary of engagements finalised in 2012................................................................................................. 7
2.1. Horizontal audit
engagements................................................................................................................. 7
2.1.1.
Annual Activity Report process (multi-DG).................................................................................................... 7
2.1.2.
Management and monitoring of staff allocation (multi-DG)....................................................................... 9
2.1.3.
Chargeback and internal billing systems (multi-DG)................................................................................ 13
2.2. Agriculture,
Natural Resources and Health................................................................................. 16
2.2.1.
Control Strategy in DG MARE - European Fisheries Fund...................................................................... 16
2.2.2.Control
Strategy in DG SANCO....................................................................................................................... 18
2.2.3.
Control Strategy in DG AGRI - Directorate J............................................................................................... 20
2.2.4.
Audit on Public Procurement in the EAHC (Joint IAS-IAC)..................................................................... 22
2.2.5.
Modulation (DG AGRI).................................................................................................................................... 24
2.3. Cohesion.................................................................................................................................................................... 26
2.3.1.
Cohesion Fund 2000-06 - Closure (DG REGIO)......................................................................................... 26
2.3.2.
ERDF 2000-06 - Closure (DG REGIO).......................................................................................................... 28
2.3.3.
ESF 2000-06 - Closure (DG EMPL)............................................................................................................... 32
2.3.4.
Implementation of 2007-13 Programmes (DG REGIO).............................................................................. 35
2.4. Research, energy
and transport............................................................................................................. 38
2.4.1.
Control Strategy in DG ENER......................................................................................................................... 38
2.5. External Aid,
development and enlargement................................................................................ 40
2.5.1.
Set-up of internal organisation in EU delegations (DG DEVCO) - Limited Review............................ 40
2.5.2.
Financial Management of Regional Programmes (DG ELARG).............................................................. 42
2.6. Education and
citizenship............................................................................................................................ 43
2.6.1.
Lifelong Learning Programme (DG EAC/EACEA)...................................................................................... 43
2.6.2.
Control Strategy in DG HOME....................................................................................................................... 45
2.6.3.
Control Strategy in DG JUST.......................................................................................................................... 47
2.6.4.
Monitoring the implementation EU Law (DG JUST).................................................................................. 47
2.7. Economic and
financial affairs.............................................................................................................. 50
2.7.1.
Implementation by the EIF of the CIP Programme (DG ECFIN).............................................................. 50
2.7.2.
Off-budget operations (DG ECFIN)............................................................................................................... 51
2.7.3.
Control Strategy in DG ENTR......................................................................................................................... 53
2.7.4.
Monitoring the Implementation of EU Law (DG TAXUD): joint IAS-IAC audit.................................... 54
2.8. General services
and HR................................................................................................................................. 57
2.8.1.
Strategy and coordination of statistical data production, development and
dissemination .................        
         
(DG ESTAT and DG AGRI, DG MARE, DG RTD and JRC)......................................................................... 57
2.8.2.
Service Level Agreements (DG HR, OIB, OIL and PMO)............................................................................ 62
2.8.3.
Ethics in the Legal Service (consulting engagement)................................................................................ 63
2.9. IT audit engagements...................................................................................................................................... 65
2.9.1.
Local IT in DG DEVCO..................................................................................................................................... 65
2.9.2
Local IT in DG TRADE....................................................................................................................................... 67
2.9.3.
Horizon 2020 (DG RTD, DG CNECT, ERCEA)............................................................................................ 69
2.9.4.
IT Governance and performance (DG SANCO/EAHC)............................................................................... 72
2.9.5.
Internal Market Information System (IMI) Project Management (DG MARKT)................................... 74
2.9.6.
Capitalisation of Internally Generated Intangible Assets......................................................................... 76
2.10. Follow-up
engagementsfinalised in 2012........................................................................................... 77
2.10.1.
1st Follow-up Audit on Interventions in Agricultural Markets and 2nd
Follow-up Audit on      Interventions in Agricultural Markets........................................................................................................................................................... 77
2.10.2.
Follow-up audit on the Management of Procurement by DG HR.......................................................... 77
2.10.3.
Follow-up audit on the activities of OIB.OS3: Social Infrastructures ISPRA...................................... 77
2.10.4.
Follow-up audit on the Official Journal Production Process as managed by the
...............  Publications
Office....................................................................................................................................... 78
2.10.5.
2nd Follow-up Audit on Missions in PMO................................................................................................... 78
2.10.6.
Follow-up audit on Monitoring the implementation of EU law in DG ENTR..................................... 78
2.10.7.
Audit Follow-up of Audits on the Global Navigation Satellite System Programmes
in DG ENTR. 78
2.10.8.
Audit Follow-Up on Enterprise Europe Network IT Tools in EACI...................................................... 78
2.10.9.
Follow-Up Audit on Local IT systems supporting financial management in DG TREN/........................ 
............... EACI/TEN-T
EA............................................................................................................................................. 78
2.10.10.
Follow-up audit on Schengen Facility in DG HOME............................................................................ 79
2.10.11.
Follow-up audit on the EAHC Management of the operational budget............................................ 79
2.10.12.
2nd Follow-up audit on Procurement in JRC........................................................................................... 79
2.10.13.
Follow-up audit on Life+ Grant management in DG ENV.................................................................... 79
2.10.14.
2nd Follow-Up Audit on Data Centre – Operations and Security in DG
DIGIT................................ 79
2.10.15.
Follow-Up Audit on Management of the telecommunication infrastructure and
services sTESTA (DG DIGIT)    79
2.10.16.
Follow-Up  Audit on Security of IT environment in subcontracted projects (DG
REGIO)............. 80
2.10.17.
Follow-Up Audit on Treasury and Accounting System (TAS) of DG ECFIN..................................... 80
2.10.18.
Follow-Up Audit on Corporate Data Network Infrastructures & Services
Management (DG DIGIT)    80
2.10.19.
Follow-Up Audit on Management of local IT (DG EAC)...................................................................... 80
2.10.20.
Follow-up Audit on Control Strategy - Audit and Financial Correction Processes
(DG REGIO) 80
2.10.21.
Follow-up Audit on Control Strategy – On-the-spot controls and Fraud prevention
and detection (DG RTD)   80
2.10.22.
Follow-up Audit on Control Strategy - Audit and Financial Correction Processes
(DG EMPL) 81
2.10.23.
Follow-up audit on Financial management of main programmes in Asia (DG DEVCO)............... 81
2.10.24.
Follow-up audit of Financial management of main programmes under the European
Neighbourhood Policy Instrument (DG DEVCO- ENPI).............................................................................................................................................. 81
2.10.25.
Follow-up audit on Financial management of main programmes in Latin America 
............... (DG DEVCO-LA)........................................................................................................................................... 81
2.10.26.
Follow-up audit of Financial Management of Regional Projects (DG DEVCO-Regional)........... 81
2.10.27.
Follow-up audit of Food Aid (DG ECHO)............................................................................................... 81
2.10.28.
Follow-up audit on Public Procurement under IPA (DG ELARG)...................................................... 81
2.10.29.
Follow-up audit on Closure of pre-IPA instruments (DG ELARG)...................................................... 82
2.10.30.
2nd Follow-up audit on Ex-post Control activities in the former DG
RELEX (FPI)......................... 82
2.10.31.
3rd Follow-up audit on "Implementation of selected Internal
Control Standards in DG ECFIN" 82
2.10.32.
Follow-up audit on Ethics in the Commission (multi-DG)................................................................... 82
Content of this document
This document contains a summary of the original
executive of all engagements finalised (cut-off date for the exercise
01/02/2013). 
Each executive summary underwent the applicable
standard professional validation and contradictory procedures between auditor
and auditee at the time of the finalisation.

1.                
Level of implementation of recommendations
(auditee's assessment)

Table 1 sums up the level of implementation of accepted
recommendations, based on the auditee’s assessment, for IAS recommendations
made during the period 2008-2012.
The
recommendations not yet implemented are broken down by period overdue on the
right-hand side of the table.
Table 1: Level of
implementation of recommendations based on auditee’s assessment
 Year || Priority || Total || Implemented || In progress (by number of months overdue) 
   ||   ||   || No. || % || No. || % || No delay || 0 - 6 || 6 - 12 || 12+ 
 2008 || Critical || 0 || 0 ||   ||   ||   ||   ||   ||   ||   
 Very Important   || 136 || 134 ||   || 2 ||   || 0 || 0 || 1 || 1 
 Important || 164 || 159 ||   || 5 ||   || 0 || 0 || 0 || 5 
 Desirable || 15 || 14 ||   || 1 ||   || 0 || 0 || 0 || 1 
 2008 Total || 315 || 307 || 97% || 8 || 3% || 0 || 0 || 1 || 7 
 2009 || Critical || 2 || 2 ||   || 0 ||   || 0 || 0 || 0 || 0 
 Very Important   || 136 || 132 ||   || 4 ||   || 0 || 0 || 0 || 4 
 Important || 142 || 138 ||   || 4 ||   || 0 || 0 || 0 || 4 
 Desirable || 9 || 9 ||   || 0 ||   || 0 || 0 || 0 || 0 
 2009 Total || 289 || 281 || 97% || 8 || 3% || 0 || 0 || 0 || 8 
 2010 || Critical || 2 || 2 ||   || 0 ||   || 0 || 0 || 0 || 0 
 Very Important   || 124 || 105 ||   || 19 ||   || 1 || 3 || 2 || 13 
 Important || 150 || 131 ||   || 19 ||   || 1 || 5 || 2 || 11 
 Desirable || 7 || 7 ||   || 0 ||   || 0 || 0 || 0 || 0 
 2010 Total || 283 || 245 || 87% || 38 || 13% || 2 || 8 || 4 || 24 
 2011 || Critical || 0 || 0 ||   ||   ||   ||   ||   ||   ||   
 Very Important   || 51 || 29 ||   || 22 ||   || 7 || 9 || 5 || 1 
 Important || 97 || 67 ||   || 30 ||   || 7 || 16 || 5 || 2 
 Desirable || 10 || 10 ||   || 0 ||   || 0 || 0 || 0 || 0 
 2011 Total || 158 || 106 || 67% || 52 || 33% || 14 || 25 || 10 || 3 
 2012 || Critical || 0 || 0 ||   ||   ||   ||   ||   ||   ||   
 Very Important   || 83 || 10 ||   || 73 ||   || 66 || 7 || 0 || 0 
 Important || 108 || 20 ||   || 88 ||   || 78 || 10 || 0 || 0 
 Desirable || 0 || 0 ||   ||   ||   ||   ||   ||   ||   
 2012 Total || 191 || 30 || 16% || 161 || 84% || 144 || 17 || 0 || 0 
 TOTAL 2008-2012 || 1236 || 969 || 78% || 267 || 22% || 160 || 50 || 15 || 42 
Overall, 969 or 78 % of
the total number of recommendations made over the period 2008-2012 are reported
by the auditee as implemented to date, leaving a total of 267 recommendations
still in progress. 
Not all open
recommendations are overdue. Of the total number of recommendations in
progress, a total 120 very important ones are outstanding, of which 27 are more
than 6 months overdue. In addition, two very important recommendation issued in
2006 were still outstanding on 1 February 2013[1]. 

2.                
Summary of engagements finalised in 2012
2.1. Horizontal audit engagements
2.1.1. Annual Activity Report process
(multi-DG)

(10 audit
reports: SG/BUDG, OIB, DG CNECT, DG EAC, DG REGIO, DG EMPL, DG HOME, DG MARE,
DG AGRI, DG DEVCO)
Background[2]
According to the
Financial Regulation[3], Directors-General and Heads of Service are empowered by the
College as Authorising Officers by Delegation (AOD) to define the most adequate
and effective control systems for implementing the budget and achieving their
organisational objectives in accordance with the principle of sound financial
management and in compliance with the rules and regulations. The Annual
Activity Reports (AARs) are the means by which the AODs report on the
performance of their duties, providing financial and management information to
the Institution. A key element of the AAR is the declaration of assurance, in
which the AOD states that he has "reasonable assurance that the
resources assigned to the activities […] have been used for their intended
purpose and in accordance with the principles of sound financial management,
and that the control procedures put in place give the necessary guarantees
concerning the legality and regularity of the underlying transactions"[4]. The declaration of assurance may be qualified by reservations if
deemed necessary. 
The AARs are the main
basis for preparing the Synthesis report, with which the College takes full
political responsibility for the implementation of the budget, in particular
before the Discharge Authority.
The Secretariat General
and DG BUDG play a key role in the AAR process by providing instructions,
support and guidance to the Commission DGs/Services. They currently ensure,
through a process that includes the peer-review exercise, that the Standing
Instructions are being applied consistently by the DGs in their AAR[5].
Audit
Objectives and Scope
The overall objective
of the audit was to assess the adequacy and effectiveness of the Annual Activity Report process in the Commission and, in particular, the extent to which the
process is effective in supporting the Declaration of Assurance.
As for
any horizontal process, its effectiveness relies on an adequate design, clear
guidance and regular monitoring at corporate level, and on consistent
implementation by the individual 
DGs/Services
in compliance with centrally defined rules, regulations and instructions. For
this reason, the audit followed an approach that covers:
a)      Central roles
and responsibilities, in particular with reference to issuance of
instructions and guidance, provision of support to the DGs/Services and
coordination of the AAR process;
b)      Individual DGs/Services
roles and responsibilities to implement the process in compliance with
rules and guidelines in order to provide the addressees of the AAR (as well as
other interested readers) with complete information on the achievements of
objectives, the status of internal control systems, and on the elements that
support the declaration of assurance. 
The audit was conducted in
the SG and DG BUDG for their central role as well as in nine operational
DGs/Services (OIB, CONNECT, EAC, REGIO, EMPL, HOME, MARE, AGRI, DEVCO).
Through
this audit engagement, the IAS aimed at identifying possible improvements in
the AAR assurance building processes, together with best practices amongst
individual DGs and/or within families, room for
simplification and rationalisation in the AAR process as well as in the actual
AARs.
The
audit did not cover completeness and accuracy of financial information in the
AARs nor the robustness of the DGs/Services control strategies[6].
No scope limitations have been identified to date.
The
fieldwork was finalised end of November 2012. All observations and
recommendations relate to the situation as of that date. However, information
provided during the validation phase was duly taken into account when
finalising the audit engagement.
Risks and audit recommendations
The following high risks, that may impact the achievement of
the business objectives for the process audited, were identified:
·       
Reporting on sound management – Risk
rating: High: The Standing
Instructions do not provide sufficient guidance on reporting in the AARs on the
economy, efficiency and effectiveness of operations and controls. Without
sufficient information on sound management, the AARs may not adequately support
the conclusions on sound management as well as the Declaration of Assurance in
this regard. The Central Services should develop further instructions on reporting
on the economy, efficiency and effectiveness of financial and non-financial
activities.
·       
AAR quality control process and
summary for the Synthesis report – Risk rating: High: Weaknesses in the AARs may remain undetected due to a quality
control process which does not effectively examine the robustness of DGs’
assurance-building process. This may consequently weaken the Synthesis report
in fulfilling its accountability objective towards the Discharge Authority. The
Central Services should enhance the quality control process by further
examining the substance and the reliability of the assurance-building processes
and by asking for justification if the Services do not adequately address the
questions raised by the Central Services in the finalisation of the AARs.
·       
Structure of the AAR – Risk rating:
High: Given that the AAR in reality serves several objectives and that
some important AARs are examined by a broad audience, including the College but
also the ECA and, more importantly, the Discharge Authority, the current AAR
structure and the way the individual AARs are presented risk not being entirely
useful for all its users. The Central Services should therefore streamline the
structure of the AAR, avoiding overly long and complex reports. A revised structure
should be introduced with an executive summary, the body of the report with key
information and annexes providing the necessary detail.

2.1.2. Management and monitoring of staff
allocation (multi-DG)

(5 audit
reports: SG/BUDG/HR, DG RTD, DGT, DG COMP, DG AGRI)
Background
The audit on the management and monitoring of the staff allocation
is included in the IAS 2012 Audit Work Programme. This engagement has been
carried out in the framework of the ever-increasing importance of efficiency
and effectiveness in the use of administrative appropriations in the current
political context. Human capital is by far the most important resource of the
Commission and expenditure linked to staff is subject to close scrutiny by the
Budgetary Authority and the general public, although it represents a small
percentage of the total EU budget.
The Commission committed itself to serving political priorities in
the context of "zero growth" in human resources over the last years,
and adopted a proposal[7] aiming to reduce staff in each EU Institution, body and agency by
5% during the period 2013-2017 through the non-replacement of some departing
staff (retiring or with expired contracts).
The
Commission also established a mechanism to redeploy posts in order to meet its
priorities, based upon a linear 1% levy on all basic job quotas. The
application of this mechanism on 1 May 2012 has allowed the creation of a
redeployment pool of 255 posts to be allocated to Commission priorities.
In
July 2011, the EU institutions entered a new cycle of Multiannual Financial
Framework (MFF) negotiations, defining the budgetary priorities of the EU for
the years 2014-2020. The negotiations of November 2012 ended without agreement
between the Heads of Government and State of the 27 MSs, who have postponed the
final decision until the first trimester of 2013. Several MSs have been seeking
a significant reduction in the EU administrative budget. In such a political
context, the Services must already identify
effective ways to implement the planned reductions of staff so that the impact
on service delivery is minimised.
Audit
Objectives
The
objective of the audit was to assess whether the Commission Services have
adequate procedures and mechanisms in place to manage and monitor staff
allocation effectively and efficiently in a context of staff reduction.
Although
the Central Services have significant responsibilities in this area, the focus
of the audit was on the relevant procedures in place within the operational
DGs. Based on the general information collected
during the preliminary survey, four DGs were
selected (i.e. DG AGRI, DG COMP, DGT and DG RTD) in
order to have a representative view of the different activities in the
Commission, with emphasis on the relatively high number of staff as one other
main selection criterion. In addition, a
general survey was carried out in the form of a questionnaire,
in order to obtain a comprehensive overview of the procedures in place across
Commission Services, and identify potential good practices.
Audit
Scope
This
audit focused on the procedures and systems in place within the four selected
DGs to manage and monitor staff allocation. The
scope of the audit included a review of the systems, methods and tools used
this context. Their effectiveness and efficiency were assessed against the
following set of elements that the IAS consider necessary in order to achieve
an allocation of Human Resources (hereafter HR) aligned to the organisation's
highest priorities:
·       
A clear picture of all its activities, tasks,
priorities and the human resources allocated to these (task mapping);
·       
A comprehensive picture of the skills required
for each job and information on the skills available within the Services;
·       
Information on the share of the workload between
staff in the entities;
·       
Based on the above mentioned elements, a formal
HR plan, updated at least annually, which identifies the
current and future HR needs for achieving the objectives, as well as any
ensuing measures (e.g. redeployments, recruitment, training).
The
audit also aimed at identifying good practices in this field, which may
potentially be spread across other Commission services.
It
was not in the scope of the audit to analyse how activities are currently
organised within the audited Services and how possible overlaps in the
activities of Directorates and Units could be reduced. Furthermore, the scope
of the audit did not include the assessment of the efficiency of operations nor
the definition of optimal staffing levels in Directorates and Units.
As
concerns the Central Services, the audit team collected information on the main
tools, systems and methods existing at corporate level for supporting the
Commission Services, and on the main current developments in this area.
There
are no observations/reservations in SG, DG BUDG, DG HR, DG RTD, DGT, DG COMP and
DG AGRI AARs for the year 2011, which relate to the area/process audited.
The
fieldwork was finalised on 07/11/2012. All observations and recommendations
relate to the situation as of that date.
Risks and audit recommendations
related to the Central Services
The following High risks that may impact the achievement of
the business objectives for the process audited were identified:
·       
Corporate Framework to support
Commission Services' management and monitoring of staff allocation
– Risk rating High: Insufficient
corporate guidance and support to help the Commission Services in their
responsibility to achieve efficient and effective HR allocation may have a
negative effect on the effectiveness and efficiency of the HR allocation within
the Commission Services. The Central Services should further develop a
framework for the management and monitoring of staff allocation and communicate
it to the Commission Services.
In addition, the insufficient support to the staff
allocation process by means of corporate tools and methodologies may cause
certain Services to develop similar tools and methods locally, leading to a
duplication of efforts and waste of human and financial resources. The Central
Services should therefore further facilitate the coordination and exchanges of
experiences, good practices, tools and methodologies between the HR
professionals, e.g. through joint meetings of HR and SPP practitioners.
·       
Reporting and accountability by
Commission Services on the effective use of posts – Risk rating High: The
insufficient reporting and accountability on the effective use of posts
attributed to the Commission Services in the context of the staff allocation
procedure may leave potential cases of non-respect of the applicable Commission
decision undetected. This could lead to an ineffective or inefficient
redeployment of posts, which in its turn could adversely impact the achievement
of the Commission's priorities. IAS recommends that the Central Services should
improve the corporate framework for reporting and accountability by Commission
Services about the use of posts redeployed to these Services, in line with the
Commission decisions on the allocation of posts.
Risks
and audit recommendations related
to DG RTD
The following High risks that may impact the achievement of
the business objectives for the process audited were identified:
·       
Mapping of Human Resources with
activities and associated priorities – Risk rating High: Insufficient information concerning the HR
allocated to the DG's existing tasks and their associated priorities may lead
to inappropriate trade-off decisions in this area. This may have a negative
impact on the efficient and effective use of resources, especially in a context
of staff reductions.
DG RTD should further develop its mechanisms and tools to
ensure the availability of complete, reliable and up-to-date information
concerning the existing HR and their allocation to the DG's tasks and
associated priorities (task mapping).
·       
Workload assessment – Risk rating
High: An
insufficient basis for comparing in a transparent way the workload of different
units/ Directorates may prevent the DG from taking the most appropriate HR
allocation/reallocation decisions. There is a risk that the allocation of HR to
units/Directorates is not in line with the workload, which may prevent it from
achieving its objectives in an efficient way.
DG RTD should put in place tools/methods to gather
sufficient and reliable information concerning the workload related to its
activities/tasks.
·       
Identification of current and future
staff needs – Risk rating High: Insufficient
analysis on the current / future optimal level of staff necessary to carry out
different activities/tasks may hamper the reallocation of staff according to
changing priorities and the implementation of staff reduction strategies, and
prevent proper justification of HR requirements.
DG RTD should develop
an HR plan, including the identification of the
level of resources and competences needed (for different scenarios) to carry
out its current and future activities/tasks and meet its priorities. It should
compare the results of this analysis to the HR available in
terms of numbers, function groups and competences.
Risks
and audit recommendations related
to DG AGRI
The following High risks that may impact the achievement of
the business objectives for the process audited were identified:
·       
Mapping of Human Resources with
activities and associated priorities – Risk rating High: Insufficient information concerning the HR
allocated to the DG's existing tasks and their associated priorities may lead
to inappropriate trade-off decisions in this area. This may have a negative
impact on the efficient and effective use of resources, especially in a context
of staff reductions.
DG
AGRI should pursue its effort to develop mechanisms and tools to ensure the
availability of complete, reliable and up-to-date information concerning the
existing HR and their allocation to the DG's tasks and associated priorities
(task mapping).
·       
Workload assessment – Risk rating
High: An
insufficient basis for comparing in a transparent way the workload of different
units/ Directorates may prevent the DG from taking the most appropriate HR
allocation/reallocation decisions. There is a risk that the allocation of HR to
units/Directorates is neither in line with the workload nor with the strategic
priorities of the DG, which may prevent it from achieving its objectives in an
efficient way.
DG
AGRI should develop tools/methods to gather sufficient and reliable information
concerning the workload related to its activities/tasks.
·       
Identification of current and future
staff needs – Risk rating High: Insufficient
analysis on the current / future optimal level of staff necessary to carry out
different activities/tasks may hamper the reallocation of staff according to
changing priorities and the implementation of staff reduction strategies, and
prevent proper justification of HR requirements.
DG
AGRI should develop an HR plan, including
the identification of the level of resources and competences
needed (for different scenarios) to carry out its current and future
activities/tasks and meet its priorities. It should compare the results of this
analysis to the HR available in terms of numbers,
function groups and competences.

2.1.3. Chargeback
and internal billing systems (multi-DG)

(3 audit
reports: DG BUDG, DG DIGIT and SCIC)
Background
Several
Commission DGs and Services provide various types of services to other
DGs/Services or to other Institutions. When the client "pays" for the
services, this process is commonly referred as Charge-back process,
given the fact that the cost of the services has to be transferred from the
budget line of the client to the one of the provider (by using different
mechanisms like recovery orders, co-delegations and cross sub-delegations).
In
absence of a formal definition of the Charge-back process within the
Commission, the IAS considers it as a set of coordinated activities conducted
by a provider and a client aiming at providing/receiving value-for-money services
in the respect of the existing (budgetary) rules. This process encompasses
different steps, from the definition of the needs by the client to the delivery
of the service requested and the monitoring of the results, and is based on an
agreement (formalised or not) between the two parties.
The main objective of
this process is to ensure that internal resources and existing
competencies are used efficiently and effectively (by requesting the provision
of services to in-house specialised providers) and in compliance with the
budgetary rules (to ensure the proper use of the budgetary appropriations).
This should permit to realise economies of scale as well as to have more
flexible and rapid response comparing with what the market could offer. In
addition, the development of a cost-accounting system, necessary to correctly
define the amount to be charged-back, should help in promoting the sound
financial management, as it would allow gathering information on the real costs
of the services to be then used to take management decisions.
The
risk factors inherent to the process relate to:
·       
erroneous identification of services to be
charged-back (possibly leading to double budgeting of services, those not
charged-back when due or to misuse of budget lines[8]);
·       
miscalculation of costs (resulting in an over or
under charge-back to the client);
·       
lack of information available to allow the
client DG/Service to take informed decision on the services requested or
obtained.
Central
services, in their responsibility for ensuring compliance with rules and
regulations, and for fostering sound financial management, should contribute to
the efficient functioning of the process by providing guidance and instructions
on the charge-back process and on the costing mechanism and by monitoring their
implementation.
There
is no consolidated figure providing an overview of the amounts charged-back to
internal and external clients by all Commission service providers.
Audit
objectives
The objectives of the audit were to assess whether
the charge-back process complies with existing Commission's rules and
instructions (Financial Regulation, budgetary rules, central guidance) and is
implemented consistently and transparently (including how the costs of the
services provided are defined and communicated). In addition, the IAS looked at
whether the information is used to promote
sound financial management (to operate economically,
effectively and efficiently).
Audit
Scope
The scope
of the audit encompassed the charge-back process implemented in a sample of
DGs/Service (DG BUDG, DG DIGIT and SCIC) as well as the support and monitoring
activities provided by Central Services. In this context, the IAS identified DG
BUDG as the main auditee for its responsibility in the implementation of the
Commission budget.
There are no observations/reservations in the 2011 AAR that relate
to the area/process audited.
The
fieldwork was finalised in November 2012. All observations and recommendations
relate to the situation at that time.
Risks and audit recommendations
The following high risks that may impact the achievement of the
business objectives for the process audited were identified:
·       
Governance
of the charge-back process (Risk rating: High): The absence of a formal
definition/description of the charge-back process and of a clear allocation of
responsibilities could lead to an ineffective and inefficient charge-back
process due to a lack of a common understanding or to incoherent
implementation. In addition, it could lead to non-compliance with the budgetary
rule of specification[9] or to double
budgeting of services[10]. The absence of endorsement by central services of cost model(s)
currently used to define the unit cost to be charged-back may lead to
non-transparent and/or inaccurate calculation of costs of the services
provided.
To mitigate those risks, an existing
governance body
(the ABM Steering Group) should own the process and be the ultimate responsible
body for the definition (scope, actors, responsibilities, reporting
arrangements) of the process. It should also be in charge of endorsing the cost
models used by the service providers (where relevant).
·       
Central
guidance and instructions (Risk rating: High): The lack of
central guidance and instructions may lead to inconsistencies within and across
DGs/Services, possibly resulting in non-compliance with budgetary rules. In
addition, Commission resources may be used to finance activities of non-EC
bodies.
DG BUDG, under the responsibility of
the ABM Steering Group and with the support of the DGs involved in the charge-back
process, should develop a framework including guidance and instructions on the
charge-back process (identification of actors and responsibilities, types of
services/costs to be charged-back, charge-back mechanisms, guidelines to
calculate cost of services, definition of reporting arrangements). The legality
and regularity constraints and the needs for transparency and flexibility
should be taken into consideration, as well as the need to avoid increasing the
administrative burden.
·       
Clarity
and transparency of budget lines used for financing IT expenditures (Risk
rating: High): Due to a lack of sufficiently detailed
(budgetary) information, funds may be used in a way that is not in compliance
with the budgetary principle of specification (not for the intended purpose) or
services may be budgeted twice. In addition, the client DG may perceive the
charge-back as unjustified, leading to possible mistrust in the service
provider.
For the lines used to fund specific
(IT) expenditure, DG BUDG should remind the Authorising Officers about the
clarity of the budgetary comments and the type of information to be included,
in line with the relevant legal base. In addition, the availability of easily
accessible information on the free (not charged-back) services proposed by the
providers would improve the clarity of the management of the administrative
budget lines used to finance IT expenditure.

2.2. Agriculture, Natural
Resources and Health

(DG AGRI, DG ENV, DG CLIMA, DG MARE, EAHC, DG SANCO)

2.2.1. Control Strategy in DG MARE - European Fisheries Fund

Background
Council Regulation (EC) n° 1198/2006 established the European
Fisheries Fund (EFF), defining the framework for EU support for the sustainable
development of the fisheries sector, fisheries areas and inland fishing. This
programme financial envelope is 4.3 billion € for the 2007-2013 period and it
is implemented by shared management.
Although the Member States (MSs) have primary responsibility for
implementing effective internal control systems to prevent, detect and correct
irregular and illegal expenditure, the Commission performs a supervisory role
over national systems and assumes final responsibility for the implementation
of the budget. Therefore, DG MARE should have a credible control strategy for
demonstrating that they are seeking reasonable assurance on the effective
functioning of the Management and Control Systems in the MSs.
Audit
Objectives
The main objective of the audit was to assess the effectiveness
and efficiency of DG MARE's Control Strategy for obtaining reasonable assurance
on the correct functioning of the Management and Control Systems relating to
the EFF in the MSs.
Audit
Scope
The
audit specifically assessed:
·       
whether DG MARE EFF Control strategy: 
o      
is adequate, properly planned, and the DG's audit
plans are risk-based and timely updated to reflect the results of key
supervisory controls; is effectively implemented, regularly monitored and
adequately reported on in terms of delivery status and key results;
o      
ensures that corrective measures (interruptions,
suspensions and financial corrections) are taken promptly and proportionately,
when the Commission's audit activities detect serious deficiencies;
o      
is effective in monitoring the implementation of
the audit strategies and plans by the National Audit Authorities (NAAs), e.g.
timely detecting deviations from national audit plans and insufficient audit
coverage by the NAAs; 
·       
whether DG MARE has adequately and effectively
demonstrated the reasonable assurance obtained for the EFF in the 2011 Annual
Activity Report (AAR), and in particular if the key information supporting
reasonable assurance is adequately disclosed.
DG MARE
has included the following reservation in its 2011 AAR concerning the processes
within the scope of this audit:
·       
Management and Control Systems for EFF
programmes in the following 8 MSs: Czech Republic, Spain, Finland, Italy, the
Netherlands, Romania, Slovakia and Sweden. For 5 of these MSs, national audit
reports revealed error rates exceeding 2% of declared expenditure. For 3 MSs
(CZ, IT and RO), the error rates were not considered to be reliable.
·       
Eligibility of expenditure under
Art. 25(2) of Council Regulation n° 1198/2006: in a number of cases MSs did not
verify that investments on board did not increase vessels' ability to catch fish.
Some investments that have been funded have increased the ability to catch
fish.
The
fieldwork was finalised on 15 June 2012. All observations and recommendations
relate to the situation as of that date.
Risks and audit recommendations
The following Very High risks that may impact the achievement of
the business objectives for the process audited were identified:
·       
The EFF Audit Strategy and Audit Plan concerning
the assurance on the effective functioning of the MSs' Management and Control
Systems – Risk rating: Very High: If the audit
strategy lacks clear quantitative and measurable targets and the risk
assessment is incomplete, the DG may not timely achieve its audit objectives to
provide reasonable assurance that the Management and Control Systems in MSs
function properly.
DG MARE's audit strategy should therefore include the
overall coverage that the NAAs plan to reach in terms of system audits, the
assurance targets to be achieved, and the related audit coverage targets for
its own audit work, based on the available resources. DG MARE should develop a
more complete risk assessment on the reliability of NAAs, including specific
risk factors.
·       
Execution and monitoring of the Audit
Strategy and Audit Plans – Risk rating: Very High: DG MARE not sufficiently or appropriately monitoring the
implementation of its Audit Strategy and audit plan may lead to insufficient
audit coverage. The DG may also not take timely actions to correct potential
significant delays or deviations compared to planned activities. Partial audit
coverage of NAAs' work may jeopardise the reliance on their audit opinions and
therefore the level of assurance provided by NAAs. In addition, insufficient
audit procedures on the spot and audit trail may put at risk the reliance put
on NAAs.
DG MARE should therefore provide a finer analysis of the
information related to the assurance on the reliability of the NAAs, obtained
on the basis of the modules and countries/regions covered by its audit work. It
should seek to increase this level of assurance by optimising the use of its
limited human resources. In addition, DG MARE should seek to optimise the added
value of the work done by Structural Funds DGs on common NAAs, e.g. exploring
possible ways to obtain efficiency gains in the audit function, which would
also increase the level of assurance.
DG MARE Ex-post control sector should introduce a
consolidated table to monitor the timely issue of reports and the associated
follow-up of recommendations, sharing the information regularly with the
Authorising Officers by Sub-delegation (AOSDs). 
·       
Monitoring of the National Audit Strategies
and Annual Control Reports – Risk rating: Very High: An ineffective monitoring mechanism of National
Audit Strategies may prevent DG MARE from promptly identifying and addressing
problems, timely launching procedures for suspending payments and applying
financial corrections to safeguard the EU budget. In addition, unreliable error
rates communicated by MSs may lead to an inaccurate declaration of assurance by
the Authorising Officer by Delegation (AOD).
DG MARE should hence reinforce the monitoring of National
Audit Strategies through an additional interim review, by further developing
its central overview of the assessment of the OPs including the main
Intermediate Bodies, and by developing procedures to improve the assessment of
the reliability of the error rate calculated by MS.

2.2.2. Control
Strategy in DG SANCO

Background
The IAS audit on the Control
Strategy in DG Health and Consumers (DG SANCO) was included in the IAS 2012
Audit Work Programme. This followed the audit risk assessment carried out in
2011. The relative importance of the budget of DG SANCO in the context of the
IAS Overall Opinion and the residual error rate reported in DG SANCO's 2011 AAR
(4,8% observed in payments made for co-financing Member States' animal disease
eradication programmes) justified its inclusion in the IAS's Strategic Audit
Plan for 2011-2012.
Audit Objectives
The objective of the audit was
to assess the adequacy and effective application of the internal control system
(ICS), risk management and governance processes related to the Control Strategy
in DG SANCO. In particular, the audit assessed whether the ICS provided
reasonable assurance regarding compliance with the relevant legislation, the
reliability of financial and management information and the effectiveness and
efficiency of the processes mentioned in the scope below.
Audit Scope
As a result of the desk review
and the interviews carried out during the Preliminary Survey (which took into
account the work already performed by the IAS, the IAC, the Ex-Post Control
Section in DG SANCO and by the Court of Auditors), the scope of this audit
engagement focused on the:
·       
Ex-ante financial controls in the following
sub-processes of DG SANCO: commitments, payments (pre-financing – interim
payments – final payments), recoveries and de-commitments. 
·       
Ex-post controls (external audit). 
The activities of DG SANCO in
Luxembourg and Ireland were excluded from the scope because the budget involved
is very small. The budget delegated to EAHC was also excluded because DG SANCO
is only involved in the programming phase. 
Observations/reservations made
in the 2011 Annual Activity Report (AAR) of DG SANCO concerning the process
under the scope of the audit:
The AAR 2011 mentioned one
reservation regarding the scope of this audit.
It was a
reservation concerning the rate of residual errors with regard to the accuracy
of Member States' cost claims under the animal disease eradication and
monitoring programmes in the food and feed policy area. With the residual error
rate of 4,8% observed in payments made for co-financing Member States' animal
disease eradication programmes, the average residual error rate in the relevant
ABB activity amounted to 4,3% which was higher than the materiality threshold
of 2%. The main sources of the detected errors were cost claims of Member
States, which did not correctly apply the eligibility rules fixed in the
legislation.
DG SANCO took
corrective actions: more precise and restrictive definition of eligible
expenditure in the Commission Decision for programmes starting on 01/01/2011
and the introduction of lump sums as from the 2012 programmes. The corrective
actions, however, will only affect the results of the ex-post controls starting
from 2014.
During the audit, no scope
limitations were identified.
The fieldwork was finalised on
19 October 2012. All observations and recommendations in this report relate to
the situation as of that date and do not consider improvements introduced since
then.
Risk and
audit recommendation
The following high risks that
may impact the achievement of the business objectives for the processes audited
were identified:
·       
Control strategy – Risk rating high: The many incomplete and lacking chapters in the control strategy
create uncertainties or may lead to wrong actions. The spread of the control
strategy over various notes may lead to inefficiencies and unclarity as to
which document is applicable and to be used.
The IAS
recommends DG SANCO to complete and finalise as soon as possible "DG SANCO
Control Strategy" and to integrate all current related notes in one
comprehensive document.

2.2.3. Control Strategy in DG AGRI - Directorate
J

DG AGRI budget finances the Common Agricultural Policy expenditure
(2007-2013) mainly through two shared management Funds, the European
Agricultural Guarantee Fund (EAGF) which fully finances EU direct aid and
market measures (€250 billion payments for the period 2007-2012) and the
European Agricultural Fund for Rural Development (EAFRD) which co-finances
rural development programmes (€53 billion payments for the period 2007-2012).
Expenditure under both funds is managed through some 81 national or regional
Paying Agencies (PAs) (sometimes through delegated bodies as well) in the 27
Member States (MSs), bearing a significant inherent risk that the Commission
may reimburse irregular expenditure declared by them. 
The Commission performs a supervisory role over national systems
to obtain reasonable assurance on their effective functioning and assumes final
responsibility for the implementation of the budget.
Audit Objectives
The main objective of the audit was to assess the adequacy of the
design and the effectiveness and efficiency of the monitoring of the Control
Strategy put in place by DG AGRI Directorate J for 2007-2013.
The practical execution of the Control Strategy, in particular as
regards the implementation of the audit engagements, their supervision and the
financial corrections process, will be examined by the IAS in future audits.
Audit
Scope
Specifically, the audit was conducted to assess whether DG AGRI
Directorate J Control strategy for 2007-2013 is adequate, in that:
·       
it clearly sets out how the audit activity will
adequately cover all funds,
·       
the available resources are properly deployed
(capacity analysis and human resources management aspects),
·       
audit activities are properly planned, based on
a thorough risk assessment, and timely updated to reflect the results of key
controls carried out; in this context Directorate J Central Risk Analysis and
Annual Work Programmes have been examined;
·       
its Key Performance Indicators (KPIs) are well
defined and properly used;
·       
it is regularly and effectively reported on in
terms of delivery status and key results.
Since
this audit aimed to be forward looking, it took into account the perspective of
the changes under discussion about the Clearance of accounts system post-2013.
During
the audit we also analysed the action plan prepared by DG AGRI aimed at
reducing the error rates in rural development.
DG
AGRI has included the following reservations in its 2011 AAR concerning the
processes within the scope of this audit:
·       
Serious deficiencies in the IACS (Integrated
Administration and Control System) in Portugal and Bulgaria, in particular in
the identification system, covering all agricultural areas, called Land Parcel
Identification System (LPIS); 
·       
The whole EAFRD, as the residual
error rate, based on the statistical information on the results of the controls
carried out by  MSs, was  2.36% of the whole ABB activity and thus above the 2%
materiality threshold;
·       
Deficiencies in the supervision and
control of certified organic products, with potential negative impact on the
market and on the organic farming sector and bearing the risks that the related
underlying transactions are not legal and regular.
The
fieldwork was finalised on 15 November 2012. All observations and
recommendations relate to the situation as of that date.
Risks
and audit recommendations
The following Very High risks that may impact the achievement of
the business objectives for the process audited were identified:
·       
DG AGRI's Directorate J Audit Strategy – Risk
rating Very High: In the absence of a
formalised audit strategy and measurable specific audits objectives and indicators,
the DG may not be able to define an appropriate audit plan and achieve the
assurance that it is expected to reach.
Insufficient analysis of the reliability of the CBs,
inadequate consideration of their work, and insufficient coordination between
the EC audit services may lead to inefficient use of audit resources and
jeopardise the assurance obtained.
DG AGRI should therefore develop and formalise its audit
strategy, and seek to strengthen the role of the CBs as assurance providers,
achieving further synergies with their work.
·       
Risk assessment and Audit planning - Risk rating
Very High: Inadequate risk-assessment and therefore
inappropriate audit planning may preclude the DG from achieving its audit
assurance objectives.
Because of an incomplete capacity analysis, the audit plan
may not be achievable, entailing backlogs, and the allocation of resources to
priorities may be inadequate.
Directorate J should re-engineer the Central Risk Analysis
and the other risk assessments, according to the targets defined in its Control
Strategy, ensure a proper coverage of IT security matters, properly monitor and
follow up recommendations issued; and conduct a thorough capacity analysis in
order to have a more realistic audit plan.
·       
Monitoring and reporting of the implementation
of the Audit Strategy and Audit Plans - Risk rating Very High: Insufficient
monitoring of audit activities may hinder timely measures to correct potential
significant delays or deviations compared to planned activities.
Insufficient disclosure of the results of certain key
building blocks supporting management's assurance may limit its effective
utilisation by third parties and expose the Commission to reputational risks.
DG AGRI should improve its quantitative and qualitative KPIs
in order to enhance the monitoring of audit activities; develop monitoring of
actual resource spent compared to plan; and improve the disclosure of all
relevant key indicators in its AAR.
·       
Human resources management aspects - Risk rating
Very High: High turnover and insufficient
audit-related training may undermine the Directorate's productivity and
performance levels.
DG AGRI Directorate J should adopt specific targets and KPIs
on human resources matters, develop a training program for its auditors,
identify the causes of the high turnover and develop a policy to encourage
retention of staff in the Directorate.

2.2.4. Audit on Public Procurement in the
EAHC (Joint IAS-IAC)

Background
The
Agency's current mandate covers the Public Health Programme, the Consumers Programme
and the "Better Training for Safer Food (BTSF)" actions. EAHC is monitored
by its parent Directorate General, DG SANCO, which will continue to address all
policy-making and institutional tasks related to the Programmes.
Public
Procurement is a significant activity of the Executive Agency for Health and Consumers
(EAHC) contributing to 37,4% of its budget 2011 (23% in 2010) with the up going
trend which justifies this joint IAS-IAC audit in the coordinated 2011 Audit
Plan.
Audit
Objectives
The
objective of the audit was to assess the adequacy and effective application of
the internal control system (ICS), risk management and governance processes
related to the Procurement process in EAHC.
In
particular, the audit assessed whether the ICS provided reasonable assurance
regarding compliance with the relevant legislation, the reliability
of financial and management information and the effectiveness and
efficiency of the processes mentioned in the scope below.
Audit
Scope
As
a result of the desk review and the interviews in the Preliminary Survey, the
scope of this audit engagement focuses on EAHC Public Procurement management:
·       
Contract
Preparation (Calls for tenders, Evaluation of tenders. Awarding decision)
·       
Budgetary
commitments and contract/decisions
·       
Delivery
and Closure (Payments, Recovery, RAL and de-commitment)
·       
Financial
and management reporting (incl. completeness of the Annual Activity Report)
There
were no observations/reservations made in the 2010 AAR of DG SANCO and EAHC
concerning the processes under the scope of this audit.
During
the audit, no scope limitations were identified.
The
fieldwork was finalised on 28 November 2011. All observations and recommendations
relate to the situation as at that date.
Risks
and audit recommendations
The
following high risks that may impact the achievement of the business objectives
for the process audited were identified:
Autonomy- Risk rating High: The EAHC's
incomplete operational autonomy may result in non-compliance with the delegation
act and the Implementing Rules (Art. 45), non-optimal use of resources, duplication
of administrative tasks, weakened accountability for decisions and actions taken
and some uncertainties about the EAHC's capacity to perform its duties fully in
line with the delegation act. 
DG SANCO should therefore complete the transfer
of operational tasks to the EAHC or consider managing a limited number of
contracts entirely within the DG (e.g. due to their political dimension,
specific field of expertise needed, etc.). The EAHC should take actions to
increase efficiency and effectiveness and better align the human resources available
in the Agency and the delegated tasks and control requirements.
Risk Management - Risk rating High: Inadequate
risk management procedures may lead to a partial view on the current risk status
of the EAHC and the possible actions to be taken, a late response to risks, new
risks not being identified and mitigated and non-compliance with internal
control standard №6.
The EAHC should thus systematically and
regularly update its risk register, reassess risks and include any new risks in
the risk register.
Award Notices for calls for tender - Risk
rating High: Non-compliance with public procurement rules and regulations
on award notice publications may expose the EAHC to litigation.
The Agency should therefore establish controls
and checks for publishing contract award notices in a timely manner.
Negotiated Procedure- Risk rating High: The
procurement objective of best value for money may not be achieved, if the use
of negotiated procedures is not sufficiently justified, as it may restrict
competition. DG SANCO's late submission of programme preparation documents to
the Agency, may lead to excessive time pressure and ineffective execution of
the EAHC's tasks and objectives. Consequently, the EAHC should formally and
systematically document the justification for choosing any type of procurement
procedure and further develop its knowledge on the related market. DG SANCO should
ensure the timely submission of work documents. 
Assessment of eligible costs- Risk rating High: Unstructured
and vaguely defined contractual requirements may lead to ineffective and inefficient
controls over eligibility of costs incurred by beneficiaries and thus may
result in irregular transactions. The lack of a sampling methodology when
assessing eligibility of costs in a high number of cost claims may result in
ineffective and inefficient checks. 
The EAHC should therefore improve the
contractual requirements for receiving reimbursement of expenditure, develop
and effectively use a sampling procedure for its eligibility checks and enhance
its controls for executing payment transactions.

2.2.5. Modulation (DG AGRI) 

In line with the IAS Strategic
Audit Plan 2010-2012, an audit on Modulation in DG AGRI was announced in
October 2011 and started in December 2011. The objective of the audit was to
assess the adequacy and effective application of the governance, risk
assessment and internal control process for managing Modulation in DG AGRI.
The IAS identified modulation as
a high risk area in the risk assessment underpinning its strategic plan, due to
the experience with voluntary modulation prior to the CAP Health Check of 2008
and the fact that it appeared to be a complex system, involving risks of
difficult implementation and control. 
The preliminary review resulted
in a re-assessment of the originally identified risks. This led to the
following conclusions.
There is no financial risk from
the EU budget point of view, because once the amount of modulation was
calculated for the period 2009-2012, it was transferred directly from the 1st
Pillar to the 2nd Pillar of the CAP and allocated to the Rural
Development Programmes. The overall expenditure allowed for agriculture and
rural development remains unchanged as the transfer is budgetary neutral.
The indicative budget concerned
is small compared to the total CAP Expenditure (about 3% of commitments
appropriations for the period 2009-2012). Modulation currently concerns only
the EU-15 Member States.
In the current system only
compulsory modulation applies to the vast majority of MSs concerned, as only
the UK decided to apply voluntary modulation in addition to compulsory
modulation.
The new net ceilings of direct
aids were set up for the period 2009-2012 in the regulation and then closely
monitored by the relevant DG AGRI units as part of the budgetary and financial
processes.
Practical implementation of
modulation (compulsory, and voluntary only for the UK) at the level of the MSs
is controlled by the Certifying Bodies and therefore by DG AGRI's Audit
Directorate.
For the new programming period
2014-2020 there is no need for compulsory modulation, as the budget is directly
allocated between the two pillars. Besides, the draft legislation for the new
period does not foresee voluntary modulation.
The sums
retained by Member States under the pre-2008 voluntary modulation scheme have
been accounted for and cleared.
The results of the IAS' preliminary
review and the above mentioned reassessment showed that the expected risks
regarding modulation did not materialise over the last few years as both the
controls in place and modified procedures adequately mitigated them.   The IAS
therefore decided to close the audit engagement without performing any
further detailed testing.

2.3. Cohesion

(DG REGIO,
DG EMPL)

2.3.1. Cohesion Fund 2000-06 - Closure (DG
REGIO)

Background
The
Structural Funds (SF) DGs' spending accounts for about one third of the total
EC budget annually under shared management in the 2000-06 Programming Period
(PP). There are some 1140 Cohesion Fund (CF) projects with a budget of EUR 32,
7 billion. According to latest data received, DG REGIO has received the full
set of closure documents for 960 projects and has completed its review of 614. 
The
closure of projects in the case of CF represents the financial settlement of
the outstanding Community commitment through payment of the final balance to
the MS or issue of the debit note and de-commitment of any unused balance.
Final settlement does not prejudice the Commissions right to adopt financial
corrections.
Member
States submit a set of closure documents (a Final Report (FR), a Winding-Up
report and declaration (WU documents), and a certified statement of
expenditure) to accompany the final request for payment (within 6 months for
the CF)[11].
DG
REGIO reviews and analyses these closure documents, making admissibility and
qualitative checks in three separate workflows. The operational (Geographical)
units (GU) make admissibility and qualitative checks on the FR of the body
responsible for implementation (or implementing body). The Audit units (AU)
check the WU documents of the national audit body. The financial and
geographical units (officers) check the certified statement of expenditure,
including the final payment claim. Certified statements of expenditure are only
processed once the other two workflows have been finalised. The DG can also
perform closure audits to obtain additional assurance if necessary.
The
general rule is that closure of CF projects should be performed within a
reasonable time after the deadlines for the submission of documents necessary
for the payment for the balance. The Cohesion Fund guidelines foresee that in
principle, if the set of documents received is complete and there are no issues
requiring clarification (for which additional delays are foreseen), the closure
procedure could be completed within two months. 
The SFs
DGs should have a credible closure process for demonstrating that all errors
and irregularities in relation to deficiencies identified in the Member States
management and control systems during the implementing period are detected and
corrected at the latest at the closure of the OP. The objective of the closure
procedure is to ensure the timely treatment of the closure documents in order
to lead to a prompt liquidation of the unspent commitment balance (RAL) while
ensuring compliance with the principles of sound financial management
(including the application of financial corrections where necessary).
Audit
Objectives
The
objective of this audit was to assess whether DG REGIO has a robust and sound
approach to the closure of the Cohesion Fund 2000-06 projects. More
specifically, whether controls have been put in place and are being exercised
in practice to ensure the adequate, timely and effective closure of CF
projects, including the determination of reliable final residual error rates.
Given that the closure process is still very much on going, the IAS aimed to
identify improvements, for which there is still time to implement, before the
closure process is finalised and all the CF projects are successfully closed.
This is expected to last for another 3-4 years.
Audit
Scope
The
scope of the audit covered the following areas:
·       
The work done by DG REGIO's
geographical/financial/audit units on the closure documents (the winding up
declaration, final report and certificate of final expenditure) based on the
admissibility and qualitative check-lists developed for the closure exercise;
·       
The methods used to establish and to apply
financial corrections, and their effective application, including consistency
aspects;
·       
The monitoring and reporting provisions in place
for the closure process, their accuracy, completeness, timeliness, including
related disclosure in the AAR;
·       
The risk assessment supporting the DGs' Audit
Plan for closure audits and the impact of the closure audits on the
establishment of the final payment amount.
The
audit scope also included coordination arrangements between GUs and AUs, and
between DG REGIO and other DGs/Services. In addition, the scope included the
current state-of-play, the recently introduced organisational changes within DG
REGIO, together with the subsequent changes in the monitoring and reporting mechanisms
and the tools in place, that support the closure of the remaining open CF
projects.
There
were no scope limitations.
The
fieldwork was finalised at the end of November 2012. 
DG's
AAR: The following observations/reservations were
made in the 2011 AAR concerning specifically the area/process under the scope
of this audit engagement:
·       
Reservation concerning the Cohesion Fund
management and control systems for the 2000-2006 period, in Hungary and Spain
for reputational reasons[12].
Risks
and audit recommendations
The following high risk that may impact the achievement of
the business objectives for the process audited was identified:
·       
Gaps in the assessment of closure
documents (Report Finding 1: Risk rating –High): The gaps noted in the assessment process together with a lack of
standardised approach may lead to inconsistencies which,
coupled with a lack of audit trail, may impact on the quality of the assessment
made. This can in turn mean that errors and irregularities are not properly
detected and corrected. It can also lead to unequal treatment between Projects
and Member States, which can in turn impact on the Commission’s reputation.
For the remaining CF Projects to be closed, DG REGIO should update
the assessment notes, templates and methodology (e.g. Cohesion Fund Manual) in
order to address the gaps in the assessment process, avoid unnecessary checks
and ensure more consistency as regards the use of additional checklists or
templates. It should improve coordination between the GU and AU through the development
of standardised templates, including for the assessment of the FR, and ensure
that qualitative checks on all key closure documents are applied on a
consistent basis. Taken together, these measures should result in a better
audit trail of the assessments made and help improve timeliness for closing the
remaining CF projects. The IAS notes that DG REGIO recently introduced
harmonised templates for the notes from the AUs to the GU[13].

2.3.2. ERDF 2000-06 - Closure (DG REGIO)

Background
The
Structural Funds (SF) DGs' spending accounts for about one third of the total
EC budget annually under shared management in the 2000-06 PP. There are some
379 Operational Programmes (OPs) for ERDF with a budget of EUR 129,6 billion.
The
closure of OPs in the case of ERDF represents the financial settlement of the
outstanding Community commitment through payment of the final balance to the MS
or issue of the debit note and de-commitments of any unused balance. Final
settlement does not prejudice the Commissions right to adopt financial
corrections[14].
Member
States submit a set of closure documents comprising of a Final Implementation
Report (FIR), a Winding-Up Declaration (WUD) and a certified statement of
expenditure to accompany the final request for payment within 15 months after
the deadline for eligibility of expenditure.
DG
REGIO reviews and analyses these closure documents, making admissibility and
qualitative checks in three separate workflows. The operational (Geographical)
units (GU) make admissibility and qualitative checks on the final
implementation reports (FIR) of the managing authority. The audit units (AU)
check the winding-up declarations (WUD) of the national audit body. The
financial and geographical units (officers) check the certified statement of expenditure,
including the final payment claim. Certified statements of expenditure are only
processed once the other two workflows have been finalised. The DG can also
perform closure audits to obtain additional assurance if necessary.
The SFs
DGs should have a credible closure process for demonstrating that all errors
and irregularities in relation to deficiencies identified in the Member States
management and control systems during the implementing period are detected and
corrected prior to or at the latest at the closure of the OP. To this effect,
the SF DGs have agreed on a common methodology for building up their opinion on
the admissibility and reliability of the final report and WUD and on the
correctness of the final statement of expenditure. The three key elements of
this methodology are i) a quality review of the submitted documents, ii) the
calculation of the residual error rate for each OP in order to show the extent
of the potential remaining deficiencies and their financial impact and iii) the
determination of the financial corrections to be applied.
The
objective is to ensure the timely treatment of the closure documents in order
to lead to a prompt liquidation of the unspent commitment balance (RAL) while ensuring compliance with the principles of sound financial management (including the
application of financial corrections where necessary).
Audit
Objectives
The
objective of this audit was to assess whether the SF DGs have a robust and
sound approach to the closure of the 2000-06 PP. More specifically, whether
controls been put in place were being exercised in practice to ensure the
adequate, timely and effective closure of OPs/Projects, including the
determination of reliable final residual error rates.
Given
that the closure process takes place over a number of years and that much of
that process has already been implemented, the IAS has placed particular
emphasis on identifying improvements which can be used for the closure of the
current, 2007-13 programming period, the planning for which is already underway[15].
Audit
Scope
In
determining the scope of the audit, the IAS took into account the comments
already made by the ECA in the framework of its audits on the closure process[16]
as well as the audits reports already produced by the IAC.
More
specifically, the scope of the audit covered the following areas:
·       
The work done by DG REGIO's
geographical/financial/audit units on the closure documents (the winding up
declaration, final report and certificate of final expenditure) based on the
admissibility and qualitative check-lists developed for the closure exercise;
·       
The methods used to establish the residual error
rate and to apply financial corrections, and their effective application,
including consistency aspects;
·       
The monitoring and reporting provisions in place
for the closure process, their accuracy, completeness, timeliness, including
related disclosure in the AAR;
·       
The risk assessment supporting the DGs' Audit
Plan for closure audits and the impact of the closure audits on the
establishment of the final payment amount.
DG's
AAR: It should be noted that in its 2011 AAR DG REGIO
made a reservation concerning specifically the area/process under the scope of
this audit engagement:
·       
Reservation for reputational reasons concerning
the ERDF for the 2000-2006 period linked to outstanding issues at closure stage
in Spain, Germany, Ireland, Italy and Cross-Border programmes[17].
The IAS
fieldwork was finalised at the end of November 2012. All observations and
recommendations relate to the situation as of that date.
Risks
and audit recommendations
The
following high risks that may affect the achievement of the business
objectives for the process audited were identified:
·       
Report on the closure 2000-2006 and DG REGIO
Preparation for closure (Planning, methodology and guidance) - [Report Finding
1 – Risk Rating - High]: Preparation is key to the
successful closure of OPs under shared management. Both in terms of timeliness
and in terms of providing clear guidance to MS to help minimise the scope for
interpretation and ensure consistent treatment. Without this, there is the risk
that, in a multi-annual control environment, the time taken to deal with
ensuing problems will lead to delays and overlaps between different programming
periods. This may impact on the prioritization of the work done due to resource
constraints and ultimately risks that the closure process fails to properly
detect and correct errors and irregularities.
The
closure of the 2000-06 PP is nearing conclusion, but preparations are already
underway for closing 2007-13 programmes. Based on the lessons learned, DG
REGIO, should, in coordination with the other SF DGs, ensure that it has a
timely and proper strategy and planning process in place for the next closure
exercise, which is supported by clear and comprehensive guidance to MS and
which is fully in line with the legal framework. The IAS notes that draft
guidance to MS on the key issue of sampling and treatment of errors and
irregularities has already been prepared and that the guidelines are expected to
be issued in February 2013.
In
addition, and recognising the importance of the role closure plays in bringing
the multi-annual control process to a conclusion, DG REGIO should, also in
conjunction with the other SF DGs, report on the current state of play and
effectiveness of the process in detecting and correcting errors and
irregularities. In this regard, the IAS notes that in response to the
Parliament's request to ensure legality and regularity when closing 2000-06
programmes[18],
the SFs DGS are planning to report in early 2013 on the state of play as
regards the closure process and demonstrate the corrective capacity of
financial corrections. 
·       
DG REGIO Checks on closure documents [Report
Finding 2- Risk Rating - High]: A lack of a common basis
between SF DGs for checks on MS closure documents may lead to inconsistent
treatment, particularly where there are common MS bodies involved.
Inconsistencies of approach, coupled with a lack of audit trail and effective
supervision may impact on the quality of the assessment made, which could in
turn mean that errors and irregularities are not properly detected and
corrected.
The
financial risk of unfinished projects is particularly high for Greek OPs where
at the moment about 1.92 billion EUR projects remain unfinished and for which
Greece will have to reimburse the EU co-financing received if the projects are
not completed by the deadline.
Using
the experience of the 2000-06 closure exercise, DG REGIO should ensure that the
methodology and internal guidance, including the checklists to be used, are
finalised in good time for closing the 2007-13 PP. They should be communicated
to staff on a timely basis and the checks which are made in practice should be
properly documented and supported by effective supervisory arrangements. DG
REGIO should continue to monitor carefully the completion of unfinished
projects for Greece and Italy and to resume recovery procedures for those
projects which do not meet the deadlines (September 2012 and March 2013).

2.3.3. ESF 2000-06 - Closure (DG EMPL)

Background
The
Structural Funds (SF) DGs' spending accounts for about one third of the total
EC budget annually under shared management for the 2000-2006 Programming Period
(PP). There are 239 Operational Programmes (OPs) for the European Social Fund
(ESF) with a budget of EUR 68,5 billion.
The
closure of an OP represents the financial settlement of the outstanding EU
budgetary commitment through payment of the final balance to the MS or the
issue of a recovery order and de-commitment of any unused balance. Financial
settlement does not prejudice the Commission's right to make financial
corrections.
Member
States submit a set of closure documents, comprising of a Final Implementation
Report (FIR), a Winding-Up Declaration (WUD) and a certified statement of
expenditure to accompany the final request for payment within 15 months after
the deadline for eligibility of expenditure.
DG EMPL
reviews and analyses these closure documents, making admissibility and
qualitative checks in three separate workflows. The operational (Geographical)
units (GU) make admissibility and qualitative checks on the FIR of the managing
authority. The Audit units (AU) check the WUD of the national audit body. The
financial and geographical units check the certified statement of expenditure,
including the final payment claim. Certified statements of expenditure are only
processed once the other two workflows have been finalised. The DG can also
perform closure audits to obtain additional assurance if necessary.
The SFs
DGs should have a credible closure process for demonstrating that all errors
and irregularities in relation to deficiencies identified in the MS management
and control systems during the implementing period are detected and corrected
at the latest at the closure of the OP. To this effect, the SF DGs agreed on a
common methodology. The three key elements to support this methodology are i) a
quality review of the submitted documents, ii) the calculation of the residual
error rate for each OP in order to show the extent of the potential remaining
deficiencies and their financial impact and iii) the determination of the
financial corrections to be applied.
The
objective is to ensure the timely treatment of the closure documents in order
to lead to a prompt liquidation of the unspent commitment balance (RAL) while
ensuring compliance with the principles of sound financial management
(including the application of financial corrections where necessary).
Audit
Objectives
The
objective of this audit was to assess whether the DG EMPL had a robust and
sound approach to the closure of the 2000-06 PP and more specifically, whether
controls put in place have been adequately exercised in practice to ensure a
timely and effective closure of OPs, with a particular focus on the controls
related to the determination of adequate financial corrections and reliable
final residual error rates.
Given
that the closure process takes place over a number of years and that much of
that process has already been implemented, the IAS has placed particular
emphasis on identifying improvements which can be used for the closure of the
current, 2007-13 programming period, the planning for which is already underway[19].
Audit
Scope
In
determining the scope of the audit, the IAS took into account the comments
already made by the ECA in the framework of its audits on the closure process[20]
as well as the audits reports already performed by the IAC.
More
specifically, the scope of the audit covered the following areas:
·       
The work done by DG EMPL's geographical/financial/audit
units on the closure documents (the winding up declaration, final report and
certificate of final expenditure) based on the admissibility and qualitative
check-lists developed for the closure exercise;
·       
The methods used to establish the residual error
rate and to apply financial corrections, and their effective application,
including consistency aspects;
·       
The monitoring and reporting provisions in place
for the closure process, their accuracy, completeness, timeliness, including
related disclosure in the AAR;
·       
The risk assessment supporting the DGs' Audit
Plan for closure audits and the impact of the closure audits on the
establishment of the final payment amount.
DG's
AAR: It should be noted that in its
2011 AAR, DG EMPL made a reservation concerning specifically the area/process
under the scope of this audit engagement. For the 2000-2006 PP, it concerned 13
ESF OPs[21]
for which the reservation was maintained from the previous AAR and related to "deficiency
of the management and control systems set up in relation to the requirements of
Regulation 438/2001".
The IAS
fieldwork was finalised mid-November 2012 and all recommendations relate to the
situation as of that date.
Risks
and audit recommendations
The
following high risks that may impact the achievement of the business
objectives for the process audited were identified:
·       
Preparations for closure (Planning, methodology
and guidance) - [Report Finding 1 – Risk Rating - High]: Preparation
is key to the successful closure of OPs under shared management. Both in terms
of timeliness and in terms of providing clear guidance to MS to help minimise
the scope for interpretation and ensure consistent treatment. Without this,
there is the risk that, in a multi-annual control environment, the time taken
to deal with ensuing problems will lead to delays and overlaps between
different programming periods. This may impact on the prioritization of the
work done due to resource constraints and ultimately risks that the closure
process fails to properly detect and correct errors and irregularities.
The
closure of the 2000-06 PP is nearing conclusion, but preparations are already
underway for closing 2007-13 programmes. Based on the lessons learned, DG EMPL,
should, in coordination with
the other SF DGs, ensure that it has a timely and proper strategy and planning
process in place for the next closure exercise, which is supported by clear and
comprehensive guidance to MS and which is fully in line with the legal
framework. The IAS notes that draft guidance to MS on the key issue of sampling
and treatment of errors and irregularities has already been prepared and that
the guidelines should be issued in February 2013 followed by
information/training sessions to the DG's staff and representatives of the MS.
In
addition, and recognising the importance of the role closure plays in bringing
the multi-annual control process to a conclusion, DG EMPL should, also in
conjunction with the other SF DGs, report on the current state of play and
effectiveness of the process in detecting and correcting errors and
irregularities. In this regard, the IAS notes that in response to the
Parliament's request to ensure legality and regularity when closing 2000-06
programmes[22],
the SFs DGS are planning to report in early 2013 on the state of play as
regards the closure process and demonstrate the corrective capacity of
financial corrections.
·       
DG EMPL Checks on closure documents [Report
Finding 2- Risk Rating - High]: A lack of a common basis
between SF DGs for checks on MS closure documents may lead to inconsistent
treatment, particularly where there are common MS bodies involved.
Inconsistencies of approach, coupled with a lack of audit trail and effective
supervision may impact on the quality of the assessment made, which could in
turn mean that errors and irregularities are not properly detected and
corrected.
Using
the experience of the 2000-06 closure exercise, DG EMPL should ensure that the
methodology and internal guidance, including the checklists to be used, are
finalised in good time for closing the 2007-13 PP. They should be communicated
to staff on a timely basis and the checks which are made in practice should be
properly documented and supported by effective supervisory arrangements. 
DG
EMPL has envisaged to organise information/training sessions to the DG's own
staff on the content of the closure guidelines and the different aspects of the
closure. In addition, for the 2007-2013 closure, The IAS notes that DG EMPL
does not intend to outsource the analysis work of the closure documents.

2.3.4. Implementation of 2007-13 Programmes (DG REGIO)

Background
The
Cohesion area spending accounts for more than one third of the total EC budget.
For the 2007-2013 Programming Period (PP) covering the European Regional
Development Fund (ERDF) and Cohesion Fund (CF), there are a total of 317
Operational Programmes (OPs). In 2011, DG REGIO made payments of EUR 25,84
billion covering both ERDF and CF.
Under
shared management, the Member States (MS) have primary responsibility for
implementing effective internal control systems to prevent, detect and correct
irregular expenditure, while the Commission performs a supervisory role over
national systems and assumes final responsibility for the implementation of the
budget. 
Audit
Objectives
Recognising
the persistently high error rates in the Cohesion area, the IAS conducted this
audit on the implementation of the 2007-13 PP for ERDF/CF programmes in order
to assess firstly, the extent to which DG REGIO has determined and reported
reliable error rates and secondly, the extent to which it has taken sufficient
and adequate measures to reduce the high error rates.
Audit
Scope
The
audit specifically covered the following areas:
·       
The guidance provided to MS Audit Authorities
(AAs) on the methodology for determining error rates and the checks made by DG
REGIO on the reliability of those error rates.
·       
The checks made by DG REGIO in order to place
reliance on AAs and their Annual Control Reports (ACR), based on a sample of
files and by accompanying DG REGIO auditors during audit missions to MS.
·       
Follow up of the actions resulting from the
Commission working paper on the analysis of errors on Cohesion Policy and from
other action plans. 
·       
Preventive, detective and corrective measures to
tackle the problem of high error rates. 
·       
Through file examination, analysis of the key
decision processes basis for making/lifting reservations, interruptions,
suspensions and financial corrections.
·       
Analysis of the DG process for addressing the
high risk OPs, including accompanying DG REGIO auditors in a sample of Bridging
the Gap missions to MS.
There
were no scope limitations.
The
fieldwork was finalised in mid-November 2012. All observations and
recommendations relate to the situation as of that date.
DG's
AAR: The following reservation was made in the 2011
AAR concerning specifically the area/process covered by the scope of this
engagement:
·       
"Reservation concerning the ERDF/Cohesion
Fund management and control systems for the period 2007-2013: 
o      
Significant issues regarding the effective
functioning of management and control systems in the following Member States:
Austria, Bulgaria, Czech Republic, Estonia, France Germany, Italy, Latvia,
Lithuania, the Netherlands, Poland, Slovenia, Slovakia, Spain, United Kingdom
and Territorial Cooperation programmes.
o      
Compliance assessment not yet approved: one
Italian programme
o      
Reputational risks for Greece, Hungary,
Romania."
The
total number of OPs in reservation for the ERDF/CF is 146 of which, 93 are in
reservation for the entire programme, 28 for only part of the programme, and 25
are in reservation for reputational risks.
Risks
and audit recommendations
The
following high risks that may impact on the achievement of the business
objectives for the process audited were identified:
·       
Reliability of Audit Authority error rates
(Report Finding 1: Risk rating – High): The IAS
recognises the high inherent risk of a process in which DG REGIO depends
heavily on the work of the AAs. Reliable AA error rates are key to the
assurance building process and the IAS notes the progress made. However,
problems experienced by AAs in interpreting the guidance on sampling means
there is a risk that error rates may be understated. DG REGIO recognises this
and, together with the other SFs DGs, is currently finalising revised guidance
aimed at addressing the gaps noted. DG REGIO should complete this process as
soon as possible and follow up with AAs to ensure that the guidance is properly
understood and implemented in practice.
Concerning
the DG's checks on the reliability of AA error rates, the complex and time
-consuming nature of this work means there is a risk that mistakes may not be
identified and corrected and/or key information is not taken into account when
concluding on reliability. DG REGIO should amend its checklist for reviewing
the AA ACR, taking also into account the on-going clarifications on guidance,
to ensure that auditors conclude in their checklist on the potential impact of
their review on the overall assessment of the AA error rate.
·       
Detective measures to reduce error rates (Report
Finding 2: Risk rating – High):  Given the high inherent
risks of the shared management system whereby the DG is so dependent on the
work of AAs, it is essential that it undertakes its own very robust detective
checks on the spot in the MS. Notwithstanding the need for a risk based
approach, the variations in the depth and extent of DG REGIO audit testing
noted by the IAS, in particular for on-the-spot work at final beneficiaries and
checks made on original documents, means there is a risk that system weakness
and/or errors and irregularities may not be detected. DG REGIO should ensure
more consistency of approach for the same audit enquiry type through further
instruction/guidance on the extent of testing to be carried out on-the-spot. It
should explain more clearly in its Audit Strategy that the scope of on-the-spot
work can vary considerably between the audit teams, depending on programmes and
ensure that appropriate checklists are used on missions. Their completion
should be clearly evidenced for management/quality review and tailor-made
checklists used for each mission which involves the follow up of an action
plan, including the specific corrective measures set out in the
interruption/pre-suspension letter.

2.4. Research,
energy and transport

(EACI,
ERCEA, DG CNECT, JRC, REA, DG RTD, TEN T-EA, DG MOVE, DG ENER)

2.4.1. Control
Strategy in DG ENER

Background
The IAS
audit on The Control Strategy in DG Energy (DG ENER) was included in the
IAS coordinated 2011 Audit Work Programme. This followed the audit risk
assessment carried out in 2010. The relative importance of the budget of DG
ENER (174 million EURO commitments in 2011) and the error rate (4,4% for the 6th
Research Framework Programme in 2010) which affects the ECA DAS, justified its
inclusion in the IAS' Strategic Audit Plan for 2011-2012.
Audit
Objectives
The
objective of the audit was to assess the adequacy and effective application of
the internal control system (ICS), risk management and governance processes
related to the Control Strategy in DG ENER.
In
particular, the audit assessed whether the ICS provides reasonable assurance
regarding compliance with the relevant legislation, the reliability
of financial and management information and the effectiveness and
efficiency of the processes mentioned in the scope below.
Audit
Scope
As a
result of the desk review and the interviews carried out during the Preliminary
Survey (which took into account the work already performed by the IAS, the
SIAC and the Financial Audit Unit SRD.5 in DG ENER and by the Court of
Auditors), the scope of this audit focussed on the following processes: 
·       
Ex-ante financial controls in the following
sub-processes of DG ENER: commitments, payments (prefinancing – interim
payments – final payments), recoveries and decommitments. 
·       
Ex-post controls (external, financial audit). 
The
part of the budget sub-delegated to the Executive Agency for Competition and
Innovation (EACI) is excluded from the scope of this audit because it is
covered by other audits[23].
Observations/reservations
made in the 2011 AAR of DG ENER concerning the processes under the scope of
this audit:
·       
Reservation concerning the rate of residual
errors with regard to the accuracy of cost claims in Sixth Framework Programme
(FP6) contracts. The residual error rate observed by ex-post controls was
4,44%, which is higher than the control objective (2%).
·       
Reservation concerning the rate of residual
errors with regard to the accuracy of cost claims in Seventh Framework
Programme (FP7) contracts. The residual error rate detected by ex-post controls
is higher than the control objective (2%). As the limited number of random FP7
audits was insufficient to give a representative indication of the likely trend
in its FP7 error rate, DG ENER considers 4,5% (i.e. the average of the DG RTD
and DG INFSO error rates) as the best estimate of its likely error rate.
During
the audit, no scope limitations were identified.
The
fieldwork was finalised on 24 February 2012. All observations and
recommendations relate to the situation as at that date and do not consider
improvements introduced since then.
Risk and audit recommendation
The
following high risks that may impact the achievement of the business objectives
for the processes audited were identified:
·       
3220-
Completeness and consistency of audit working papers
– Risk rating high: Ex-post audits that are not
properly documented, reviewed and filed may affect the control efficiency and
might lead to non-compliance with the International Audit Standards. The risk
of fraud is not sufficiently mitigated.
The
IAS recommends DG ENER to improve the audit files by using standardised audit
programmes and working papers, by cross-referencing information on the working
papers with the underlying evidence and the audit issues in the audit report
and by documenting their review and approval. Checks should also address fraud
prevention and detection.

2.5. External Aid, development and
enlargement

(DG DEVCO,
DG ECHO, DG ELARG, FPI)

2.5.1. Set-up of internal organisation in
EU delegations (DG DEVCO) - Limited Review

Background
The
creation of the European External Action service (EEAS), along with the
adaptation of the relevant legal provisions, has required the set-up of a
number of new structures and processes, involving both Headquarters and Delegations,
while at the same time ensuring the implementation of the main operations
related to external aid. Delegations, in particular, play a crucial role in
implementing both the Commission's operational budget and the EEAS's
administrative budget[24].
The setting up of adequate financial circuits is a key element to ensure
financial and operational accountability and an effective implementation of a
sound financial management system. This exposes DG DEVCO to a high level of
residual risk in this area.
As a
result, the IAS undertook a limited review on the set-up of the internal
organisation in EU Delegations following the creation of the European
External Action Service (EEAS). The related report deals exclusively with the
issues identified in the management of the operational budget of the Commission.
A separate report was addressed to the EEAS concerning issues related to the
administrative budget and those of a cross-cutting nature.
Due to
the constantly changing environment following the creation of the EEAS (e.g.
revised financial circuits in place after the end of the limited review
fieldwork) or the implementation of a revised internal control architecture in
the Delegations (e.g. revamped External Assistance Management Reports,
declaration of assurance from Heads of Delegation), the effective implementation
of these revised arrangements will be the subject of a future audit once the
controls have been embedded in DG DEVCO and the Delegations. 
Objectives and Scope
The
general objective of this engagement was to assess the procedures put in place
between the European Commission and the EEAS to ensure the sound financial
management of the external aid budget implemented through EU Delegations.
The
detailed objectives were as follows:
·       
To assess the organisational arrangements and
functioning of financial circuits, including sub-delegations and deputising
arrangements.
·       
To assess the support provided by DG DEVCO (HQ)
to EU Delegations, i.e. in defining internal management and control systems in
Delegations, the provision of specific training to newly appointed Heads of
Delegation addressing in particular their duties, obligations and
accountability towards the Commission.
·       
To assess the role of Heads of Delegation (and
Deputy Heads of Delegation, where applicable) to ensure the set up and
functioning of an adequate internal management and controls system and for the
management of funds and operations within their Delegations.
·       
To assess the reporting mechanisms from EU
Delegations to provide assurance to DG DEVCO’s Authorising Officers by
Delegation (AOD), i.e. completeness, quality, timeliness, etc.
·       
To assess the procedures put in place by the
Appointing Authority to ensure that the rotation exercise does not have a
negative impact on the implementation of the external aid budget.
Main risks and recommendations
In
addition to the setting up of new structures and processes following the
creation of the EEAS, DG DEVCO launched a major revision of its internal
control architecture (Control Pyramid strategy) in 2010. One of the expected
benefits is better accountability through improved reporting systems. This
initiative has resulted in a number of specific actions including a new
web-based reporting tool (External Assistance Management Reports) for
Delegations. As from 2012, Heads of Delegation have also been required to
provide a declaration of assurance and hence need to cooperate closely with the
Commission for the proper implementation of the funds in order to ensure, in
particular, the legality and regularity of financial transactions, the respect
of the principle of sound financial management of the funds and the effective
protection of the financial interests of the union.
One high
risk was identified and a corresponding recommendation was made:
Role of Deputy Head of Delegation
·       
Risk: A
cross-cutting inter-institutional governance issue identified in an audit
report of the IAC of DG ELARG concerns the current role of Deputy Heads of
Delegation. The post of Deputy Head of Delegation was created in the
enlargement EU Delegations to help the Head of Delegation in the management of
financial assistance. These officials were selected due their knowledge and
experience in financial assistance at the Commission. As of 1 January 2011, all
Deputy Heads of Delegation were transferred to the EEAS. In line with the
current rules (Financial Regulation), they can no longer hold a sub-delegation
or act in the financial circuit for the execution of the operational budget.
However, this automatic transfer of all Deputy Heads of Delegation to the EEAS,
regardless of the nature of their tasks and the expertise they possess, led to
disruptions in the operation of these enlargement EU Delegations and may
represent an inefficient allocation of resources and skills across the two
institutions at the level of the Delegations.
·       
Recommendation (Very Important):
The IAS invites DG DEVCO to consider whether the
creation of a DEVCO middle management function - particularly in the larger EU
delegations - may help the Head of Delegation in the management of financial
assistance.
Conclusion
Delegations
play an important role in the control architecture of DG DEVCO. One of the most
tangible benefits of DG DEVCO’s new Control Pyramid strategy is expected to be
better accountability through improved reporting systems of the quality of
implementation of aid programmes. In this respect, the delegations’ External
Assistance Management Reports together with the declaration of assurance by
Heads of Delegations as from 2012 are considered to be the foundation of this
Control Pyramid.
The
creation of the EEAS has necessitated changes to the working environment and
rules within Delegations and which has brought about an added complexity.
During 2011, working arrangements between Commission services and the EEAS were
issued and subsequently fine-tuned to mitigate the risks associated with issues
detected. Some of the measures put into place had not been fully embedded at
the time of the limited review fieldwork and can only be assessed once a
full cycle of budget implementation has been completed.
The
creation of the Steering Committee for Delegations (EUDEL) should help resolve
most, if not all, of these issues. However, some inefficiency may be
unavoidable due to the separate legal structure of the two institutions and the
need to strictly comply with the financial regulation.
The IAS
intends to conduct a follow-up within two years of the issuance of this report.
It will also assess (as part of a future audit) the controls put in place to
assess the risks, if any, associated with the other issues identified and for
which no recommendations have been made in this report.

2.5.2. Financial Management of Regional
Programmes (DG ELARG) 

Following the completion of its
preliminary survey, the IAS decided not to pursue its planned audit on Financial
Management of Regional Programmes in DG ELARG. The main reasons for this
decision are as follows:
·       
The IAC of DG ELARG was undertaking an audit on
Joint Management (including Regional Programmes) at the time.
·       
The remaining part of Regional Programmes, which
is managed under centralised direct management, was assessed as a low risk
activity by DG ELARG management,
·       
The relatively low value of commitments and
payments made during the period 2009-2011.

2.6. Education and citizenship

(DG COMM,
DG EAC, EACEA, DG HOME, DG JUST)

2.6.1. Lifelong Learning Programme (DG EAC/EACEA)

Background
The
Lifelong Learning Programme (LLP) is an umbrella programme integrating various
educational and training initiatives. It has a budget of over €7 billion for
the 2007-2013 period, of which around 11% is managed by the Education,
Audiovisual and Culture Executive Agency (EACEA – hereafter the Agency) under
the supervision of its parent DG (DG EAC – Education and Culture). EACEA
started its operations on 1 January 2006 and its current mandate ends at the
end of 2015[25].
Audit
Objectives
The
objective of this audit was to assess whether the control
strategy in place in the Education, Audiovisual and Culture Executive Agency
for the management of the Lifelong Learning Programme enables it to obtain
reasonable assurance on the legality and regularity of the underlying financial
transactions.
In
addition, the audit also assessed the adequacy, efficiency and effectiveness of
the internal control system put in place by DG EAC for exercising its
supervisory role as parent DG in the implementation of LLP by EACEA.
Audit
Scope
The
detailed scope of the audit was as follows:
·       
EACEA's procedures and control systems in place
for the processing of final payments of the LLP programme in
terms of compliance with the applicable rules, regulations and sound financial
management principles;
·       
DG EAC's control strategy and the internal
control system in place for exercising its supervision on the implementation
of LLP by EACEA.
In its
2011 AAR, the Agency made a reservation concerning the high rate of residual
errors regarding the implementation of the 2000-2006 and 2007-2013 LLP
programmes of 3,02% and 3,93% respectively. The analysis of the errors by EACEA
shows that these resulted mostly from difficulties faced by beneficiaries to
produce adequate justifying documents and the non-respect of some eligibility
rules during reporting. However, the 2011 value at risk represented 0,80% of the
2011 total payments budget of the Agency (€4,3 m out of total payments of
€533,4 m). In order to deal with this reservation on LLP and a previous
reservation in 2010 on two other EACEA managed programmes (Culture and Youth),
EACEA is in the process of implementing an action plan[26],
which was prepared for the 2010 reservation.
Areas
excluded from the scope of this audit included final
payments of the administrative budget and procurement as well as those parts of
LLP implemented through the National Agencies in the Member States.
The
audit fieldwork was finalised on 2 October 2012. All observations
and recommendations relate to the situation as of that date.
Risks and audit recommendations
The following High risks that may impact the efficiency of the
achievement of the business objectives for the process audited were identified:
·       
Sub-optimal effectiveness with the
parent DG's supervisory requirements of Council Regulation No 58/2003
(Executive Agency statute) and the Delegation Act, which may have an adverse impact
on the achievement of the parent DG's efficiency objectives as well as an
inefficient and ineffective implementation of the LLP programme.
·       
Insufficient clarity or duplication
of roles and responsibilities may result in inefficiencies in the implementation
of LLP and sub-optimal use of resources.
·       
An inconsistent treatment/approach in applying
the control strategy when processing final payments and weaknesses in the
application of the non-retroactivity rule may result in the approval of
ineligible costs leading to inappropriate payments made, inconsistency in the
treatment of beneficiaries and reputational damage for the Agency.
DG EAC
should therefore:
·       
define an updated
supervision strategy for the Agency which should be validated by its senior
management,
·       
conduct a review to identify
efficiencies in the use of its resources by, for example, performing a resource
mapping of the DG EAC policy units , or building on the results of a Cost
Benefit analysis of alternative delegation arrangements between DG EAC and
EACEA.
The EACEA
should:
·       
ensure that its desk control strategy is applied
systematically,
·       
take the necessary steps to ensure compliance
with the non-retroactivity rule.

2.6.2. Control
Strategy in DG HOME

Background
The
mission of the Directorate-General for Home Affairs (DG HOME) is to create, on
the basis of the principle of solidarity, an area of freedom, security and
justice without internal borders where EU citizens and third-country nationals
may enter, move, live and work. Four separate Funds; the External Borders Fund
(EBF ), European Return Fund (RF) , European Refugee Fund (ERFIII), and the
European Fund for Integration of third country nationals (EIF), are
together managed under the "Solidarity and Management of migration
flows" general programme (SOLID). The management of these funds is a
shared responsibility between the Commission and the Member States under
Article 53 of the Financial Regulation. Grants are disbursed over a
thirty-month period for each annual programme and the Commission's funds
co-finance these activities at a percentage between 50 and 75%.
In
2011, DG HOME had committed in total 1.382M€ in appropriations for the SOLID
Funds.
The IAS
audit on the Control Strategy in DG HOME is included in the IAS 2012 Audit Work
Programme. This follows the audit risk assessment carried out in 2010/11. The requirement for the supervision and management of an Annual
Programme for each year, for four funds, by 27 Member States and 3 associated
Countries[27],  using a control structure that has been designed principally in
respect of the (multi annual programme based) Structural Fund DGs, is a
demanding challenge for a relatively small DG. This
audit should contribute to the Internal Auditor's overall opinion.
Audit
Objectives
The
objective of the audit was to assess the adequacy and effective application of
the internal control system (ICS), risk management and governance processes
related to the operational financial and ex post controls system for the
operation of the four shared management SOLID Funds managed by DG HOME.
The
audit focussed on the procedures and processes applied by the DG in
establishing the annual management opinion of the Director-General in this area
based on the assurance provided using the building blocks of both an audit
opinion (from DG Home Affairs auditors) and an operational opinion (from the
Authorising Officer by Sub-delegation) and  on the processes in place to ensure
that the Commission fully complies with its regulatory and supervisory
responsibilities in managing the SOLID Funds.
Audit
Scope
The
audit focussed on the procedures and controls in respect of the closure and
final payments of the SOLID Funds for the 2007 (EBF and EIF) and 2008 (all four
funds) Annual Programmes (APs), as well as procedures in place for suspensions
and financial corrections. The audit also reviewed the overall audit and
control strategy developed and implemented by DG HOME to ensure the
Commission's compliance with its regulatory and supervisory responsibilities in
managing the Funds. 
There
are no reservations in the DGs 2011 Annual Activity Report (AAR) for this area.
The
fieldwork was finalised on 13 July 2012. All observations and recommendations
relate to the situation as of that date.
Risks
and audit recommendations
The following high risks that may impact the achievement of the
business objectives for the process audited were identified:
1. Submission of Closure Files:
There is a materialised risk that the DG is not
acting in accordance with the requirements of the underlying Council Decisions.
This practice could be considered as giving an unfair treatment to some MS.
Further, this could bring a reputational risk to the Commission or weaken the
Commission's position when enforcing other deadlines. Also, these extended
delays could limit the Commission’s ability to take prompt corrective actions. 
The IAS recommends DG HOME to take immediate steps to confirm with
MS the current practice and to report these non-compliance events to its
Internal Control coordinator and kept centrally in the register of exceptions
and non-compliance events.  It should take steps to implement the procedures
within the earliest timeframe possible, and ensure that any future exceptions
of this nature are appropriately reported and followed up (See also
recommendation 3).
2. Ex Post Audit Strategy;
Without a methodology for the incorporation of the results of ex post audits in
the declaration of assurance, the level of assurance that might cost
effectively be taken from ex post audits in DG HOME cannot be identified and
realised in the AAR, and an error rate cannot be correctly established. The
Audit Strategy in respect of ex post control is incomplete and fails to
properly identify the full scope of audit work, the level of audit assurance
sought, and its resourcing requirements over the period. If the overall
approach for the ex post audits is not risk based there is a risk that the
audit sampling and coverage might not be sufficient to provide the level of
assurance for the DG in the overall opinion.
The IAS recommends DG HOME should establish
a methodology for the incorporation of the results of ex post audits in the DGs
assurance model, in the declaration of assurance, and in the AAR. In doing so,
the DG should determine the level of assurance that might cost effectively be
taken from the results of ex post controls and establish the means of
determining an annual error rate. Further, the IAS recommends that the key details of the DGs planned ex post audit work for the SOLID
Programme (levels of assurance sought overall number of audits, resource and
cost budget analysis) should be updated to the Audit Strategy and the overall
manner of audit selection if not risk based, should be justified. Lastly, the
IAS recommends that the DG clearly identify the budget required to meet the ex
post audits plan both annually and as far as possible for the likely sample
population over the period of the Programme. 
3. Management and supervision of closure procedures: With a
significantly growing number of cases the current tools used to track and
manage Closure files cannot be considered sufficient to avoid errors and
oversights and maintain an effective control to ensure the sound monitoring of
the funds. A lack of up to date, approved, and clear guidelines could lead to
inefficiencies and delays in the conduct of the Closure process and a possible
loss of audit trail. 
The IAS recommends that the DG revise its procedures in both the
current and the new legislative programme replacing the SOLID Funds to
strengthen its management and control systems in proportion with the amount of
funds involved. Further, the IAS recommends that the DG take steps to
appropriately revise and formalise their Closure Checklist and Guidelines.
Particular attention should be paid to the determination of clear policies and
procedures in respect of Closure file document management and retention.

2.6.3. Control Strategy in DG JUST 

Following the completion of its
preliminary survey, the IAS has decided not to pursue its planned Audit on
the Control Strategy in DG JUST. The main reasons for this decision are as
follows.
The IAS preliminary audit work
confirmed that the Grant and Procurement Programmes implemented by DG JUST from
2011 have not yet reached the stage in their implementation that would have
allowed a sufficient audit examination and assessment of the management controls
and procedures in respect of both ex ante and ex post controls to be conducted.
On grounds of materiality, it was
not considered that the audit would have covered a sufficient volume of final
payments (insufficient level of final payments compared to commitments). 

2.6.4. Monitoring the implementation EU Law (DG JUST)

Background
A timely and correct application of EU legislation is primarily
the responsibility of the Member States. The control of the exercise of that
responsibility by the Member States is one of the Commission's core activities
as laid down in the Treaty in the fulfilment of its role as the "Guardian
of the Treaties". The IAS audit on Monitoring
the Implementation of EU law in DG JUST was included, as a result of a
risk assessment, in the 2012 IAS-IAC coordinated Audit Work Programme.
Ineffective and inefficient monitoring and implementation of EU law as
well as difficulties to deal with infringement cases are examples of risks that
DG JUST may run if the audited process is not sufficiently under control.
Both DG JUST acquis and policy areas (Union Citizenship, Civil / Criminal
Justice, Equality and Fundamental Rights) give rise to more than 10 % of
all Commission-wide active infringement cases. Furthermore, the adoption of the
Charter of Fundamental Rights has generated many inquiries. Finally, a higher
number of infringements are expected in the coming years due to the
implementation of the Lisbon Treaty and the shift of legislation from the first
to the third pillar in the Justice policy area.
Audit
Objectives
The objective of this audit was to audit the management,
efficiency and effectiveness of the monitoring of EU law for the years 2007 to
2011 in DG JUST.
After
having performed similar audits in other DGs, the IAS intends to address in
2013 an overview report to the Secretariat-General on possible recurrent and
Commission-wide issues.
Audit
Scope
The
audit focussed on:
·       
Pro-active monitoring:
assessing the efficiency and effectiveness of the DG's process for monitoring
the timely, correct and complete implementation of Directives, mainly for the
years 2007 to 2011, against the criteria defined for the different phases.
·       
Ex post
monitoring: assessing the DG's handling of complaints and
infringements related to Directives, Regulations and the Treaty, with respect
to correctness, efficiency and effectiveness, including compliance with the
Manual of Procedures.
·       
Assessing compliance of the
EU law monitoring function (pro-active and ex post) with relevant
Commission Internal Control Standards and provisions.
·       
Assessing potential issues for simplification
of procedures, including IT processes.
This
process had been audited in DG JUST neither by the IAS, the IAC nor the
European Court of Auditors (ECA). 
There
are no reservations in the Annual Activity Reports (AAR) from 2007 to 2011 that
relate to the area / processes audited.
The
fieldwork was finalised in July 2012. All observations and recommendations
relate to the situation as of that date.
Risks and audit recommendations
The following high risk that may impact the achievement of the
business objectives for the process audited was:
Due to
insufficient formal performance measurement notably in the MP and the AAR, the
activity “monitoring the application of EU law” may not be performed effectively,
efficiently and economically.
In
order to better monitor performance, DG JUST should:
·       
consolidate the most relevant data in the MP and
AAR; 
·       
regularly report to management on the output of
indicators and achievement of MP objectives in relation to this activity,
analyse performance evolution over time and root causes of delays and/or
increasing backlog and propose remedial solutions;
·       
assess the volume of the activity (number of
cases, staff involved, etc.) in relation to preliminary rulings;
·       
put in place a uniform DG-wide monitoring system
to enable a reliable statistical reporting both for DG JUST management and
SG coherence exercises.

2.7. Economic
and financial affairs

(DG COMP,
DG ECFIN, DG ENTR, DG MARKT, OLAF, DG TAXUD, DG TRADE)

2.7.1. Implementation
by the EIF of the CIP Programme (DG ECFIN)

Background
The High Growth and
Innovative SME Facility (GIF) is a Community financial instrument for small and
medium-sized enterprises (SMEs) within the Competitiveness and Innovative
Framework Programme (CIP)[28].
CIP has a budget of € 3.6 billion for the period 2007-2013. It comprises
the following specific programmes: the Entrepreneurship and Innovation
Programme (EIP); the ICT Policy Support Programme and the Intelligent Energy
Europe Programme. The EIP devotes € 1.1 billion to improving access to finance
for the start-up and growth of SMEs and for investment in innovation as
follows: € 0.5 billion through the SME Guarantee Facility (SMEG) and € 0.6
billion through the High Growth and Innovative SME Facility (GIF). The European
Investment Fund (EIF) implements GIF on behalf of the Commission on the basis
of a Fiduciary Management Agreement (FMA).
Objectives
and scope
The
general objective of this joint IAS/ECFIN-IAC audit was to assess how
effectively the EIF implements GIF, and in particular i) how the EIF complies
with the FMA and ii) how effectively and efficiently ECFIN supervises that GIF
achieves its specific objectives.
There
are no observations/reservations in the 2010 AAR in relation to the
area/process audited.[29]
The
fieldwork was finalised on 16 November 2011. All observations and
recommendations relate to the situation as of that date.
Risks
and audit recommendations
The
following high risks that may affect the achievement of the business objectives
for the process audited were identified:
·       
Indicators – Risk rating High: Non-effective
indicators may mean that ECFIN cannot measure GIF's progress towards its
objectives. This may also mean that the actors involved cannot correct timely
their actions. In order to mitigate these risks, DG ECFIN should, within the
scope of its responsibilities, define and monitor relevant indicators for CIP's
successor programme.
·       
Material events – Risk rating High: If
DG ECFIN receives incomplete or insufficient information it may not have all
material elements to approve or reconsider financing decisions. In order to
mitigate this risk, DG ECFIN should require the EIF: 1) to
review its procedures for identifying material events; 2) to ensure that
the information contained in financing proposals is complete and up-to-date;
new material developments, if any, should be reported. This is particularly
important when the EIF's Due Diligence happens long before the Request for
Approval to the Commission.

2.7.2. Off-budget
operations (DG ECFIN)

Background
Since 2008, the global
economy is facing a financial crisis involving banking systems, stock markets
and the flow of credit which has turned into a sovereign debt crisis. In order
to deal with this unprecedented situation, the European Union has created new financial
instruments or revamped existing ones to act as a borrower and on-lend money to
Member States in financial difficulties.
The European Commission,
acting on behalf of the European Union (EU), currently operates three
programmes of financial assistance under which it may grant loans and fund
these by issuing debt instruments in the capital markets:
·       
The European Financial Stabilisation Mechanism
("EFSM"): assistance to all EU Member States,
currently activated for Ireland and Portugal. In addition, the European
Financial Stability Facility (EFSF), providing financial assistance to Euro
area Member States, was created as a temporary and inter-governmental crisis
management instrument. The activities of these two instruments have been
absorbed by the new EU's permanent crisis mechanism, the European Stability
Mechanism (ESM), which entered into force on 27 September 2012;
·       
The Balance-of-Payments ("BoP")
assistance: assistance to Member States that have not yet
adopted the euro;
·       
The Macro-Financial Assistance
("MFA"): assistance to third countries that are
experiencing short-term balance of payments difficulties.
In addition, the
European Commission manages the package of pooled bilateral loans from Euro
Area Member states to Greece.
Audit
Objectives and Scope
The
objective of this audit was to assess whether the existing controls are
adequate to ensure compliance of the borrowing and lending operations
and the related monitoring activities related to the EFSM
with the relevant procedures and market practices. 
The
following activities were considered out of scope of this engagement:
·       
The verification of the yearly budget
appropriations' compliance with the maximum allowed own resources threshold[30]
(task assigned to DG Budget in the communication accompanying the empowerment
decision SEC(2010)941).
·       
The accounting of the borrowing and lending
activities under the EFSM as it is audited by the European Court of auditors
("ECA") as part of the annual audit of the financial statements.
There
are no observations/reservations in DG ECFIN's 2011 AAR that relate to the
area/process audited.
The
fieldwork was finalised on 31 August 2012. All observations and recommendations
relate to the situation as at that date. The audit findings have taken into
consideration the findings and recommendations of the recent audits relevant to
off budget operations and in particular the IAC's audit on BoP Borrowing and
Lending operations[31]
and on Macro Financial Assistance.[32]
Risks and audit recommendations
The
weaknesses may affect business continuity and the efficiency and effectiveness
of operations resulting in the Commission's image with external stakeholders
and the wider public being undermined and expose it to a high reputational
risk.
Due to
the number of outside parties involved in the process, some risks may be
unavoidable (e.g. leaks of sensitive information). However, given the nature of
the activities, the interest of the media and the EP in the process, DG ECFIN
should ensure that robust controls, adapted to the evolving nature of the
crisis, are developed to mitigate the above risks as follows:
·       
Given the interrelationship between the issues
identified, DG ECFIN should firstly perform a risk assessment of the activities
related to the management of the financial crisis it currently performs under
EFSM (risk identification, risk rating, identification of resource
implications),
·       
DG ECFIN should secure support at the highest
level from the central services in terms of the provision of logistic support
and involve other parties concerned (DG HR[33],
DIGIT, DG COMM, DG BUDG, etc.),
·       
DG ECFIN should set its risk appetite for the
process accordingly,
·       
DG ECFIN should develop appropriate controls to
mitigate the risks identified,
·       
DG ECFIN should have appropriate staff
arrangements and contingency planning in place to ensure business continuity.

2.7.3. Control
Strategy in DG ENTR

Objectives and Scope
The IAS
audit on the Control Strategy for managing the operational budget in DG
Enterprise and Industry (DG ENTR) was included in the IAS' 2011 and 2012
audit plan. This follows the audit risk assessment carried out in 2010 and
updated in 2011. Furthermore, DG ENTR manages a relatively important budget in
the context of the IAS Overall Opinion (€ 706
million commitments excluding administrative expenditure in 2012). Moreover, the
DG made reservations in its 2011 Annual Activity Report concerning the residual
error rate with regard to the accuracy of cost claims in the 6th and
7th Research Framework Programmes (2,83% and 5,41% respectively).
Audits to ensure that a coherent control strategy is being implemented for
every significant area of expenditure to address the risk of error in the
underlying transactions have received priority in the IAS' audit plan, as they
should contribute to achieving a more positive Statement of Assurance (DAS) by
the European Court of Auditors (ECA).
The
objective of the audit was to assess whether DG ENTR's control strategy
designed to obtain assurance on the legality and regularity of underlying
transactions is adequate, effectively implemented, regularly monitored and
adequately reported on and is ensuring that corrective measures are taken
promptly and proportionately.
The
scope of this audit engagement covered the processes of ex-ante financial
controls, ex-post controls and DG ENTR antifraud strategy. The Global
Navigation Satellite Programmes (GNSS) were excluded from the scope as they had
been already audited by the IAS in 2011.
DG ENTR
disclosed the following two reservations in the 2011 AAR concerning
specifically the areas under the scope of this audit: 
·       
Reservation concerning the rate of residual
error with regard to the accuracy of cost claims in the 6th Research
Framework Programme (FP6). At the end of 2011, the
cumulative residual error rate is 2.83 % and exceeds the 2% multiannual
control objective.
·       
Reservation concerning the rate of the
residual error with regard to the accuracy of cost claims in the 7th
Research Framework Programme (FP7). As the audit sample is not representative,
it is not possible to state with certainty that the cumulative residual error
rate (5.41% for DG ENTR at the end of 2011) or if the level of financial impact
of errors identified will fall below the materiality threshold at the end of
the multi-annual period.
During the audit, no scope
limitations were identified.
The fieldwork was finalised on
25 May 2011. All observations and recommendations relate to the situation as of
that date.
Risks and Recommendations
The following high risks that
may impact the achievement of the business objectives for the processes audited
were identified:
·       
Internal Control Coordinator (ICC) role. The
limited ICC's role may lead to ineffective and inefficient oversight and
coordination of the implementation of the internal control standards and audit
recommendation, especially in the financial area. Therefore, DG ENTR should
strengthen his role.
·       
e-Domec rules. Non-compliance relating to
e-Domec rules (internal control standard n° 11) may lead to loss of files,
inefficient processing of documents and weak accountability. DG ENTR should
strengthen document management, at least in the audited Directorates, through
awareness actions, proactive support and close monitoring.   
·       
Exception register. Incomplete and inaccurate
registration of exceptions does not comply with the internal control standard
n°8 and weakens the ICC's capacity to monitor the functioning of the internal
control. Exception reporting should be implemented for non-financial exceptions
and duly monitored. 

2.7.4. Monitoring the Implementation of
EU Law (DG TAXUD): joint
IAS-IAC audit

Background
A timely and correct application of EU legislation is primarily
the responsibility of the Member States. The control of the exercise of that
responsibility by the Member States is one of the Commission's core activities
as laid down in the Treaty in the fulfilment of its role as the "Guardian
of the Treaties".
The
Joint IAS-IAC audit on Monitoring the Implementation of EU law in
DG TAXUD was included in the 2011 IAS-IAC coordinated Audit Work
Programme as a result of a risk assessment.
Ineffective
and inefficient monitoring and implementation of EU law in the field of
customs and taxation as well as difficulties to deal with infringement cases
are examples of risks that DG TAXUD may run if the audited process is not
sufficiently under control. DG TAXUD is one of the three most
infringement-prone policy areas with more than 12 % of all Commission-wide
active infringement cases. However, the inherent risk related to transposition
is lower because of a limited number of directives, which are rather stable.
Audit
Objectives
The objective of this audit was to audit the management,
efficiency and effectiveness of the monitoring of EU law for the years 2006 to
2011 in DG TAXUD. After having performed similar
audits in other DGs, the IAS should address in 2013 an overview report to the
Secretariat-General on possible recurrent and Commission-wide issues.
Audit
Scope
The
audit focussed on:
·       
Pro-active monitoring: assessing the efficiency
and effectiveness of the DG's process for monitoring the timely, correct and
complete implementation of Directives, mainly for the years 2006 to 2011,
against the criteria defined for the different phases.
·       
Ex post
monitoring: assessing the DG's handling of complaints and infringements related
to Directives, Regulations and the Treaty, with respect to correctness,
efficiency and effectiveness, including compliance with the Manual of
Procedures.
·       
Assessing compliance of the EU law monitoring
function (pro-active and ex post) with relevant Commission Internal
Control Standards and provisions.
·       
Assessing potential issues for simplification of
procedures, including IT processes.
The IAC
of DG TAXUD, the IAS or the ECA had not yet audited this process.
There
were no reservations made by DG TAXUD in its 2011 AAR, which relate to the
audited processes.
The
fieldwork was finalised in March 2012. All observations and recommendations
relate to the situation as of that date.
Risks
and audit recommendations
The following high risks that may impact the achievement of the
business objectives for the process audited were identified:
·       
Strategic
planning and programming – Risk rating: High: The
planning and results of these core business activities may remain under the
radar of top management and other stakeholders if insufficiently reported on,
possibly resulting in an incoherent and inefficient approach of the monitoring
of EU law and non-optimal use of resources. MPs and AARs should provide
sufficient information on planned and executed activities related to the monitoring
of the correct implementation of EU law as one of the core business activities
of DG TAXUD.
·       
Performance measurement – Risk rating: High: Insufficient
performance measurement may prevent the DG's management to monitor resource
allocation and time schedules in compliance with the benchmarks set by the SG.
Furthermore, without clear objectives translated into indicators, allowing for
a performance measurement over time, management may not know whether the
activity is carried out in an efficient, effective and economical manner. DG TAXUD
should therefore develop SMART[34] objectives
and a set of standardised RACER[35]  indicators in its MP and AAR to
better steer the activity. Statistical data (volume, staff allocated, average
duration, origin, complexity, etc) should form the basis for forthcoming
performance measurement. Measuring performance evolution over time will enable
management to put in place timely and appropriate remedial actions in case of
bad performance. 
·       
Awareness-raising on
DG TAXUD performance – Risk rating:
High: The lack of awareness on performance aspects may
negatively affect the efficient and effective monitoring of EU law. DG TAXUD
should therefore enhance its focus on performance aspects. Infringement
coordinators should have the responsibility to better monitor the progress of
the cases managed in their unit by anticipating deadlines. DG TAXUD bad
performance cases against the SG benchmarks should be brought to the attention
of management in order to identify their causes and develop remedial measures.
·       
Coordination
in the customs area – Risk rating: High: If
legal breaches detected in the course of monitoring actions are not
appropriately and timely reported and the appropriate process initiated leading
to the decision to start or abandon a coordinated action in the case of
potential infringements, the Commission may fail to assume its responsibility
to check the correct application of the customs legislation. DG TAXUD
should consequently ensure that the unit responsible for infringements in the
customs area be systematically informed of the outcome of such actions and play
a supportive role, providing overall coherence, guidance and advice. It should
be involved in any decision to start (or drop) further enquiries in case of
suspicion of infringements with a structural character detected during
monitoring actions.

2.8. General services and HR

(DG HR,
DG BUDG, DGT, DG DIGIT, EPSO, DG ESTAT, SJ, OIB, OIL, OP, PMO, SCIC, SG)

2.8.1. Strategy and coordination of statistical data production, development
and dissemination (DG ESTAT and DG AGRI, DG MARE, DG RTD and JRC)

(5 audit reports: DG ESTAT and included in the
audit sampling: DG AGRI, DG MARE, DG RTD, JRC)
Background
Official
statistics play a fundamental role in today's society. The availability of
impartial and objective statistical information is essential for all
decision-makers. At EU level, statistics has become increasingly important for
the development, implementation, monitoring and evaluation of EU policies, such
as the Europe 2020 strategy.
Regulation
(EC) No 223/2009 establishes the legal framework for the development,
production and dissemination of European statistics. It has
entrusted DG ESTAT (Eurostat) with the responsibility at Community level to
ensure the production of European statistics according to established rules and
statistical principles[36].
In this respect, Eurostat has the sole responsibility for deciding on
processes, statistical methods, standards and procedures and ensures its
independence, integrity and accountability through compliance with the European
Statistics Code of Practice[37].
In
fulfilling its role under Regulation (EC) No 223/2009, Eurostat has to deal
with many actors and, in particular, to coordinate (i) the work of the European
Statistical System (ESS)[38],
and (ii) the work of policy DGs within the Commission. The lack of coordination
between policy DGs and Eurostat on statistical work was included in DG ESTAT’s
2011 risk register as a critical risk. This prompted Eurostat and SG to issue a
note[39]
to all Directors Generals and Heads of Services regarding the coordination of
Commission activities with statistical aspects. The note drew their attention
to the risk of a lack of coordination on activities with a statistical
dimension and recalled the need for all DGs and services to associate Eurostat
at an early stage on all such initiatives.
An
important recent development related to the production of European statistics
is the current revision of Commission Decision 97/281/EC[40],
which foresees the strengthening of DG ESTAT’s role to ensure the quality
management of European statistics[41].
This decision is expected to address most, if not all, of the very important
issues raised in this report.
Audit
Objectives
The
general objective of the audit was to assess the adequacy, efficiency and
effectiveness of processes related to the production, development and
dissemination of statistics managed by DG ESTAT.
In
particular, this audit assessed whether the existing legal, methodological and
quality management framework and mechanisms put in place are sufficiently
developed in order to ensure a sufficient and efficient coordination
between DG ESTAT and other Commission DGs and Services active in the
production, development and dissemination of statistics.
Audit
Scope
The scope
of this audit engagement was on the coordination between DG ESTAT and other
Commission DGs and Services for the production, development and dissemination
of statistics. The relationship between DG ESTAT and the Member States
(National Statistical Offices) was considered to be out of scope for the
current audit engagement as it has recently been addressed by the European
Court of Auditors[42].
The following four DGs were included in the sample for the audit engagement: DG
AGRI, DG MARE, DG RTD and JRC.
Separate
reports containing issues specific to the four DGs included in the sample have
been issued. These are attached in Annex 3 (see below).
There
are no observations/reservations in the 2011 AAR of Eurostat that relate to the
area/process audited.
The fieldwork
was finalised on 31 May 2012. All observations and recommendations relate to
the situation as at that date.
Risks and audit recommendations
The
High risks faced by the Commission services due to the weaknesses noted above
can be summarised as follows:
·       
Eurostat not fulfilling the responsibility
entrusted to it under Regulation (EC) No 223/2009 to ensure the production of
European statistics according to established rules and statistical principles
(Findings No 1 and 2).
·       
Eurostat not being in a position to provide the
necessary input to help achieve the Commission’s strategic objectives (Finding
No 2).
·       
Inconsistencies, gaps, low quality of data,
overlaps and disruption to business continuity (Findings No 3 and 5).
·       
Impairment of the independence, integrity and
accountability of Eurostat as the statistical authority of the European Union
(Findings No 3 and 4).
To
mitigate the above risks, Eurostat should:
·       
Develop, in cooperation with other DGs, a
Commission-wide definition of the term “statistics”.
·       
Develop a statistical roadmap to include short
and long term strategic action plans and require policy DGs to provide their
short and longer term needs as part of the 2014-2020 MFF.
·       
Sign harmonised Memoranda of Understanding with
policy DGs to define their respective roles and responsibilities.
·       
Ensure that statistics produced by policy DGs
and external providers that fall under the scope of Regulation (EC) No 223/2009
are the subject of an independent external review to complement the annual
monitoring done by the European Statistical Governance Advisory Board (ESGAB).
·       
Coordinate the use of external providers of
statistical services.
Separate
reports addressed to DG AGRI, DG MARE, JRC and DG RTD
The
issues detected in this audit, together with those stemming from the audits in
DG MARE, DG RTD and JRC, are summarised in the consolidated report addressed to
DG ESTAT. 
à
Separate report addressed to DG AGRI
DG
AGRI was selected on the basis of its extensive
use of data and the results of an IAS survey conducted in
February 2011. 
The
objective of this audit was to assess whether the existing tools and procedures
are adequate to ensure a sufficient and efficient coordination between DG ESTAT
and DG AGRI of processes related to the production, development and
dissemination of statistics.
There
are no observations/reservations in the 2011 AAR of either DG AGRI or DG ESTAT
that relate to the area/process audited.
The
fieldwork for DG AGRI was finalised on 5 June 2012. All observations and
recommendations relate to the situation as at that date.
Risks
and audit recommendations
The
following high risk that might affect the achievement of the business
objectives for the process audited was identified:
·       
Coordination of contracts – Risk rating High:
The lack of coordination between DG ESTAT and
policy DGs, including DG AGRI, on external providers of statistical services
may lead to inefficiency and ineffectiveness due to low quality of statistical
data, overlaps, waste of resources and missed economies of scale.
In
order to mitigate this risk, DG AGRI should cooperate with DG ESTAT in
coordinating contracts with external providers of statistical services, in
order to achieve economies of scale through a stronger negotiating power.
à
Separate report addressed to DG MARE
DG MARE
was selected on the basis of its extensive use of data and
the results of an IAS survey conducted in February 2011. 
The
objective of this audit was to assess whether the existing tools and procedures
are adequate to ensure a sufficient and efficient coordination between DG ESTAT
and DG MARE of processes related to the production, development and
dissemination of statistics.
There
are no observations/reservations in the 2011 AAR of either DG MARE or DG ESTAT
that relate to the area/process audited.
The
fieldwork for DG MARE was finalised on 6 June 2012. All observations and
recommendations relate to the situation as at that date.
Risks
and audit recommendations
The
following high risk that might affect the achievement of the business
objectives for the process audited was identified:
·       
Coordination of contracts – Risk rating High: The
lack of coordination between DG ESTAT and policy DGs, including DG MARE, on
external providers of statistical services may lead to inefficiency and
ineffectiveness due to low quality of statistical data, overlaps, waste of
resources and missed economies of scale.
In
order to mitigate this risk, DG MARE should cooperate with DG ESTAT in
coordinating contracts with external providers of statistical services, in
order to achieve economies of scale through a stronger negotiating power.
à
Separate report addressed to JRC
In particular, JRC was
included in the sample due to its role as a producer of statistical data for
other Commission services.
The
objective of this audit was to assess whether the existing tools, procedures
are adequate to ensure a sufficient and efficient coordination between DG ESTAT
and JRC of processes related to the production, development and dissemination
of statistics.
There
are no observations/reservations in the 2011 AAR of either JRC or DG ESTAT that
relate to the area/process audited.
The
fieldwork for JRC was finalised on 30 May 2012. All observations and
recommendations relate to the situation as at that date.
Risks
and audit recommendations
The
following high risk that might affect the achievement of the business
objectives for the process audited was identified:
·       
Coordination of contracts – Risk rating High: The
lack of coordination between DG ESTAT and policy DGs, including JRC, on
external providers of statistical services may lead to inefficiency and
ineffectiveness due to low quality of statistical data, overlaps, waste of
resources and missed economies of scale.
In
order to mitigate this risk, JRC should cooperate with DG ESTAT in coordinating
contracts with external providers of statistical services in order to achieve
economies of scale through a stronger negotiating power.
à
Separate report addressed to DG RTD
DG RTD was included in
the sample as a DG with specific data needs and as a DG using external contractors
for statistical purposes. 
The
objective of this audit was to assess whether the existing tools and procedures
are adequate to ensure a sufficient and efficient coordination between DG ESTAT
and DG RTD of processes related to the production, development and
dissemination of statistics.
There
are no observations/reservations in the 2011 AAR of either DG RTD or DG ESTAT
that relate to the area/process audited.
The
fieldwork for DG RTD was finalised on 1 June 2012. All observations and
recommendations relate to the situation as at that date.
Risks
and audit recommendations
The
following high risk that might affect the achievement of the business
objectives for the process audited was identified:
·       
Coordination of contracts – Risk rating High: The
lack of coordination between DG ESTAT and policy DGs, including DG RTD, on
external providers of statistical services may lead to inefficiency and
ineffectiveness due to low quality of statistical data, overlaps, waste of
resources and missed economies of scale. 
In
order to mitigate this risk, DG RTD should cooperate with DG ESTAT in
coordinating contracts with external providers of statistical services in order
to achieve economies of scale through a stronger negotiating power.

2.8.2. Service Level Agreements (DG HR, OIB, OIL and PMO)

Background
In line with the IAS Strategic Audit Plan 2010-2012, an Audit on
the Management of Service Level Agreements (hereafter SLAs) by DG HR, OIB, OIL
and PMO was announced in October 2011 and started in January 2012.
The main risk underpinning the inclusion of this topic in the IAS
Strategic Audit Plan was a  potential lack of harmonized approach and content
of the SLAs signed between DG HR and related Offices on the one hand, and the
EU Agencies and the Institutions on the other hand. Indeed, DG HR considered
the potential lack of standard SLAs with Agencies as a critical risk in its
2010 risk register.
The relative importance of SLAs, in terms of revenue generated by
providing services in the framework of the SLAs versus total budget, differs
between the four Services reviewed, ranging from 12% for PMO activities
(including Agencies only) to around 2% for OIL.
Objectives
The objective of the review was to assess the adequacy of the
design and management of the SLAs signed between DG HR, OIB, OIL and PMO on the
one hand, and the EU Agencies and the Institutions on the other hand.
Scope
The
results of the preliminary survey indicated that management had taken the
appropriate initiatives in order to reduce the risks originally identified, in
particular as regards inconsistencies between the SLAs in use and supervision
over their design. The IAS therefore decided to limit the scope of its work to
a compliance test of recent SLAs with the
templates approved by the Offices' Management Boards, and to checking overall
consistency of a sample of SLAs from the four Services. Issues
relating to the determination of prices were also analysed, focusing on PMO and
OIB for which the importance of SLAs in their activities is relatively more
significant.
There
are no observations/reservations in the 2011 AARs of DG HR, OIB, OIL or PMO
that relate to the area audited.
The
fieldwork was finalised on 30 April 2012. The report relates to the situation
as of that date.
No significant
risks that may adversely affect the achievement of the business objectives for
the process reviewed were identified. 

2.8.3. Ethics in the Legal Service (consulting engagement)

The
Legal Service ("LS"), due
to the nature of its activities, may be exposed to ethical incidents that
potentially might harm the Commission's reputation.
For
this reason, it should set up and implement an ethics framework that encourages
high standard of behaviour by formalising the common values and standards of
conduct the LS consider important for the proper functioning of its activities.

The
ethics framework normally includes an Ethics Policy (high-level
principles or “core values”) and a Code of Conduct. In particular:
·       
the
Ethics Policy describes the core values of the organization in terms of expected
(acceptable) behaviour for staff members in day-to-day decision making, The aim
of the Ethics policy is to express Senior management's view on ethics, diffuse the
ethical culture within an organization and ensure a long-term commitment to
important values;
·       
the
Code of Conduct translates the high-level principles into concrete procedures
and standards to guide the staff in handling ethical issues.
The European Commission has set
out general Ethical rules[43] that each Service has to translate into specific procedures which
takes into account its own specificities (environment, type of activities
performed and internal organisation) and the ethical-related risks it is
facing. 
For this reason it is essential
that each Service identify its own ethical vulnerability and risks in order to
address them properly in the Code of Conduct.
The process to define the ethics
framework is divided into three steps:
1.       
Define a dedicated structure, with roles and
responsibilities clearly identified and assigned. The structure should include
an Ethics Steering Committee (strategic level), Ethics Task Force and Ethics
Correspondent (operational level). The Ethics Steering Committee is a
high-level decision-making body providing strategic direction and policy
guidance and oversight of the implementation of the ethics framework. 
2.       
Establish and implement the "roadmap",
i.e. the milestones to be achieved to set up the ethics framework. The roadmap
will enable the LS to define the Ethics policy, identify the values gap, detect
the inherent ethical risks, draw up detailed procedures applicable to LS staff
(Code of Conduct), develop training, awareness-raising and communication
programmes, define monitoring and reporting systems and a review process. For
each milestone, the roadmap should include the logical sequence of tasks to be
completed, persons responsible for the tasks, deadlines and expected outputs. 
3.       
Monitor the implementation of the roadmap.

 2.9. IT audit
engagements
2.9.1. Local IT in DG DEVCO

Background
The activities of DG DEVCO rely heavily on IT systems. Two main
systems are currently in production to support the operational and financial
management of the projects funded by DG DEVCO and other DGs belonging to the
Relex family (CRIS[44]) and to allow third parties applying
for grants to register their organisation data (PADOR[45]).
In addition, different programmes are currently
under development to fill the gaps between business needs and the current
information systems, among which PCM and PROSPECT[46]. All those systems are considered by DG DEVCO as critical.
DG DEVCO IT unit's mission is to assists
the DG in achieving its strategic objectives by supporting business processes
and operational procedures with Information Technology and Infrastructure.
Audit
Objectives 
The overall objective of the audit was to assess the internal
control system put in place by DG DEVCO to ensure an effective and efficient
management of its local IT activities, with a particular focus on the following
areas:
·       
IT Governance;
·       
physical and logical security arrangements;
·       
organisation and management of the IT operations and projects.
This audit did not cover the effectiveness and efficiency of the
main IT systems in supporting DG DEVCO's business processes. In this context,
it is worth mentioning that in May 2012 the ECA finalised an audit, of which
the objective was to assess "whether CRIS is effective in responding to
the Commission's information needs in the field of external actions". This
audit covered effectiveness, reliability of data and the security aspects.
Audit
Scope
The
audit looked in particular to the following CobiT processes[47]:
·       
Plan
& Organise (IT architecture, IT organisation and IT governance, quality
management, risk assessment and project management);
·       
Acquire
& Implement (IS acquisition and maintenance, change and release
management);
·       
Deliver
& Support (third party services,  logical and physical security, service
desk and incidents management, configuration management, data management and
management of the configuration).
No observations or reservations were
made in the Annual Activity Report 2011 that relate to the processes audited.
The fieldwork was finalised in February 2012.
All observations and recommendations relate to the situation as of that date.
Risks and audit recommendations
The following High risks that may impact the achievement of the
business objectives for the process audited were identified:
·       
IT
Security - Risk rating: High: The lack or
the inadequacy of security plans may lead to failure in protecting information
systems, as necessary and sufficient controls are not implemented to mitigate
threats to a level acceptable for the business. In addition, if the LISO is not
sufficiently involved in supervising IT security matters, the information
systems may not be adequately protected, which is the case if uncontrolled or
unauthorised software is run on a workstation. This could lead to security
breaches with an impact on all Commission IT resources as well as to violation
of software licensing policies that could expose the Commission to reputational
and financial risks.
DG DEVCO should therefore define IT security
plans for all its information systems, including as a minimum the definition of
IT security needs, the IT security requirements and the description of measures
selected to meet the identified requirements. In addition, the DG should
promote the role of the LISO to ensure its involvement in the management of
information systems security and the performance of tasks foreseen in the
Commission framework in that domain and its independence from IT operations.
Concerning unauthorised software, DG DEVCO should define a "white
list" of software allowed, perform periodic scans of software installed
and launch an awareness raising program to inform users of the obligations and
risks related to the installation and usage of unauthorised software.
·       
IT
Operations - Risk rating: High: Inadequate
management of service packs or patches may lead to information systems being
prone to malware attacks, resulting in security breaches like unauthorised
disclosure (confidentiality), unauthorised modification or deletion of
information (integrity) or denial of service (availability). DG DEVCO should
therefore define and implement a configuration management procedure to support
changes in workstation or servers configuration and integrate it with the
existing processes of change, incident and problem management procedures. The
DG should also review the current configuration of equipment, and report for
correction the identified non-compliances with the reference configuration
published by DG DIGIT.
Privileges not respecting the "need to
know" and "least privileges" principles may lead to unauthorised
access to IT systems and undetected security breaches. This may result in
unauthorised disclosure, deletion or modification of information and denial of
service. To mitigate this risk, DG DEVCO should define and implement procedures
for the user account management at the OS level and regularly review the system
administration privileges.

2.9.2 Local IT in DG TRADE

Background
The activities of DG TRADE rely heavily on IT systems. The four
main Information Systems (ISs) currently in production support the handling of
Trade Defence cases and investigations (Sherpa and Sherlock) and the exchange
of denials of dual goods items between EU Member States (Dual Use), and provide
the import licenses and surveillance documents in the area of textile and steel
(SIGL).
The IT unit's mission is to
provide DG TRADE with high quality, secure and cost-effective information
technology solutions in support of its activities. The IT unit manages all DG
TRADE’s ISs (hosted in local computer rooms) and provides Office Automation
services (File services, Intranet, remote access to ISs). DG TRADE will join
ITIC in 2013.
Audit
Objectives
The overall objective of the audit was to assess the internal
control system put in place by DG TRADE to ensure an effective and efficient
management of its local IT activities, with a particular focus on the following
areas: 
·       
IT Governance.
·       
Physical and logical security
arrangements.
·       
Organisation and management of the
IT activities and projects.
Audit
Scope
The
scope of the audit included the following processes:
·       
Plan & Organise[48]
(IT organisation and IT governance, quality management, risk assessment and
project management);
·       
Acquire & Implement[49]
(ISs development, change and release management);
·       
Deliver & Support[50]
(services continuity, logical and physical security, service desk &
incidents management, performance management, configuration management, data
management).
The audit focused in particular on the activities performed by
unit A4 – Information technology and IT systems. Other units and key staff (A1
– Resources and Strategic Planning, and Directorate H – Trade Defence) were
also consulted regarding their respective responsibilities.
No observations or reservations were made in the Annual Activity
Report 2011 that relate to the processes audited.
The
fieldwork was finalised in September 2012. All observations and recommendations
relate to the situation as of that date.
Risks
and audit recommendations
The following High risks that may impact the achievement of the
business objectives for the process audited were identified:
·       
Role of IT Steering Committee –
Risk rating: High: Effective
IT Governance involves business senior management taking the lead and
allocating resources, attention and support to the process. Without proper
participation and supervision at business level, there is a risk that the IT
strategy is not in line with the organisation’s strategy and IT-enabled
investments cannot support the organisational goals and objectives.
DG TRADE should reinforce the role of the ITSC to enhance the IT
Governance setup and ensure effective business–IT alignment. The ITSC should be convened at least twice a year
with ad-hoc meetings to be organised if critical issues need to be discussed.
The ITSC mission and tasks should be adequately formalised in a
charter/foundation document. Its scope should include both IT and information
security issues. In this area, proper co-ordination with the work of the Ethics
and Information Security Steering Committee should be ensured.
·       
Management of IT-related risks in DG TRADE –
Risk rating: High: Weaknesses
in the risk management approach may lead to significant IT risks not being
timely detected and effectively mitigated, which, if materialised, may have
operational repercussions (e.g. business disruptions or inadequate services
provided to the business due to IT problems) and / or reputational consequences
(e.g. if sensitive information is disclosed due to a security failure in an IT
system).
DG TRADE should raise awareness on the
importance of the IT–related risks for the achievement of its business
objectives and should instruct its staff to consider among the different risk
factors, those related to the support provided by IT to the operational
activities. The IT experts, in addition to performing their own specific risk
assessment, should support the business owners in the detection and evaluation
of the impact of IT–related risks.
·       
Management of shared drives –
Risk rating: High: Lack
of proper control of user privileges to sensitive resources may lead to
unauthorised access to sensitive data and possible unauthorised disclosure,
modification or deletion of information with subsequent impact on the
reputation of the DG and, eventually, the Commission as whole.
DG
TRADE should ensure that, at the end of each investigation, all final documents
have been uploaded in Sherlock and the related working folders on the shared
drive are no longer accessible to the users. In addition, it should enhance the
management of the shared drive by performing an exhaustive review of current
users’ privileges to the shared drive and plan regular reviews (on a sample
basis). The requests for granting/modifying/revoking users’ privileges to the
shared drive should be adequately recorded.
In
view of the migration to ITIC, consideration should be given to the opportunity
to formalise and document the procedure used for managing users’ privileges to
shared drives.

2.9.3. Horizon 2020 (DG RTD, DG CNECT,
ERCEA)

Background
Horizon 2020 is the
financial instrument implementing the Innovation
Union, a Europe 2020
flagship initiative aimed at securing Europe's global competitiveness. Running
from 2014 to 2020 with a proposed budget of €80 billion, the EU’s new programme
for research and innovation is part of the drive to create
new growth and jobs in Europe. DG RTD owns the Development of
IT Systems, which will support the management of the Horizon 2020 Framework
Programme. An IT audit in this area was included
in the 2011 Work Programme of the IAS, as a result of a risk assessment,
considering the budget importance and the IT systems contribution to the
assurance to be given on the financial management in this area.
Another
Commission's objective is to streamline the IT spending and to free human
resources, to be reoriented towards priority areas. There are notably diverging
systems across various policy areas to deal with the grant process. The
projects being developed in the research and innovation family have the
potential to become the consolidated system to deal with grants across the
whole Commission and generate savings of around 3M€ per year from 2014 onwards[51].
However, addressing all DGs' needs and interconnecting
more systems will increase the complexity and the risks. IAS
audits in this context can also contribute to ensuring that this strategy is
sustainable.
Audit
Objectives
To
support the management of the Horizon 2020 Framework Programme (FP8) the
Research and Innovation DGs decided to develop a common platform called SyGMA
(System for Grant Management) for their project management cycle and Submission
Evaluation Proposals (SEP) application. These systems, together with the
updated version of Participant Data Management and Unique Registration Facility
(PDM/URF), and the Participant Portal will cover to a large extent the full
grant management process.
The
objective of the audit was to assess the adequacy and effective application of
the internal control systems (ICS), IT governance, IT Project Management and IT
Development related to these common IT Projects. The IAS
decided to cover URF/PDM and SEP in 2011-2012 and to audit the SyGMA project in
2012-2013 when it has sufficiently progressed. This report relates to the first
part.
The IAS
looked at the controls in place to verify whether DG RTD as
System Owner and Business Manager, and DG INFSO and the European Research
Council Executive Agency (ERCEA) as Business Managers have fulfilled their
responsibilities, and whether they had the means to do so. The report is
addressed to DG RTD, as System Owner and lead DG but the implementation of the
recommendations may involve DG DIGIT and other Research DGs. Moreover, they
should be considered in the broader perspective of all projects being developed
to support the management of the new Horizon 2020 programme.
Audit
Scope
As a
result of the preliminary survey, the audit focused on the following critical
aspects for the projects' success:  organisation, planning, and resource
management, as well as users' involvement and coordination.
The
audit team ensured that there was no overlap with another on-going IT audit
performed by the RTD IAC on operational systems (e.g. IT security aspects,
interoperability and automated business controls).
There
are no observations/reservations in the 2011 Annual Activity Report (AAR) that
relate to the area/process audited.
The
fieldwork was finalised on the 22 December 2011. All observations and
recommendations relate to the situation as of that date.
Risks and audit recommendations
The following high risks that may impact the achievement of the
business objectives for the process audited were identified:
·       
Project Management Methodology and Reporting - High: Lack of clear procedures
or applying different procedures along the project organisation may lead to a
situation where, because of uncertainty of rules some key project tasks are not
performed on a timely basis or not performed at all. Without proper project
performance reporting, the Project Steering Committees may not be able to
perform an overall control of the project priorities and related costs. The
project might be delayed. Since these are critical projects, their failure may
affect Research DGs' and the Commission's reputation.
DG RTD should therefore propose to the IT Project Steering
Committee (ITPSC) (or the Architecture Steering Committee
(ASC)) to define minimum procedural
requirements in line with the budget/importance of the project to ensure
applied project management procedures are consistent and complete. DG RTD
should formally specify performance measurement, reporting and monitoring
requirements and set standards, indicators and targets for the projects under
its ownership in the Vision document of the respective projects.
·       
Project Resource Planning - High: In the
absence of a proper project planning process the System Owner may
not be able to properly monitor its projects and optimise its resource usage.
DG
RTD should define the project work and resource plan as one of the first
deliverables for the projects under its ownership and ensure that its implementation
is appropriately monitored.
The IAS notes that some of the issues below, (risk management,
quality management) were already noted and reported to the IT Programme
Steering Committee and Research DGs in 2008 in its Management Letter on the inter-DG
FP7 IT Governance Structure.
In
line with the Commission standards for project management, the System Owners
have delegated daily project management activities to Business Project Managers
in order to concentrate on strategic issues. However, for a number of project
management processes (see observations 3, 4, 6) the business side did not fully
succeed to provide the expected input, which would maximise the effectiveness
of project management procedures.
As
often in the Commission, stakeholders may think that the project management of
an IT project is the sole responsibility of the System Supplier. IT project
management procedures can only succeed if they are effectively applied by both
sides of the project organisation. DG RTD should
ensure that the pre-agreed project management procedures resulting from the
selected methodologies are equally applied on the business side, and that formalised
input for the project planning, risk and change management processes is
provided.
DG RTD should also consider whether project management assistance
to the Business Project Managers could alleviate the administrative burden
resulting from a stricter application of the above project management and
development methodologies.

2.9.4. IT Governance and performance (DG SANCO/EAHC)

Background
The IT
audit of the IT Governance and performance in DG SANCO and
the EAHC was included in the 2012 Work Programme of the IAS. This
followed the audit risk assessment underpinning the IAS' Strategic Audit Plan
for 2010-2012. This audit could also contribute to a possible overview report
on IT performance management in the Commission.
The
engagement was justified by the fact that DG SANCO has a relatively high IT
Budget (11,5 m€) and finances most of its IT spending from operational credits.
This could enable the auditors to identify specific issues related to this type
of IT spending. Moreover, DG SANCO is developing and operating many IT systems,
notably for crisis management.
Audit
Objectives
The
objective of the audit was to assess the internal control systems put in place
to ensure an effective and efficient management of local IT, IT governance and
IT Performance management in DG SANCO and the Executive Agency for Health and
Consumers (EAHC).
Audit
Scope
As a
result of the preliminary survey, and due to the fact that DG SANCO made
significant progress in the area of IT General Controls the scope was narrowed
and the IAS selected specific CobiT[52]
processes that are focusing on governance, performance and quality aspects for
the scope of this audit.
The IAS
analysed and evaluated the controls put in place by DG SANCO management to
mitigate the major risks associated with these processes, with the objective of
assessing their adequacy of design and operating effectiveness. A more limited review
of these controls was performed for the EAHC taking into account its much
smaller IT Budget.
There
are no observations/reservations in the 2011 AARs of DG SANCO or the EAHC that
relate to the area/process audited.
The
fieldwork was finalised on 1st September 2012. All observations and
recommendations relate to the situation as of that date.
Risks
and audit recommendations
The following High risks that may impact the achievement of the
business objectives for the process audited were identified:
·       
IT governance
- High: The lack of a co-ordinated IT governance may prevent DG SANCO
and the EAHC from effectively allocating and managing IT investments, which may
ultimately result in increasing costs for IT investments and operations.
Ineffective coordination and communication of IT matters between the Agency and
DG SANCO may lead to technical and contractual captivity and IT investments
that are not in line with the overall IT strategy.
DG
SANCO should therefore reinforce a coordinated multi-annual IT strategy by
including the EAHC's activities. The strategy should be discussed and
coordinated with all key stakeholders and approved at the highest level of
management. DG SANCO should implement a formal change procedure, which ensures
that important amendments to the IT master plan are approved and coordinated at
the same level of governance and authority as the original plan.
·       
IT performance management - High: The relative lack
of project performance management may prevent the board and senior management
of DG SANCO and the EAHC from effectively directing and controlling key IT
activities and related costs and may lead to wrong decisions on priorities and
budget distribution. Furthermore, the lack of effective performance monitoring
may lead to failure in timely responding to performance issues and lost
opportunities for improvement. This might eventually lead to a situation where
business needs are not efficiently or effectively met.
DG SANCO should therefore review the catalogue of its IT-enabled
services and redefine S.M.A.R.T. (Specific, Measurable, Achievable, Relevant
and Timed) performance criteria and RACER (Relevant, Accepted, Credible, Easy,
Robust) KPI's (Key Performance Indicators) against them. DG SANCO should
improve the system for collecting and reporting of performance data and
measures to allow for better supervision of IT performance by its stakeholders.
The IT master plan and staff appraisal reports should reflect the performance
targets, so that staff and managers can be held accountable for meeting them
and performance achievement should be appropriately recognised.
·       
IT procedures in EAHC - High: Inadequate formal procedures may result in deliverables failing to
meet business and user requirements, unauthorised project decisions, lack of
continuity of service and inability to support the operations of systems.
The
EAHC should therefore implement a formal and documented change control, quality
and performance management procedure. Since the majority of underlying
activities are already performed in the Agency, the formalisation of the
procedures should not create any additional workload.

2.9.5. Internal Market Information System
(IMI) Project Management (DG MARKT)

Objectives and scope
The main objective of this audit
was to verify the efficiency and effectiveness of the IMI system. The specific
objectives of this audit were to:
·       
obtain an overview of the project, its processes
and operations
·       
assess the efficiency and effectiveness of the
System
·       
assess compliance with the rules on protection
of individuals with regards to the processing and free movement of personal
data, and
·       
assess compliance with IT requirements.
The audit scope included a
review of the IMI's project architecture, use of resources, established
processes and operations, and performance in 2010 and 2011. The review was
expanded until July 2012 to include the most recent developments of the project
and related documentation. All observations and recommendations relate to the
situation as of 12 September 2012 when the fieldwork was finalised.
The risks and associated
recommendations are grouped under the following risks:
Risk of taking ineffective
strategic decisions on the IMI system's future and exercising inadequate
project's management oversight 
The IMI Steering Committee
(IMISC), the key decision-making body of the project, has not met so far and
thus has not discharged its responsibilities and tasks. The System Owner (DG MARKT) should convene meetings of the IMISC at
regular periods. Members from all policy areas included in the IMI system and a
representative of the System's end users should attend these meetings. DG
MARKT's LISO, DPC, DMO, and a staff member of the DG's financial unit should
also be invited to take part in the deliberations of the IMISC or the IMI's
Project Steering Committee, as appropriate. Minutes should be prepared and
distributed to all participants and to the senior management of DGs using the
IMI.
Risk of applying ineffective
security measures for the IMI system
The current security measures
are based on an outdated risk assessment, do not include sufficient controls,
and have not been subject to a security audit. The responsibilities and
accountabilities for the security of the IMI system are not clear. 
a) The System Owner should
revise the IMI's Security Plan with the assistance of DG MARKT's LISO and
taking into consideration all new guidance, templates and mandatory standards
issued by the Security Directorate of DG HR (HR.DS) as well as any Security
Plans of DG DIGIT. 
b) The new Security Plan should
contain a Security Audit Strategy, and should be approved by the
Director-General of DG MARKT, submitted for review to the HR.DS, and reported
to the European Data Protection Supervisor. 
c) For any future security
audits and studies, full access to the relevant documentation and to the
premises of DG DIGIT's Data Centre should be ensured via an appropriate request
at Director-General level. 
d) The System Owner should
inform regularly the LISO of DG MARKT about developments that can affect the
security of the IMI system and ask for his opinion/advice as necessary.
e) As part of the Service Level
Agreement on Hosting, a formal agreement should be drawn up between the System
Owner and the System Supplier (DG DIGIT) delegating the implementation and
monitoring of the IMI system's security requirements to the System Supplier and
defining how to deal with any constraints when performing these tasks.  
Risk of inadequate activities
in case of a business interruption/disruption due to the use of inconsistent
and unapproved documentation for the IMI system's development and project
management, and to a limited access to essential technical documentation
There is no documentation
explaining how the methodologies applied by the IMI project have been
customised and what artefacts have to be produced, how often, and by whom. The System Owner, in cooperation with the System Supplier, should
prepare a document that specifies how the PM² and RUP@EC methodologies are
customised for the IMI system. This document should in particular clarify a)
which artefacts (e.g., plans, logs, and reports) should be produced and by
whom, b) what methodology each artefact should follow, and c) how often the
artefacts should be reviewed.
Key project documents do not
contain evidence of approval or version control.
The System Owner should ensure that the latest versions of all significant
IMI's artefacts are regularly reviewed and formally approved. A version control
should be introduced for each of these artefacts.
The System Owner has limited
access to essential technical documentation prepared by the System Supplier. DG MARKT should sign an agreement with DG DIGIT to receive full
access to the technical documentation of its IT systems. The owner of the IMI
system should consider including a provision to the same effect in the next
version of the Memorandum of Understanding with the System Supplier.

2.9.6. Capitalisation of Internally
Generated Intangible Assets 

In line with the 2012 IAS
strategic planning, an audit on the Capitalisation of internally generated
intangible assets (IGIA) was launched in February 2012. 
The objective of the audit was
to assess the efficiency and effectiveness of the systems and procedures put in
place centrally (in DG BUDG) and locally (in operational DGs managing IT projects)
to comply, as of 1 January 2010, with the principles laid down in Accounting
rule 6 for intangible assets internally generated. The scope of the audit
included the identification of the assets to be capitalised, the amount to be
capitalised and the information to be disclosed in the annual accounts.
The inherent risks identified at
the audit planning stage related to financial statements not providing a true
and fair view of the Commission's financial position, financial performance and
cash flows due to an under/over estimation of amounts to be capitalised as
internally generated intangible assets and to be disclosed as development
expenses by each DG/Services managing IT projects. 
As a result of the preliminary
review, the IAS identified the main risks that may impair the correct
capitalisation of internally generated intangible assets by the individual
DGs/Services, ultimately affecting the reliability of the accounting data. They
include:
Incompleteness of the IT
projects to be capitalised, due to:
·       
non-recognition by the DG/Service of the
criteria set by DG BUDG for the capitalisation of intangible assets;
·       
lack of proper monitoring of IT projects within
the DG/Services (no project management methodology, weak project and IT
governance within the DGs/Services, no monitoring of costs, no adequate tools
to monitor the IT expenditures).
·       
Inaccuracy or incompleteness of costs to be
capitalised and disclosed, due to lack of clarity of the instructions for
defining the costs of the IT projects or lack of appropriate cost accounting
system in the DGs/ Services.
·       
Inconsistent implementation of the accounting
rule in the different DGs (with similar projects receiving different accounting
treatments).
In order to assess the
materiality of the risks identified, the IAS analysed the final figures for the
year-end 2011 of the internally generated costs to be capitalised and disclosed
Commission's accounts.  
According to those figures, the
amount of the internally generated intangible asset as of 31/12/2011
(25.476.416€) represents respectively, 0,028% of non-current assets[53]
of the Commission; 0,020% of the total assets;  while the costs disclosed for
research and development represent 0,23% of "Other operating
expenses" incurred by the Commission in 2011[54].
The maximum error in the
capitalisation of IGIA would be represented by the amount of development
expenditure charged in 2010 and 2011 (246 million €).  This amount of
unrecognised internally generated intangible assets would represent 0,27% of
the total non-current assets, well below the materiality threshold fixed by the
ECA. 
Taking into account the results
of its preliminary review, and in particular the low value of the amount
capitalised as internally generated intangible assets as well as the
corresponding level of materiality, the IAS decided to close the audit
without performing any detailed testing on the internal control and monitoring
systems implemented. The level of risk related to this process will be
re-assessed in the next planning period.

 2.10. Follow-up
engagements[55]finalised in 2012
2.10.1. 1st
Follow-up Audit on Interventions in Agricultural Markets and 2nd
Follow-up Audit on Interventions in Agricultural Markets

The IAS
assessed that the recommendations addressed to DG AGRI resulting from the
original audits have been satisfactorily implemented. 

2.10.2. Follow-up audit on the Management
of Procurement by DG HR

The IAS
assessed that all the recommendations addressed to DG HR have been adequately
and effectively implemented.

2.10.3.
Follow-up audit on the activities of OIB.OS3: Social Infrastructures ISPRA

The IAS
assessed that all the recommendations addressed to OIB have been adequately and
effectively implemented.

2.10.4. Follow-up audit on the Official Journal Production Process
as managed by the Publications Office

The IAS
assessed that the recommendations addressed to the Publications Office have
been adequately and effectively implemented, except for one recommendation.

2.10.5.
2nd Follow-up Audit on Missions in PMO

The IAS
assessed that all relevant recommendations addressed to PMO have been
adequately and effectively implemented.  

2.10.6.
Follow-up audit on Monitoring the implementation of EU law in DG ENTR

A
second follow-up audit on Monitoring the implementation of EU law has
been performed in DG ENTR. The IAS agreed to close the two last outstanding
recommendations.

2.10.7. Audit Follow-up of Audits on the Global Navigation Satellite
System Programmes in DG ENTR 

Based
on the results of our follow-up audit, the IAS assessed that 15 out of the 16
recommendations addressed to DG ENTR that resulted from the above-mentioned
audits and that were sent for audit review have been adequately and effectively
implemented.  One very important recommendation has been reopened again because
it was only partially completed.  

2.10.8.
Audit Follow-Up on Enterprise Europe Network IT Tools in EACI

The IAS
assessed that all the recommendations addressed to EACI that resulted from the
audit have been adequately and effectively implemented, except for one very
important recommendation.

2.10.9. Follow-Up Audit on Local IT
systems supporting financial management in DG TREN/EACI/TEN-T EA 

The IAS
assessed that all the recommendations addressed to DG MOVE, DG ENER, EACI and
TEN-T EA that resulted from the audit on the Local IT systems supporting
financial management in DG TREN/EACI/TEN-T EA have been adequately and
effectively implemented, except one recommendation. 

2.10.10. Follow-up audit on Schengen
Facility in DG HOME

The IAS
assessed that all the recommendations addressed to DG HOME that resulted
from the audit on the Schengen Facility have been adequately and effectively
implemented, except for two recommendations.
The
recommendations kept open will be subject to a second follow-up audit.

2.10.11. Follow-up audit on the EAHC
Management of the operational budget 

The IAS
assessed that all the recommendations addressed to EAHC and DG SANCO that
resulted from the audit have been adequately and effectively implemented,
except for two recommendations addressed to DG SANCO and EAHC 

2.10.12. 2nd Follow-up audit
on Procurement in JRC

The IAS
assessed that all the recommendations addressed to JRC that resulted from the
audit on Procurement in JRC  have been adequately and effectively implemented.

2.10.13. Follow-up audit on Life+ Grant
management in DG ENV

The IAS assessed that all the
recommendations addressed to DG ENV that resulted from the audit LIFE+ Grant
Management have been adequately and effectively implemented.

2.10.14. 2nd Follow-Up Audit on
Data Centre – Operations and Security in DG DIGIT

A
second follow-up engagement on the audit on "Data centre – Operations and
Security" has been performed in DG DIGIT. The IAS considers that three out
of the remaining 11 recommendations have not been fully implemented. 

2.10.15. Follow-Up Audit on Management of
the telecommunication infrastructure and services sTESTA (DG DIGIT)

The IAS
assessed that the recommendations have been adequately implemented and will be
closed. 

2.10.16. Follow-Up  Audit on Security of
IT environment in subcontracted projects (DG REGIO)

The IAS
has assessed that ten recommendations have been adequately and effectively
implemented (and will be closed). 
Four remaining recommendations require further
improvements.

2.10.17. Follow-Up Audit on Treasury and
Accounting System (TAS) of DG ECFIN

The IAS
assessed that all the recommendations have been adequately and effectively
implemented (and will be closed), except for one recommendation. 

2.10.18. Follow-Up
Audit on Corporate Data Network Infrastructures & Services Management (DG
DIGIT) 

The IAS
assessed that 10 of 11 recommendations have been adequately and effectively
implemented and will be closed.

2.10.19.
Follow-Up Audit on Management of local IT (DG EAC) 

The IAS
assessed that all of them have been adequately and effectively implemented and
will be closed.

2.10.20. Follow-up
Audit on Control Strategy - Audit and Financial Correction Processes (DG REGIO)

The
IAS assessed that all 7 recommendations subject to the follow-up have been
adequately and effectively implemented.

2.10.21. Follow-up
Audit on Control Strategy – On-the-spot controls and Fraud prevention and
detection (DG RTD)

The
IAS assessed that all 7 recommendations issued in the final report have been
adequately and effectively implemented.

2.10.22. Follow-up Audit on Control
Strategy - Audit and Financial Correction Processes (DG EMPL)

The
IAS assessed that 7 out of the 8 recommendations issued in the final report
have been adequately and effectively implemented. 

2.10.23. Follow-up
audit on Financial management of main programmes in Asia (DG DEVCO)

The IAS assessed that 17 out of the 18 accepted
recommendations can be closed. 

2.10.24. Follow-up audit of Financial
management of main programmes under the European Neighbourhood Policy
Instrument (DG DEVCO- ENPI)

The IAS assessed that 9 out of 13
recommendations have been implemented. 

2.10.25. Follow-up audit on Financial
management of main programmes in Latin America (DG
DEVCO-LA)

The IAS assessed that 11 out of the 14 accepted
recommendations can be closed. 

2.10.26. Follow-up audit of Financial
Management of Regional Projects (DG DEVCO-Regional)

The IAS assessed that 5 out of 12
recommendations have been implemented.

2.10.27.
Follow-up audit of Food Aid (DG ECHO)

The IAS
assessed that all recommendations addressed to DG ECHO that resulted from the
"Financial Management of Food Assistance in DG ECHO" audit
have been adequately and effective implemented, except for two recommendations.

2.10.28.
Follow-up audit on Public Procurement under IPA (DG ELARG)

The IAS
assessed that all the recommendations addressed to DG ELARG that resulted from
the audit “Public Procurement under IPA” have been adequately and
effectively implemented, except for two recommendations.

2.10.29.
Follow-up audit on Closure of pre-IPA instruments (DG ELARG)

The IAS
assessed that all the recommendations addressed to DG ELARG that resulted from
the audit “Closure process of pre-IPA instruments” have been adequately
and effectively implemented.

2.10.30.
2nd Follow-up audit on Ex-post Control activities in the former DG
RELEX (FPI)

The IAS
assessed that all the recommendations addressed to the former DG RELEX and
transferred to FPI that resulted from the audit “Ex-post Control activities
in DG RELEX” have been adequately and effectively implemented.

2.10.31.
3rd Follow-up audit on "Implementation of selected Internal
Control Standards in DG ECFIN"

The IAS
assessed that all the recommendations addressed to DG ECFIN that resulted from
the audit "Implementation of selected Internal Control Standards in DG
ECFIN" have been adequately and effectively implemented.

2.10.32.
Follow-up audit on Ethics in the Commission (multi-DG)

HR specific findings
The IAS assessed that the actions taken by DG HR
for the recommendations addressed to DG HR and reported as 'implemented' by the
services are adequate and effective. Other specific findings: SG, TRADE, OIB,
CONNECT, RTD
The IAS assessed that all the recommendations
addressed to these DGs have been adequately and effectively implemented. 
[1]       Recommendation 5 on
ensuring system security of the audit on Data Center-Operations and Security in
DG DIGIT and Recommendation 10 on governance structure of the audit on OIB
Financial management and implementation of financial circuits in DG HR (the
latter was closed in March 2013).
[2]       Art.
60(7) Financial Regulation; Synthesis Report for 2011.
[3]       The responsibilities of
the Authorising officers and the reporting obligations are stated in Art. 59
and 60 (Authorising Officer) and in Art. 64 to 66 (Liability of the financial
actors) of the Financial Regulation. 
[4]       Standard text of the
Declaration of Assurance (Part 4 of the AAR). 
[5]       According to the SG and
DG BUDG, "Central Services' mission is not to provide assurance over the
substance of the underlying facts and information reported in the AAR, but to
provide guidance and support to the AOD's who remain the owner of the reports
and have the final say on their content".
[6]       These
two areas are audited by the IAS in individual audit engagements. 
[7]       COM(2011) 890.
[8]       This may occur when
administrative budget lines are used to fund operational expenditure or
vice-versa.
[9] Administrative budget lines
used to fund operational (policy-related) expenditure or vice-versa.
[10] This may occur when a service
for which the provider receives appropriations is then charged-back to the
client.
[11]      The Commission, as a
general rule, set for CF the initial final date of eligibility not beyond 31
December 2010 for CF and at end December 2008 or 31 April 2009 for ERDF in
light of the financial crisis, the Commission authorised for both Funds, in
April 2010, the extension of the final eligibility date for a limited number of
projects to 31 December 2011 and 2012 under certain conditions. The Commission
may decide to extend the final date of eligibility beyond the dates mentioned
(end 2011 and 2012) only under exceptional and duly justified circumstances.
[12]      AAR 2011, page 136
[13]      Ares(2012)1539817
of 21 December 2012
[14]      Closure guideline ref
C(2006)3424
[15] Draft Commission
decision on guidelines for the closure 2007-2013 – version 29/05/2012
[16] Chapter 5 of the ECA Annual report for 2011 and the ECA special report 2012 n°3 "Did the
Commission successfully deal with deficiencies identified in the MS's management
and control systems?"
[17]  AAR 2011, page 136
[18] Specific request from the Rapporteur to the European
Parliament following the ECA special report n°3/2012
[19]  Draft Commission decision on
guidelines for the closure 2007-2013 – version 29/05/2012
[20] Chapter 5 of the ECA Annual
report for 2011 and the ECA special report 2012 n°3 "Did the
Commission successfully deal with deficiencies identified in the MS's
management and control systems?"
[21]
The 13 OPs concerned are : 2000DE162DO001
/ 2000ES051PO015 /2000ES053PO303 /2000FR162DO010 /2000FR162DO011 /
2000FR162DO017 /2000FR162DO021 /1999IT053PO007 /1999IT161PO006 /1999IT161PO007
/1999IT161PO009 /1999IT161PO010 /1999IT161PO011
[22] Specific request from the
Rapporteur to the European Parliament following the ECA special report n°3/2012
[23] IAC Audit of the supervisory
process of the EACI in DG ENER, dated 15 December 2011 and IAS Audit on the
EACI Control Strategy planned for 2012.
[24] Approximately 52% of which is
financed by the Commission (DG DEVCO).
[25]  Commission Decision No 56 of
2005(EC) of 14.1.2005 setting up the Educational, Audiovisual and Culture
Executive Agency for the management of Community action in the fields of
education, audiovisual and culture in application of Council Regulation (EC) No
58/2003. OJ L 11, 16.1.2003. Later amended by the Commission Decision of 20
April 2009.
[26] Action plan added to the
EACEA AAR 2011.
[27]  EBF only for the 3
associated countries implementing the programme
[28]  Decision No. 1639/2006/EC of
the European Parliament and of the Council of 24 October 2006
[29]
            In 2006 ECFIN inserted in the AAR a reservation related to the
achievement of additionality requirements under SMEG 01 (predecessor programme
of SMEG 07). Corrective actions allowed the lifting of the reservation in 2009.
[30] The EFSM regulation  (Council Regulation No. 407/2010 of 11 May
2010) introduced the necessity to monitor the respect of the "own
resources ceiling", intended as the margin between the own resources
ceiling of 1.23% of GNI and the budgeted payment appropriations for every
budgetary year. Credit reimbursements and interest payments of all financial
instruments due by Member States or other counterparties should not exceed that
margin in any budgetary year.
[31]  Report issued on 25/02/2011.
[32]  Report issued on 28/10/2010.
[33] Including HR DS
    [34]  Specific, Measurable,
Achievable, Relevant, Timely.
    [35]  Relevant, Accepted,
Credible, Easy and Robust.
[36] Regulation (EC) No 223/2009,
Article 6.
[37] COM(2005)0217 final.
[38] Partnership between Eurostat
and the National Statistical Institutes and other national authorities
responsible in each Member State for the development, production and
dissemination of European statistics.
[39] Ares(2011)318441.
[40]
Commission Decision on the role of Eurostat as regards the production of
Community statistics.
[41] Interservice consultation
estat.a.5(2012)582639.
[42] Preliminary observations on
“Did the Commission and Eurostat improve the process for producing reliable and
credible European statistics?”, dated 29 March 2012.
[43]  The general framework is set
up in the Staff Regulation (Title II) and in the Commission's Code of Good Administrative
Behaviour, complemented by Commission communication SEC(2008)301 on
"Enhancing the environment for professional ethics in the
Commission". 
[44]    CRIS [Common RELEX
Information System] is a modular system covering the establishment of policy
and country strategy, action preparation and their execution and reporting,
complemented by a data warehouse for reporting purposes.
[45]    The "Potential
Applicant Data On-Line Registration" - PADOR" database is managed by
DG DEVCO and contains information about organisations applying for grants of
the European Commission in the field of external assistance. 
[46]    PCM (Project Cycle
Management) aims at covering modules of the project management cycle not yet
provided by other applications while PROSPECT will replace the current system
Call for Proposal (it is planned to be in production in the course of 2012).
[47]   For each of the processes
selected for the audit, the IAS identified specific control objectives for
which detailed analyses and tests were performed during the fieldwork. The
selection of these control objectives was based on the results of the
assessment of inherent and residual risk performed during the preliminary
survey phase of the audit. The list of the control objectives covered during
the fieldwork is in Annex 1 – Audit methodology.
[48]    Plan &
Organise covers strategy and tactics, and concerns the identification of
the way IT can best contribute to the achievements of the business objectives.
[49]    Acquire &
Implement covers identification, development, acquisition, implementation
and integration of IT  solutions, including changes and maintenance of existing
systems, to ensure that solutions continue to meet business objectives.
[50]  Deliver & Support
is concerned with the actual delivery of required services, which include
management of security and continuity, service support to users, and management
of data and operational facilities.
[51] 
SEC(2011) 1500 Communication from VP
Šefčovič to the Commission: Follow up to the Communication    
"Getting the best from IT in the Commission" of 7 October 2010 -
First decisions in the IT rationalisation process
[52]  COBIT is an internationally
recognised IT control framework
[53]  Non-current assets include
Intangible assets, Property, plant and equipment, Financial assets, Long-term
receivable and pre-financing.
[54]  Other operating expenses
represent 1,5% of the total expenses of the year. The other 98,5% of expenses
are the so-called "primary operating expenses", that covers the
various headings of the financial framework (direct and indirect centralised
management, decentralised, shared and joint management).
[55]
Follow-up audits do not result in a re-assessment of the adequacy of controls
as a whole, but focus on the specific recommendations in the original audit.
They are carried out in accordance with the IAS methodological guidelines. The
assessment of the state of implementation is mainly based on a review of
evidence provided by the auditee. In most cases, no formal report - as
envisaged in the Mutual Expectations Paper- was issued and the engagement was
treated as final in respect of this follow-up work by means of a note.