Report on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2015, together with the Agency’s reply
Date: 2016-09-13
Institutions: European Court of Auditors
Subjects: European Union Agency for Cybersecurity, administration of the Institutions, auditing, budgetary control, financial control








C_2016449EN.01013801.xml










1.12.2016   


EN


Official Journal of the European Union


C 449/138





REPORT
on the annual accounts of the European Union Agency for Network and Information Security for the financial year 2015, together with the Agency’s reply
(2016/C 449/25)

INTRODUCTION









1.


The European Union Agency for Network and Information Security (hereinafter ‘the Agency’, aka ‘ENISA’), which is located in Athens and Heraklion (1), was created by Regulation (EC) No 460/2004 of the European Parliament and of the Council (2) which, following different amendments, was superseded by Regulation (EU) No 526/2013 (3). The Agency’s main task is to enhance the Union’s capability to prevent and respond to network and information security problems by building on national and Union efforts.












2.


The table presents key figures for the Agency (4).

Table


Key figures for the agency








 


2014


2015




Budget (million euro)


10


10




Total staff as at 31 December (1)



62


69












INFORMATION IN SUPPORT OF THE STATEMENT OF ASSURANCE









3.


The audit approach taken by the Court comprises analytical audit procedures, direct testing of transactions and an assessment of key controls of the Agency’s supervisory and control systems. This is supplemented by evidence provided by the work of other auditors and an analysis of management representations.










STATEMENT OF ASSURANCE









4.


Pursuant to the provisions of Article 287 of the Treaty on the Functioning of the European Union (TFEU), the Court has audited:






(a)


the annual accounts of the Agency, which comprise the financial statements (5) and the reports on the implementation of the budget (6) for the financial year ended 31 December 2015; and










(b)


the legality and regularity of the transactions underlying those accounts.










The management’s responsibility










5.


The management is responsible for the preparation and fair presentation of the annual accounts of the Agency and the legality and regularity of the underlying transactions (7):






(a)


The management’s responsibilities in respect of the Agency’s annual accounts include designing, implementing and maintaining an internal control system relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error; selecting and applying appropriate accounting policies on the basis of the accounting rules adopted by the Commission’s accounting officer (8); making accounting estimates that are reasonable in the circumstances. The Executive Director approves the annual accounts of the Agency after its accounting officer has prepared them on the basis of all available information and established a note to accompany the accounts in which he declares, inter alia, that he has reasonable assurance that they present a true and fair view of the financial position of the Agency in all material respects.










(b)


The management’s responsibilities in respect of the legality and regularity of the underlying transactions and compliance with the principle of sound financial management consist of designing, implementing and maintaining an effective and efficient internal control system comprising adequate supervision and appropriate measures to prevent irregularities and fraud and, if necessary, legal proceedings to recover funds wrongly paid or used.










The auditor’s responsibility










6.


The Court’s responsibility is, on the basis of its audit, to provide the European Parliament and the Council (9) with a statement of assurance as to the reliability of the annual accounts and the legality and regularity of the underlying transactions. The Court conducts its audit in accordance with the IFAC International Standards on Auditing and Codes of Ethics and the INTOSAI International Standards of Supreme Audit Institutions. These standards require the Court to plan and perform the audit to obtain reasonable assurance as to whether the annual accounts of the Agency are free from material misstatement and the transactions underlying them are legal and regular.












7.


The audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the accounts and the legality and regularity of the underlying transactions. The procedures selected depend on the auditor’s judgement, which is based on an assessment of the risks of material misstatement of the accounts and material non-compliance by the underlying transactions with the requirements in the legal framework of the European Union, whether due to fraud or error. In assessing these risks, the auditor considers any internal controls relevant to the preparation and fair presentation of the accounts, as well as the supervisory and control systems that are implemented to ensure the legality and regularity of underlying transactions, and designs audit procedures that are appropriate in the circumstances. The audit also entails evaluating the appropriateness of accounting policies, the reasonableness of accounting estimates and the overall presentation of the accounts. In preparing this report and Statement of Assurance, the Court considered the audit work of the independent external auditor performed on the Agency’s accounts as stipulated in Article 208(4) of the EU Financial Regulation (10).












8.


The Court considers that the audit evidence obtained is sufficient and appropriate to provide a basis for its statement of assurance.





Opinion on the reliability of the accounts









9.


In the Court’s opinion, the Agency’s annual accounts present fairly, in all material respects, its financial position as at 31 December 2015 and the results of its operations and its cash flows for the year then ended, in accordance with the provisions of its Financial Regulation and the accounting rules adopted by the Commission’s accounting officer.





Opinion on the legality and regularity of the transactions underlying the accounts









10.


In the Court’s opinion, the transactions underlying the annual accounts for the year ended 31 December 2015 are legal and regular in all material respects.














11.


The comments which follow do not call the Court’s opinions into question.





COMMENTS ON BUDGETARY MANAGEMENT









12.


Carry-overs of committed appropriations are high for Title II (administrative expenditure) at 0,15 million euro, i.e. 22 % (2014: 0,6 million euro, i.e. 49 %). These carry-overs relate to investments in IT infrastructure that was ordered as planned near the end of the year.





OTHER COMMENTS









13.


In 2016 the Agency plans to relocate some administrative staff from Heraklion to Athens while its basic Regulation provides that staff primarily engaged in the administration of the Agency should be based in Heraklion.





FOLLOW-UP OF PREVIOUS YEARS’ COMMENTS









14.


An overview of the corrective actions taken in response to the Court’s comments from previous years is provided in the Annex.





This Report was adopted by Chamber IV, headed by Mr Baudilio TOMÉ MUGURUZA, Member of the Court of Auditors, in Luxembourg at its meeting of 13 September 2016.


For the Court of Auditors

Vítor Manuel da SILVA CALDEIRA

President





(1)  The Agency’s operational staff was relocated to Athens in March 2013.

(2)  OJ L 77, 13.3.2004, p. 1.

(3)  OJ L 165, 18.6.2013, p. 41.

(4)  More information on the Agency’s competences and activities is available on its website: www.enisa.europa.eu

(1)  Staff includes officials, temporary and contract staff and seconded national experts.

Source: data provided by the Agency.

(5)  These include the balance sheet and the statement of financial performance, the cash flow table, the statement of changes in net assets and a summary of the significant accounting policies and other explanatory notes.

(6)  These comprise the budgetary outturn account and the annex to the budgetary outturn account.

(7)  Articles 39 and 50 of Commission Delegated Regulation (EU) No 1271/2013 (OJ L 328, 7.12.2013, p. 42).

(8)  The accounting rules adopted by the Commission’s accounting officer are derived from the International Public Sector Accounting Standards (IPSAS) issued by the International Federation of Accountants or, where relevant, the International Accounting Standards (IAS)/International Financial Reporting Standards (IFRS) issued by the International Accounting Standards Board.

(9)  Article 107 of Delegated Regulation (EU) No 1271/2013.

(10)  Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (OJ L 298, 26.10.2012, p. 1).


ANNEX
Follow-up of previous years’ comments







Year


Court's comment


Status of corrective action
(Completed/Ongoing/Outstanding/N/A)




2012


Whereas the Financial Regulation and the corresponding Implementing Rules provide for a physical inventory of fixed assets at least every 3 years, the Agency has not carried out a comprehensive physical inventory since 2009.


Completed




2014


The overall level of committed appropriations was high at 100 % (94 % in 2013). In total, committed appropriations carried over to 2015 amount to 1,3  million euro, i.e. 15 % of total appropriations (2013: 1,2  million euro, i.e. 13,5  %). Commitment appropriations carried over are high for Title II (administrative expenditure) at 0,6  million euro, i.e. 49 % (2013: 0,8  million euro, i.e. 59 %). These were linked to investments in IT infrastructure ordered as planned near the year-end for the Agency’s two offices.


N/A







THE AGENCY’S REPLY






12.


ENISA notes the decrease of the rate of appropriations carried over to the next year from 15 % in 2014 to 7 % in 2015, due to continuous performance improvement of ENISA in this area. The carry-over is justified and related to the building project (0,05 million euro) for the removal of the landlord data centre of Athens office (1) that was only finalised in December 2015. Moreover, the procurement of 26 laptops (0,05 million euro), which reached the end of their warranty period, was finalised in December 2015, following a negotiated procurement procedure.










13.


According to recital 7 of the preamble of ENISA Regulation (EC) No 526/2013, ‘staff primarily engaged in the administration of the Agency […] should be based in Heraklion’. However the text in the preamble is not considered to be a restrictive factor (2).






(1)  The move of the data centre of the landlord was dictated by the committee of the Council’s Security Directorate which Identified risks and suggested immediate removal of a third party’s data centre from within ENISA premises.

(2)  According to settled case law of the Court of Justice of the EU. The preamble of an EU text has no binding legal force Case C-162/97. Nilsson and others. ECLI:EU:1998:554, paragraph 54.