Special Report No 27 // 2016#Governance at the European Commission — best practice? #(pursuant to Article 287(4), second subparagraph, TFEU)
Date: 2016-09-20
Institutions: European Court of Auditors
Subjects: European Commission, accounting, administration of the Institutions, administrative expenditure (EU), auditing, closing of accounts, political responsibility, public accounting, public sector

EN 

2016 

NO 27

Special Report  Governance at the 

European Commission — 
best practice?

EUROPEAN
COURT
OF AUDITORS

 
EUROPEAN COURT OF AUDITORS 
12, rue Alcide De Gasperi 
1615 Luxembourg 
LUXEMBOURG

Tel. +352 4398-1
Enquiries: eca.europa.eu/en/Pages/ContactForm.aspx
Website: eca.europa.eu
Twitter: @EUAuditors

More information on the European Union is available on the internet (http://europa.eu).

Luxembourg: Publications Office of the European Union, 2016

Print 
PDF 
EPUB 

ISBN 978-92-872-6050-5 
ISBN 978-92-872-6075-8 
ISBN 978-92-872-6092-5 

ISSN 1831-0834 
ISSN 1977-5679 
ISSN 1977-5679 

doi:10.2865/38354 
doi:10.2865/802820 
doi:10.2865/60868 

QJ-AB-16-027-EN-C
QJ-AB-16-027-EN-N
QJ-AB-16-027-EN-E

© European Union, 2016
Reproduction is authorised provided the source is acknowledged.
For any use or reproduction of the figure in Box 10 on p. 30, permission must be sought directly from the copyright 
holder. All rights reserved.

EN 

2016 

NO 27

Special Report

Governance at the 
European Commission — 
best practice?

(pursuant to Article 287(4), second subparagraph, TFEU)

Audit team

02

The ECA’s special reports set out the results of its performance and compliance audits of specific budgetary areas or 
management topics. The ECA selects and designs these audit tasks to be of maximum impact by considering the risks 
to performance or compliance, the level of income or spending involved, forthcoming developments and political 
and public interest.

This performance audit was produced by Audit Chamber V, which has a focus in the areas of financing and adminis-
tering the Union. The audit was led by ECA Member Mr Lazaros S. Lazarou, Dean of Chamber V, supported by  
Andreas Antoniades, Head of private office and Johan Adriaan Lok, Attaché of private office; Peter Welch, Director; 
Mariusz Pomienski, Principal Manager; Bogna Kuczynska, Head of Task; Rogelio Abarquero Grossi, Erik De Bruyne, 
Daria Bochnar, Andreas Dürrwanger, Mehmet Ergün, Paul Sime, Michael Tatianos and Carl Westerberg, Auditors.

From left to right: E. De Bruyne, A. Dürrwanger, J. A. Lok, P. Sime, D. Bochnar, L. S. Lazarou,  
B. Kuczynska, A. Antoniades, P. Welch, M. Pomienski, C. Westerberg, R. Abarquero Grossi.

Contents

03

Paragraph 

List of abbreviations 

I-VIII 

Executive summary

1-10 

1-10 

Introduction

Getting governance right is a priority in public and private sector bodies

11-14 

Audit scope and approach

15-57  Observations

15-31 

15-22 

Changes to governance structures and the creation of the Internal Audit Service and the Audit 
Progress Committee

The Commission distinguishes between its own political responsibility and the responsibility of its 
directors-general for management

23-24 

The Commission abolished the financial controller and set up an internal audit function

25 

26 

The Internal Audit Service initially had a stronger orientation on high level institution-wide governance 
issues …

… and now gives greater attention to the Commission’s internal control framework

27-29 

The Commission set up an Audit Progress Committee as one of the first steps in the reform process

30-31 

Overview by the Audit Progress Committee is in practice limited to the work of the Internal Audit Service

32-41 

Aligning internal controls and financial reporting with international standards

32-34 

The Commission chose the COSO framework as the basis for its internal control standards …

35-39  … but completing transition to the updated COSO framework is challenging

40-41 

Producing annual accounts in line with international standards improved financial reporting

 
Contents 

04

42-57 

Providing non-financial information to internal and external stakeholders

42-44 

The Commission provides non-financial information alongside the accounts …

45-47  … but less than many other organisations do

48-51 

Since 2013 the Commission has reported a material level of error in its spending

52-53 

It is best practice to base the estimates of amounts at risk on a consistent methodology

54-57 

Reports introduced through the Prodi reform still form the basis for Commission internal reporting

58-66  Conclusions and recommendations

Annex I  —  The GGPS Framework and COSO 2013 

Annex II  —  Key elements of selected corporate reporting frameworks 

Annex III  —  Overview of annual reports and accounts of selected public sector bodies

Reply of the Commission

 
 
 
 
List of abbreviations

05

AAR: Annual Activity Report

APC: Audit Progress Committee

ABM: Activity-based management

AMP: Annual Management Plan

AMPR: Annual Management and Performance Report

CFO: Chief financial officer

CFS: Central Financial Service

CIE: Committee of Independent Experts

CIPFA: The Chartered Institute of Public Finance & Accountancy

CONT: Committee on Budgetary Control

COSO: The Committee of Sponsoring Organisations of the Treadway Commission

DG: Directorate-general

DG AGRI: Directorate-General for Agriculture and Rural Development

DG BUDG: Directorate-General for Budget

DG DEVCO: Directorate-General for International Cooperation and Development

DG DIGIT: Directorate-General for Information Technology

DG REGIO: Directorate-General for Regional and Urban Policy

DG RTD: Directorate-General for Research and Innovation

ECA: European Court of Auditors

EU: European Union

FEE: Fédération des Experts-comptables Européens — Federation of European Accountants

FSD&A: Financial Statement Discussion and Analysis

GAO: Government Accountability Office

GGPS: Good governance in the public sector

IAC: Internal audit capability

IAS: Internal Audit Service

IASB: International Accounting Standards Board

List of abbreviations 

06

IFAC: International Federation of Accountants

IFRS: International Financial Reporting Standards

IIA: Institute of Internal Auditors

Iperia: Improper Payments Elimination and Recovery Improvement Act

IPSAS: International Public Sector Accounting Standards

IPSASB: International Public Sector Accounting Standards Board

IIRC: International Integrated Reporting Council

ISSB: Information Security Steering Board

MP: Management plan

OECD: Organisation for Economic Cooperation and Development

OLAF: European Anti-Fraud Office

PG: Preparatory group

PIC: Public internal control

RPG: Recommended practice guideline

SAI: Supreme Audit Institution

SG: Secretariat-general

SPP: Strategic Planning and Programming

SR: Synthesis Report

TEU: Treaty on the European Union

TFEU: Treaty on the Functioning of the European Union

Executive summary

07

I
In the wake of the resignation of the Santer Commission and in response to the report of the Committee of Inde-
pendent Experts, in March 2000, the Commission approved the ‘Reforming the Commission’ White Paper, intended 
to modernise the governance of the Commission. The reforms proposed covered setting priorities and allocating 
resources; changing human resource policy; and overhauling audit, financial management and control. The White 
Paper and the report of the Committee of Independent Experts continue to influence decision-making and govern-
ance in the Commission to this day.

II
The pressure to have excellent governance arrangements remains. As a recent Commission document explains: ‘We 
are living in times of substantial pressure on public finances at all levels in the EU. (…) Under such conditions, it is 
paramount that state-of-the-art frameworks and standards are implemented in the public sector.’1 Good govern-
ance is not just about relationships, it is about achieving results, and providing decision-makers with the tools to 
do their job. It should encourage the efficient use of resources, strengthen accountability for the stewardship of 
resources, promote robust scrutiny, improve organisational leadership, management, and oversight. If these are 
achieved, it should lead to more effective interventions2.

III
While the rules and structures set up by the Commission largely reflected best practice at the time, best practice 
has continued to evolve. We thus examined the current governance arrangements at the Commission with a focus 
on audit, financial management and control to see whether they are in line with best practice and whether they still 
meet the needs of the institution.

IV
Best practice has continued to evolve since the 2000 reforms. Although some action3 has been taken, we conclude 
that in several areas the Commission diverges from, or does not meet in full best practice set out in standards or put 
in place by the international and public bodies we selected as benchmarks.

1 

2 

3 

European Commission: Public Internal Control System: http://ec.europa.eu/budget/pic/index_en.cfm

See Chartered Institute of Public Finance and Accountancy (CIPFA)/International Federation of Accountants (IFAC), ‘International Framework: Good 
Governance in the Public Sector’, 2014, p. 6.

Including the publication alongside the accrual-based EU accounts of the financial statement discussion and analysis, reporting on performance 
(resulting in 2015 in an integration with reporting on management in the annual management and performance report) and the transition to the 
updated 2013 COSO internal control – integrated framework.

Executive summary 

08

V
The distinction made between the ‘political responsibility of commissioners’ and the operational responsibility 
of directors-general means that it has not always been made clear whether ‘political responsibility’ encompasses 
responsibility for the directorates-general, or is distinct from it. Recent organisational reforms are beginning to 
address some of the risks of a ‘silo’ culture. But to continue to address key risks the Commission will need to further 
strengthen the governance structure across the institution.

VI
The Internal Audit Service focuses its efforts on the Commission’s internal control systems. In recent years its cover-
age of institution-wide governance issues included corporate information security. Spending outside the Commis-
sion — for which the Commission is responsible — is the responsibility of audit directorates and units in the spend-
ing directorates-general. This has an impact on the information presented to the Commission’s audit committee. 
The role of the Audit Progress Committee (and the participation of independent, external members) is more limited 
than that of audit committees at international bodies we selected as benchmarks.

VII
The Commission has recently begun to accompany the accounts with non-financial information. However, despite 
recent improvements, it still provides less non-financial information alongside the accounts than organisations we 
selected as benchmarks for best practice do.

VIII
We recommend that the Commission should:

 ο

as required of European public interest entities, when it decides not to follow best practice, explain its reasons 
for not doing so;

 ο

invite the IAS to carry out more audit work on high level governance issues;

 ο

complete the process of aligning its internal control framework with the COSO 2013 principles;

 ο

further bring forward the publication of the annual accounts;

Executive summary 

09

 ο

bring together information already presented in a variety of existing reports to form a single accountability 
report or suite of reports, containing the accounts but also incorporating:

- 

- 

- 

- 

- 

- 

- 

a governance statement;

a President’s report;

a discussion of operational and strategic risks;

a report on non-financial performance;

information on activities during the year and the achievement of policy objectives;

a report on the role and conclusions of the Audit Committee; and

a mid- and long-term fiscal sustainability statement, together with, where appropriate, links to information 
contained in other reports;

 ο

 ο

 ο

 ο

present this single accountability report or suite of reports for audit of the accounts and checks by the auditor 
that other information presented within it is consistent with accounting information;

publish as part of the annual accounts or accompanying information an estimate of the level of error based on 
a consistent methodology;

update and publish its governance arrangements on a regular basis and explain its choice of structures and 
processes in relation to the framework it chooses; and

turn the Audit Progress Committee into an audit committee with a majority of independent, external members 
and expand its mandate to cover risk management, financial reporting and the work and results of ex post verifi-
cation units and audit directorates.

Introduction

10

Getting governance right is a priority in public and 
private sector bodies

4 

01 
A series of corporate failures during the 1990s brought the issue of corporate 
governance into the public eye — and made improving governance arrange-
ments in the private sector a key policy priority. Typically these failures involved 
a situation where the full extent of a risk, or of irregular behaviour was either not 
known by members of the governing body, or known only to a small number 
of dominant (usually executive) board members. Concerns over failures in the 
private sector led to changes in EU legislation, requiring all public interest enti-
ties4 to comply with a code of governance5 and to confirm this in their published 
annual report and financial statements.

02 
The move to adopt good governance arrangements extended into the public 
sector. The CIPFA/IFAC document Good Governance in the Public Sector6 (GGPS) is 
a recent reflection of this, as is the EU-led PIC7 initiative, focused on the appropri-
ate governance and control arrangements for countries seeking admission to the 
EU.

03 
Good governance (see Box 1) is not just about relationships, it is about achieving 
results, and providing decision-makers with the tools to do their job.

Such as companies listed on 
a stock exchange (Directive 
2004/39/EC of the European 
Parliament and of the Council 
of 21 April 2004 on markets in 
financial instruments 
amending Council Directives 
85/611/EEC and 93/6/EEC and 
Directive 2000/12/EC of the 
European Parliament and of 
the Council and repealing 
Council Directive 93/22/EEC 
(OJ L 145, 30.4.2004., p. 1)).

5  Directive 2013/34/EU of the 
European Parliament and of 
the Council of 26 June 2013 on 
the annual financial 
statements, consolidated 
financial statements and 
related reports of certain 
types of undertakings  
(OJ L 182, 29.6.2013, p. 19)  
(as amended by Directive 
2014/95/EU (OJ L 330, 
15.11.2014, p. 1)) (Accounting 
Directive).

6  Chartered Institute of Public 
Finance and Accountancy 
(CIPFA)/International 
Federation of Accountants 
(IFAC), ‘International 
Framework: Good Governance 
in the Public Sector’, 2014.

7 

Public Internal Control is 
a platform for exchange of 
information and good 
practices between public 
administrations in the EU.

1
x
o
B

Good governance

‘Good governance in the public sector encourages better-informed decision-making as well as the efficient 
use of resources. It strengthens accountability for the stewardship of those resources. Good governance is 
characterised by robust scrutiny, which places important pressures on improving public sector performance 
and tackling corruption. Good governance can improve organisational leadership, management, and over-
sight, resulting in more effective interventions and, ultimately, better outcomes.’8.

8  Chartered Institute of Public Finance and Accountancy (CIPFA)/International Federation of Accountants (IFAC), ‘International Framework: Good 

Governance in the Public Sector,’, 2014, p. 6.

 
Introduction 

11

04 
Concerns about governance in the European Commission came to a head in 1999 
with the resignation of the Santer Commission and, particularly, with the report 
of the Committee of Independent Experts (CIE) appointed by Parliament to inves-
tigate the problems behind the resignation and to recommend a way forward. 
The Committee’s complaint that they could find no one ‘prepared to take respon-
sibility’ lay at the centre of their critique of governance within the Commission 
(see Box 2). These events, and the report of the CIE, led to the Prodi Commission 
agreeing, in 2000, on a comprehensive reform package, intended to modernise 
the governance of the Commission (the ‘Prodi reform’). The White Paper, the 
resignation of the Commission, and the report of the CIE continue to influence 
decision-making in the Commission to this day.

2 Governance and accountability frameworks
x
o
B

‘Governance comprises the arrangements put in place to ensure that the intended outcomes for stakeholders 
are defined and achieved’, according to Good Governance in the Public Sector.

The COSO 20139 principles state that the governing body ‘demonstrates independence from management 
and exercises oversight of the development and performance of internal control’10 (see Box 10).

Accountability is a key element of governance, especially in the public sector. IFAC defines it as ‘the process 
whereby public sector entities, and the individuals within them, are responsible for their decisions and ac-
tions, including their stewardship of public funds and all aspects of performance, and submit themselves to 
appropriate external scrutiny. It is achieved by all parties having a clear understanding of those responsibili-
ties, and having clearly defined roles through a robust structure. In effect, accountability is the obligation to 
answer for responsibility conferred.’11.

The Commission is involved in promoting good governance in the EU Member States through the PIC net-
work. It has stressed the importance of sound control and the use of best practice standards: ‘We are living 
in times of substantial pressure on public finances at all levels in the EU. More than ever, taxpayers in every 
Member State expect value for money and the public sector is held accountable for sound and efficient man-
agement of funds entrusted to it. The public sector must demonstrate that resources are spent efficiently, and 
that output and outcomes are effective. Under such conditions, it is paramount that state-of-the-art frame-
works and standards are implemented in the public sector.’12.

These are examples of best practice drawn from relevant codes and guidance. Throughout this report we use 
the symbol 

to designate boxes presenting such examples.

GOOD 
GOVERNANCE
GUIDELINES

BEST PRACTICE

9  Committee of Sponsoring Organisations of the Treadway Commission (COSO), Internal Control – Integrated Framework, 2013.

10  Source: Internal Control – Integrated Framework, Executive Summary, © Committee of Sponsoring Organisations of the Treadway Commission 

(COSO).

11 

IFAC Public Sector Committee, ‘Governance in the Public Sector: A Governing Body Perspective’, 2001, p. 12.

12  European Commission: Public Internal Control System: http://ec.europa.eu/budget/pic/index_en.cfm

 
Introduction 

12

05 
The Commission based its reform programme on three pillars: reforms to priority-
setting and budgeting, modernising human resources policy, and improvements 
to audit, financial management, and control (Figure 1). The Commission argued 
that five main principles should underlie a period of ‘cultural change’: independ-
ence of the Commission, responsibility, accountability, efficiency in the achieve-
ment of results and transparency.

1 Three pillars of the Prodi (White Paper) reform
e
r
u
g
i
F

2000 White Paper Reform

Pillars

Goals

Setting up 
of political
priorities and 
resource allocation

Human 
resources policy

Audit, ﬁnancial
management
and control

Introduce a more
eﬀective method 
for setting priorities 
and allocating 
resources to them

Modernise human
resources policy 
from recruitment to
retirement [...] for the
benefit of staff of 
all grades

Improve ﬁnancial
management,
eﬃciency and
accountability

Source: European Court of Auditors (ECA) based on COM(2000) 200 final/2 ‘Reforming the Commission, A White Paper - Part I’.

 
Introduction 

13

06 
The first pillar of the reform introduced new planning and monitoring tools for 
each Commission department (management plans (MPs) and AARs). The third 
pillar (Box 3) simplified rules for authorising expenditure. One issue of intense 
debate was the way the different responsibilities within the Commission were to 
be managed and combined. The key roles were those of the Commission as a col-
lege, the individual commissioners, the financial controller and the directorates-
general (DGs) (and the directors-general who have the chief administrative role 
within them).

3
x
o
B

Third pillar of the Prodi reform: Modernisation of financial management, control 
and audit system13

Overhauling the financial management, control and audit system in line with best practice:

 ο devolving responsibility for checking spending from the financial controller to DGs;

 ο declaration by each director-general in the Annual Activity Report (AAR) that adequate internal controls 

have been put in place and that resources have been used for the intended purposes;

 ο creating finance units within DGs to provide advice and assistance to operational units;

 ο creating a Central Financial Service to provide advice to operational departments;

 ο setting up an Internal Audit Service (IAS) under the authority of the Vice-President for Reform to assist 

management within the Commission;

 ο setting up specialised ‘audit capability’ within each DG, reporting directly to the director-general;

 ο establishing an Audit Progress Committee (APC) to monitor the control processes of the Commission, the 

implementation of audit recommendations, and the quality of audit work;

Defining the responsibilities of authorising officers and line managers:

 ο drawing up simplified and easily accessible rules defining the responsibilities of staff with key financial 

roles.

13  Source: ECA based on COM(2000) 200 final/2.

 
Introduction 

14

07 
A further reform, which was not part of the White Paper, but put forward when 
the Commission’s proposal for recasting the Financial Regulation was discussed, 
was to transform the basis for preparing the EU accounts. Following pressure 
from the Council, the Commission accepted the challenge of putting in place an 
accrual-based accounting system, based on international standards by 200514.

08 
The Commission moved quickly to make the Prodi reforms: the APC met in De-
cember 2000 (see paragraph 27); an externally recruited head of internal audit 
was appointed the following day; the new Financial Regulation was approved 
on 25 June 2002 and new Staff Regulations on 22 March 2004. The Commission 
produced the first set of full-accrual, IPSAS15-based annual accounts in 2005.

14  The ECA had been 

recommending such a step 
since 1978. See Eduardo Ruiz 
García, ‘The Role of the Court 
of Auditors in Modernising the 
Accounting System of the 
European Institutions’ in 
Revista Española de Control 
Externo, May 2013.

15 

International Public Sector 
Accounting Standards.

16  COM(2005) 668 final of 

21 December 2005 ‘Progress 
report on the Commission 
reform beyond the reform 
mandate’.

09 
In its progress report on Commission reform of December 2005, the Commission 
considered that the key principles underlying reform measures remained sound 
and that the Commission was set to ‘build upon its achievements and ensure that 
its resources, both financial and human, are used efficiently and effectively in an 
open and transparent manner so as to facilitate control and build up the trust of 
Europe’s citizens’16.

10 
Over 10 years have passed since this statement. While the rules and structures 
adopted by the Commission largely reflected best practice at the time, govern-
ance rules in respect of both private and public sectors have continued to evolve. 
Members of the Commission need effective tools to exercise their overall respon-
sibility for the management of the EU budget.

Audit scope and approach

15

17  We use the term ‘best practice’ 

throughout this report, 
covering practices described 
as ‘best’, ‘leading’, or ‘good’ in 
specific reference documents.

18 

IFAC, ‘Governance in the 
Public Sector: A Governing 
Body Perspective’, 2001.

19  Accounting Directive (see 
footnote 4), Commission 
Recommendation of 
9 April 2014 on the quality of 
corporate governance 
reporting (‘comply or explain’) 
(OJ L 109, 12.4.2014, p. 43). 
Directive 2014/56/EU of the 
European Parliament and of 
the Council of 16 April 2014 
amending Directive 2006/43/
EC on statutory audits of 
annual accounts and 
consolidated accounts (OJ 
L 158, 27.5.2014, p. 196) 
(Statutory Audit Directive), 
and Regulation (EU) 
No 537/2014 of the European 
Parliament and of the Council 
of 16 April 2014 on specific 
requirements regarding 
statutory audit of public-
interest entities and repealing 
Commission Decision 
2005/909/EC (OJ L 158, 
27.5.2014, p. 77).

20  See list of abbreviations.

11 
Our central audit question, underlying the work performed to produce this re-
port with focus on audit, financial management and control, was:

Are governance arrangements at the Commission in line with recognised 
best17 practice and the Institution’s needs?

12 
We focused on the following issues (see Figure 1 and Box 3):

 ο Changes to governance structures and the creation of the IAS and the APC 

(paragraphs 15 to 31);

 ο Aligning internal controls and financial reporting with international stand-

ards (paragraphs 32 to 41);

 ο

Providing non-financial information to internal and external stakeholders 
(paragraphs 42 to 57).

13 
We take GGPS as a key point of reference (Box 2). We also take account of the 
earlier IFAC study Governance in the Public Sector: A Governing Body Perspec-
tive, in particular to understand best practice at the time of the Prodi reform18. 
A key source for the Commission’s action on internal control during the reform 
period was the COSO framework (this is explained in paragraphs 32 to 39). The 
most recent revision of the COSO framework (2013) is principles based and puts 
internal control within a context of good governance. We mapped the content 
of the GGPS against that of COSO 2013 (see Annex I) to inform our discussion of 
best practice in governance. We have also taken account of the requirements of 
EU directives for public interest entities and of Commission recommendations in 
this area19.

14 
We conducted our audit by reviewing Commission documents (the White Paper, 
internal and external reports), and documents of relevant international bodies 
(CIPFA, FEE, IASB, IFAC, OECD20, etc.), academics, etc. We held meetings with key 
actors within the Commission including members of the APC, members of the 
APC Preparatory Group, the IAS, the Secretariat-General (SG) and DG Budget (DG 
BUDG). We discussed best practice with an expert focus group drawn from lead-
ing international organisations, public sector auditors, independent experts and 
universities, and the reform process with people who played a significant role in 
the process. We surveyed the EU Member States’ supreme audit institutions on 
public sector governance in their jurisdictions. We drew upon our audit results 
and reports since 2001.

Observations

16

21  Pursuant to Article 17(2) TEU, 
EU legislative acts ‘may only 
be adopted on the basis of 
a Commission proposal, 
except where the Treaties 
otherwise provide’.

22  For example in competition 

policy.

23  Throughout this report we use 
the term ‘directorate-general’ 
to cover both a directorate-
general and a department.

24  Throughout this report we use 

the term ‘director-general’ to 
cover both a director-general 
and a head of department.

Changes to governance structures and the creation of 
the Internal Audit Service and the Audit Progress 
Committee

The Commission distinguishes between its own political 
responsibility and the responsibility of its directors-general 
for management

15 
The European Commission is the EU’s executive body. Its governing body 
(see Box 4) — the College of Commissioners (college) — is the final decision-
making body of the Commission. The Commission is, under the Treaty, collec-
tively responsible for the execution of the budget. However, the Commission’s 
responsibilities extend far beyond the execution of the budget. In practice it has 
a monopoly on the proposal of EU legislation21, prepares rules on implementing 
legislative acts and has a significant role in policing the enforcement of EU law22.

16 
Individual commissioners are assigned responsibilities for specific policies. This 
means that most have a leadership role in relation to one or more directorates-
general (DG)23. DGs are headed by directors-general24. The Commission’s power 
to authorise EU spending is in practice delegated to directors-general (in this 
capacity referred to as Authorising Officers by Delegation).

4
x
o
B

Governing body

GOOD 
GOVERNANCE
GUIDELINES

BEST PRACTICE

‘Governing body is the person(s) or group with primary responsibility for overseeing an entity’s strategic 
direction, operations, and accountability. The governing body has a crucial leadership role with respect to 
implementing, evaluating, and improving an entity’s governance.’25.

25  Chartered Institute of Public Finance and Accountancy (CIPFA)/International Federation of Accountants (IFAC), “International Framework: Good 

Governance in the Public Sector”, 2014, p. 9.

 
17

26  Communication from the 

President to the Commission: 
The Working Methods of the 
European Commission 
2014-2019. C(2014) 9004, p. 7.

27  Communication from the 

President to the Commission: 
The Working Methods of the 
European Commission 
2014-2019. C(2014) 9004, p. 2.

28  Activity-based management.

29  Also known as private offices.

30  The Commission defines 
resource director as ‘the 
person of the management 
board in charge of resource 
management at DG-level 
including programming, 
human resources and financial 
resources management’, 
(SEC(2003) 59 final).

Observations 

17 
In his communication on Commission’s working methods of November 2014, 
President Juncker stressed that ‘commissioners should assume full political 
responsibility for the work done by the services that report to them’26. He also 
organised the college with the aim that it should ‘work together as a strong team, 
cooperating across portfolios (…) to overcome silo mentalities by working jointly 
on those areas where we (the college) can really make a difference’27 (see  
Figure 2).

18 
Since the reform, a number of management groups assist the Commission  
(Figure 3):

 ο

 ο

 ο

The ABM28 Steering Group, created to coordinate the policy and strategy is-
sues linked to the three strands of the reform (strategic planning and pro-
gramming, staff policy, financial management and audit). Since 2015 it also 
covers Commission-wide IT governance matters. Chaired by the Secretary- 
General, it brings together directors-general and cabinets29 responsible for 
central services.

The Directors-General Group, created to implement the reform, now oversees 
coordination of policy implementation and provides a forum for the discus-
sion of issues of horizontal interest.

The Resource Directors Group, created to examine the specific issues related 
to the implementation of the reform, is a consultative body of resource direc-
tors30 aiming to promote a coherent and optimal management of Commis-
sion’s resources and to ensure that the needs of the operational departments 
are taken into account. It provides a forum for discussion and exchange of 
best practices between horizontal and operational departments.

Observations 

18

2 The College of Commissioners November 2014-June 20161
e
r
u
g
i
F

Cooperation & Development Malmström: Trade

Mimica: International

Stylianides: Humanitarian & Aid
& Crisis Management


Hahn: European Neighbourhood
Policy & Enlargement

Negotiations





Ansip





Dombrovskis
Katainen





Šefčovič

Mogherini






Georgieva

Timmermans



President
Juncker

Avramopoulos: 
Migration,
Home Affairs & 
Citizenship



Thyssen:
Employment,
Social Affairs, 
Skills &
Labour Mobility



Moscovici: 
Economic & 
Financial 
Affairs, 
Taxation & 
Customs



Hill: Financial
Stability, Financial
Services & Capital
Markets Union



Andriukaitis: Health & Food Safety


Vella: Environment, Maritime 
Affairs & Fisheries


Arias Cañete: Climate 
Action & Energy




Bulc:
Transport



Hogan:
Agriculture
 & Rural
Development



Creţu:
Regional Policy



Vestager: Competition



Moedas: Research, 
Science & Innovation

Jourová: Justice, 
Consumers &
Gender Equality





Oettinger: Digital 
Economy & Society




Navracsics: Education, 
Culture, Youth & Sport

Bieńkowska: Internal Market, Industry,
Entrepreneurship & SMEs

Area of Vice-Presidents’ (VP) responsibility by colour

First VP: Better Regulation, Interinstitutional 
Relations, Rule of Law & Charter of Fundamental 
Rights.
VP: Budget & Human Resources.
High Representative (HR) of the Union for Foreign 
Policy & Security Policy/VP.
VP: Energy Union.

VP: Jobs, Growth, Investment & Competitiveness.
VP: The Euro & Social Dialogue.
VP: Digital Single Market.

The college of commissioners includes the President 
of the Commission, his seven Vice-Presidents (VP), 
including the First Vice-President, and the High-
Representatives (HR) of the Union for Foreign Policy and
Security Policy and 20 commissioners in charge of 
portfolios.

Commissioners are members of project teams,
which are led by Vice-Presidents.

Areas to which they contribute in particular.

1  Commissioner Hill resigned on 15 July 2016 and his portfolio was taken over by Vice-President Dombrovskis and Commissioner Moscovici.

Source: ECA, based on Annex 3 of Working Methods of the European Commission 2014-2019, C(2014) 9004.

 
Observations 

19

Flows of information on internal control to college

3
e
r
u
g
i
F

Directors General Group

Group of Resource
Directors

ABM Steering Group

Management
groups

OLAF

Audit Progress 
Committee

Internal Audit Service

The college of
commissionners

(cid:98)

(cid:98)

(cid:98)

(cid:99)

(cid:98)

(cid:99)

(cid:98)

(cid:99)

(cid:98)

(cid:98)

(cid:98)

(cid:98)

(cid:98)

(cid:98)

(cid:99)

(cid:98)

(cid:98)

(cid:99)

(cid:99)

(cid:98)

Secretariat General

Central Financial Service

Directorate General

Director General
Resource Director

Source: ECA.

 
Observations 

20

19 
The Secretariat-General (SG) has responsibility for a number of corporate pro-
cesses, including decision-making, document management, business continuity 
arrangements, and strategic planning and programming. It manages the collegial 
decision-making process and provides support to the President and the Vice-
Presidents. It coordinates activities across policy areas and Commission depart-
ments and acts as the Commission’s interface and manages relations with the 
other European institutions, national parliaments and non-governmental organi-
sations and entities.

31  Committee of Independent 
Experts, Second Report on 
Reform of the Commission, 
1999, p. 118.

20 
A concern of the CIE was not to leave the directors-general to ‘sink or swim’31. 
It thus recommended the creation of the Central Financial Service (CFS). This 
department, located within DG BUDG provides support and advice on financial 
management, interpretation of financial rules and legislation, internal control 
and risk management.

21 
Until the reform, the Commission’s financial controller was responsible for 
approving all expenditure. This role led to criticism that DGs saw their respon-
sibility for EU spending as limited essentially to obtaining the financial control-
ler’s approval (visa) (see paragraph 4). The Commission abolished the financial 
controller function and moved responsibility for checks to DGs. The move from 
a system of centralised ex ante approval to a system of decentralised responsibil-
ity, and ex post accountability was a fundamental building block of the reform. 
But this means that it has not always been made clear whether the responsibility 
of the Commission as a whole encompasses responsibility for the actions of its 
directors-general, or is distinct from responsibility of its directors-general (see 
Figure 4). 

Observations 

21

4
e
r
u
g
i
F

Accountability in the Commission



28 Commissioners

‘The College of Commissioners assumes collective political responsibility but in practice does not itself exercise the budget
 implementation powers vested in it. It delegates these tasks each year to individual civil servants’1.

‘Collective political responsibility’¹

Responsibility for the ‘entire management process’¹

‘The responsibility of the Authorising Officers covers the entire management process, from determining what needs to be
done to achieve the policy objectives set by the institution to managing the activities launched from both an operational 
and budgetary standpoint’1.

DGs/AOD²

0

1 000

2 000

3 000












DEVCO:
JRC:
DGT:
NEAR:
RTD:
OIB:
GROW:
COMM:
AGRI:
CONNECT:








Other DGs (33)














Directorate-general/Service staﬀ members³
The 10 largest DGs manage around 50 % of the 
33 thousand civil servants working in the Commission.








Around 
16.5 
thousand 
civil 
servants

1 

2 

 COM(2015) 377 final of 23 July 2015 ‘Consolidated annual accounts of the European Union 2014’, p. 11. The individual civil servants con-
cerned — generally directors-general and heads of service — are known as ‘Authorising Officers by delegation’ or ‘AODs’ or shortened, as in 
this figure ‘authorising officers’.

 The Authorising Officer for the Commission is the College of the 28 Commissioners. The College through specific decisions delegates tasks of 
financial management to the directors-general, who thus become the ‘Authorising Officers by Delegation’. Directors-general delegate further 
to the directors, heads of units, etc. who thus become the ‘Authorising Officers by Sub-delegation‘, in accordance with Articles 56, 65 and 66 
of the Financial Regulation.

3  Commission 2016 Human Resources Key Figures Staff Members (excluding staff in Executive Agencies).

Source: ECA, based on Commission information and figures.

 
Observations 

22 
The legal situation is, however, clear. According to the Treaty on the Functioning 
of the European Union (the Treaty) the Commission is collectively responsible for 
the execution of the budget32. This is reflected in the Financial Regulation which 
specifies that ’each institution shall perform the duties of authorising officer‘33. 
The Commission bears this responsibility notwithstanding its delegation to 
directors-general (see Box 5) and thus, it is the authorising officer (Commission) 
who is responsible for ’implementing revenue and expenditure in accordance 
with the principle of sound financial management and for ensuring compliance 
with the requirements of legality and regularity’34.

22

32  Article 234 of the Treaty on the 

Functioning of the European 
Union (TFEU).

33  Article 65.1 of Regulation (EU, 
Euratom) No 966/2012 of the 
European Parliament and of 
the Council of 25 October 2012 
on the financial rules 
applicable to the general 
budget of the Union and 
repealing Council Regulation 
(EC, Euratom) No 1605/2002 
(OJ L 298, 26.10.2012, p. 1).

34  Article 66.1 of Regulation (EU, 

Euratom) No 966/2012.

5
x
o
B

Commission’s responsibility

The CIE stressed in 1999 that ‘the font of all authority in the Commission is the college of commissioners itself. 
Ultimately therefore, responsibility for all actions of the administration must find its way back to individual 
commissioners and through them to the college. […] The chain of delegation begins at the level of the Com-
mission through the commissioner. She or he thus holds the ultimate responsibility for all financial matters, 
including for internal control, and as a member of the college’.

A 2007 CONT35 Working Document on ‘Governance in the European Commission’36 took a critical view of some 
elements of the reform. It stated that ‘The silo structure of the Commission — and the associated concentra-
tion of information and power within the directorates-general — should have made it clear to everybody 
that there would not be any kind of serious governance without functional reporting lines between related 
services across the directorates-general. That did not happen. (…)The price for considering each directorate-
general as an independent fiefdom, with its own controllers, its own accountants and its own internal auditors 
only reporting to the director-general, is paid by the institution as a whole and is inconsistent with the Treaty, 
which gives the college a collective responsibility’.

Throughout this report we use the symbol 
Parliament.

PRESSURE
FROM
PARLIAMENT

to designate boxes containing examples of pressure from 

35  European Parliament’s Committee on Budgetary Control.

36  PE 393.916v01-00, 3.9.2007, pp. 2-3.

 
Observations 

23

The Commission abolished the financial controller and set up 
an internal audit function

23 
Abolition of the centralised ex ante financial controller and the creation of 
a ‘modern Internal Audit Service’37 (see Box 6) was a key element in the Prodi 
reform. The Commission established the IAS in April 200138 (it had already ap-
pointed an internal auditor (see paragraph 8)). There was considerable debate as 
to the form Internal Audit should take (institution-wide, or within individual DGs). 
Eventually the Commission set up a specialised audit capability (IAC), reporting 
directly to each director-general alongside a central Internal Audit Service. In 
2015 the Commission abolished the IACs.

37  A new Framework for 

Resource Management and 
Internal Auditing in the 
Commission, Final Report of 
the Planning and Co-
ordination Group ‘Internal 
Audit’, February 2000, p. 2.

38  Commission Decision, 

SEC(2000) 560.

39  Of the total IAS staff 31 work 

on the decentralised agencies 
and other autonomous 
bodies. Their work is not 
presented to the 
Commission’s APC.

24 
The DGs with a significant spending role continue to have ex post verification 
units and audit directorates which examine spending. There are for example 
around 180 staff in such entities in DG DEVCO, 130 in DG AGRI, 100 covering re-
search and 90 in DG REGIO. In 2016, the IAS had a staff of 14739.

6
x
o
B

Role of internal audit in the public sector

GOOD 
GOVERNANCE
GUIDELINES

BEST PRACTICE

‘The function of internal auditing is to provide independent, objective assurance and consulting services de-
signed to add value and improve an entity’s operations. The internal audit activity helps an entity accomplish 
its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of 
governance, risk management, and control processes. Internal audit reviews can cover a wide range of topics, 
including those relating to the achievement of value for money and the prevention and detection of fraud 
and corruption.’40.

This definition is in line with the IIA framework: ‘Internal auditing is an independent, objective assurance and 
consulting activity designed to add value and improve an organisation’s operations. It helps an organisation 
accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effec-
tiveness of risk management, control, and governance processes’.

40  CIPFA/IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, p. 29.

 
Observations 

The Internal Audit Service initially had a stronger orientation 
on high level institution-wide governance issues …

25 
Governance arrangements were of pressing interest to the Commission as it 
implemented the White Paper. Thus initially, the IAS had a strong profile on 
high level, institution-wide governance issues41. In recent years the work of the 
IAS has covered both issues related to processes in individual DGs and govern-
ance. Institution-wide governance issues in recent years have included corporate 
information security (see Box 7). We take note of an IAS recommendation42 for 
‘corporate level central measures … to ensure a consistent reliable complete and 
comprehensive approach at the operational level and overview on … Commis-
sion wide issues’ such as fraud prevention and detection. A survey of DGs by an 
external assessor showed that, while there was a high level of appreciation over-
all for the work of the IAS, appreciation of its impact on corporate governance 
was significantly lower.

24

41 

Illustrated, for example, by the 
2002 ‘Verstehen’ conference at 
which the Head of the IAS 
promoted the ‘single audit’ 
concept.

42  The IAS has first made this 
recommendation in the 
Working document 
accompanying the Overall 
opinion for the year 2010.

7
x
o
B

Some significant IAS recommendations on governance have not been followed

In its annual report for 2006 the IAS recommended that the Commission produce an annual governance state-
ment: ‘in order to achieve full maturity and to make its governance architecture and its latest developments 
known to stakeholders, the Commission should describe its governance policy and practice, preferably in the 
synthesis report summarising the DGs annual activity reports, make it available on its website and provide for 
its regular updating’43.

The Commission’s governance arrangements were last published in 2007 (see paragraph 45).

In its 2009 annual report, the IAS recommended that the overview is necessary at the level of the institution 
for common processes: ‘Risk Management overview — The role presently played by the SG and DG BUDG 
should be significantly strengthened so as to assure an effective overview of the implementation of risk man-
agement in the Commission, to promote best practices in risk management and to identify risks to which the 
Commission as a whole is exposed.’44.

The Commission’s central departments did not accept this recommendation in its entirety, as they considered 
it inconsistent with the Commission’s approach of making directorates-general finally responsible45.

In 2015, the IAS conducted an audit on corporate information security governance. It tested the adequacy 
of the governance structure and the measures in place to ensure that appropriate security provisions were 
implemented in the Commission’s information systems and processes.

Following the IAS recommendation, the Commission set up an Information Security Steering Board (ISSB) and 
a new IT security directorate.

43  COM(2007) 280 final of 30 May 2007 ‘Annual report to the discharge authority on internal audits carried out in 2006’, p. 12.

44 

IAS, ‘Final audit report on risk management in the Commission’ (IAS.B1-2009-4 COMM-001).

45 

IAS Audit Report: Final Audit Report on Risk Management in the Commission, IAS.B1-2009-Y COMM-001, Annex 2, comments from SG and DG 
BUDG: Recommendation 1.

 
Observations 

25

… and now gives greater attention to the Commission’s 
internal control framework

26 
A key risk to the Commission relates to the legality and regularity of its expendi-
ture. Our work has indicated a material impact of legality and regularity errors 
throughout the period since the reform of the Commission. The IAS focuses its 
efforts on the internal control systems of the Commission. While this focus is 
understandable in the context of the significant work of other bodies (auditors 
in the Member States, audit directorates within the spending DGs, the ECA), this 
restricted coverage has an impact on the range of material presented to the 
APC. The IAS does not cover operations outside the Commission — these are the 
responsibility of the ex post verification units in spending DGs (see paragraph 24). 
The findings of these units and directorates are not considered by the Commis-
sion’s audit committee: the APC.

The Commission set up an Audit Progress Committee as one 
of the first steps in the reform process

27 
The APC held its first meeting in December 2000, and is thus one of the long-
est-standing elements of the reformed governance structure. The APC was 
initially composed of the Budget Commissioner (chairperson), the Vice-Presi-
dent in charge of administration and reform, and two further members of the 
Commission.

28 
It is best practice to have a majority of external, independent members of the 
audit committee (see Box 8). The Commission appointed the first external mem-
ber of the APC in May 2001, and a second in 2004. This formation represented 
the highest share of independent, external members (two out of a total of six 
members of the APC). In 2005 the number of internal members increased to five, 
and in 2007 — to seven, thus reducing the proportion of external members to 
two out of nine. This formation was still in place at the time of the audit. The First 
Vice-President of the Commission chairs the current (2014-2019) APC and three 
further commissioners are members of the APC for the whole mandate. A fur-
ther three commissioners will rotate halfway through the mandate. Among the 
internal members there is a strong representation of DGs with the highest levels 
of spending. The commissioner members of the APC are responsible for around 
80 % of EU budget spending from the beginning of their mandate until July 2017 
and for around 60 % of EU budget spending from August 2017 until the end of 
the mandate. In addition, the APC Charter sets out rules to further ensure that 
the independence of the individual APC members is not compromised by oblig-
ing the member to declare an interest and to refrain from commenting in cases 
where APC examines an audit report that concerns his/her services.

Observations 

Audit committees

8
x
o
B

26

GOOD 
GOVERNANCE
GUIDELINES

BEST PRACTICE

‘It is good practice for public sector governing bodies to establish an audit committee or equivalent group or 
function. The audit committee provides another source of assurance on an entity’s arrangements for manag-
ing risks, maintaining an effective control environment, and reporting on financial and non-financial perfor-
mance. The committee’s effectiveness depends on it being independent of the executive. It can have a signifi-
cant role in:

 ο helping to improve the adequacy and effectiveness of risk management and internal control;

 ο promoting the principles of good governance and their application to decision-making;

 ο overseeing internal audit and supporting the quality of its activity, particularly by underpinning organisa-

tional independence;

 ο reinforcing the objectivity and importance of external audits and, therefore, the effectiveness of the 

audit function;

 ο raising awareness of the need for sound risk management and internal control and the implementation 

of recommendations by internal and external audit; and

 ο helping the entity to embed the values of ethical governance, including effective arrangements for coun-

tering fraud and corruption.

To enhance the effectiveness of an audit committee, the majority of its members should be independent 
members of the governing body. It is also important that a public sector entity’s annual report contains ap-
propriate information about the mandate, operations, activities, and outcomes of the audit committee.’ 46.

46  CIPFA,IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, pp. 29-30.

 
Observations 

27

29 
APC responsibilities include monitoring the quality of internal audit work and en-
suring that audit recommendations are properly taken into account and followed 
up by Commission DGs and departments47. Each meeting of the APC is preceded 
by meetings of a Preparatory Group (PG) composed of the two external members 
of the APC and members of cabinets of commissioners sitting in the APC (see Ta-
ble 1). A standing invitation to attend the meeting is given to the IAS, DG DIGIT, 
DG BUDG and the SG at director level.

47  C(2015) 3014 final ‘Charter of 

the Audit Progress Committee 
of the European Commission - 
C(2015) 3014’.

1 Number of meetings of the Audit Progress Committee and 
e
l
b
a
T

its Preparatory Group in 2011-2016

Year

APC Meetings

PG Meetings

2011

2012

2013

2014

2015

4 (including 1 in written procedure)

4 (including 1 in written procedure)

4 (including 1 in written procedure)

3 (including 2 in written procedures)

2 (including 1 in written procedure)

2016 to date (24 May)

3

Source: ECA based on Commission documents.

12

9

9

6

6

4

Overview by the Audit Progress Committee is in practice 
limited to the work of the Internal Audit Service

30 
Table 2 shows that the APC is focused on internal audit reports. Members of 
the APC plan to cover issues stemming from the external auditor’s (ECA) Annual 
Reports and Special Reports in the future. The APC does not examine the find-
ings of audit directorates and ex post verification units in the spending DGs (see 
paragraph 26).

 
Observations 

28

2 Role/composition of Audit Progress Committee and selected audit committees 
e
l
b
a
T

compared to best practices recommended by Good Governance in the Public Sector 
Framework

Best practices recom-
mended by Good Govern-
ance in the Public Sector 
Framework

Commission’s 
Audit Progress 
Committee2

Role of selected audit committees1

World Food Pro-
gramme 
Audit Committee

European Invest-
ment Bank 
Audit Committee

World Bank Group 
Audit Committee

United Nations In-
dependent Advisory 
Committee

Provide assurance on risk 
management arrangements

Provide assurance on internal 
control arrangements

Provide assurance on ar-
rangements for reporting on 
financial and non-financial 
performance.

Oversee internal audit

Reinforce effectiveness of 
external audit

Majority of independent 
members

x

x

x

√

x

x

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

√

x

√

1 

 Sources: World Food Programme: Terms of reference for the Audit Committee of the World Food Programme (November 2011), European In-
vestment Bank: Audit Committee Charter (June 2007), World Bank Group: World Bank Resolution Standing Committees (2009), Annex A Terms 
of Reference of the Audit Committee, United Nations: Terms of reference for the Independent Audit Advisory Committee and strengthening 
the Office of Internal Oversight Services (June 2007).

2  Source: ECA. The APC Charter also refers to external audit (see paragraph 30).

31 
As stated in the Commission communication on the APC Charter, ‘audit com-
mittees play an increasingly important role in delivering the transparency and 
accountability citizens and other stakeholders rightly demand of public bodies’48. 
The APC is currently the ‘audit committee’ of the Commission. We examined the 
APC against the criteria of best practice (Box 8), and international bodies selected 
as benchmarks (Table 2). Notably, all members of audit committees in these in-
ternational bodies are independent. In the case of Commission, seven out of nine 
members of the APC are internal.

48  C(2015) 3014 final ‘Charter of 

the Audit Progress Committee 
of the European Commission’, 
p. 2.

 
Observations 

29

Aligning internal controls and financial reporting with 
international standards

The Commission chose the COSO framework as the basis for 
its internal control standards …

9
x
o
B

Internal control

‘Internal control is a process, effected by an entity’s board of directors, management, and other person-
nel, designed to provide reasonable assurance of achieving objectives relating to operating, reporting and 
compliance’49.

49  Definition of COSO, Committee of Sponsoring Organisations of the Treadway Commission, 2013 COSO Internal Control – Integrated Framework. 

© Committee of Sponsoring Organisations of the Treadway Commission (COSO). All rights reserved. Used with permission.

32 
The Commission modified its internal control (see Box 9) arrangements as part 
of the Prodi reform (see Figure 1 and Box 3). The new arrangements represented 
a significant departure from the previous system based on the centralised 
approval (visa) of the financial controller. The Commission based the control ar-
rangements on the COSO 1992 framework (see Box 10) and introduced the COSO 
definition of internal control into the Financial Regulation50.

50  Article 32.2 of Regulation (EU, 

Euratom) No 966/2012.

33 
In 2001 the Commission introduced 24 control standards complemented by a set 
of baseline requirements defining the specific practical actions which should 
underlie each department’s internal control system. It required DGs to assess 
and report on their level of compliance with the baseline requirements each 
year. These reports rely on internal reviews, management self-assessments and 
relevant audits performed by the IAS and the ECA. We reported on progress in 
implementing these standards in our annual reports from 2002 to 2008.

 
Observations 

30

34 
The Commission revised its internal control framework in 2007, reducing the 
number of standards to 16. It asked DGs to report on an exception basis (only 
when they did not apply a standard). In 2014 it further reduced the number of 
requirements. In 2014 DGs assessed their own progress and reported that, across 
the Commission, they had implemented 98 % of the internal control standards51. 
In 2016 the Commission intends to update its internal control framework to bring 
it in line with COSO 201352.

51  Overview of the state of 
internal control in the 
Commission services in 2014, 
ARES (2015) 1930721 — 
07/05/2015, p. 21.

52  2015 Annual Management and 
Performance Report for the EU 
Budget.

COSO framework

0
1
x
o
B

GOOD 
GOVERNANCE
GUIDELINES

BEST PRACTICE

Source: 2013 COSO Internal Control – Integrated Framework.  
© Committee of Sponsoring Organisations of the Treadway Commission (COSO). All rights reserved. Used with permission.

©2013, Committee of Sponsoring Organizations of the 
Treadway Commission (COSO). Used by permission.

COSO is a framework released in 1992 in the United States, that was originally aimed at private companies. 
It is now widely applied by both private and public sectors worldwide. COSO issued an updated framework 
in May 2013. COSO considered the 1992 framework to be superseded by the 2013 revisions after a transition 
period that ended in December 2014.

The 2013 framework introduced 17 principles that are all necessary for effective internal control. Management 
may determine that a principle is not relevant, based on its circumstances. If a principle is relevant, yet not 
present and functioning, a major deficiency exists in the system of internal control.

The new COSO requirements have a greater focus on governance concepts, including the need to establish 
oversight responsibilities for the board and its committees for each component of internal control (we map 
the requirements of COSO 2013 against the requirements of GGPS in Annex I).

 
Observations 

31

… but completing transition to the updated COSO framework 
is challenging

35 
In Annex I we present the requirements of COSO 2013 and GGPS. The internal 
control standards of the Commission cover most of the principles of COSO 2013. 
However, completing transition to the new COSO framework is challenging 
because it makes demands of organisations at the level of governance structures, 
highlighting the responsibility of governing bodies to oversee the performance 
of all components of the internal control system (see Box 11 COSO principle 2), 
and requires all elements of control to be in place and working before an organi-
sation meets COSO standards (see Annex I). In paragraphs 36 to 39 we discuss 
three challenging elements of the COSO framework.

1
1
x
o
B

Challenging elements of the new COSO framework

COSO Principle 2

‘The board of directors demonstrates independence from management and exercises oversight of the devel-
opment and performance of internal control’.

COSO Principle 5

‘The organisation holds individuals accountable for their internal control responsibilities in the pursuit of 
objectives’.

COSO Principle 8

‘The organisation considers the potential for fraud in assessing risks to the achievement of objectives’53.

53  Source: 2013 COSO Internal Control – Integrated Framework. © Committee of Sponsoring Organisations of the Treadway Commission (COSO). All 

rights reserved. Used with permission.

 
32

54  A similar issue was raised by 
the IAS in the Working paper 
supporting the 2015 Overall 
Opinion: ‘an overview at the 
level of the institution is 
necessary if common 
processes, such as fraud 
prevention and detection, are 
to be effective in protecting 
the institution as a whole. The 
IAS recommends that at the 
corporate level central 
measures should be taken to 
ensure a consistent, reliable, 
complete and comprehensive 
approach at the operational 
level and an overall view on 
the Commission-wide issues 
and on the cost-effectiveness 
of the measures taken. The 
central services should 
strengthen their guidance to 
the DGs/Services to improve 
the effectiveness of controls at 
the operational, DG/Service 
level. All the 
recommendations are being 
addressed under action plans’.

55  The document was 

discontinued in 2015.

56  The IAS issues a ‘limited 

conclusion on internal control’ 
in support of the AAR rather 
than an ‘annual opinion’.

57  COM(2000)358 final of 

28 June 2000 ‘Protection of 
the Communities’ financial 
interests. The fight against 
fraud For an overall strategic 
approach’.

58  COM(2011) 376 final of 

24 June 2011 ‘Commission 
Anti-Fraud Strategy’. This built 
upon the Communication on 
fraud prevention (COM(2007) 
806 final).

Observations 

36 
Bringing the Commission’s control framework into line with COSO 2013 (COSO 
Principle 2) would require a central level function to provide oversight of the 
internal control system. The Commission told us that the reason for not having 
such a function is to maintain a clear definition of responsibilities and account-
ability at the level of DGs. The Commission considers that the current structure 
places responsibility for the operation of the internal control system exclusively 
on individual authorising officers by delegation and that a central oversight 
function may lead to a transfer of responsibility54. While the CFS issued an annual 
document on the ‘Overview on the state of Internal Control in the Commission’ 
until 201455, this was not an independent source of assurance, but a descriptive 
summary.

37 
The Commission abolished the financial controller function in order to make the 
directors-general responsible for the legality and regularity of spending by their 
DGs. DGs report annually on their management via the AAR (see paragraph 55). 
But mechanisms to hold individuals to account for their contribution to internal 
control (COSO Principle 5) are relatively undeveloped. The Commission has not 
put in place staff evaluation criteria linked to this objective. The AAR provides 
a potential mechanism to achieve such a linkage for directors-general. However, 
in practice the Commission has not established a basis to determine whether the 
declarations made within AARs are well-founded56, or established a benchmark 
against which to hold DGs accountable.

38 
In 2001, following the adoption of the first overall anti-fraud strategy57 (COSO 
Principle 8) and in the wake of the White Paper on administrative reform the 
Commission announced that a unit within OLAF would ‘develop an overall stra-
tegic approach to fraud prevention. This should target new draft legislation with 
significant financial implications in areas at risk of fraud’. In 2011 the Commission 
developed a new anti-fraud strategy58 covering the whole ‘anti-fraud cycle’ from 
the prevention and detection of fraud to investigations, sanctioning and recovery 
of misused funds and also clarifying the responsibilities of the various parties 
involved.

39 
The Commission’s risk management guidelines take the risk of fraud into account 
and DGs are required to report annually on fraud prevention and detection in 
a specific section of their AARs. The Commission’s current internal control stand-
ards do not, as required by COSO principle 8 (see Annex I), address fraud risk di-
rectly. The Commission told us that they will cover this point in the next revision 
of the internal control standards.

Observations 

33

Producing annual accounts in line with international 
standards improved financial reporting

2
1
x
o
B

IPSAS

The International Public Sector Accounting Standards (IPSAS) issued by the International Public Sector Ac-
counting Standards Board (IPSASB), ‘provide the most complete suite of accrual-based international financial 
reporting standards developed specifically for the public sector’59.

59  CIPFA/,IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, p. 31.

40 
As can be seen in Figure 5, accrual accounting was introduced in two stages. The 
Commission first moved towards accruals, with some changes to financial report-
ing in 2001. A much bigger change took place in 2005 (see paragraph 8) when the 
Commission moved to base its financial reporting on international standards. The 
impact of these changes was that the pre-2000 presentation of a partial balance 
sheet was replaced with a complete presentation of assets and liabilities.

41 
The Commission’s new accounting framework first applied in 2005, and we were 
able for the first time to issue an unqualified opinion on the reliability of the 2007 
annual accounts. This marked the successful culmination of the Commission’s 
accounting modernisation project. In producing financial statements on an ac-
crual basis and in line with international standards (Box 12), the Commission has 
improved transparency and achieved a good standard of financial reporting.

 
Observations 

34

5 European Union — presentation of assets and liabilities 1997-2015
e
r
u
g
i
F

full accrual accounting

Billion euro
175

125

75

25

- 25

- 75

- 125

- 175

- 225

1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015

Total assets
Total liabilities
Net assets

Total assets full accrual
Total liabilities full accrual

Source: ECA (based on a visual presentation from French Cour des comptes in ‘La comptabilité générale de l’État, dix ans après’, February 2016).

Providing non-financial information to internal and 
external stakeholders

The Commission provides non-financial information 
alongside the accounts …

42 
While the reform resulted in much better annual accounts, the EU provided no 
accompanying management analysis or narrative until 2014 when it voluntarily 
accompanied the consolidated annual accounts for 2014 with a Financial State-
ment Discussion and Analysis (FSD&A). This provided some background and 
analytical material for users60. However the discussion of EU objectives focused 
on those announced for the Commission by its President61, rather than agreed 
EU 2020 strategy62. The only discussion of governance issues in the FSD&A was 
a brief (and Commission-centred) listing of the roles of the key institutions63.

60  Some of the information that 
similar organisations provide 
alongside the accounts in an 
annual report has been made 
available in the synthesis 
report (see paragraph 57 and 
Figure 8).

61  COM(2015) 377 final, p. 6.

62  COM(2010) 2020 final of 

3 March 2010 ‘Europe 2020, 
a strategy for smart, 
sustainable and inclusive 
growth’.

63  Council is described as the 

forum in which ‘Governments 
defend their country’s national 
interests’, while the ‘interests 
of the EU as a whole are 
promoted by the European 
Commission’. COM (2015) 377 
final p. 7.

 
Observations 

43 
A key statement of best practice is provided in Box 13. We compared the con-
tents of a number of frameworks64 and evaluation criteria and found that several 
elements of best practice were common to many frameworks (see Annex II). 
All the benchmarks we used included an annual report on governance (as does 
GGPS), discussion of risks, as well as financial and non-financial performance. All 
but one require a narrative report covering objectives and strategies as well as 
social and staff issues. Three require a description of business model.

35

64  Directive 2014/95/EU of the 
European Parliament and of 
the Council of 22 October 2014 
amending Directive 2013/34/
EU as regards disclosure of 
non-financial and diversity 
information by certain large 
undertakings and groups  
(OJ L 330, 15.11.2014, p. 1), the 
International Integrated 
Reporting Council (IIRC), the 
‘Building Public Trust Awards’ 
award criteria, IPSASB 
Recommended Practice 
Guidelines and OECD 
guidelines.

GOOD 
GOVERNANCE
GUIDELINES

BEST PRACTICE

3 Principles of annual reporting
1
x
o
B

GGPS: ‘Public sector entities should demonstrate that they have delivered their stated commitments, require-
ments, and priorities and have used public resources effectively in doing so. To that end, they need to report 
publicly at least annually in a timely manner, so that stakeholders can understand and make judgements on 
issues such as how the entity is performing, whether it is delivering value for money, and the soundness of its 
stewardship of resources. It is also important that the process for gathering information and compiling the an-
nual report ensures that the governing body and senior management own the results shown.

Governing bodies should assess the extent to which they are applying the principles of good governance, as 
set out in this Framework, and report publicly on this assessment, including an action plan for improvement.

The performance information and accompanying financial statements that public sector entities publish 
should be prepared on a consistent and timely basis. The statements should allow for comparison with other, 
similar entities and be prepared using internationally accepted high quality standards.’ 65

Commission recommendation for listed companies: governance information should be sufficiently clear, 
accurate and comprehensive to enable shareholders, investors and other stakeholders to gain a good under-
standing of the manner in which the company is governed. Also companies should routinely make this infor-
mation available on their websites and include a reference to the website in their management report.66

65  CIPFA/,IFAC, ‘International Framework: Good Governance in the Public Sector’, 2014, p. 31.

66  Commission Recommendation of 9 April 2014 on the quality of corporate governance reporting (‘comply or explain’) (OJ L 109, 12.4.2014, p. 43).

 
36

67  We contacted supreme audit 
institutions (SAIs) in the 28 
Member States, to gain an 
insight into the way accounts 
are prepared, the provision of 
non-financial information, and 
the responsibility for signing 
accounts.

Observations 

44 
Among the EU Member States67:

 ο

 ο

 ο

 ο

21 out of 28 Member States require public bodies to publish a statement of 
internal control and/or a governance statement;

18 Member States issue their financial statements within 6 months of year 
end (of which nine prepare accounts on an accrual basis);

in 12 Member States financial statements covering the central government 
apparatus are signed by the Minister of Finance;

12 Member States prepare accounts on an accrual basis, with four others 
moving towards an accrual-based (generally under IPSAS) presentation;

 ο

seven Member States require publication of an audit committee report.

… but less than many other organisations do

45 
Comparing the audited EU annual accounts (including the FSD&A) with guidance 
and with practice elsewhere (see Figure 6 and paragraphs 43 to 44) we find:

 ο preparation of accounts on an accruals basis: as described in paragraph 40 
the Commission has prepared the EU accounts on an IPSAS-compliant, accru-
als basis since 2005.

 ο

summary of key figures: the FSD&A provides an overview of key figures 
from the economic outturn account and balance sheet, pre-financing and 
financial instruments.

 ο opinion of the independent auditor: the accounts (as published in the 

Official Journal) are accompanied by an opinion of the independent auditor. 
(Other documents that appear to have some of the characteristics of annual 
accountability information (such as the SR and the Financial Report) are not 
accompanied by an independent audit opinion).

 ο

comparison between budgetary and financial results: the Commission 
includes in the annual accounts a full comparison of the budgetary and finan-
cial results.

37

68  Listed companies in the EU are 
required by EU directive to 
include a corporate 
governance statement in their 
management report.

69  Annual Report to the 

discharge authority on 
internal audits carried out in 
2006, COM(2007) 280 final, p. 
12, Conclusion No 5.

70  Documents referred to by the 
Commission in its reply are 
only made available after 
completion of the audit of 
annual accounts.

Observations 

 ο

analysis of governance structures and issues: the Commission does not 
produce an annual statement on governance or on internal control, in line 
with best practice and the common practice of Member States (see para-
graph 44)68. Such a document was produced in 2007, in response to a recom-
mendation of the Internal Auditor69, but we found no evidence that it has 
been approved by the Commission. We have been informed that the Com-
mission is currently updating its 2007 governance statement and that it will 
be submitted to the College of Commissioners. Since 2014 the Commission 
has included an overview of institutional roles, of responsibilities of financial 
actors within the Commission and of the discharge procedure in the FSD&A.

 ο president’s/senior official’s foreword (or report): the EU accounts are not 
accompanied by an explanatory foreword from the President (or other mem-
ber of the Commission). The Commission’s governing body does not endorse 
its ownership of the annual accounts by producing a foreword or a narrative 
report from the President or the Budget Commissioner. The separately pub-
lished Financial Report (see Figure 7) is, however, preceded by a foreword 
from the Vice President for the budget.

 ο discussion of the risk of irregular transactions or activities: there is 

limited reference to the risk of irregular transactions in the EU accounts and 
accompanying information. In 2015 the Commission introduced a separate 
section in the FSD&A on risks and uncertainties, and measures taken for 
‘bearing or mitigating’ them in accordance with IPSASB RPG2 (see also para-
graph 42). This addresses financial risks only: operational and strategic risks 
are not covered.

 ο

estimation of the level of irregularity: the Commission provides a quan-
tification of the risk of irregular transactions in the Synthesis Report (now 
included in the AMPR), but not alongside the audited annual accounts.

 ο

informative report on activities during the year:

- 

- 

- 

the EU accounts provide information on financial performance, but not 
on non-financial performance70;

there is no description of the EU business model (see Annex II), nor is 
there a report on key activities;

the FSD&A focuses on the new Commission’s plan rather than the EU 
objectives and strategy under the EU2020 strategy.

 ο

the long-term projection sustainability report: the Commission does not 
accompany the accounts with any projection of long-term/mid-term sustain-
ability of the EU finances.

 ο description of the role and conclusions of the Audit Committee: the 

annual accounts are not accompanied by any text summarising the role and 
conclusions of the APC.

Observations 

38

(see Annex III)

6 Overview of annual reports and accounts of selected public sector bodies  
e
r
u
g
i
F

EU 2014 annual accounts

European
Investment Bank
2015 Financial 
Report

8

***
7

10 6

11
10

9
8
7
6

5**
4
3
2

1

1

1

1

2

1

2

3

2

4

4

11 9

5

3

2

3

5

6

9

11

4

10

***
7

8

European
Investment Fund
2015 Annual Report

Comptes de l’État
2014
(France)

8

7

3 6

11*

10

9

5

4

5

6

7

8

9

10

11

US 2015 Financial Report

1 Accrual accounting.

2

3
4

5
6
7

8
9

10
11

Summary of key figures.

Accompanied by the opinion of the independent auditor.

Comparison between budgetary and financial result.

Analysis of governance structures and issues.

Chairman’s/ President’s/Senior official’s foreword (or report).

Discussion of the risk of irregular transactions or activities.

Estimated level of irregularity.

Informative report on activities in the year.

Long-term projection/sustainability report.

Description of the role and conclusions of an audit committee.

Source: ECA.

Elements included:

Yes

No

Published separately

(*)      Summarised
(**)     Summarised (see paragraph 45)
(***)     Not applicable

 
39

71  E.g. Communication from the 
President to the Commission: 
The Working Methods of the 
European Commission 
2014-2019. C(2014) 9004.

72  Annual management and 

performance report; Financial 
report; Communication on the 
protection of the EU 
budget; Annual accounts.

Observations 

46 
The EU annual accounts do not provide an overall view of the Commission’s 
governance, performance and strategy against the risks to achieving its goals. 
Key information is dispersed between corporate and DG-level documents pre-
sented separately throughout the year (often too late for consideration alongside 
the audit of annual accounts). Some of the elements not included in the annual 
accounts (paragraph 45) are present in other reports (Figure 7). The Financial 
Report is preceded by a foreword from the Budget Commissioner where it pre-
sents information on activities during the year. Operational and strategic risks are 
discussed to some extent in planning documents (DGs’ strategic and manage-
ment plans). The risk of irregular transactions is described in the Management 
and Performance Report. A document on the working methods of the European 
Commission approved shortly after the current Commission took office covers 
some elements of the Commission’s governance arrangements71. However, the 
College of Commissioners does not produce an annual statement where it takes 
responsibility for the internal control and risk management in the Commission.

47 
On 19 July 2016, 4 weeks after we sent the draft of this report to the Commission 
and one week after the closure of our audit of the annual accounts, the Commis-
sion issued an ‘Integrated Financial Reporting Package’ comprising four reports72. 
Two of these have previously been published later in the year. While we welcome 
this move to provide a fuller explanation of activities and finances of the EU at 
an earlier date, this set of reports was not, with the exception of the annual ac-
counts, subject to audit. It represents a further step, following the introduction of 
the FSD&A in 2014, in the direction of producing a single accountability report (or 
suite of reports) subject to external assurance.

Since 2013 the Commission has reported a material level of 
error in its spending

48 
Where there is a high risk of irregularity it is best practice both to discuss the risk 
and to quantify the level and likely impact. As we discuss above, the Commission 
has many staff working in the field of audit and control, and EU legislation also 
requires extensive checks on spending by bodies managing EU funds. Com-
mission reporting on this subject pays very significant attention to ‘corrective 
capacity’ (the possibility to disallow spending claims after initial acceptance by 
the Commission) rather than to quantifying and analysing the nature of the er-
rors it identifies. The key document on this (‘Protection of the EU budget’ — see 
Figure 7) provides no estimate of the level of irregularity present in initial or in 
approved claims for reimbursement.

Observations 

40

7
e
r
u
g
i
F

Overview of key Commission periodic reports (timing is that applicable in 2015 and 
earlier years — see paragraph 47)

Approved by 
internal 
procedure

or by VP / 
Empowerment 
procedure

or by the College
of Commissioners

Year ‘n+1’

1

3
3

9

5

6

7

Subject to
the discharge
procedure

2

4

8

10

Date of publication

Reports related to the ﬁnancial year  ‘n’

1

2

3

4

5

6

7

8

9

31 March ‘n+1’:

Report on Budgetary and Financial Management Financial Year ‘n’. 
Report pursuant to Art 142 of the Financial Regulation.

June ‘n+1’:

June ‘n+1’:

July ‘n+1’:

31 July ‘n+1’:

31 July ‘n+1’:

31 July ‘n+1’:

Report from the Commission to the European Parliament, the Council 
and the Court of Auditors. Synthesis Report1.

Financial Transparency System (FTS) ‘n’.

Report from the Commission to the European Parliament and the Council. 
Protection of the European Union’s ﬁnancial interests — Fight against 
fraud ‘n’ Annual Report.

Communication from the Commission to the European Parliament, the 
Council and the Court of Auditors. Protection of the EU Budget to end ‘n’.

Communication from the Commission to the European Parliament, the 
Council and the Court of Auditors. Annual Accounts of the European 
Commission ‘n’.

Communication from the Commission to the European Parliament, the 
Council and the Court of Auditors. Consolidated Annual Accounts of the 
European Union ‘n’.

September ‘n+1’:

Report from the Commission to the European Parliament and the Council. 
Annual report to the Discharge Authority on internal audits carried out 
in ‘n’ (Article 99(5) of the Financial Regulation).

30 September ‘n+1’:

EU budget ‘n’ Financial report. Publications Office of the European Union.

10

Oct./Nov. ‘n+1’:

Report from the Commission to the European Parliament and the Council 
on ﬁnancial instruments supported by the general budget according to 
Art.140.8 of the Financial Regulation as at 31 December ‘n’.

Subject to 
external 
audit

1 

 In 2016 the Commission merged the Synthesis of the Commission’s management achievements and the evaluation of the Union’s finances 
based on the results achieved into a single document approved by the Commission, and forwarded to the Court, on 5 July.

Source: ECA.

 
Observations 

49 
In 2013 the Commission recognised for the first time in the SR that EU spending is 
affected by a material level of error (see Table 3). The Commission’s methodology 
for estimating its level of error has developed over the years, in part responding 
to pressure from Parliament (Box 14).

41

PRESSURE
FROM
PARLIAMENT

4
1
x
o
B

Pressure from Parliament: disclosure of amount at risk

In the 2013 discharge resolution the Parliament asked the Commission ‘to further clarify the calculation of the 
amount at risk in explaining the estimated impact of corrective mechanisms on this figure’73.

73  P8_TA-(2015)0118, paragraph 27.

50 
There are no mechanisms for overseeing the work of audit directorates in this 
respect, other than the IAS limited reviews (see paragraph 26) carried out for 
11 DGs and executive agencies since 2013. The Commission needs good quality 
information to be able to provide reliable estimates of the level of error. We have 
reported in the past on actions to be taken to improve reliability of the Commis-
sion figures74.

51 
We consider good practice the approach of DG DEVCO75 which is different from 
usual arrangements and uses a model that has some similarities76 with the US 
model for estimating the level of error in spending (Iperia) (Box 15 and Table 3).

74  See paragraph 1.20 of 2010 
annual report (OJ C 326, 
10.11.2011), paragraphs 1.22, 
1.23 and 1.25 of 2011 annual 
report (OJ C 344, 12.11.2012), 
paragraphs 1.41-1.42 and 
1.44-1.45 of 2012 annual report 
(OJ C 331, 14.11.2013), 
paragraphs 1.29-1.30 and 
1.32 of 2013 annual report (OJ 
C 398, 12.11.2014), paragraphs 
1.50, 1.53-1.54, and 
1.65 of 2014 annual report. (OJ 
C 373, 10.11.2015), paragraphs 
1.35 and 1.48 of 2015 annual 
report, paragraphs 61-63, 
69-70, 81-88 and 113-114 of 
‘Agriculture and cohesion: 
overview of EU spending 
2007-2013’, (http://www.eca.
europa.eu/Lists/
ECADocuments/PL14_AR13/
PL14_AR13_EN.pdf).

75  See also the section on the 

‘2015 residual error rate (RER) 
study’ in the annual report on 
the activities funded by the 
8th, 9th, 10th and 11th 
European Development Funds 
(EDFs).

76  The calculation is based on 
a statistically valid method.

 
Observations 

42

PRESSURE
FROM
PARLIAMENT

5 Iperia
1
x
o
B

In the USA an Act of Congress requires all government agencies to carry out sufficient testing of their own 
payments to calculate a statistically valid estimate of the annual amount of improper payments in those 
programmes where risk analysis suggests that such payments are likely to exceed 1.5 % of the total sum paid. 
Agencies are required to publish the result both as an extrapolated total and as a percentage of payments 
made. The auditors of government agencies are required to report on whether the process of producing and 
publishing these figures is in compliance with the relevant Act of Congress77.

Improper payments are defined as:

 ο

incorrect amounts paid to eligible recipients;

 ο

payments made to ineligible recipients;

 ο

payments for goods or services not received;

 ο

duplicate payments; or

 ο

payments for which insufficient or no documentation was found.

77  Currently the Improper Payments Elimination and Recovery Improvement Act of 2012 (Iperia). Certain agencies first began reporting improper 

payments in 2003, as required by the Improper Payments Information Act of 2002 (IPIA).

 
Observations 

43

3 Differences and similarities between US and EU models for estimating the level of 
e
l
b
a
T

error in budgetary spending

Responsibility for calculating 
the estimated level of error

Managers of funds must provide a statistical estimate of levels 
of error

Coverage

Basis for error calculation

All payments from the budget are subject to sampling

Spending on programmes considered risky by managers of 
funds are sampled

Testing of a sample of operations selected with the use of 
statistical methods

Corrective actions (carried out by managers of funds) can 
reduce the estimated level of error

Presentation of the estimated 
level of error

Estimated error presented in cash terms

Estimated error presented as percentage

Management results

Average level of error for 2013-2015

Level of error for 2015

US government

√

x

√

√

x

√

√

4.0%

4.4%

European 
Commission

partially1

x

x

partially

√

√2

√2  
2013 and 2015

From 2.6 % to 3.1 %3

From 2.3 % to 3.1 %

1  The Commission, however, requires managers in Member States to prepare statistical estimates in some areas of spending. 
2  The Commission includes in its SR/AMPR a quantification of the ‘amount at risk’ which we consider as equivalent to the level of error. 
3 

 The Commission changed the way it calculated its estimate in 2015 AMPR as compared with previous years. The average is calculated on the 
published figures.

 
44

78  A framework for mitigation is 
provided by the Four Ts 
approach: Treat, Tolerate, 
Transfer, Terminate.

79  The agency may however 

coordinate this work with the 
work performed by other 
auditors. Executive Office of 
the President, Office of 
Management and Budget, 
Appendix C to circular 
No A-123 requirements for 
effective estimation and 
remediation of improper 
payments, 2014.

80 

IMPROPER PAYMENTS: Chief 
Financial Officers (CFO) Act 
agencies need to improve 
efforts to address compliance 
issues, GAO, June 2016.

Observations 

It is best practice to base the estimates of amounts at risk on 
a consistent methodology

52 
Ex post examination of spending can serve multiple purposes within an organisa-
tion. It can:

 ο

alert managers to patterns of behaviour;

 ο

bring to light particular risks linked to the legislation in place;

 ο

provide a basis for focusing action to mitigate risks78;

 ο

allow the governing body to assess the efforts of senior managers in tackling 
risks.

All these objectives require the organisation to produce estimates of error separately 
from estimates of corrective action. It is also important for the body to evaluate the 
impact of errors arising from different causes.

53 
In the US, the Executive Office of the President (Office of Management and 
Budget) provides federal agencies with instructions on how to make statisti-
cal estimates of the level of improper payments, in particular it does not allow 
federal agencies to rely on self-reporting by sub-agencies or the recipients of the 
payments as the sole source for improper payment estimates79, nor to net off the 
improper payments total by calculating the impact of recovery action. The audi-
tors of the government agencies (the inspectors general) are required to assess 
whether the agencies were compliant with Iperia. Agencies with programmes 
reported as non-compliant for three consecutive years are required to submit 
proposals to Congress to reauthorise the programmes or change the statutes that 
established them80.

Observations 

45

Reports introduced through the Prodi reform still form the 
basis for Commission internal reporting

54 
The reform introduced planning and monitoring tools in the Commission. Each 
DG prepared a management plan (MP) for the year to come, intended to translate 
policy objectives in the Commission’s work programme into concrete operational 
objectives. In 2016 the Commission adjusted these arrangements, replacing MPs 
with 5-year Strategic Plans (SPs) and Annual Management Plans (AMPs)81.

55 
The AAR is a management report (internal report) by the director-general to 
the members of the Commission82. The AAR covers management and internal 
control and the delivery of key objectives and activities identified in the MP. The 
AAR includes a declaration by the director-general or head of department on the 
financial information provided in the AAR.

81  The Strategic Plan is built 
around objectives to be 
achieved in support of the 
delivery of the Commission’s 
priorities during its whole 
mandate (i.e. 2016-2019 for 
this planning cycle) and 
provides the framework for 
the implementation details to 
be specified in the subsequent 
Annual Management Plan.

82  The Annual Activity Reports 
are made public after 
publication of the AMPR. 
While the SG, DG BUDG and 
IAS review AARs (the ‘peer 
review’) and the IAS carries out 
a small number of ‘limited 
review’ audits each year, the 
director-general has the final 
say on the content of the 
report.

56 
If the director-general is unable to make the declaration in full, he/she issues 
a ‘reservation’ (i.e. qualifies the assurance given).

57 
The Commission summarises and comments on the AARs in an annual report 
known until 2015 as the Synthesis Report (SR) (produced jointly by SG and DG 
BUDG). In spite of requests by the Parliament (see Box 16), the Commission does 
not provide explicit assurance through this document: as described above (Fig-
ure 4) it provides a statement that in approving the SR it takes ‘political responsi-
bility’ for the Commission’s actions. The varying titles of the SR and the different 
forms in which the Commission has expressed its duties are set out in Figure 8.

Observations 

46

PRESSURE
FROM
PARLIAMENT

6 Pressure from Parliament: providing assurance
1
x
o
B

The European Parliament has frequently pressed for a more explicit statement from the Commission.

2003: It called upon the Commission to convert the ‘Annual Synthesis Report into a consolidated assurance 
statement on the Commission’s management and financial controls as a whole’83.

2010: It called upon the Commission to ‘further improve its corporate governance and to inform the discharge 
authority of actions and measures taken by:

 ο incorporating those elements of corporate governance required or proposed by Union company law rel-

evant for Union institutions;

 ο taking measures allowing the President to sign the accounts, and to present together with the accounts:

- 

- 

a description of the risks and uncertainties which could affect the achievement of the policy objec-
tives as well as a statement in which the President, together with the college of commissioners, ac-
cepts responsibility for risk management; and

a formal Corporate Governance declaration clearly showing which international standards for cor-
porate governance the Commission is adhering to as well as objective and complete explanations 
if there is a need to depart from the corporate governance code’s recommendation (the ’comply or 
explain‘ principle)’84.

The Commission rejected the recommendation.

2013: The Parliament called for the Commission ‘to issue in its synthesis report a proper ‘statement of assur-
ance’ based on the Directors-General annual activity reports’85.

83  P6_TA(2005)0092, paragraph 62.

84  P7_TA(2012)0153, paragraph 35.

85  See footnote 74.

 
Observations 

47

8
e
r
u
g
i
F

From Synthesis Report to Annual Management and Performance Report

Reporting on performance

Reporting on management

None

‘Synthesis of 
Policy Achievements’

None

‘Article 318
Evaluation Report¹’

‘Synthesis of the AARs and declarations 
of the DG and Head of Service’

‘Synthesis of the AARs and
 DGs and Services’

No declaration
made by the
Commission

‘2004 Synthesis’ 

‘Synthesis of the Commission’s
management achivements
in [year] ’

‘By adopting this synthesis, the 
Commission assumes its political 
responsability for management by its 
Directors-General and Heads of service, 
on the basis of the assurances and 
reservations issued by them in their AARs’

‘By adopting this Synthesis Report,
on the basis of the assurances and 
reservations made by its 
Directors-General and Heads 
of service in their AARs, the Commission
 takes overall political responsibility for 
management of the EU Budget’

‘Declarations’
made by the
Commission

2001

2002

2003

2004

2005

2006

2010

2011

2014

2015

‘Annual Management and Performance Report’
 ‘On the basis of the assurances and reservations in the Annual Activity Reports, 
the College adopts this 2015 Annual Management and Performance Report 
for the EU Budget and takes overall political responsibility 
for the management of the EU budget’

1 

 Article 318 TFEU requires the Commission to submit to the European Parliament and the Council an evaluation report on the Union’s finances 
based on the results achieved, which is not covered by this report.

Source: ECA.

 
48

86  See paragraphs 23 to 24.

87  See paragraphs 27 to 29.

88  COSO, see paragraphs 32 to 

34.

89 

IPSAS, see paragraphs 40 to 41.

90 

Including the publication 
alongside the accrual-based 
EU accounts of the financial 
statement discussion and 
analysis, reporting on 
performance (resulting in 2015 
in an integration with 
reporting on management in 
the annual management and 
performance report) and the 
transition to the updated 2013 
COSO internal control – 
integrated framework.

91  See paragraph 17.

92 

‘[…] the anti-fraud risk 
assessments of DGs are not 
sufficiently coordinated with 
the annual risk management 
exercise, or are too high level 
to take the existing internal 
control structure into account. 
They do not address all 
elements of the fraud cycle, 
and do not cover all 
management modes. 
Furthermore, risks identified in 
the AFS are not prioritised and 
cannot be individually 
reconciled or identified with 
actions in the AFS action 
plan.’( IAS Working paper 
supporting the 2015 Overall 
Opinion, May 2016).

Conclusions and 
recommendations

58 
The Commission is a complex organisation responsible for an annual budget of 
more than 140 billion euros. It achieved a significant overhaul of its governance 
arrangements in the first decade of the millennium, such as creating the IAS86, 
setting up the APC87, applying international standards for internal control88 and 
accounting89. However best practice has continued to evolve. Although some 
action90 has been taken, we have identified areas in which the Commission’s gov-
ernance arrangements with focus on audit, financial management and control 
diverge from or do not meet in full best practice set out in standards or put in 
place by the international and public bodies we selected as benchmarks.

59 
The distinction made between the ‘political responsibility of commissioners’ and 
the operational responsibility of directors-general means that it has not always 
been made clear whether ‘political responsibility’ encompasses responsibility for 
the actions of the DGs or is distinct from it (see paragraphs 21 and 22). Recent 
organisational reforms are beginning to address some of the risks of a ‘silo’ cul-
ture91. But to continue to address key risks the Commission will need further to 
strengthen the governance structure across the institution.

60 
The IAS focuses its efforts on the internal control systems of the Commission. 
Operations outside the Commission — the spending for which the Commission 
is responsible — are the responsibility of the ex post verification units in spend-
ing directorates-general (see paragraphs 25 to 26). This has an impact on the 
information presented to the Commission’s audit committee — the APC. The role 
of the APC (and the participation of independent, external members) is more 
limited than that of audit committees at international bodies that we selected as 
benchmarks (see paragraphs 30 to 31).

61 
In the area of internal control, after implementing COSO 1992, the Commission 
is moving to the COSO 2013 framework. While the Commission has produced 
two communications on fraud and an anti-fraud strategy (AFS), this risk is not 
reflected in the current internal control framework (paragraph 39). This can have 
a negative impact on the effectiveness of the DGs fraud assessment exercise92 
exposing the Commission to potential fraud risk.

Conclusions and recommendations 

49

62 
Since 2005 the Commission has produced annual accounts in accordance with 
international standards. However, despite recent innovations, involving coopera-
tion with the Court, the Commission still publishes them later than the majority 
of the EU Member States (see paragraph 44 and Figure 7).

63 
The Commission has recently begun to accompany the accounts with non-finan-
cial information. However, despite improvements, it still provides less non-finan-
cial information alongside the accounts than the other organisations we consid-
ered. Information is dispersed among several corporate and DG-level documents 
(see paragraphs 45 to 47).

64 
Since 2013 the Commission has recognised that the EU spending is affected 
by a material level of error. Individual DGs’ estimations of the level of irregular 
spending are not based on a consistent methodology (see paragraphs 50 to 53).

65 
Best practice has continued to evolve since the Prodi reforms. Although some 
action has been taken, we conclude that the Commission diverges from, or does 
not meet in full best practice in the following areas:

 ο

coverage of high level governance issues by the IAS (paragraphs 25 to 26);

 ο

composition of the APC (paragraph 31); and

 ο

coverage by the APC of:

- 

- 

- 

- 

external audit results;

risk management;

financial and performance reporting; and

the work of the Commission’s audit directorates and ex post verification 
units (paragraphs 26, 30 to 31);

 ο

consider the risk of fraud in the internal control framework (paragraph 39);

 ο

timing of publication of financial statements (paragraph 44);

Conclusions and recommendations 

50

 ο

accompanying the financial statements with:

- 

- 

- 

- 

- 

- 

- 

a governance statement;

a President’s report;

a discussion of operational and strategic risks;

a report on non-financial performance;

information on activities during the year and the achievement of policy 
objectives;

a report on the role and conclusions of the Audit Committee; and

a mid- and long-term fiscal sustainability statement (Figure 7 and para-
graph 45).

 ο

consistency of calculation of the level of irregular spending and analysis of 
results across all DGs (paragraph 53).

66 
The Commission should either comply with best practice, or explain why it con-
siders it inappropriate to do so (see footnote 19):

Recommendation 1 — Explain where it does not comply with 
best practice

The Commission should, as required of European public interest entities, when it 
decides not to follow best practice, explain its reasons for not doing so.

Target implementation date: April 2017.

Conclusions and recommendations 

51

Recommendation 2 — Comply with best practice

The Commission should:

(a)  invite the IAS to carry out more audit work on high level governance issues;

(b)  complete the process of aligning its internal control framework with the 

COSO 2013 principles;

(c)  further bring forward the publication of the annual accounts;

(d)  bring together information already presented in a variety of existing reports 
to form a single accountability report or suite of reports, containing the 
accounts but also incorporating:

 ο

a governance statement;

 ο

a President’s report;

 ο

a discussion of operational and strategic risks;

 ο

a report on non-financial performance;

 ο

information on activities during the year and the achievement of policy 
objectives;

 ο

a report on the role and conclusions of the Audit Committee; and

 ο

a mid- and long-term fiscal sustainability statement, together with, 
where appropriate, links to information contained in other reports;

(e)  present this single accountability report or suite of reports for audit of the 
accounts and checks by the auditor that other information presented within 
it is consistent with accounting information;

(f)  publish as part of the annual accounts or accompanying information an esti-

mate of the level of error based on a consistent methodology;

(g)  update and publish its governance arrangements on a regular basis and 

explain its choice of structures and processes in relation to the framework it 
chooses;

(h)  turn the APC into an audit committee with a majority of independent, exter-
nal members and expand its mandate to cover risk management, financial 
reporting and the work and results of ex post verification units and audit 
directorates.

Target implementation date: April 2018.

Conclusions and recommendations 

52

This report was adopted by Chamber V, headed by Mr Lazaros S. LAZAROU, 
Member of the Court of Auditors, in Luxembourg at its meeting of 
20 September 2016.

For the Court of Auditors

Vítor Manuel da SILVA CALDEIRA
President

 
 
 
Annexes

53

I
x
e
n
n
A

The GGPS Framework and COSO 2013

Principles of good 
governance in the public 
sector (GPPS) Framework 
(CIPFA/IFAC)

A.  Behaving with integrity, 
demonstrating strong 
commitment to ethical 
values, and respecting 
the rule of law.
(A-1)

B.  Ensuring openness and 

comprehensive stakeholder 
engagement.
(B-15)

C.  Defining outcomes in 
terms of sustainable 
economic, social, and
environmental benefits.
(C-6)

D.  Determining the 

interventions necessary to 
optimize the achievement 
of the intended outcomes.
(D-6)

E. Developing the entity’s 
capacity, including the 
capability of its leadership 
and the individuals within it.
(E-3 and 4)

F. Managing risks and 

performance through 
robust internal control 
and strong public financial 
management.
(F-7, 9, 10, 11 and 12)

G.

Implementing good 
practices in transparency, 
reporting, and audit to 
deliver effective 
accountability.
(G-13, 14, 16 and 17)

Source: ECA.

COSO 2013 internal control principles

1.

The organization demonstrates a commitment to integrity and ethical values.

2.  The board of directors demonstrates independence from management and 
exercises oversight of the development and performance of internal control. 

3.  Management establishes, with board oversight, structures, reporting lines, 
and appropriate authorities and responsibilities in the pursuit of objectives.

4.

5.

The organization demonstrates a commitment to attract, develop, and retain 
competent individuals in alignment with objectives.

The organization holds individuals accountable for their internal control 
responsibilities in the pursuit of objectives.

6. The organization specifies objectives with sufficient clarity to enable the 

identification and assessment of risks relating to objectives.

7.  The organization identifies risks to the achievement of its objectives across 
the entity and analyzes risks as a basis for determining how the risks should 
be managed.

8. The organization considers the potential for fraud in assessing risks to the 

achievement of objectives.

9. The organization identifies and assesses changes that could significantly 

impact the system of internal control.

10. The organization selects and develops control activities that contribute to the 
mitigation of risks to the achievement of objectives to acceptable levels.

11.  The organization selects and develops general control activities over 

technology to support the achievement of objectives.

12.  The organization deploys control activities through policies that establish 

what is expected and procedures that put policies into action.

13. The organization obtains or generates and uses relevant, quality information 

to support the functioning of internal control.

14. The organization internally communicates information, including objectives 
and responsibilities for internal control, necessary to support the functioning 
of internal control.

15. The organization communicates with external parties regarding matters 

affecting the functioning of internal control.

16. The organization selects, develops, and performs ongoing and/or separate 
evaluations to ascertain whether the components of internal control are 
present and functioning.

17. The organization evaluates and communicates internal control deficiencies in 
a timely manner to those parties responsible for taking corrective action, 
including senior management and the board of directors, as appropriate.

 
Annexes 

54

I
I
x
e
n
n
A

Key elements of selected corporate reporting frameworks

Directive 2014/95/EU

IIRC

Building Trust Award 
(UK)

IPSASB Recommend-
ed Practice Guideline 
No 2

OECD Guidelines 
for Multinational 
Enterprises 
(III Disclosure)

Governance

Corporate governance

Governance

Narrative clearly dem-
onstrating governance 
structure and tone at 
the top.
Transparent infor-
mation about how 
the Board works ef-
fectively to govern the 
organisation.

Governance 

Governance structures 
and policies

Risks

Financial and 
non-financial 
performance

The principal risks re-
lated to those matters 
linked to the undertak-
ing's operations includ-
ing, where relevant 
and proportionate, its 
business relationships, 
products or ser-
vices which are likely to 
cause adverse impacts 
in those areas, and how 
the undertaking man-
ages those risks.

Requires information to 
be prepared in accord-
ance with a recognised 
framework (national, 
Union-based or inter-
national frameworks).
Publication with 
accounts or separately 
(within 6 months).
The non-financial 
statement include 
references to, and 
additional explanations 
of, amounts reported 
in the annual financial 
statements.
Non-financial KPIs rel-
evant to the particular 
business.

Risks and opportunities

Linkage between risks, 
strategic objectives and 
annual report narrative
Quantified risks.
Discussion of how the 
dynamic of the risk 
profile has evolved over 
time.

Risks and uncertainties: 
Risks and uncertain-
ties with financial 
impact, risk mitigation 
measures, internal and 
external risks

Information on 
systems for managing 
risks and complying 
with laws, and
on statements or codes 
of business conduct.
Foreseeable risk 
factors.

Outlook

An understandable 
and fair reflection of 
financial performance 
which is consistent with 
the underlying financial 
statements.
Discussion of actual 
performance against 
expected/budgeted 
performance.
Quantified KPIS aligned 
to strategic objectives. 
Balanced assessment 
of goals achieved and 
performance against 
target.

Information about the 
financial statements 
and variances and 
trends.
Comparison of budget 
and actual amounts 
in the financial 
statements

Financial and operat-
ing results of the 
company

Elements present in all frameworks

Elements present in 4 of 5 frameworks

Elements present in 3of 5 frameworks

 
Annexes 

I
I
x
e
n
n
A

55

Directive 2014/95/EU

IIRC

Building Trust Award 
(UK)

IPSASB Recommend-
ed Practice Guideline 
No 2

OECD Guidelines 
for Multinational 
Enterprises 
(III Disclosure)

Social and staff 
issues

Social and employee 
matters.
Respect for human 
rights.

The capitals: Financial, 
Manufactured, Intel-
lectual, Human, Social 
and relationship and 
Natural

Objectives and 
strategies

-

Strategy and resource 
allocation. Inputs

Business model

Brief description of the 
business model.
A description of the 
policies pursued by the 
undertaking, including 
due diligence processes 
implemented.
Outcomes of these 
policies.

Business model (busi-
ness activities that 
create value over the 
short, medium and 
long term).
Value creation process: 
stakeholder groups, key 
material matters, Risks, 
Strategic objectives, 
Value drivers, KPIs, 
Targets, Impact.

Discussion and 
quantitative analysis 
of people factors in the 
organisation.
Details of equal oppor-
tunities and diversity

Clear statement of 
purpose.
Balanced view of pro-
gress against objectives

Different delivery 
models.
Narrative around how 
business operations 
support wider parlia-
mentary objectives. 
Consideration of capital 
investment and how 
it achieves value for 
money.

-

Issues regarding 
employees and other 
stakeholders

Information about ob-
jectives and strategies.
Mission and vision

Company objectives

-

-

Elements present in all frameworks

Elements present in 4 of 5 frameworks

Elements present in 3of 5 frameworks

Source: ECA.

 
Annexes 

I Overview of annual reports and accounts of selected public sector bodies
I
I
x
e
n
n
A

EU 2014 
consolidated 
accounts1

European 
Investment Fund 
2015 Annual 
report

European 
Investment Bank 
2015 Financial 
report

US 2015 
Financial 
Report

Accrual accounting

Summary of key figures

Accompanied by the opinion of the inde-
pendent auditor

Comparison between budgetary and 
financial results

Yes

Yes

Yes

Yes

Analysis of governance structures and issues

Summarised2

Chairman’s/President’s/Senior official’s 
foreword (or report)

Discussion of the risk of irregular transac-
tions or activities

Estimation of the level of irregularity

Informative report on activities in the year

Long-term projection/sustainability report

Description of the role and conclusions of an 
audit committee

Source: ECA.

Published 
separately

Published 
separately

Published 
separately

Published 
separately

No

No

Yes

Yes

Yes

Published 
separately

Yes

Yes

No3

No

Yes

Yes

Yes

Yes

Published 
separately

Yes

Published 
separately

No3

No

Yes

Published 
separately

Published 
separately

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

56

Comptes de 
l’État 2014 
(France)

Yes

Yes

Published 
separately

Yes

Yes

Published 
separately

No

No

Yes

Yes

Summarised

See paragraphs 45 and 46.
See paragraph 45.

1 
2 
3  Not applicable. These reports do not include a discussion of the risk of irregular transactions or activities. However, we have indications that there 

are no material levels of irregularity.

 
Reply of the  
Commission

Executive summary

57

Common Commission reply to paragraphs I to IV
The Commission recognises the importance of a state-of-the-art framework for governance. The Commission strives 
to comply with evolving and relevant best practice set out in standards or put in place by international or public 
bodies and will continue to adapt its governance structure. 

The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and 
responsibilities, appointment and resignation of the Commission and its members, transparency) are enshrined in 
the EU treaties. 

The College delegates operational tasks to its departments. To ensure that each Commission department has put 
in place the organisational structure and the internal control systems best suited to ensure the achievement of its 
objectives, the Commission has defined minimum features at corporate level, which are based on the internation-
ally recognised COSO framework. In its 2015 Annual Management and Performance Report (AMPR), the Commission 
reported on the effective implementation of those standards. 

The governance arrangements applicable to the European Commission are tailored to the supranational nature of 
the institution or its particular structure with a College of Commissioners supported by a permanent administra-
tive corps. These features were the basis for the decisions taken in 2000 on the Commission’s governance struc-
ture. They also took into account the reports of the Committee of Independent Experts and the Court’s Opinions 
Nos 4/97 and 1/2000. The Commission control and audit arrangements are solid, comprehensive and are currently 
being enhanced to comply fully with COSO 2013 Internal Control principles. Furthermore, the IAS is fully compliant 
with the standards of the internal audit profession as evidenced by an external quality assessor. These arrange-
ments enable the Commission to exert a robust oversight over the functioning of the governance structure. 

See also Commission reply to VI.

V
The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and 
responsibilities) are enshrined in the EU treaties. The College adopts the Annual Management and Performance 
Report for the EU Budget and takes overall political responsibility for the management of the EU Budget. The Com-
mission considers that this encompasses accountability for the work of its services. 

In operational terms, the oversight takes place, first via the practical arrangements governing working relations 
between members of the Commission, cabinets and services, second via the APC on regular basis dealing with all 
the IAS recommendations and third, by a clear reporting from the Authorising Officers by Delegation (AODs) to the 
Commission through the Annual Activity Reports (AARs) and the Declarations of Assurance by the AODs, and the 
overall Opinion of the Internal Auditor. See also Commission replies to paragraphs 55 and 57.

Addressing ‘silo’ culture was a priority of the new Commission. It implemented a new structure with Vice-Presidents 
overlooking wider policy areas and enhancing the coordinating role of the Secretariat-General and other Central 
Services, and through various corporate steering groups including the Activity Based Management (ABM) Steering 
Group and the Group of Resource Directors. 

Reply of the Commission 

58

VI
In line with best practice, the Financial Regulation and its Charter, the IAS necessarily focuses on the management 
and control systems of the DGs who are responsible for ensuring legality and regularity of transactions, including 
auditing those DGs’ ex post verification/audit function. Besides the audit on the information security governance, 
other governance areas were also covered, for example:

ο  Objective setting process in the context of the management plan;

ο  Annual Activity Reporting process;

ο  Governance of the Anti-fraud Strategies. 

The APC is just one of the multiple means in place facilitating the College’s oversight of the Commission’s govern-
ance, risk management, and internal control practices. The primary channel is through the formal communica-
tion mechanisms stated in the working arrangement between Commissioners, their cabinets and the Commission 
services (regular meetings, discussion of Strategic Plans, Management Plans, Annual Activity Reports, etc.) through 
which the Commissioner first, and the College later are informed.

Risk management, financial reporting and the results of ex post verifications/audit function fall under the responsi-
bility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs.

VII
In line with the IPSASB Conceptual Framework for GPFRs,1 which foresees that GPFRs ‘are likely to comprise multiple 
reports’, each addressing more directly specific needs of different stakeholders, the Commission provides an Inte-
grated Financial Reporting Package. This consists of the Annual Management and Performance Report (AMPR), the 
Financial Report, the Communication on the Protection of the EU Budget, and the EU Annual Accounts. The infor-
mation presented in this package is at the same level as that provided by the benchmark entities selected by the 
Court. In addition, further information is available in documents such as the President’s State of the Union Speech, 
the Annual General Report on the Activities of the European Union, the Follow-up Report on the Discharge Recom-
mendations, etc. 

VIII First bullet
The Commission accepts this recommendation. The Commission strives to comply with evolving and relevant best 
practice set out in standards or put in place by international or public bodies (see reply to paragraphs I-IV, VIII, 
24-26, 44-49) and will continue to adapt its governance structure.

VIII Second bullet
The Commission accepts this recommendation in line with Article 116.2 of the Rules of application of the Financial 
Regulation (see also the Commission’s reply to recommendation 2.h). 

VIII Third bullet
The Commission accepts this recommendation. The Commission control arrangements (including the IAS) are solid, 
comprehensive and being enhanced to comply fully with COSO 2013 Internal Control principles. They enable the 
Commission to exert an adequate oversight over the functioning of the governance structure.

1  The ‘Conceptual Framework for General Purpose Financial Reporting by Public Entities’ (Conceptual Framework for GPFRs) adopted in October 

2014 by the International Public Accounting Standards Board (IPSASB).

Reply of the Commission 

59

VIII Fourth bullet
The Commission accepts this recommendation.

See reply to paragraph 62.

VIII Fifth bullet
The Commission accepts the recommendation to issue a suite of reports in a way that mitigates additional risks as 
regards availability and quality of information. See also reply to recommendation 2(e).

The Commission has already taken steps in this direction through the publication on 19 July 2016 of the Integrated 
Financial Reporting Package.

A single accountability report would not be adequate and is not in line with the Conceptual Framework for GPFR of 
IPSASB which states clearly that GPFRs, which have as objective to provide information useful for accountability and 
decision making purposes, ‘are likely to comprise multiple reports, each responding more directly to certain aspects 
of the objectives of financial reporting’. In line with the Conceptual Framework the Commission provides or will 
provide the following documents which cover the elements identified by the Court: 

VIII Fifth bullet — First indent
The Commission is currently working on an update of the Governance Statement.

VIII Fifth bullet — Second indent
In the context of the Commission, the State of the Union Address, which is presented in September, corresponds to 
the President’s report.

VIII Fifth bullet — Third indent
In addition to the information contained in AMPR, the Commission reports and communicates extensively on opera-
tional and strategic risks in the State of the Union Speech, and in strategic and management plans of each DG.

VIII Fifth bullet — Fourth indent
Non-financial performance information is available in the AARs and the AMPR.

VIII Fifth bullet — Fifth indent
The General Report on the Activities of the Union and the AMPR contain information on activities during the year 
and the achievements of the policy objectives.

VIII Fifth bullet — Sixth indent
The APC Annual Report summarises the conclusions of the APC in fulfilling its mission and highlights issues which 
the APC has brought to the attention of the College. The work of the APC was referred to in the Synthesis Reports 
and in the AMPR in 2015. There will be a specific section in the future AMPRs on the role and conclusions of the APC.

VIII Fifth bullet — Seventh indent
In particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or 
increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue 
sources) the EU Budget is not comparable to the budgets of states.

Reply of the Commission 

60

In the EU context, the MFF is the tool ensuring medium to long-term stability and predictability of future payment 
requirements and budgetary priorities. The Commission provides information on these aspects in the AMPR, the 
Financial Report, the Accounts and whenever necessary other reports.

VIII Sixth bullet
The Commission partially accepts this recommendation.

The information underlying the new Integrated Financial Reporting Package and complementary reports will be 
made available, as far as possible (i.e. subject in particular to the relevant deadlines for Member States for providing 
necessary data), to the Court in order to allow checks concerning consistency.

VIII Seventh bullet
The Commission accepts this recommendation. It will continue to report on the overall amount at risk in the AMPR.

VIII Eighth bullet
The Commission accepts this recommendation. It will update and publish its governance arrangements on a regular 
basis and explain how it complies with international standards and good practice.

VIII Ninth bullet
The Commission partially accepts this recommendation. The Commission will consider, in the context of the mid-
mandate renewal of the membership of the APC, the issue of an increase in the number of external members with 
proven professional expertise in audit and related matters and appointed by the Commission following an open 
and transparent procedure. Risk management, financial reporting and the results of ex post verifications/audit func-
tion fall under the responsibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs. Communication 
channels, including in particular the AARs, Management and Strategic Plans, etc., ensure that the AODs inform the 
respective Commissioners and the College, allowing the latter to exercise appropriate oversight. Furthermore, the 
IAS regularly audits the ex post verification/audit function across the relevant DGs, particularly in the key areas such 
as shared management, and its findings are considered by the APC. The Commission will consider inviting the IAS 
to undertake audit work on governance/oversight arrangements concerning risk management, financial reporting, 
and the ex post verification/audit function, in particular second level scrutiny, to identify any improvements which 
can further enhance the performance of these mechanisms.

Observations

15
A first unique feature of governance within the Commission is that the division of responsibilities and accountability 
lines are fixed in the Treaty (Art 317) and in the Financial Regulation (Art 66) and described in the 2000 White Paper 
which took into account the recommendations of the Committee of Independent Experts. 

A second feature of the Commission is that, whenever a new College takes office, aspects of the internal organisa-
tional, governance and accountability arrangements may be revised. This is done through the Commissioners’ mis-
sion letters, the Working Methods of the European Commission (See C(2014) 9004) and the written working arrange-
ments between the Commissioners and the services.

Reply of the Commission 

61

21
The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and 
responsibilities) are enshrined in the EU treaties. The College adopts the Annual Management and Performance 
Report for the EU Budget and takes overall political responsibility for the management of the EU Budget. The Com-
mission considers that this encompasses accountability for the work of its services. 

In operational terms, the oversight takes place, first via the practical arrangements governing working relations 
between members of the Commission, cabinets and services, second via the APC on regular basis dealing with all 
the IAS recommendations and third, by a clear reporting from the AODs to the Commission through the AARs and 
the Declarations of Assurance by the AODs, and the overall Opinion of the Internal Auditor. 

Box 5 — Commission’s responsibility 
The Commission has made further changes to its governance and reporting between 2007 and 2016.

23
The Commission abolished the IACs because with the passage of time, it has become increasingly important for the 
internal audit function to look beyond the boundaries of one DG. This is much more effectively done with a fully 
centralised internal audit function. Furthermore, the centralised IAS is fully independent, which helps ensure good 
quality audits. An external quality assessor, while giving a clean bill of health to the IAS, had pointed to a lack of suf-
ficient independent oversight of the IACs and a perceived risk to their independence. 

The IAS is now also providing the directors-general with a limited assurance report, to feed into the Annual Activity 
Reports (AARs), as IACs used to do (for the first time in February 2016 covering the year 2015). 

24
The staffing of the entities mentioned by the Court is not wholly devoted to audit or control activities. 

The ex post verifications/audit function in many large spending DGs (often referred to as ‘audit function’) are part of 
the internal control system of the Authorising Officer by Delegation. They should be clearly distinguished from the 
internal audit function.

25
Besides the audit on the information security governance, other governance areas were also covered, in particular, 
but not exclusively through audits covering a multitude of DGs, for example audits addressing the:

ο  objective setting process in the context of the management plan;

ο  annual activity reporting process;

ο  governance of the Anti-fraud Strategies;

ο  governance of the European Semester work;

ο  governance of the Common Support Centre hosted by RTD;

ο  governance of EU Trust Funds, 

ο 

supervision of decentralised agencies; 

ο  governance in the IT domain. 

Reply of the Commission 

62

Box 7 — Some significant IAS recommendations on governance have not been followed
The Commission is working on a revision of the Governance Statement.

26
The IAS shares the Court’s assessment that the risk of irregular and illegal expenditure is important. This is precisely 
why approximatively 40 to 50 % of the available time for its audits is spent on engagements assessing the manage-
ment and control systems aimed at preventing and detecting/correcting irregularities. 

This includes important audits on the DG control strategies (including ex post verification/audit function) covering 
the main policy expenditure areas. All of these audit reports are sent to and addressed by the APC.

In line with best practice, the Financial Regulation and its Charter, the IAS necessarily focuses on the management 
and control systems of the DGs which are responsible for ensuring legality and regularity of transactions.

The APC is just one of the multiple means in place facilitating the College’s oversight of the Commission’s govern-
ance, risk management, and internal control practices. The primary channel is through the formal communica-
tion mechanisms stated in the working arrangement between Commissioners, their cabinets and the Commission 
services (regular meetings, discussion of Strategic Plans, Management Plans, Annual Activity Reports, etc.) through 
which the Commissioner first, and the College later are informed.

30
The Commission confirms that the APC mandate of 2015 includes a strengthening of the follow-up of the ECA rec-
ommendations. The APC analyses the ECA’s reports and the relevant findings where appropriate in the context of its 
thematic discussions based on groups of IAS audit reports. 

The IAS carries out audits on the effectiveness of the ex post verification/audit functions in many large spending 
DGs. Thereby it covers this important element of the AODs’ internal control system aimed at preventing and detect-
ing/correcting irregularities (see reply to paragraph 26). The APC addresses these issues to the extent that they are 
covered by IAS audits.

Reply to table 2 
The APC receives and addresses all IAS audit reports, which cover the areas of risk management, internal control and 
reporting on financial and non-financial performance. It thus facilitates the Commission’s oversight by ensuring the 
independence of the IAS, monitoring the quality of its work and following up recommendations. Furthermore, it 
considers key documents regarding the internal control framework.

Reply of the Commission 

63

31
Risk management, financial reporting and the results of ex post verifications/audit function fall under the respon-
sibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs. Communication channels, including in 
particular the AARs, Management and Strategic Plans, etc., ensure that the AODs inform the respective Commission-
ers and the College, allowing the latter to exercise appropriate oversight. Furthermore, the IAS regularly audits the 
ex post verification/audit function across the relevant DGs, particularly in the key areas such as shared management, 
and its findings are considered by the APC.

Other international organisations (World Food Programme, European Investment bank, World Bank and UN) have 
different governance structures. 

35
The new revision of the Internal Control Framework the Commission is now conducting will address all the Court’s 
observations.

36
Taking into account the specificities of the Commission COSO Principle 2 has to be seen from a double perspec-
tive. At DG level each director-general conducts an independent oversight of the development and performance of 
internal control by means of the Internal Control Coordinator. At Commission level the College — i.e. equivalent to 
the Board of Directors referred to in COSO Principle 2 — exercises an independent oversight of the developments 
and performance of internal control (see reply to paragraph 21).

The Central Financial Service was created to provide support and advice on financial management, interpretation 
of legislation, internal control and risk management but not to oversee the actual implementation of the internal 
control system. 

37
The current framework, as decided in the Commission reform and stipulated by the financial regulation, provides 
a sound definition of responsibilities and accountability. The DGs are required to set up the organisational structure 
and the internal control systems including sub-delegation acts and the related cascading reporting system which 
build up the assurance inside each DG.

Concerning the basis to determine whether the declarations made within AARs are well-founded, the instructions 
(and guidelines) for the preparation of the AARs provide a sound basis to build up the Declaration of Assurance 
and represent a clear benchmark against which to hold DGs accountable. Besides, the AARs contain a section on 
the reports and conclusion of the Internal Auditor on the state of control of the DG. Finally, the AAR review pro-
cess ensures the quality of the AARs so that the political level can rely on the management representations and 
assurance.

The Commission will, however, analyse whether certain aspects can be further clarified. 

Reply of the Commission 

64

38
The Commission has reported on the implementation of the Commission Anti-fraud Strategy (CAFS) annually, start-
ing from 2013, in the Annual Report on the Protection of the EU’s Financial Interests (‘Article 325 Report’).

39
Even though it considers that the risk of fraud is sufficiently covered in the methodology and guidance for the DGs 
regarding the anti-fraud strategies, the Commission is currently preparing a proposal to specially include the risk of 
fraud in the new Internal Control Framework. 

42
The objective of the Financial Statement Discussion and Analysis (FSDA) according to the IPSASB Recommended 
Practice Guideline 2 (RPG 2) is to provide ‘an explanation of the significant items, transactions and events presented 
in an entity’s financial statements and the factors that influence them.’

It is therefore logical that the FSDA focusses on the President’s 10 priorities as they ‘represent a continuation of the 
Europe 2020 strategy’ and are the current key drivers of Commission policy and how EU money is spent. In addition, 
the FSDA includes also information on Europe 2020. However, the FSDA is an evolving document. Therefore, the 
Commission remains open to discussing improvements to the content and focus.

44 Third bullet
The EU accounts are adopted by the Commission.

44 Fourth bullet
The Commission notes that its accrual-based accounting system and reporting is thus very well advanced in com-
parison with many Member States.

45 Second bullet
The FSDA prepared by the Commission complies with the structure and content suggested by the IPSASB Recom-
mended Practice Guideline 2 (RPG 2).

45 Third bullet
As the Court notes the accounts are accompanied by the Statement of Assurance in the Official Journal. The Com-
mission would welcome the possibility to include the Court’s opinion on the accounts in the accounts document as 
soon as it is adopted, as is the case in the private sector.

45 Fifth bullet
In the FSDA, the Commission also includes information on different management modes, financial reporting and 
accountability. 

The Commission is working on a revision of the Governance Statement.

Reply of the Commission 

65

45 Sixth bullet
The EU Annual Accounts are adopted by the Commission. As a foreword can be found in the Financial Report it was 
not duplicated in the accounts. The Commission will consider introducing a foreword in the future.

45 Seventh bullet
In addition to the annual accounts and accompanying information, the Commission also produces, in particular, 
the Annual Management & Performance Report (AMPR), the Communication on the Protection of the EU Budget 
and the Financial Report, the General Report on the Activities of the EU and the State of the Union Address of the 
President of the European Commission. These documents contain extensive non-financial information and address 
operational and strategic risks. 

The EU Annual Accounts comply with the information requirements of the relevant international accounting stand-
ards (IPSAS) and the EU accounting rules. 

The Commission reports on the overall amounts at risk with regard to the legality and regularity of the transactions 
(amounts at risk at payment and amount at risk at closure) in the AMPR. The report also discusses what areas of 
expenditure are most prone to errors. 

45 Eighth bullet
As the AMPR contains a quantification of the risks of irregular transactions (amounts at risk at payment and amounts 
at risk at closure), the Commission considers that there is no need to duplicate information. See reply above.

45 Ninth bullet — First indent
In addition to the annual accounts and accompanying information, the Commission also produces, in particular, the 
Annual Management & Performance Report (AMPR), the Communication on the Protection of the EU Budget and 
the Financial Report, the General Report on the Activities of the EU and the State of the Union Address of the Presi-
dent of the European Commission where information on non-financial performance is given.

45 Ninth bullet — Second indent
In addition to the annual accounts and accompanying information, the Commission also produces, in particular, the 
Annual Management & Performance Report (AMPR), the Communication on the Protection of the EU Budget and 
the Financial Report, the General Report on the Activities of the EU and the State of the Union Address of the Presi-
dent of the European Commission. 

45 Ninth bullet — Third indent
Information on progress on the EU 2020 headline targets is regularly updated and published on Eurostat’s website 
and reported in the context of the European semester. See also reply to paragraph 42.

Reply of the Commission 

66

45 Tenth bullet
In particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or 
increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue 
sources) the EU Budget is not comparable to the budgets of states.

In the EU context, the MFF is the tool ensuring medium to long-term stability and predictability of future payment 
requirements and budgetary priorities. The Commission provides information on these aspects in different reports.

45 Eleventh bullet
The role of the APC was referred to in the Synthesis Reports and in the AMPR in 2015. There will be a specific section 
in the future AMPRs on the role and conclusions of the APC.

Common reply to paragraphs 46-47
For the first time this year, the Commission has presented a comprehensive Integrated Financial Reporting Package. 
In doing so, the Commission provides at the same moment all the key financial information for the year 2015. The 
package includes:

(a)  the AMPR providing information on the EU Budget performance based on results achieved with the EU Budget up 
to end 2015. It also comprises the Commission’s management of the EU Budget in 2015, containing an overview of 
the functioning of the internal control systems that the Commission departments have put in place to ensure the 
achievement of policy and operational objectives and the major related risks if any. This includes the assessment 
of the legality and regularity risks, the cost-effectiveness of controls and the anti-fraud strategies; 

(b)  the Financial Report providing in particular a detailed overview of the revenue and the distribution of funds per 

Member State and per MFF heading;

(c)  the Communication on the Protection of the EU Budget on the actions taken to exclude illegal and irregular ex-
penditure from financing by the EU Budget indicating also how Member States are involved and impacted;

d)  the Annual Accounts of the EU (i.e. assets and liabilities, revenue and expenditure) at the end of 2015.

The integrated set of financial reporting is preceded by a foreword from the Budget Commissioner. 

The College of Commissioners takes overall responsibility of the Commission’s internal control systems and risk 
management by adopting the Annual Management and Performance Report.

48
The Commission reports on the estimate of amounts at risk in the AMPR and provides an overview on preventive 
actions in the Communication on the Protection of the EU Budget. In the AAR the responsible AOD reports on the 
results of the controls carried out and provides an estimate of the amount at risk of irregular payments. Further-
more, the nature of the detected errors is also discussed in the AAR. In the context of the discharge procedure the 
Commission has also reported on request to the European Parliament on the actions taken to address some of the 
most frequent types of errors in specific policy areas.

Reply of the Commission 

67

49
Since 2013, the Commission has improved information on the amounts at risk compared to what was done in previ-
ous years, in particular by adding the total amount at risk at payment and at closure. The latter takes into consid-
eration the financial corrections and recoveries which are detailed in the Communication on Protection of the EU 
Budget.

Prior to 2013 the Commission had reported transparently in the Synthesis Report on the reservations made and pro-
vided for the areas of expenditure the estimated amount at risk under reservation. Further information was avail-
able in the respective AARs.

50
The IAS spends a considerable part of its resources (approximatively 40 to 50 %) on engagements assessing the 
management and control systems aimed at preventing and detecting/correcting irregularities in addition to the 
limited reviews on the calculation of the residual error rate.

This work of the IAS led to real improvements, in particular in DG AGRI which was welcomed both by the Court and 
the Discharge Authority.

51
DG DEVCO is implementing its budget under direct management mainly, which has a different assurance model 
than that of shared management which represents 80 % of the EU Budget. 

See also Commission reply provided to paragraph 1.35 of 2015 ECA Annual Report:

The Commission considers that reference to the statistical methodology used by ‘US bodies managing federal 
funds’ is not appropriate for funds under shared management. Under shared management, the Commission relies 
not on audits of expenditure made by its own agencies at EU level but on audit authorities in sovereign Member 
States auditing expenses made by these Member States, frequently with national co-financing. Therefore the Com-
mission considers that production of a statistically valid EU wide estimate of the level of error by itself auditing 
beneficiaries would not provide added-value for shared management expenditure.

In line with the requirements of the legal framework, the Commission will continue to cooperate with Member 
States Audit Authorities and define in common a statistically valid approach to estimate the level of error, and to use 
such error rates after validation. The Commission thus implements the ‘single audit principle’ by focusing its activ-
ity on auditing the Member State auditors and validating their audit work. This is based upon the Court's Opinion 
No 2/2004 on the single audit model and a proposal for a Community internal control framework. This approach is 
fully in line with the objective of reducing the administrative burden on beneficiaries and reduces also the need of 
audit posts in the EC.

Reply of the Commission 

68

53
The Commission notes that the US General Accountability Office, i.e. the external auditor, has identified material 
weaknesses and concludes the following: ‘Until the Federal Government has implemented effective processes to 
determine the full extent to which improper payments occur, and has taken appropriate actions across entities and 
programmes to effectively reduce improper payments, it will not have reasonable assurance that the use of federal 
funds is adequately safeguarded’.

The Commission notes as well that the Executive Office of the US President included in the instruction of 20 Octo-
ber 2014: ‘Working with other entities. Agencies should consider working with entities — such as grant recipients 
— that are subject to Single Audits to leverage ongoing audits to assist in the process to estimate an improper pay-
ment rate and amount’.

The Commission underlines that it provides in the AMPR an estimate for the amount at risk at payment (which does 
not take into consideration recovery actions concerning improper payments). It complements this information with 
an estimate for the amount at risk at closure (which takes into consideration the impact of multiannual corrective 
systems).

57
The Commission refers to its replies to earlier requests from the Parliament and reconfirms its position on the issue 
of providing assurance as referred to by the Court (see Commission reply to paragraph 1.40 of the Court's 2012 
Annual Report).

See also reply to paragraph V of the Executive Summary.

Conclusions and recommendations

58
The Commission will continue its actions to ensure that its governance arrangements with focus on audit, financial 
management and control meet relevant best practice set out in standards or put in place by international and pub-
lic bodies (see detailed Commission replies to paragraphs I-IV, IX, 24-26, 44-46). 

59
The overarching principles of the Commission’s governance framework (i.e. authority, accountability, duties and 
responsibilities) are enshrined in the EU Treaties. See also the Commission replies to paragraphs 21, 55 and 57.

60
The APC is just one of the multiple means in place facilitating the College’s oversight of the Commission’s govern-
ance, risk management, and internal control practices. The primary channel is through the formal communica-
tion mechanisms stated in the working arrangement between Commissioners, their cabinets and the Commission 
services (regular meetings, discussion of Strategic Plans, Management Plans, Annual Activity Reports, etc.) through 
which the Commissioner first, and the College later are informed.

Reply of the Commission 

69

61
See the Commission replies to paragraph 39. 

62
The deadline for the adoption of the annual accounts is set by the Financial Regulation, being 31 July. However, 
this year, working together with the Court, the Commission has already brought forward the adoption of the 2015 
annual accounts by over 2 weeks. Relying heavily on the deadlines for delivery of Member States data, the Commis-
sion will investigate if further advancements are possible.

63
The Commission does not provide less non-financial information than the other bodies — the information is pro-
vided in GPFRs other than the annual accounts. Furthermore, from 2016 onwards, the Commission will issue an inte-
grated package of these reports containing financial and non-financial information at the same time — see replies 
above. 

As previously stated, the IPSAS Conceptual Framework (paragraph 8.6) specifically foresees the use of multiple 
GPFRs, comprising the accounts or financial statements, the FSDA and other reports which address users’ comple-
mentary information needs.

64
The Commission does not share the Court’s view that the estimations of level of error are not based on a consist-
ent methodology. The DGs are required to report in line with the AAR guidance issued by the Central Services. The 
various concepts and indicators have been defined in a sufficiently flexible manner to enable taking account of the 
specific circumstances of the various DGs and yet, ensure a sufficient degree of consistency to consolidate data2.

65
See references below to the replies to the specific conclusions.

65 First bullet
See replies to paragraphs 24-26.

65 Third bullet — First indent
See reply to paragraph 30.

The Commission confirms that the APC mandate of 2015 includes a strengthening of the follow-up of the ECA 
recommendations.

65 Third bullet — Second indent
See replies to paragraphs 30 and 31.

2  See also Commission replies to paragraphs 1.19-1.20 of the Court's 2010 Annual Report, paragraphs 1.22, 1.23 and 1.25 of the Court's 2011 Annual 
Report, paragraphs 1.41-1.42 and 1.44-1.45 of the Court's 2012 Annual Report, paragraphs 1.29-1.30 and 1.32 of the Court's 2013 Annual Report, 
paragraphs 1.50, 1.53-1.54, and 1.65 of the Court's 2014 Annual Report and paragraphs 1.35 and 1.48 of the Court's 2015 Annual Report.

Reply of the Commission 

70

65 Third bullet — Third indent
See replies to paragraphs VIII and 30, 31, 45. Performance reporting falls under the responsibility of the ABM Steer-
ing Group, SG, DG BUDG, and the relevant AODs. 

65 Third bullet — Fourth indent
See Commission replies to paragraphs 26, 30 and 31.

65 Fourth bullet
See reply to paragraph 39.

65 Fifth bullet
See reply to paragraph 62.

65 Sixth bullet — First indent
The Commission is currently working on an update of the Governance Statement.

65 Sixth bullet — Second indent
In the context of the Commission, the State of the Union Address by the President is the vehicle through which the 
President reports on achievements and challenges.

In addition, the General Report on the Activities of the Union published each year by the European Commission 
gives an account of the EU’s major initiatives and achievements of the past year. It is about progress made by the 
Commission in delivering on its priorities (covering much broader aspects than financial information). It also con-
tains a foreword of the President.

65 Sixth bullet — Third indent
Risk management in the Commission is mainly part of the planning phase of the Strategic Planning and Program-
ming (SPP)-cycle in particular the preparation of the Strategic Plans (SPs) and Management Plans (MPs) by each 
Commission department. Critical risks are reported in the MP, Annex 4, and potential cross-cutting critical risks are 
assessed by the Central Services. Significant materialised risks are covered in the Annual Activity Reports (AARs) and 
the Annual Management and Performance Report. 

In addition to the information contained in the AMPR, the Commission reports and communicates extensively on 
political objectives, challenges and risks in a number of forms. The State of the Union Address delivered by the 
President is a key vehicle for communicating challenges and opportunities at political level. Also more detailed 
reporting on issues specific to each policy area is included in the Strategic and Management Plans issued by each 
directorate-general.

65 Sixth bullet — Fourth indent
Non-financial performance information is available in the AARs and the AMPR. 

Reply of the Commission 

71

65 Sixth bullet — Fifth indent
The AMPR, the Financial Report and the annual General Report on the Activities of the Union contain such 
information.

65 Sixth bullet — Sixth indent
The APC Charter requires the APC to report annually to the College on its activities. The APC Annual Report sum-
marises the conclusions of the APC in fulfilling its mission and highlights issues which the APC has brought to the 
attention of the College. It forms part of the evidence supporting the Commission’s adoption of the AMPR of the EU 
Budget. The work of the APC was referred to in the Synthesis Reports and in the AMPR in 2015. There will be a spe-
cific section in the future AMPRs on the role and conclusions of the APC.

65 Sixth bullet — Seventh indent
In particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or 
increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue 
sources) the EU Budget is not comparable to the budgets of States.

In the EU context, the MFF is the tool ensuring medium to long-term stability and predictability of future payment 
requirements and budgetary priorities. The Commission provides information on these aspects in different reports.

The IPSAS Recommended Practice Guideline does not propose reporting on fiscal sustainability to be included in or 
published alongside the annual accounts.

65 Seventh bullet
The Commission does not share the Court’s view that the estimations of level of error are not based on a consist-
ent methodology. The DGs are required to report in line with the AAR guidance issued by the Central Services. The 
various concepts and indicators have been defined in a sufficiently flexible manner to enable taking account of the 
specific circumstances of the various DGs and yet, ensure a sufficient degree of consistency to consolidate data. 

The Commission considers that reference to any benchmark made to ‘US agencies’ is inappropriate in reference to 
the EU Budget (please see reply to paragraph 53).

Recommendation 1 — Explain where it does not comply with best practice 
The Commission accepts this recommendation. The Commission strives to comply with evolving and relevant best 
practice set out in standards or put in place by international or public bodies (see reply to paragraphs I-IV, VIII, 
24-26, 44-49) and will continue to adapt its governance structure. 

Recommendation 2 — Comply with best practice
The Commission partially accepts this recommendation (see detailed replies to the different actions requested 
below).

Reply of the Commission 

72

Recommendation 2 (a)
The Commission accepts this recommendation in line with Article 116.2 of the Rules of application of the Financial 
Regulation. See also the Commission’s reply to recommendation 2(h).

Recommendation 2 (b)
The Commission accepts this recommendation. The Commission control arrangements (including the IAS) are solid, 
comprehensive and being enhanced to comply fully with COSO 2013 Internal Control principles. They enable the 
Commission to exert an adequate oversight over the functioning of the governance structure. 

Recommendation 2 (c)
The Commission accepts this recommendation. See reply to paragraph 62.

Recommendation 2 (d)
The Commission accepts the recommendation to issue a suite of reports in a way that mitigates additional risks as 
regards availability and quality of information. See also reply to recommendation 2(e).

The Commission has already taken steps in this direction through the publication on 19 July 2016 of the Integrated 
Financial Reporting Package.

A single accountability report would not be adequate and is not in line with the Conceptual Framework for GPFR 
of IPSASB stating clearly that GPFRs, which have as objective to provide information useful for accountability and 
decision making purposes, ‘are likely to comprise multiple reports, each responding more directly to certain aspects 
of the objectives of financial reporting’. In line with the Conceptual Framework the Commission provides or will 
provide the following documents which cover the elements identified by the Court:

ο  The Commission is currently working on an update of the Governance Statement.

ο 

ο 

In the context of the Commission, the State of the Union Address, which is presented in September, corresponds 
to the President's report.

In addition to the information contained in AMPR, the Commission reports and communicates extensively on 
operational and strategic risks in the State of the Union Speech, and in strategic and management plans of each 
DG.

ο  Non-financial performance information is available in the AARs and the AMPR.

ο  The General Report on the Activities of the Union and the AMPR contain information on activities during the year 

and the achievements of the policy objectives.

ο  The APC Annual Report summarises the conclusions of the APC in fulfilling its mission and highlights issues which 
the APC has brought to the attention of the College. The work of the APC was referred to in the Synthesis Reports 
and in the AMPR in 2015. There will be a specific section in the future AMPRs on the role and conclusions of the 
APC.

ο 

ο 

In particular due to differences in the debt dimension (i.e. capacity to meet financial commitments or refinance or 
increase debt) and the revenue dimension (i.e. capacity to vary existing taxation levels or introduce new revenue 
sources) the EU Budget is not comparable to the budgets of states.

In the EU context, the MFF is the tool ensuring medium- to long-term stability and predictability of future payment 
requirements and budgetary priorities. The Commission provides information on these aspects in the AMPR, the 
Financial Report, the EU Annual Accounts and whenever necessary in other reports.

Reply of the Commission 

73

Recommendation 2 (e)
The Commission partially accepts this recommendation.

The information underlying the new Integrated Financial Reporting Package and complementary reports will be 
made available, as far as possible (i.e. subject in particular to the relevant deadlines for Member States for providing 
necessary data), to the Court in order to allow checks concerning consistency.

Recommendation 2 (f)
The Commission accepts this recommendation. It will continue to report on the overall amount at risk in the Annual 
Management and Performance Report.

Recommendation 2 (g)
The Commission accepts this recommendation. It will update and publish its governance arrangements on a regular 
basis and explain how it complies with international standards and good practice.

Recommendation 2 (h)
The Commission partially accepts this recommendation. The Commission will consider, in the context of the mid-
mandate renewal of the membership of the APC, the issue of an increase in the number of external members with 
proven professional expertise in audit and related matters and appointed by the Commission following an open 
and transparent procedure. Risk management, financial reporting and the results of ex post verifications/audit func-
tion fall under the responsibility of the ABM Steering Group, SG, DG BUDG, and the relevant AODs. Communication 
channels, including in particular the AARs, Management and Strategic Plans, etc., ensure that the AODs inform the 
respective Commissioners and the College, allowing the latter to exercise appropriate oversight. Furthermore, the 
IAS regularly audits the ex post verification/audit function across the relevant DGs, particularly in the key areas such 
as shared management, and its findings are considered by the APC. The Commission will consider inviting the IAS to 
undertake audit work on governance/oversight arrangements concerning risk management, financial reporting, and 
the ex post verification/audit function, in particular the second level scrutiny, to identify any improvements which 
can further enhance the performance of these mechanisms.

HOW TO OBTAIN EU PUBLICATIONS

Free publications:

(cid:127) 

one copy: 
via EU Bookshop (http://bookshop.europa.eu);

(cid:127)   more than one copy or posters/maps: 

from the European Union’s representations (http://ec.europa.eu/represent_en.htm);  
from the delegations in non-EU countries (http://eeas.europa.eu/delegations/index_en.htm);  
by contacting the Europe Direct service (http://europa.eu/europedirect/index_en.htm) or  
calling 00 800 6 7 8 9 10 11 (freephone number from anywhere in the EU) (*).

(*) 

The information given is free, as are most calls (though some operators, phone boxes or hotels may charge you).

Priced publications:

(cid:127) 

via EU Bookshop (http://bookshop.europa.eu).

Event

Adoption of the Audit Planning Memorandum/Start of audit

Official sending of draft report to Commission (or other auditee)

Adoption of the final report after the adversarial procedure

Commission’s (or other auditee’s) official replies received in all languages

Date

15.12.2015

21.6.2016

20.9.2016

14.10.2016

 
Governance comprises the arrangements put in place to 
ensure that the intended outcomes for stakeholders are 
defined and achieved. Good governance is not just about 
relationships, it is about achieving results, and providing 
decision-makers with tools to do their job. In several areas, 
the Commission diverges from, or does not meet in full best 
practice set out in standards or put in place by the 
international and public bodies we selected as benchmarks. 
To continue to address the key risks the Commission will 
need to further strengthen the governance structure across 
the institution.

EUROPEAN
COURT
OF AUDITORS