REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Annual report on internal audits carried out in 2015 (Article 99(5) of the Financial Regulation)
Date: 2016-09-30
Institutions: European Commission, Secretariat-General
Subjects: administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EUROPEAN 
COMMISSION 

Brussels, 30.9.2016  
COM(2016) 628 final 

REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND 
THE COUNCIL 

Annual report on internal audits carried out in 2015 
(Article 99(5) of the Financial Regulation) 

{SWD(2016) 322 final} 

EN 

   EN 

 
 
 
 
  
 
1. 

Introduction.......................................................................................................... 3 

2. 
The IAS mission: Independence, objectivity and accountability objectives and 
scope of the Report ...................................................................................................... 3 

3.  Overview of audit work ........................................................................................ 4 

3.1. 

3.2. 

Implementation of the 2015 audit plan ................................................................... 4 

Statistical data on IAS recommendations ................................................................ 6 

4. 

Summary of the audit work .................................................................................. 8 

4.1. 

Conclusions on performance audits......................................................................... 8 
Performance of Commission DGs, Services and Executive Agencies: horizontal processes 

4.1.1. 
(HR, IT, anti-fraud, etc.).........................................................................................................................9 
Performance in implementing budget operational appropriations......................................11 
4.1.2. 
Performance in non-spending policy areas...........................................................................13 
4.1.3. 

4.2. 

4.3. 

IAS limited conclusions on the state of internal control of each DG ....................... 13 

Overall opinion on the Commission's financial management ................................. 14 

5.  Consultation with the Commission's Financial Irregularities Panel...................... 15 

6.  Conclusions......................................................................................................... 15 

7. 

List of acronyms.................................................................................................. 16 

2 

 
 
 
1. 

INTRODUCTION 

This report is to inform the European Parliament and Council  of the work carried 
out by the Commission’s Internal Audit Service (IAS), as required by Article 99(5) 
of the Financial Regulation. It is based on the report drawn up by  the Commission’s 
Internal  Auditor    under  Article  99(3)  of that  Regulation, regarding IAS audit-  and 
consulting  reports  completed  in  2015  on  Commission  Directorates-General, 
Services and Executive Agencies1. In line with its legal base it contains a summary 
of the number and type of internal audits carried out, the recommendations and the 
action taken on those recommendations2. The audit reports finalised in the period 1 
February  2015  -  31  January  2016  are  included  in  this  report.  Recommendations 
implemented after the cut-off date of 31 January 2016 are not considered. 

2.  THE  IAS  MISSION:  INDEPENDENCE,  OBJECTIVITY  AND  ACCOUNTABILITY 

OBJECTIVES AND SCOPE OF THE REPORT 

The  mission  of  the  Internal  Audit  Service  is  to  provide  to  the  Commission 
independent, objective assurance and consulting services designed to add value and 
improve  the  operations  of  the  Commission.  The  IAS  helps  the  Commission 
accomplish its objectives by bringing a systematic, disciplined approach in order to 
evaluate  and  make  recommendations  for  improving  the  effectiveness  of  risk 
management,  control  and  governance  processes.  Its  tasks  include  assessing  and 
making  appropriate  recommendations  for  improving  the  governance  process  in  its 
accomplishment  of  the  following  objectives:  promoting  appropriate  ethics  and 
values  within  the  organisation,  ensuring  effective  organisational  performance 
management  and  accountability  and  effectively  communicating  risk  and  control 
information to appropriate areas of the organisation. Thereby it promotes a culture 
of efficient and effective management within the Commission and its departments. 
The IAS's independence  is enshrined in the Financial Regulation3 and its Mission 
Charter4 as adopted by the Commission. The IAS reports on all of its audits to the 
Audit  Progress  Committee  (APC).  The  Audit  Progress  Committee  assists  the 
College of Commissioners by ensuring that the work of the IAS, the former Internal 
Audit  Capabilities  (IACs)  and  of  the  ECA  is  properly  taken  into  account  by  the 
Commission services and receives appropriate follow-up. 

1   The  Report  does  not  cover  the  decentralised  European  Agencies,  the  European  External  Action 

Service, or other bodies audited by the IAS, which receive separate annual reports. 

2  Required by Performance Standard 2060 of the International Standards for the Professional Practice of 

Internal Auditing (Standards) promulgated by the Institute of Internal Auditors (IIA). 

3   Article 100 of the FR. 

4   C(2015)2541  (20  April  2015),  Communication  to  the  Commission,  Mission  Charter  of  the  Internal 

Audit Service of the European Commission. 

3 

 
 
 
                                                 
The  IAS  performs  its  work  in  accordance  with  the  Financial  Regulation  and  the 
International  Standards  for  the  Professional  Practice  of  Internal  Auditing  and  the 
Code of Ethics of the Institute of Internal Auditors. 

The IAS does not audit  Member States’ systems of control over the Commission’s 
funds.  Such  audits,  which  reach  down  to  the  level  of  individual  beneficiaries,  are 
carried  out  by  Member  States’  internal  auditors,  national  Audit  Authorities,  other 
individual Commission DGs and the European Court of Auditors (ECA). The IAS 
does, however, audit measures taken by the Commission services to supervise and 
audit  bodies  in    Member  States,  and  other  bodies  which  are  responsible  for 
disbursing EU funds, such as the United Nations. As provided for in the Financial 
Regulation, the IAS can carry out these duties on the spot, including in the Member 
States. 

3.  OVERVIEW OF AUDIT WORK  

3.1. 

Implementation of the 2015 audit plan 

By the cut-off date of 31 January 2016, the implementation of the 2015 audit plan 
reached  its  target  of  100%  of  planned  engagements  for  audits  in  the  Commission, 
Services and Executive Agencies5. 

139  engagements  (including  audits,  follow-ups,  limited  reviews,  risk  assessments 
and  one  management  letter)  were  finalised,  broken  down  as  indicated  in  the 
following table. 

5   The SWD provides an overview of all completed audit and follow-up audit engagements. 

4 

 
 
                                                 
2015 

2014  

2013 

Engagements 

Reports 

Engagements 

Reports 

Engagements 

Reports 

Audit 

Follow-up 

(Limited) Review 

Management Letter 

IT Risk Assessment 

JSIS10 Risk Assessment 

Consulting 

Total 

38 

96 

2 

1 

0 

1 

1 

526 

-9 

2 

1 

0 

1 

1 

257 

53 

5 

1 

1 

0 

0 

31 

- 

5 

1 

1 

0 

0 

228 

48 

4 

1 

0 

0 

0 

23 

- 

4 

1 

0 

0 

0 

139 

57 

85 

38 

75 

28 

The increase in number of engagements finalised by the IAS in 2015 compared to 
previous years is mainly due to the centralisation of the internal audit function. In 
2015,  the  IAS  received  60  new  posts  which  it  has  gradually  been  filling.  As  a 
result,  the  audit  plan  included  new  engagements  in  line  with  the  increased 
availability of capacity. The 2016 final audit plan contains 101 audit engagements 
(excl. follow-up engagements), of which 67 are planned to be finalised in 2016. 

In  accordance  with  its  Charter  and  the  International  Standards  and  in  order  to 
ensure an efficient and effective implementation of the audit plan, the IAS plans its 
audit  work  on  the  basis  of  a  risk  assessment  and  a  capacity  analysis.  The 
implementation is then regularly monitored and adjustments are made as necessary. 

6   Some audits, in particular multi-DG audits, may give rise to more than one audit report. 

7   The "Gap analysis of new legislation/design of 2014-20 programming period of European Structural 
and  Investment  Funds  –  Part  2"  addressed  to  DG  REGIO  and  DG  EMPL  is  counted  as  two 
engagements. 

8   The  "Audit  on  Control  Strategy  -  Implementation  in  DG  AGRI"  is  counted  as  two  engagements 

conducted by two different audit teams resulting in a single audit report. 

9   Following the centralisation of the internal audit function at the beginning of 2015, the IAS took over 
908 recommendations of former IACs to be followed-up. When launching the follow-ups in 2015, the 
IAS grouped recommendations stemming from a number of audits performed previously by an IAC. 
The  results  were  reported  in  a  single  report  or  closing  note.  Given  that  separate  reports  or  closing 
notes were not produced for every audit followed-up, no figures on the number of reports are shown in 
the table. 

10   Joint Sickness Insurance Scheme (JSIS) 

5 

 
 
 
 
  
 
 
                                                 
3.2. 

Statistical data on IAS recommendations 

The  number  of  recommendations  issued  by  the  IAS  (including  their  acceptance 
rate) in 2015 was as follows: 

Priority 

Critical 

Very Important 

Important 

Desirable 

Total 

New 
recommendations 

Accepted 
recommendations 

Non-accepted 
recommendations 

1 

80 

128 

7 

216 

% 

100% 

100% 

100% 

100%. 

100% 

1 

80 

128 

7 

216 

0 

0 

0 

0 

0 

% 

N.A. 

N.A 

N.A. 

N.A. 

N.A 

For  all  accepted  recommendations,  the  auditees  drafted  action  plans,  which  were 
submitted to and assessed as satisfactory by the IAS. 

The  implementation  of  the  accepted  recommendations  made  during  the  period 
2011-2015,  as  assessed  by  auditees11,  as  at  31  January  201612  is  presented  in  the 
following  table.  Recommendations  implemented  after  the  cut-off  date  of  31 
January 2016 are not considered. 

Implemented 

In progress (by number of months overdue) 

Year

2011 

2012 

2013 

2014 

Priority 

Critical 
Very Important 
Important 
Desirable 
2011 Total 
Critical 
Very Important 
Important 
Desirable 
2012 Total 
Critical 
Very Important 
Important 
Desirable 
2013 Total 
Critical 
Very Important 
Important 
Desirable 

Total  
0 
47 
101 
10 
158 
0 
68 
123 
0 
191 
0 
48 
73 
6 
127 
0 
45 
77 
3 

# 
0 
47 
99 
10 
156 
0 
62 
113 
0 
175 
0 
40 
60 
6 
106 
0 
19 
53 
3 

% 
0% 
100% 
98% 
100% 
99% 
0% 
91% 
92% 
0% 
92% 
0% 
83% 
82% 
100% 
83% 
0% 
42% 
69% 
100% 

# 
0 
0 
2 
0 
2 
0 
6 
10 
0 
16 
0 
8 
13 
0 
21 
0 
26 
24 
0 

% 
0% 
0% 
2% 
0% 
1% 
0% 
9% 
8% 
0% 
8% 
0% 
17% 
18% 
0% 
17% 
0% 
58% 
31% 
0% 

No 
delay 
0 
0 
0 
0 
0 
0 
0 
2 
0 
2 
0 
5 
1 
0 
6 
0 
5 
6 
0 

0 - 6 
0 
0 
0 
0 
0 
0 
0 
2 
0 
2 
0 
0 
1 
0 
1 
0 
14 
8 
0 

 6 - 
12 
0 
0 
0 
0 
0 
0 
3 
0 
0 
3 
0 
0 
1 
0 
1 
0 
7 
9 
0 

12+ 
0 
0 
2 
0 
2 
0 
3 
6 
0 
9 
0 
3 
10 
0 
13 
0 
0 
1 
0 

11   This  table  shows  the  latest  rating  of  the  recommendations.  This  may  differ  from  the  rating  in  the 
original report if actions subsequently taken by the auditee are deemed sufficient to partly mitigate the 
risks identified and therefore to a downgrading of the recommendation. 

12   Recommendations implemented after the cut-off date of 31 January 2016 are not considered. 

6 

 
 
  
  
  
  
 
 
 
  
                                                 
 
Year

IACs 
recs 
taken 
over 

2015 

Priority 
2014 Total 
Critical 
Very Important 
Important 
Desirable 
IACs Total 
Critical 
Very Important 
Important 
Desirable 

2015 Total 
TOTAL 2011-2015  
Thereof Critical or 
Very Important  

Implemented 

In progress (by number of months overdue) 

Total  
125 
0 
281 
583 
44 
908 
1 
80 
128 
7 

216 
1725 
570 

# 
75 
0 
233 
466 
44 
743 
0 
6 
9 
0 

15 
1270 
407 

% 
60% 
0% 
83% 
80% 
100% 
82% 
0% 
8% 
7% 
0% 

7% 
74% 
72% 

# 
50 
0 
48 
117 
0 
165 
1 
74 
119 
7 

201 
455 
163 

% 
40% 
0% 
17% 
20% 
0% 
18% 
100% 
92% 
93% 
100% 

93% 
26% 
28% 

No 
delay 
11 
0 
10 
20 
0 
30 
1 
69 
109 
7 

186 
235 
90 

0 - 6 
22 
0 
23 
40 
0 
63 
0 
5 
10 
0 

15 
103 
42 

 6 - 
12 
16 
0 
5 
23 
0 
28 
0 
0 
0 
0 

0 
48 
15 

12+ 
1 
0 
10 
34 
0 
44 
0 
0 
0 
0 

0 
69 
16 

The  large  increase  in  the  total  number  of  open  recommendations  is  mainly 
explained  by  the  fact  that  with  the  centralisation  of  the  internal  audit  function, 
former IAC recommendations have been taken over by the IAS. 

Overall, 1270 or 74% of the total number of accepted recommendations made over 
the  period  2011-2015  are  considered  by  the  auditees  as  implemented,  leaving  a 
total  of  455  recommendations  (or  26%)  still  in  progress.  Of  this  total  of  455 
recommendations  in  progress,  one  is  critical,  however,  not  delayed,  and  162 
recommendations are very important.  

Of  the  total  of  455  recommendations  in  progress,  220  are  overdue,  representing 
13% of the total number of accepted recommendations, of which 31 very important 
recommendations  are  long  overdue  (for  more  than  6  months  compared  to  the 
original  due  date).  To  this  figure,  one  further  long  overdue  very  important 
recommendation should be added from an audit report issued prior to this reporting 
period  (2011-2015).  Overall,  these  represent  only  1.9%  of  the  total  number  of 
accepted recommendations in the period 2011-2015. 

Overall, the IAS judges this to be a good situation, comparable to previous reports 
and an indication that Commission services are diligent in implementing the very 
important  recommendations,  hence  mitigating  the  risks  identified.  Nevertheless, 
attention has to be paid to recommendations rated 'very important' which are long 
overdue, i.e. overdue by more than six months. The APC was regularly informed of 
the  state  of  play  on  the  implementation of the  IAS recommendations  (assessment 
by management and results of the follow-up engagements conducted by the IAS). 
Specific  attention  was  drawn  to  the  very  important  recommendations  overdue  by 
more  than  six  months.  The  APC  decided  to  take  specific  action  by  reminding 
services  of  their  responsibility  to  implement  the  IAS  recommendations,  where 
necessary.  

The  total  number  of  recommendations  issued  during  the  period  2011-2015  for 
which  a  follow-up  audit  has  been  conducted  amounts  to  1004  compared  to  1270 
reported as 'ready for review' by the auditees. 

7 

 
 
 
 
 
  
 
Of the total number of recommendations issued and followed up during that period 
(1004), 911 (91%) have been closed by the auditor. This means that on average, the 
IAS  assessed  that  9%  of  recommendations  could not  be considered as effectively 
implemented yet, and therefore not closed following the completion of the follow-
up audit. This represents an increase compared to the previous year (5%). This is 
explained by the fact that the IAS performed several follow-up audits in the second 
half  of  2015  which  also  included  a  review  of  the  state  of  implementation  of 
recommendations  which  had  not  yet  been  assessed  as  "ready  for  review"  by  the 
auditee. Most of these recommendations were IAC recommendations for which the 
IAS  took  the  opportunity  to  assess  their  state  of  play  at  the  same  time  when 
assessing other recommendations of the same audit that were considered as 'ready 
for  review'  by  the  auditee.  Furthermore,  the  IAS  assessed  progress  made  on 
selected recommendations directly related to the assurance building process in the 
context  of  the  Annual  Activity  Reports  (AAR)  process  in  order  to  provide  DGs 
with the latest state of play for reporting in the AAR. This was a new approach in 
comparison to previous years. 

When  neutralising  this  effect  (i.e.  by  considering  only  recommendations  reported 
'ready  for  review'  by  management),  the  overall  percentage  of  recommendations 
assessed as 'in progress' after a follow up audit drops to 4% which is in line with 
previous reports. 

4.  SUMMARY OF THE AUDIT WORK 

4.1.  Conclusions on performance audits  

In  response  to  the  Commission's  move  towards  an  enhanced  performance-based 
culture  and  greater  focus  on  value  for  money,  the  IAS  continued  to  carry  out 
performance  audits13  and  audits  which  include  important  performance  elements 
(comprehensive audits) in 2015 as part of its 2013-2015 strategic audit plan. 

These audits addressed a number of aspects related to performance:  

–  DGs and Services are faced with a growing pressure on financial and human 
resources  while  at  the  same  time  they  need  to  demonstrate  that  they  are 
delivering  on  their  objectives  and  achieving  value  for  money.  The  IAS 
focused  on  (1)  how  DGs  and  Services  manage,  monitor  and  report  on  the 
specific  objectives  which  are  under  their  control  and  can  be  achieved 
through their outputs and actions, (2) the use of their internal resources and 
(3) how they evaluate the benefits of their internal processes and controls.  

–  The 2014-2020 Multi-annual Financial Framework places more emphasis on 
the achievement of results and new provisions in the legal bases introduced 
mechanisms which aim at strengthening the performance frameworks of the 
2014-2020 spending programmes.  

13   In total, the IAS carried out 35 performance and comprehensive audits. For more details see the SWD. 

8 

 
 
                                                 
The IAS focused on how the DGs and Services manage, monitor and report on the 
performance of EU policies. It is applicable to both spending programmes and non-
spending activities. Policy objectives are in general defined via general objectives 
to which the DGs and Services contribute to a certain extent. The achievement of 
the general objectives is however also influenced by other external factors and by 
third parties.  

In line with its methodology and best practice, the IAS approached performance in 
an  indirect  way,  i.e.  an  assessment  of  whether  and  how  management  has  set  up 
systems intended to measure the performance (efficiency and effectiveness) of its 
activities.  Through  this  approach,  the  IAS  aims  at  ensuring  that,  in  the  first 
instance,  DGs  and  Services  have  established  performance  frameworks  including 
performance  measurement  tools,  (i.e.  key  indicators)  and  monitoring  systems14. 
This results in part from the fact that a large number of legal bases for the spending 
programmes set out objectives that are of a wider scope than what the Commission 
can really achieve on its own. This means that objectives and SMART benchmarks 
have first to be established at Commission level, in order to dissociate, to the extent 
possible, the Commission's specific objectives and performance from those of the 
spending programmes, the achievement of which also depends on other major key 
players,  particularly  when  EU  programmes  are  implemented  under  shared  and 
indirect management (Member States, Regions, etc.). 

The  following  sections  set  out  the  conclusions  of  the  IAS  on  the  various 
performance aspects of its audits carried out in 2015. 

4.1.1.  Performance  of  Commission  DGs,  Services  and  Executive  Agencies: 

horizontal processes (HR, IT, anti-fraud, etc.) 

4.1.1.1.Strategic planning and programming 

In  the  area  of  strategic  planning  and  programming,  the  Commission  is 
implementing a robust performance framework based on (1) the ex-ante setting of 
general  and  specific  objectives,  which  are  derived  from  the  Commission  political 
orientations,  by  the  DGs  and  Services  in  their  management  plans,  (2)  regular 
measurement  and  monitoring  of  performance  indicators  and  (3)  reporting  on 
achievements  in  their  annual  activity  reports.  These  decentralised  responsibilities 
are  counterbalanced  at  corporate  level  by  SG  and  DG  BUDG  who  provide  the 
overall  framework,  coordinate  the  work  and  provide  guidance  and  support.  The 
IAS  found  that  further  efforts  are  necessary,  at  both  corporate  and  decentralised 
level, to further improve the quality of the indicators. Post-audit event: the central 
services  have  in  the  meantime  carried  out  a  comprehensive  overhaul  of  the 
strategic  planning  and  programming  cycle,  which  resulted  notably  in  new 

14   See European Parliament resolution of 28 April 2016 with observations forming an integral part of the 
decisions on discharge in respect of the implementation of the general budget of the European Union 
for the financial year 2014, Section III – Commission and executive agencies (2015/2154(DEC)) (ref. 
P8_TA-PROV(2016)0147), par. 18: "the move to an increased level of performance auditing cannot 
be  done  in  a  single  step,  as  it  is  only  once  the  basic  legal  acts  and  the  budget  are  drafted  with  the 
intention to align policy objectives with qualitative indicators or to produce measurable results that 
performance audits can move forward;". 

9 

 
 
                                                 
instructions  for  the  planning  documents  in  November  2015.  The  IAS  has  not  yet 
carried out a follow-up audit. (See SWD, Part 1, section 1.2). 

In this context, the IAS also performed a consulting engagement at the request of 
DG  FISMA's  management  which  resulted  in  a  number  of  recommendations  and 
suggestions  for  the  DG's  strategic  and  annual  management  plans  and  more 
generally, in the move towards a performance based culture. (See SWD 1, Part 1, 
section 7.5). 

4.1.1.2.Anti-fraud 

In  the  Anti-Fraud  area,  the  IAS  found  that  all  audited  DGs  and  Services  have 
designed  and  effectively  implemented  an  Anti-Fraud  Strategy,  in  line  with  the 
guidance  provided  by  OLAF  in  this  area.  However  further  improvements  are 
necessary at the corporate and operational levels to increase the effectiveness of the 
Anti-Fraud Strategy. The IAS recommended to strengthen the corporate Anti-Fraud 
framework and guidance and to evolve from stand-alone, high-level assessments to 
a coordinated exercise embedded in the strategic planning and programming cycle 
whereby  Anti-Fraud  actions  are  effectively  integrated  in  the  internal  control 
systems  of  the  DGs  and  Services.  Furthermore,  the  IAS  considered  that  ad  hoc 
actions are necessary to address the status of forensic audits in DG DEVCO and to 
strengthen  the  controls  of  COFUND  projects  in  REA.  (See  SWD,  Part  1,  section 
1.3). 

4.1.1.3.IT security 

In  the  IT  area,  effective  IT  security  represents  a  major  challenge  in  the  face  of 
continually  evolving  threats  which  can  harm  the  confidentiality,  integrity  and 
availability of the information retained and processed by the Commission. Previous 
audits  undertaken  by  the  IAS  in  recent  years  identified  a  series  of  systemic  and 
recurrent  weaknesses  in  this  area  which  have  been  summarised  in  a  management 
letter  addressed  to  the  corporate  services  in  charge  of  IT  security.  Despite  the 
availability  of  a  highly  committed  and  technically  competent  workforce  at 
operational  level,  the  IAS  found  that  the  Commission  needs  to  strengthen  the 
effective oversight of information security issues. (See SWD, Part 1, section 9.2). 

At  local  level,  an  audit  on  the  management  of  local  IT  in  DG  COMP  confirmed 
some  of  the  IT  security  issues  and  identified  also  other  issues  with  regard  to  the 
funding  of  IT,  business-IT  alignment  and  project  and  quality  management.  (See 
SWD, Part 1, section 9.1). 

4.1.1.4.Common  Support  Centre  in  the  Research  family  (business  process, 

IT tools, governance) 

In the research family of DGs and Services, the Common Support Centre provides 
common business processes and IT, legal, audit, information and data services. In 
addition, the centralisation of support services was expected to result in efficiency 
gains  from  cost  reduction,  job  savings  and  rationalisation  of  processes  and 
procedures. The IAS audit, performed at an early stage of the Centre's operations, 
terms  of  harmonisation  and 
recognised 
simplification of the business process and IT tools resulting in a positive outcome 
for  EU  fund  beneficiaries  (limited  time  to  grant,  reduced  administrative  burden) 

the  significant  achievements 

in 

10 

 
 
even though some weaknesses remain, in particular in the governance set-up. (See 
SWD, Part 1, section 4.7). 

4.1.1.5.HR 

In the HR area, the IAS found that the sickness absence rate in the Commission is 
stable  but  that  the  average  rate  is  significantly  higher  in  the  Offices  (OIB,  OIL, 
PMO).  The  responsibility  for  managing  sickness  absences  lies  at  both  the 
operational and corporate level (DG HR). At both levels, managers are well aware 
of  sickness  absences  and  fully  committed  to  managing  it  within  their  areas  of 
responsibility.  Further  steps  are  nevertheless  necessary  at  both  levels  in  order  to 
improve the measurement, monitoring and reporting on the sickness absence level, 
the  identification  of  reference  sickness  absence  rates  and  the  verification  of 
sickness absences by the medical service. (See SWD, Part 1, section 1.1). 

Another HR topic covered in 2015 was the knowledge management process in DG 
COMP  where  the  IAS  found  that  the  knowledge  collection,  storing  and  sharing 
systems  in  place  are  overall  efficient  and  effective  and  adequately  support  DG 
COMP  staff  in  ensuring  high  quality  and  consistent  competition  case  handling. 
(See SWD, Part 1, section 7.4). 

4.1.2.  Performance in implementing budget operational appropriations 

4.1.2.1.Direct management 

In the area of directly managed funds, several audits assessed the preparedness of 
the DGs' and Services' management and control systems to implement the budget 
of  the  spending  programmes  for  which  they  are  responsible  (Horizon  2020, 
Consumer  and  Health  programmes,  LIFE  programme,  SME 
Instrument, 
Connecting  Europe  Facility).  Some  of  these  audits  focused  in  particular  on  the 
adequacy of the design of the grant management process while others assessed the 
efficiency  and  effectiveness  of  the  systems  put  in  place  for  the  management  and 
control  of  specific  programmes.  In  general,  the  IAS  audits  found  that  the  audited 
DGs and Services (DG CONNECT, DG RTD, CHAFEA, and ERCEA) have set-up 
efficient and effective processes for grant management. In CHAFEA and EASME, 
significant  weaknesses  have  nevertheless  been  identified  concerning  the  grant 
management procedures which need to be addressed. Some Executive Agencies, in 
particular EASME and INEA, face significant challenges in adequately managing 
the  implementation  of  the  various  spending  programmes  delegated  to  them.  The 
weaknesses  observed  in  the  control  strategy  and  assurance  building  processes  for 
various programmes managed by EASME and INEA are a specific area of concern. 
(See SWD, Part 1, sections 2.5 (CHAFEA), 4.1 (DG CONNECT), 4.8 (DG RTD), 
4.10 (EASME), 4.11 (ERCEA), 4.12 (INEA)). 

4.1.2.2.Indirect management 

(a) 

External action family (EU Trust Funds) 

In the external action family of DGs, an audit was performed in DG DEVCO and 
DG NEAR on the design and implementation of EU trust funds. It concluded that 
although  the  first  trust  funds  have  achieved  some  success  in  attracting  a  limited 
number  of  donors  and  enhancing  the  visibility  of  their  operations,  further  efforts 
11 

 
 
are required to benefit fully from this funding mechanism to address the complex 
operational  and financial challenges  posed by implementing projects in crisis and 
fragile  environments.  In  particular,  the  governance  processes  and  the  trust  funds' 
operational  performance  management  should  be  strengthened.  (See  SWD,  Part  1, 
section 5.1). 

(b) 

Combination  of  different  management  modes:  Erasmus+ 
(EAC and EACEA) and ENI/IPA (NEAR) 

Some  funding  programmes  are  implemented  via  a  combination  of  different 
management modes. This is the case for the Erasmus+ programme managed by DG 
EAC and EACEA and the European Neighbourhood Instrument and Instrument for 
Pre-Accession managed by DG NEAR.  

For  Erasmus+,  both  DG  EAC  and  EACEA  have  implemented  effective  internal 
control  systems  capable  of  providing  reasonable  assurance  to  the  Authorising 
Officers  by  (Sub)Delegation.  (See  SWD,  Part  1,  sections  6.2  (DG  EAC)  and  6.3 
(EACEA)). 

In  DG  NEAR  however,  the  IAS  identified  significant  weaknesses  in  the  control 
strategy of the Instrument for Pre-Accession, in particular for obtaining assurance 
on the ability of beneficiary countries to implement the budget. (See SWD, Part 1, 
section 5.3). 

For  the  new  Instrument  of  Pre-Accession  under  the  2014-2020  programme,  DG 
NEAR  is  not  sufficiently  prepared  for  implementing  a  performance  assessment 
framework for beneficiary countries. (See SWD, Part 1, section 5.2). 

(c) 

Indirect management: supervision arrangements in place (DG 
DEVCO, DG ENER, DG GROW, DG MOVE) 

In the area of indirectly managed funds, several audits focused on the supervision 
arrangements  in  place  in  the  DGs  and  Services  (DG  DEVCO,  DG  ENER,  DG 
GROW, DG MOVE) for the management of specific programmes (African Peace 
Facility,  Connecting  Europe  Facility,  Nuclear  decommissioning  assistance 
programme,  and  Galileo).  In  this  area,  several  very  significant  weaknesses  were 
identified in the DGs’ control and supervision strategies, which may endanger the 
achievement  of  the  policy  objectives,  giving  rise  to  critical  and  very  important 
recommendations  calling  for  urgent  action.  (See  SWD,  Part  1,  sections  5.4  (DG 
DEVCO), 4.4 (DG ENER), 7.1 (DG GROWTH), 4.6 (DG MOVE)). 

4.1.2.3.Shared management 

(a) 

Gap  analysis:  preparedness 
requirements  and  performance  focus  of 
programmes, design of the management and control systems 

legal 
the  spending 

to  manage 

the  new 

In  2014,  the  IAS  focused  in  a  number  of  audits  on  how  DGs  and  Services  have 
responded to the new legislative requirements of the funding of programmes in the 
2014-2020 programming period. These gap analysis reviews were finalised in 2015 
(DG MARE and DG HOME) and identified a number of risks the Commission is 
facing  as  a  result  of  the  co-legislative  process  that  need  to  be  mitigated  in  the 

12 

 
 
design  and  implementation  of  the  DGs'  and  Services'  management  and  control 
systems. (See SWD, Part 1, sections 2.4 (DG MARE), 6.1 (DG HOME)). 

(b) 

Shared  management:  supervision  of  the  Member  States’ 
management  and  control  systems,  result  orientation  and 
performance framework, Ex-ante conditionalities 

In  the  area  of  shared  management,  significant  weaknesses  were  identified  in  the 
supervision of the Member States' management and control systems put in place for 
certain  policy  domains  (DG  AGRI  –  Greening)  which  may  endanger  the 
achievement of the policy objectives. (See Annex 1, Part 1, section 2.1). 

Furthermore, the assessment of performance related elements, the result orientation 
and performance framework and the assessment, monitoring and reporting of Ex-
Ante conditionalities need to be reinforced in several policy domains (DGs REGIO 
and EMPL) to ensure that results are achieved and that the desired policy outcomes 
are met. (See SWD, Part 1, section 3.1). 

4.1.3.  Performance in non-spending policy areas 

For the non-spending policy areas, an audit in DG TRADE concluded that the DG 
has ensured an efficient and effective management of trade defence instruments to 
defend  the  European  Union  against  trade  distortions.  (See  SWD,  Part  1,  section 
7.3). 

Another audit focused on the support provided by EUROSTAT in the production 
of  indicators  used  to  monitor  progress  towards  the  achievement  of  the  EU's 
strategic objectives. The IAS observed that EUROSTAT's operational processes for 
the  production  of  "European  statistics"  and  key  indicators  are  satisfactory  overall 
but  that  concerning  the  use  of  "other  statistics",  these  data  do  not  offer  the  same 
degree of independence, robustness and reliability as the "European Statistics". In 
particular,  the  IAS  found  no  evidence  that  "other  statistics"  used  by  the  DGs  to 
demonstrate  progress  made  in  achieving  Europe  2020  targets  are  subject  to  a 
quality  assurance  review  equivalent  to  the  process  implemented  by  EUROSTAT 
for "European Statistics" (See SWD, Part 1, section 8.1). 

4.2. 

IAS limited conclusions on the state of internal control of each DG 

Following  the  centralisation  of  the  internal  audit  function,  the  IAS  issued  for  the 
first time a conclusion on the state of internal control15 to every DG and Service in 
February 2016. These conclusions were intended to contribute to the 2015 Annual 
Activity Reports of the DGs and Services concerned and replaced the former IAC 
opinion  on  the  state  of  control.  The  conclusions  on  the  state  of  internal  control 
draw  on  the  audit  work  carried  out  in  the  last  three  years  and  cover  all  open 
recommendations issued by the IAS and IACs (insofar as the IAS has taken them 

15   Further  information  on  the  IAS  limited  conclusions  on  the  state  of  internal  control  is  included  in 
section  2.3  of  the  Report  from  the  Commission  to  the  European  Parliament,  the  Council  and  the 
European  Court  of  Auditors  on  the  2015  Annual  Management  and  Performance  Report  for  the  EU 
Budget (COM(2016)446). 

13 

 
 
                                                 
over).  In  addition,  the  conclusions  draw  particular  attention  to  all  open 
'critical'  or  the  combined  effect  of  a  number  of 
recommendations  rated 
recommendations  rated  'very  important'  as  they  may  require  the  issuance  of  a 
reservation in  the Annual Activity  Report of the DG/Service concerned. The IAS 
conclusion on the state of internal control is limited to the management and control 
systems  which  were  subject  to  an  audit  and  does  not  cover  those  which  had  not 
been audited by the IAS or the IAC in the past three years. 

4.3.  Overall opinion on the Commission's financial management 

As required by its Mission Charter, the IAS also issues an annual overall opinion16 
on the on the state of financial management in the Commission. It is based on the 
audit work in the area of financial management in the Commission carried out by 
both the IAS and the former Internal Audit Capabilities (IACs) during the previous 
three years (2013-2015). It also takes into account information from other sources, 
namely  the  reports  from  the  European  Court  of  Auditors  (ECA).  The  overall 
opinion is issued in parallel to this report and covers the same financial year. 

As  in  the  previous  editions,  the  2015  Overall  Opinion  is  qualified  with  regard  to 
the  reservations  made  in  the  Authorising  Officers'  by  Delegation  Declarations  of 
Assurance. In arriving at this opinion, the IAS considered the combined impact of 
amounts  estimated  to  be  at  risk  as  disclosed  in  the  AARs  in  the  light  of  the 
corrective capacity as evidenced by financial corrections and recoveries of the past. 
Given  the  magnitude  of  financial  corrections  and  recoveries  of  the  past  and 
assuming  that  corrections  on  2015  payments  will  be  made  at  a  comparable  level, 
the  EU  Budget  is  adequately  protected  as  a  whole  (not  necessarily  individual 
policy areas) and over time (sometimes several years later). 

Without further qualifying the opinion, the internal auditor added three ‘emphasis 
of matter’ which relate to: 

–  control strategies in the Research area for the 2014-2020 programmes, 

–  supervision  strategies  regarding  third  parties  implementing  policies  and 

programmes, and  

–  Nuclear Decommissioning and Waste Management Programme in JRC. 

5.  CONSULTATION WITH THE COMMISSION'S FINANCIAL IRREGULARITIES PANEL 

No  systemic  problems  were  reported  in  2015  by  the  Financial  Irregularities  Panel 
under Article 73(6) of the Financial Regulation applicable to the general budget of 
the European Communities. 

16   Further  information  on  the  2015  Overall  Opinion  is  included  in  annex  3  to  the  Report  from  the 
Commission to the European Parliament, the Council and the European Court of Auditors on the 2015 
Annual Management and Performance Report for the EU Budget (COM(2016)446). 

14 

 
 
                                                 
 
6.  CONCLUSIONS  

The IAS considers that the implementation of action plans drawn up in response to 
its  audits  this  year  and  in  the  past  contributes  to  the  steady  improvement  of  the 
Commission’s internal control framework. 

The IAS will conduct follow-up audits on the execution of action plans that will be 
examined  by  the  Audit  Progress  Committee,  which  will  inform  the  College  as 
appropriate. 

The IAS will continue to focus on financial, compliance and performance audits. 

15 

 
 
7.  LIST OF ACRONYMS 

Acronym 

Description 

AAR 

AOD 

APC 

CAP 

CF 

CONT 

CSC 

DGs 

ECA 

ESIF 

FP7 

FR 

HRM 

IAS 

ITSC 

JTI 

JUs 

KPI 

MS 

RER 

SG 

SWD 

TFEU 

Annual Activity Report 

Authorising Officer by Delegation 

Audit Progress Committee 

Common Agricultural Policy 

Cohesion Fund 

Budgetary Control 

Common Support Centre 

Directorates-General 

European Court of Auditors 

European Structural and Investment Funds 

Seventh Framework Programme for Research and 
Technological Development 

Financial Regulation 

Human Resources Management 

Internal Audit Service 

IT Steering Committee 

Joint Technology Initiatives 

Joint Undertakings 

Key Performance Indicator 

Member States 

Residual Error Rate 

Secretariat General 

Staff Working Document 

Treaty on the Functioning of the European Union 

16