Report on the annual accounts of the European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2016, together with the Agency’s reply
Date: 2017-09-19
Institutions: European Court of Auditors
Subjects: EU office or agency, administration of the Institutions, area of freedom, security and justice, auditing, budgetary control, financial control, information system








C_2017417EN.01019401.xml










6.12.2017   


EN


Official Journal of the European Union


C 417/194





REPORT
on the annual accounts of the European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) for the financial year 2016, together with the Agency’s reply
(2017/C 417/31)

INTRODUCTION









1.


The European Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), hereinafter ‘the Agency’, which is located in Tallinn, Strasbourg and St. Johann im Pongau, was established by Regulation (EC) No 1077/2011 of the European Parliament and of the Council (1). The core mission of this Agency is to fulfil the operational management tasks for the Second Generation Schengen Information System (SIS II), the Visa Information System (VIS) and the European System for the comparison of fingerprints (Eurodac).












2.


The table presents key figures for the Agency (2).

Table


Key figures for the Agency








 


2015


2016




Budget (million euro) (3)



71,7 


82,3 




Total staff as at 31 December (4)



134


144












INFORMATION IN SUPPORT OF THE STATEMENT OF ASSURANCE









3.


The audit approach taken by the Court comprises analytical audit procedures, direct testing of transactions and an assessment of key controls of the Agency’s supervisory and control systems. This is supplemented by evidence provided by the work of other auditors and an analysis of management representations.










OPINION









4.


We have audited:






(a)


the accounts of the Agency which comprise the financial statements (5) and the reports on the implementation of the budget (6) for the financial year ended 31 December 2016; and










(b)


the legality and regularity of the transactions underlying those accounts;




as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU).






Reliability of the accounts



Opinion on the reliability of the accounts









5.


In our opinion, the accounts of the Agency for the year ended 31 December 2016 present fairly, in all material respects, the financial position of the Agency at 31 December 2016, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector.






Legality and regularity of the transactions underlying the accounts



Revenue


Opinion on the legality and regularity of revenue underlying the accounts









6.


In our opinion, revenue underlying the accounts for the year ended 31 December 2016 is legal and regular in all material respects.





Payments


Opinion on the legality and regularity of payments underlying the accounts









7.


In our opinion, payments underlying the accounts for the year ended 31 December 2016 are legal and regular in all material respects.






Responsibilities of management and those charged with governance










8.


In accordance with Articles 310 to 325 of the TFEU and the Agency’s Financial Regulation, management is responsible for the preparation and presentation of the accounts on the basis of internationally accepted accounting standards for the public sector and for the legality and regularity of the transactions underlying them. This responsibility includes the design, implementation and maintenance of internal controls relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error. Management is also responsible for ensuring that the activities, financial transactions and information reflected in the financial statements are in compliance with the authorities which govern them. The Agency’s management bears the ultimate responsibility for the legality and regularity of the transactions underlying the accounts.












9.


In preparing the accounts, management is responsible for assessing the Agency’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting.












10.


Those charged with governance are responsible for overseeing the entity’s financial reporting process.






Auditor’s responsibilities for the audit of the accounts and underlying transactions










11.


Our objectives are to obtain reasonable assurance about whether the accounts of the Agency are free from material misstatement and the transactions underlying them are legal and regular and to provide, on the basis of our audit, the European Parliament and the Council or other respective discharge authorities with a statement of assurance as to the reliability of the accounts and the legality and regularity of the transactions underlying them. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit will always detect a material misstatement or non-compliance when it exists. These can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these accounts.












12.


An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the accounts and the legality and the regularity of the transactions underlying them. The procedures selected depend on the auditor’s judgment, including an assessment of the risks of material misstatement of the accounts and of material non-compliance of the underlying transactions with the requirements of the legal framework of the European Union, whether due to fraud or error. In making those risk assessments, internal controls relevant to the preparation and fair presentation of the accounts and legality and regularity of underlying transactions, are considered in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal controls. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of accounting estimates made by the management, as well as evaluating the overall presentation of the accounts.












13.


For revenue, we verify the subsidy received from the Commission and assess the Agency’s procedures for collecting fees and other income, if any.












14.


For expenditure, we examine payment transactions when expenditure has been incurred, recorded and accepted. Advance payments are examined when the recipient of funds provides justification for their proper use and the Agency accepts the justification by clearing the advance payment, whether in the same year or later.












15.


In preparing this report and Statement of Assurance, we considered the audit work of the independent external auditor performed on the Agency’s accounts as stipulated in Article 208(4) of the EU Financial Regulation (7).














16.


The comments which follow do not call the Court’s opinion into question.





COMMENTS ON THE LEGALITY AND REGULARITY OF TRANSACTIONS









17.


In 2016 the Agency received and accepted supplies amounting to 2,8 million euro without having budget and legal commitments (contracts) in place. These were made retroactively in order to regularise the purchases.





COMMENTS ON INTERNAL CONTROLS









18.


In its audit report of July 2016, the Commission’s Internal Audit Service (IAS) concluded that the overall design and practical implementation of processes ensures that eu-LISA operates the SIS II, VIS and Eurodac IT systems in a way that allows the continuous and uninterrupted exchange of data between the national authorities using them. Although the IAS did not highlight any very important issues, it considered that there is room for improving the efficiency of the processes in relation to configuration management and change management, release and test management, problem management, as well as service and incident management. The Agency and the IAS agreed on a plan to take corrective actions.





COMMENTS ON BUDGETARY MANAGEMENT









19.


Appropriations carried over under Title II (administrative expenditure) are high with 5 million euro, i.e. 63 % of committed appropriations (2015: 9 million euro, i.e. 50 %). They mainly concern building maintenance and consultancy services to be delivered in 2017. Such high level of carry-overs to cover next year’s activities is in contradiction with the budgetary principle of annuality.





COMMENTS ON SOUND FINANCIAL MANAGEMENT AND ON PERFORMANCE









20.


In June 2015, the Agency signed a construction contract for its premises in Strasbourg for an amount of 21,5 million euro. Stage payments were agreed as the main payment method. However, in order to increase budget consumption, the Agency amended the contract in July 2015 to make advance payments the preferred method. By November 2016 the Agency had paid the full contract amount although less than half of the works had been completed.












21.


In one of its meetings held in 2016 the Commission’s representative in the Agency’s Management Board addressed the issue of the increasing maintenance costs. While there are several arguments to explain this, such as the continued development and increased functionalities of the systems, the Court identified procurements where the Agency did not check for the most economical solution. For example, the Agency purchased a new software licence for an amount of 4,6 million euro under a framework contract (FWC) without checking that the framework contractor, who acted as an intermediary between the Agency and potential software suppliers, had found the best price.












22.


In May 2016 the Agency signed a FWC with a Consortium for 194 million euros for the further development and maintenance of the Visa Information System (VIS) and of the Biometrics Matching System (BMS) for a maximum period of six years. The contract was awarded through a public procurement procedure. One main requirement for tenderers to be accepted was having commercial access to the BMS technology. However, since the company that developed the BMS technology was not contractually obliged to grant commercial access to any interested tenderer, there was a potential risk for the competiveness of the procedure.












23.


An external evaluation of the Agency was carried out on behalf of the Commission from March to December 2015 and results were presented in the final evaluation report in March 2016. The evaluation concluded that the Agency contributes to the operational management of large-scale IT systems in the area of freedom, security and justice and effectively fulfils its tasks. In order to improve operational management further, the evaluators made 64 recommendations, seven of which are considered to be critical and 11 very important. The Agency has prepared a plan to address the recommendations that is under implementation.





FOLLOW-UP OF PREVIOUS YEARS’ COMMENTS









24.


An overview of the corrective action taken in response to the Court’s comments from previous years is provided in the Annex.





This Report was adopted by Chamber IV, headed by Mr Baudilio TOMÉ MUGURUZA, Member of the Court of Auditors, in Luxembourg at its meeting of 19 September 2017.


For the Court of Auditors

Klaus-Heiner LEHNE

President





(1)  OJ L 286, 1.11.2011, p. 1.

(2)  More information on the Agency’s competences and activities is available on its website: www.eulisa.europa.eu

(3)  Budget figures are based on payment appropriations.

(4)  Staff includes officials, temporary and contract staff and seconded national experts.

Source: data provided by the Agency.

(5)  The financial statements comprise the balance sheet, the statement of financial performance, the cash flow statement, the statement of changes in net assets and a summary of significant accounting policies and other explanatory notes.

(6)  The reports on implementation of the budget comprise the reports which aggregate all budgetary operations and the explanatory notes.

(7)  Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (OJ L 298, 26.10.2012, p. 1).


ANNEX
Follow-up of previous years’ comments







Year


Court's comments


Status of corrective action
(Completed/Ongoing/Outstanding/N/A)




2013


According to the Agency’s Founding Regulation, countries associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures must make a contribution to the Agency’s budget. Although Schengen associated countries were using the systems managed by the Agency in 2013 the Commission’s negotiations were still ongoing.


Ongoing




2014


Emphasis of matter in relation to the reliability of the accounts
Without calling into question the opinion expressed in paragraph 8, the Court draws attention to the valuation of the Schengen Information System (SIS II), the Visa Information System (VIS) and Eurodac (systems) in the Agency’s accounts. The operational management of these systems is the Agency’s core task. In the absence of reliable and complete information in respect of their total development cost, they are recorded in the Agency’s accounts at their net book values as per the Commission’s books and updated at year-end (approximately 6,6  million euro at date of transfer and 2,1  million euro at 31 December 2014). These values relate mainly to hardware and off-the-shelf software components and do not include software development costs (see note 6.3.1 to the annual accounts of the Agency).


Completed




2015


The Agency signed a two million euro framework contract for the procurement services by a contractor (procurement services), for training, coaching and learning services from third party providers (training services). The contractor identifies suitable training services for any specific request, and provides a quote for the training services plus a fee for its own procurement service (uplift). However, the framework contract fails to specify that the procurement services should be in compliance with the procurement provisions in the Agency’s financial rules. Therefore the current process of submitting quotes for approval by the Agency does not ensure that the services are procured in compliance with all requirements of the financial rules.


Outstanding




2015


The call for expression of interest and pre-selection of candidates for participation in a negotiated procedure with an estimated value of 20 million euro took place without a delegation by the authorising officer.


N/A




2015


The committed appropriations carried over under budget Title II (administrative expenditure) amount to 9 million euro or 50 % of total committed appropriations (2014: 15 million euro; i.e. 87 %). These carry-overs mainly concern a large contract for the extension of the Strasbourg building (4,6  million euro) as well as services provided under multiannual contracts.


N/A




2015


Arrangements with Schengen Associated Countries (Switzerland, Liechtenstein, Iceland and Norway) defining detailed rules for their participation in the work of the Agency, including provisions on voting rights and their contribution to the Agency’s budget, have still not been concluded. In their absence, Schengen Associated Countries contribute to Title III (operational expenditure) of the Agency’s budget following a provision in the association agreements signed with the EU. However they do not yet contribute to activities under Titles I and II (salaries and other administrative expenditure) of the Agency’s budget.


Ongoing




2015


The audited procurement procedures showed that the Agency engaged in contractual agreements or negotiations with a single contractor without precisely defining the services requested. This limits competition and increases dependence upon the contractor. The Agency should conclude agreements with multiple suppliers or define the services required more precisely, whenever possible.


Outstanding







THE AGENCY’S REPLY






17.


The procedures were chosen in order to deal with urgent operational requirements, also in response to rapidly growing storage needs required by Member States.










18.


The Agency takes note of the Court’s comment. An action plan to address findings has been agreed between eu-LISA and IAS and is in the process of being implemented.










20.


Carry-overs for Title 1 and 2 appropriations are constantly revised and planned with the objective of reducing them over time to the strictly necessary and only when the operation is justified.
As a performance indicator, of the EUR 19 551 594,31 non-differentiated appropriations carried over to 2016 only EUR 474 015,04 were cancelled (2,42 %).










21.


The mechanism foreseen for the payment responded to the budgetary constraints to allow full utilisation of the C1 and C2 appropriations within the year n+1 rules governing non-differentiated appropriations.
The pre-financing payments were associated to a matching financial guarantee, released in accordance with progress of work, minimising the risk for the Agency. In addition to the financial guarantees, a 5 % performance guarantee was issued by the contractor. The performance guarantee is specifically linked to the execution of the contractual obligations.










22.


As regards the VIS components maintenance extension, it was assessed that the envisaged changes could not be technically or economically separated from the main contract. In this respect, it has to be noted that WCC is the owner of intellectual property rights of Elise search engine. Therefore, any other vendor would be in fact a subcontractor of WCC, thus not in position to provide better value for money. Furthermore, SC 14 did not only concern the permanent of WCC Elise licences, but also their subsequent maintenance; such maintenance could not be attributed to a third-party vendor without compromising the overall responsibility of the MWO contractor for the VIS maintenance.
Furthermore, it is noted that the acquisition of permanent WCC Elise licences resulted in significant savings for the Agency in the long term, estimated at EUR 402 243,22 over a four-year period.
Lastly, it is noted that Article I.19.1 of the FWC special conditions foresees the ‘most favoured customer’ clause, further protecting the financial interest of the Agency when sourcing hardware or software from the contractor.










23.


The Agency acknowledges the potential risk identified by the Court but considers that it did not materialise as no economic operator raised objections about their access to the technology. Therefore we have reasonable assurance that the agreement was respected.










24.


The Agency takes note of the Court’s comment and confirms that the agreed action plan is under implementation.