Report on the annual accounts of the European Food Safety Authority for the financial year 2016, together with the Authority’s reply
Date: 2017-10-17
Institutions: European Court of Auditors
Subjects: European Food Safety Authority, administration of the Institutions, auditing, budgetary control, financial control








C_2017417EN.01011501.xml










6.12.2017   


EN


Official Journal of the European Union


C 417/115





REPORT
on the annual accounts of the European Food Safety Authority for the financial year 2016, together with the Authority’s reply
(2017/C 417/18)

INTRODUCTION









1.


The European Food Safety Authority (hereinafter ‘the Authority’, aka ‘EFSA’), which is located in Parma, was established by Regulation (EC) No 178/2002 of the European Parliament and of the Council (1). The Authority’s main tasks are to supply the scientific information needed for Union legislation to be drawn up concerning food and food safety, to collect and analyse data that allow risks to be identified and monitored, and to provide independent information on these risks.












2.


The Table presents key figures for the Authority (2).

Table


Key figures for the Authority








 


2015


2016




Budget (million euro) (3)



78,8 


79,5 




Total staff as at 31 December (4)



434


443












INFORMATION IN SUPPORT OF THE STATEMENT OF ASSURANCE









3.


The audit approach taken by the Court comprises analytical audit procedures, direct testing of transactions and an assessment of key controls of the Authority’s supervisory and control systems. This is supplemented by evidence provided by the work of other auditors and an analysis of management representations.










OPINION









4.


We have audited:






(a)


the accounts of the Authority which comprise the financial statements (5) and the reports on the implementation of the budget (6) for the financial year ended 31 December 2016, and










(b)


the legality and regularity of the transactions underlying those accounts,




as required by Article 287 of the Treaty on the Functioning of the European Union (TFEU).






Reliability of the accounts



Opinion on the reliability of the accounts









5.


In our opinion, the accounts of the Authority for the year ended 31 December 2016 present fairly, in all material respects, the financial position of the Authority at 31 December 2016, the results of its operations, its cash flows, and the changes in net assets for the year then ended, in accordance with its Financial Regulation and with accounting rules adopted by the Commission’s accounting officer. These are based on internationally accepted accounting standards for the public sector.






Legality and regularity of the transactions underlying the accounts



Revenue


Opinion on the legality and regularity of revenue underlying the accounts









6.


In our opinion, revenue underlying the accounts for the year ended 31 December 2016 is legal and regular in all material respects.





Payments


Opinion on the legality and regularity of payments underlying the accounts









7.


In our opinion, payments underlying the accounts for the year ended 31 December 2016 are legal and regular in all material respects.






Responsibilities of management and those charged with governance










8.


In accordance with Articles 310 to 325 of the TFEU and the Authority’s Financial Regulation, management is responsible for the preparation and presentation of the accounts on the basis of internationally accepted accounting standards for the public sector and for the legality and regularity of the transactions underlying them. This responsibility includes the design, implementation and maintenance of internal controls relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error. Management is also responsible for ensuring that the activities, financial transactions and information reflected in the financial statements are in compliance with the authorities which govern them. The Authority’s management bears the ultimate responsibility for the legality and regularity of the transactions underlying the accounts.












9.


In preparing the accounts, management is responsible for assessing the Authority’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting.












10.


Those charged with governance are responsible for overseeing the entity’s financial reporting process.






Auditor’s responsibilities for the audit of the accounts and underlying transactions










11.


Our objectives are to obtain reasonable assurance about whether the accounts of the Authority are free from material misstatement and the transactions underlying them are legal and regular and to provide, on the basis of our audit, the European Parliament and the Council or other respective discharge authorities with a statement of assurance as to the reliability of the accounts and the legality and regularity of the transactions underlying them. Reasonable assurance is a high level of assurance, but is not a guarantee that an audit will always detect a material misstatement or non-compliance when it exists. These can arise from fraud or error and are considered material if, individually or in the aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these accounts.












12.


An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the accounts and the legality and the regularity of the transactions underlying them. The procedures selected depend on the auditor’s judgment, including an assessment of the risks of material misstatement of the accounts and of material non-compliance of the underlying transactions with the requirements of the legal framework of the European Union, whether due to fraud or error. In making those risk assessments, internal controls relevant to the preparation and fair presentation of the accounts and legality and regularity of underlying transactions, are considered in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of internal controls. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of accounting estimates made by the management, as well as evaluating the overall presentation of the accounts.












13.


For revenue, we verify the subsidy received from the Commission and assess the Authority’s procedures for collecting fees and other income, if any.












14.


For expenditure, we examine payment transactions when expenditure has been incurred, recorded and accepted. Advance payments are examined when the recipient of funds provides justification for their proper use and the Authority accepts the justification by clearing the advance payment, whether in the same year or later.












15.


In preparing this report and Statement of Assurance, we considered the audit work of the independent external auditor performed on the Authority’s accounts as stipulated in Article 208(4) of the EU Financial Regulation (7).














16.


The comments which follow do not call the Court’s opinion into question.





COMMENTS ON INTERNAL CONTROLS









17.


In its audit report dated November 2016 the Commission’s Internal Audit Service (IAS) concluded that the controls in place for IT project management are adequate, but referred to significant weaknesses in relation to IT governance. It recommended updating EFSA’s IT governance policy, to introduce an organisation-wide IT risk management framework and risk register and to separate the information security function from the IT Unit. EFSA agreed with the IAS on a plan to take corrective actions.





FOLLOW-UP OF PREVIOUS YEARS’ COMMENTS









18.


An overview of the corrective action taken in response to the Court’s comments from previous years is provided in the Annex.





This Report was adopted by Chamber IV, headed by Mr Baudilio TOMÉ MUGURUZA, Member of the Court of Auditors, in Luxembourg at its meeting of 17 October 2017.


For the Court of Auditors

Klaus-Heiner LEHNE

President





(1)  OJ L 31, 1.2.2002, p. 1.

(2)  More information on the Authority’s competences and activities is available on its website: www.efsa.europa.eu

(3)  Budget figures are based on payment appropriations.

(4)  Staff includes officials, temporary and contract staff and seconded national experts.

Source: data provided by the Authority.

(5)  The financial statements comprise the balance sheet, the statement of financial performance, the cash-flow statement, the statement of changes in net assets and a summary of significant accounting policies and other explanatory notes.

(6)  The reports on implementation of the budget comprise the reports which aggregate all budgetary operations and the explanatory notes.

(7)  Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (OJ L 298, 26.10.2012, p. 1).


ANNEX
Follow-up of previous years’ comments







Year


Court's comments


Status of corrective action
(Completed/Ongoing/Outstanding/N/A)




2012


Following high level risk assessments carried out by an external consultation 2012 and by the Commission’s Internal Audit Service in February 2013 a number of potential critical risks were identified in the operation of the Authority’s internal controls, particularly in the areas of data management, business continuity and IT security. The Authority started a comprehensive self-assessment of its internal control system in 2012. The process is on-going and implementation of corrective actions is planned for 2013.


Completed




2015


The Authority has not yet put in place a clear and comprehensive financial ex post control strategy covering all areas of operations and specifying the frequency and scope of such controls.


Ongoing (1)







(1)  EFSA is in the process of developing an improved assurance governance and is fine tuning its Internal Control Framework. In particular, the EFSA approved and implemented a revised control strategy using a risk-based assessment for the mass payments made for scientific meetings and missions that will be incorporated in an EFSA procedure on financial ex ante and ex post control.



THE AUTHORITY’S REPLY






5.


EFSA welcomes the unqualified opinions issued by ECA on the reliability of the accounts and on the legality and regularity of the transactions underlying the accounts. This evidences that the control system in place at EFSA adequately ensures overall compliance.










17.


EFSA will duly implement the action plan following the IAS IT Governance audit. All actions concerning the positioning of the Information Security Function, the Business participation and the IT Strategy have been fully implemented. For the IT Governance, the majority of actions have been implemented and the remaining actions are planned to be implemented by the end of 2017.