COMMISSION STAFF WORKING DOCUMENT Summary of Executive summaries. Internal audit engagements finalised by the IAS in 2017 Accompanying the document Report from the Commission to the European Parliament and the Council Annual report to the Discharge Authority on Internal audits carried out in 2017
Date: 2018-09-21
Institutions: European Commission, Secretariat-General
Subjects: administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 21.9.2018 SWD(2018) 429 final  COMMISSION STAFF WORKING DOCUMENT Summary of Executive summaries. Internal audit engagements finalised by the IAS in 2017 Accompanying the document Report from the Commission to the European Parliament and the Council Annual report to the Discharge Authority on Internal audits carried out in 2017 {COM(2018) 661 final}  
 
 
Contents 

CONTENT OF THIS STAFF WORKING DOCUMENT: .................................................................................... 6 

PART 1: FINAL REPORTS ......................................................................................................................... 7 

1. 

HORIZONTAL AUDITS .................................................................................................................... 7 

1.1. 

1.2. 

1.3. 

1.4. 

1.5. 

1.6. 

Audit on management of recovery orders for competition fines (incl. guarantees for 
competition fines) and for recovery orders in the context of the Commission's 'corrective 
capacity' – Phase I (Directorates-General CONNECT, ENER, LS, EACEA) ...................... 7 

Audit on HR management and staff allocation in Directorate-General HOME and 
Directorate-General JUST ................................................................................................... 10 

Audit on amendments of 2014-2020 OPs in Directorates-General REGIO, EMPL and 
MARE ................................................................................................................................. 12 

Audit on the Commission's framework/arrangements for the estimation, assessment and 
reporting on the cost-effectiveness of controls (Directorates-General BUDG , NEAR, 
REGIO, RTD) ..................................................................................................................... 16 

Audit on the Commission's supervision of the implementation of CEF financial instruments 
in Directorate-General ENER and Directorate-General MOVE ......................................... 19 

Audit on the Commission’s governance/oversight arrangements concerning risk 
management, financial reporting and the ex-post verification/audit function (Secretariat-
General and Directorates-General AGRI, BUDG, DEVCO, REGIO, RTD) ...................... 19 

1.7. 

Audit on the production process and the quality of statistics not produced by Eurostat 
(ESTAT and Directorates-General ENER, FISMA, GROW and JUST) ............................ 29 

2. 

AGRICULTURE, NATURAL RESOURCES AND HEALTH .................................................................. 33 
Audit on Directorate-General AGRI's management of agricultural market crises .............. 33 

2.1. 

2.2. 

Audit on Directorate-General AGRI's implementation of RDPs ........................................ 35 

2.3. 

Audit on Directorate-General AGRI's control strategy for the CAP 2014-2020 ................. 36 

2.4. 

Audit on CHAFEA's management and control system for the implementation of the 
measures for the promotion of agricultural products .......................................................... 38 

2.5. 

Audit on LIFE + phasing out in Directorate-General ENV ................................................ 39 

2.6. 

Audit on monitoring and enforcement of EU environmental law in Directorate-General 
ENV ..................................................................................................................................... 41 

2.7. 

Audit on Directorate-General SANTE’s food safety crisis preparedness ........................... 44 

3. 

COHESION .................................................................................................................................... 47 
Audit on policy and funding for youth employment in Directorate-General EMPL .......... 47 

3.1. 

3.2. 

Audit on monitoring the implementation and performance of FEAD OPs in Directorate-
General EMPL ..................................................................................................................... 52 

1 

 
 
3.3. 

Audit on major projects in Directorate-General REGIO ..................................................... 55 

4. 

RESEARCH ENERGY AND TRANSPORT ............................................................................. 58 
Audit on H2020 project management in Directorate-General CONNECT ......................... 58 

4.1. 

4.2. 

Audit on procurement in DG CONNECT ........................................................................... 60 

4.3. 

Audit on closure of FP7 projects in ERCEA ....................................................................... 61 

4.4. 

Audit on grant management - phase 2: project management and payments for CEF in INEA
 ............................................................................................................................................. 62 

4.5. 

Audit on HR management in INEA .................................................................................... 63 

4.6. 

Audit on scientific project management in JRC .................................................................. 64 

4.7. 

Audit on HR management – recruitment of scientists in JRC ............................................. 65 

4.8. 

Audit on the effectiveness of the set-up and supervision of Shift2Rail by  Directorate-
General MOVE .................................................................................................................... 65 

4.9. 

Audit on closure of FP7 projects in REA ............................................................................ 67 

4.10.  Audit on HR management in Directorate-General RTD ..................................................... 68 

5. 

EXTERNAL ACTIONS ............................................................................................................. 69 

5.1. 

5.2. 

5.3. 

5.4. 

5.5. 

Audit on management of investment facilities (financial instruments) in Directorate-
General DEVCO.................................................................................................................. 69 

Audit on Directorate-General ECHO’s grant management in response to the Syrian crisis in 
the Middle East (Headquarters and Field Offices) .............................................................. 71 

Audit on procurement under Instrument for Pre-Accession (direct management and indirect 
management with beneficiary countries) – phase II in Directorate-General NEAR ........... 72 

Limited review of grant and procurement procedures in the EU Delegation of Armenia – 
Directorate-General NEAR ................................................................................................. 74 

Audit on preparedness for the mid-term review of ENI and IPA Regulations in Directorate-
General NEAR .................................................................................................................... 74 

6. 

EDUCATION AND CITIZENSHIP ........................................................................................... 75 

6.1. 

6.2. 

Consulting report on Directorate-General EAC's process to granting full financial 
autonomy to the EIT ............................................................................................................ 75 

Audit on Erasmus+ and Creative Europe – grant management phase 1 (from the call to the 
signature of contracts) in EACEA ....................................................................................... 75 

6.3. 

Audit on HR management in EACEA ................................................................................. 79 

7. 

ECONOMIC AND FINANCIAL AFFAIRS .............................................................................. 82 

7.1. 

Audit on enforcement of the EU antitrust policy in Directorate-General COMP: 
cooperation with EU national competition authorities and national courts ......................... 82 

2 

 
 
7.2. 

7.3. 

Audit on financial management of procurement contracts and grants in  Directorate-
General COMP .................................................................................................................... 83 

Audit on the governance and operational organisation of the Investment Plan for Europe in 
Directorate-General ECFIN ................................................................................................ 85 

7.4. 

Audit on HR management in EASME ................................................................................ 85 

7.5. 

Audit on H2020 project management in EASME ............................................................... 86 

7.6. 

Audit on evaluation in Directorate-General ECFIN ............................................................ 87 

7.7. 

7.8. 

7.9. 

Audit on financial management of procurement and grants in Directorate-General FISMA
 ............................................................................................................................................. 87 

Limited review of the calculation and the underlying methodology of the residual error rate 
for the 2016 reporting year in Directorate-General GROW ................................................ 89 

Audit on the accuracy of information on the Internal Market in Directorate-General GROW
 ............................................................................................................................................. 91 

7.10.  Audit on the supervision of the implementation of the Copernicus programme in 

Directorate-General GROW – phase 1: control strategy on ESA entrusted budget ............ 91 

7.11.  Audit on internal processes supporting trade policy negotiations in  Directorate-General 

TRADE ................................................................................................................................ 92 

8. 

GENERAL SERVICES .............................................................................................................. 93 
Audit on the procurement process in DIGIT ....................................................................... 93 

8.1. 

8.2. 

Audit on the charge-back of services in Directorate-General HR ....................................... 94 

8.3. 

Audit on ethics in OLAF ..................................................................................................... 96 

8.4. 

Audit on the procurement process in PO ............................................................................. 98 

8.5. 

.  Consulting engagement on the efficiency of the workflow for parliamentary questions in 
SG ........................................................................................................................................ 99 

8.6. 

Audit on the financial management of the SRSS ................................................................ 99 

9. 

IT AUDITS ............................................................................................................................... 101 
Audit on corporate IT governance framework and portfolio management (DIGIT, SG) .. 101 

9.1. 

9.2. 

Audit on management of IT security in DIGIT ................................................................. 104 

9.3. 

9.4. 

Audit on security of IT applications supporting nuclear accountancy and inspection 
processes in Directorate-General ENER ........................................................................... 107 

Audit on IT programme and project management in the HR family (DIGIT, HR, EPSO, 
PMO) ................................................................................................................................. 110 

9.5. 

Audit on IT logical security controls in OLAF ................................................................. 114 

3 

 
 
9.6. 

Audit on supervision of outsourced IT operations in Directorate-General TAXUD ........ 117 

PART 2: FOLLOW-UP ENGAGEMENTS (SUMMARISED) ........................................................................ 119 
Follow-up audit on the management of intra-muros contractors ...................................... 119 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

10. 

11. 

12. 

13. 

14. 

15. 

16. 

17. 

18. 

19. 

20. 

Follow-up audit on the new Better Regulation (BR) agenda in the Commission ............. 119 

Follow-up audit on effectiveness of the management of absenteeism in the Offices (OIB, 
OIL and Directorate-General HR) ..................................................................................... 120 

Follow-up audit on early implementation of the ESIF control strategy in Directorates-
General REGIO, EMPL and MARE ................................................................................. 121 

Follow-up audit on information security governance in the Commission ........................ 121 

Follow-up audit on the Participant Guarantee Fund for FP7 and Horizon 2020 in 
Directorate-General RTD, Directorate-General ECFIN and ERCEA ............................... 121 

Follow-up audit on Directorate-General AGRI's management and control system for 
Voluntary Coupled Support (VCS) ................................................................................... 122 

Follow-up audit on the management of grants under 2014-2020 consumer and health 
programmes in CHAFEA .................................................................................................. 122 

Follow-up audit on public procurement in Directorate-General CLIMA ......................... 123 

 Follow-up audit on Human Resources management in Directorate-General CNECT ..... 124 

Follow-up audit on strategic planning and programming/ activity based management 
(SPP/ABM) in JRC ........................................................................................................... 124 

Follow-up audit of the ex-IAC audit on document management in JRC .......................... 124 

Follow-up audit of the ex-IAC audit on nuclear decommissioning and waste management 
programme in JRC ............................................................................................................. 124 

Follow-up audit of former IAC recommendations in Directorate-General JRC ............... 125 

Follow-up audit on H2020 grant management in the REA ............................................... 125 

 Follow-up audit on H2020 grant management in Directorate-General RTD: from the 
preparation of the work programme to the signature of the grant agreements .................. 125 

Follow-up audit on the set up of the Common Support Centre (CSC) for H2020 ............ 126 

Follow-up audit on grant management in Directorate-General JUST ............................... 126 

Follow -up audit on the management of the African Peace Facility in Directorate-General 
DEVCO ............................................................................................................................. 126 

Follow-up audit of the limited review of Directorate-General NEAR’s residual error rate 
(RER) methodology and calculation ................................................................................. 127 

4 

 
 
21. 

22. 

23. 

24. 

25. 

26. 

27. 

28. 

29. 

30. 

31. 

Follow-up audit on control strategy in Directorate-General NEAR .................................. 128 

Follow-up audit on the effectiveness and efficiency of Erasmus+ control strategy in the 
Education, Audio-visual and Culture Executive Agency (EACEA) and in National 
Agencies (Directorate-General EAC) ................................................................................ 128 

Follow-up audit on financial management and grant processes in Directorate-General 
ECFIN. .............................................................................................................................. 128 

Follow-up audit on former IAC recommendations in ESTAT .......................................... 128 

Follow-up audit on the procurement process in Directorate-General COMM .................. 129 

Follow-up audit on former IAC recommendations in PMO .............................................. 129 

Follow-up audit on business continuity management in OP ............................................. 130 

Follow-up audit on management of European Commission Authentication Service - ECAS
 ........................................................................................................................................... 130 

Follow-up audit on the management of the security of EU ETS IT system ...................... 130 

Follow-up audit on management of local IT in Directorate-General COMP .................... 131 

Follow-up audit on management and supervision of contracts for outsourced IT services 
(IT contract management) in DIGIT ................................................................................. 132 

32. 

Follow-up audit on effectiveness of measures to handle manual interventions in ABAC 132 

List of follow-up audits performed in 2017 for which all recommendations have been closed after 

the follow-up ..................................................................................................................... 133 

PART 3: SUMMARY OF LONG OUTSTANDING RECOMMENDATIONS AS AT 31 JANUARY 2018 ............ 136 

5 

 
 
 
 
 
CONTENT OF THIS STAFF WORKING DOCUMENT: 

Part 1 of this Staff Working Document contains the objective and scope, key findings and the 
critical  and  very  important  recommendations  of  the  Internal  Audit  Service  engagements 
which were part of the 2017 Internal Audit Service audit plan (cut-off date for the exercise: 
31 January 2018). Important and desirable recommendations are not reproduced in this Staff 
Working Document. The information contained in this Staff Working Document reflects the 
state of play when the audit engagements were finalised as stated in the executive summary of 
the  audit  report1.  The  executive  summary  of  each  audit  underwent  the  applicable  standard 
professional validation and contradictory procedures between auditor and auditee at the time 
of  the  finalisation  and  aims  to  provide  a  quick  understanding  of  the  audits  and  their  main 
results. Following the Internal Audit Service audits, the DGs/services have developed action 
plans  which  have  been  implemented  or  which  are  in  the  process  of  being  implemented. 
Additional  information  on the measures defined and/or  implemented by  the DGs/services is 
provided at the end of each section of the audit concerned. The effective implementation of 
the  actions taken  by the  Commission’s  DGs/Services  will  be  assessed  by  the  Internal  Audit 
Service in due course, in accordance with its follow-up policy. 

Part  2  of  this  Staff  Working  Document  contains  a  summary  of  the  Internal  Audit  Service 
follow-up engagements conducted in the period from 1 February 2017 to 31 January 20182. 

Part  3  provides  a  summarised  overview  of  the  12  long  overdue  very  important 
recommendations as at 31 January 2018. 

1     For the audit on Commission’s governance/oversight arrangements concerning risk management, financial 
reporting  and  the  ex-post  verification/audit  function  the  presentation  in  this  Staff  Working  Document 
reflects the situation following the communication in September 2018 by the auditees to the Internal Audit 
Service of an action plan confirming the full acceptance of all recommendations stemming from the audit 
report; this action plan was assessed as satisfactory by the Internal Audit Service. 

2     The summary reflects the assessment of the Internal Audit Service on the status of implementation of the 
audit  recommendations  at  the  end  of  the  follow-up  assignment.  It  does  not  take  into  account  any  further 
actions that may have been undertaken by the auditee and reported to the Internal Audit Service since the 
release of the Internal Audit Service follow-up note or report, possibly having an impact on the status of the 
recommendation. 

6 

 
 
 
 
                                                            
PART 1: FINAL REPORTS 

1.  HORIZONTAL AUDITS 

1.1.  Audit on management of recovery orders for competition fines (incl. guarantees for 
competition fines) and for recovery orders in the context of the Commission's 'corrective 
capacity' – Phase I (Directorates-General CONNECT, ENER, LS, EACEA) 

Audit objectives and scope 

The objective of the audit was to assess whether the Commission has put in place an effective 
and efficient control system for the management of the recovery orders in the context of the 
Commission's 'corrective capacity' both at the central and the operational level. 

The audit was conducted under a phased approach in order to manage a perceived conflict of 
interest situation: 

Phase I of the audit assessed the efficiency and effectiveness of the system put in place for the 
management of recovery orders in the three sample-Directorates-General CONNECT, ENER 
and  EACEA.  It  also  assessed  timeliness  and  efficiency  of  the  enforced  recovery  process 
performed by the LS, as well as support and guidance offered by that service to Authorising 
Officers by Delegation (AOD). 

Phase  II  of  the  audit  will  start  during  the  second  half  of  2018  to  take  into  account  the 
"cooling-off period" as prescribed by IPPF standard 1130 A.1 (internal auditors must refrain 
from  assessing  specific  operations  for  which  they  were  previously  responsible),  due  to  the 
arrival of the Internal Audit Service Director-General from the Directorate-General Budget. It 
will cover the efficiency and effectiveness of the system put in place for the management of 
recovery  orders  in  Directorate-General  COMP  and  of  the  corporate  framework  for  the 
management of the recovery process put in place by the Directorate-General Budget. It will 
also  assess  the  efficiency  and  effectiveness  of  the  pre-litigation  phase  managed  by  the 
Directorate-General  Budget  and  the  management  of  the  credit  risk  of  provisionally  cashed 
fines and the financial guarantees provided in the context of competition fines. 

Given the distinct responsibilities of the actors involved in the recovery process, the scope of 
the audit covered/will cover: 

  At  the  central  level,  for  the  Directorate-General  Budget  (in  2018)  and  LS  (in  2017), 
whether the current framework put in place for this process supports Authorising Officers 
by  Delegation  in  carrying  out  effective  and  efficient  recovery  procedures.  It  will  also 
examine the control systems of the Directorate-General Budget and the LS for their own 
distinct  areas  of  responsibility,  including  the  pre-litigation  and  enforcement  phases, 
managed by the Directorate-General Budget and LS, respectively.  

  At  the  operational  level,  a  sample  of  Directorates-General/EAs  (in  2017)  to  assess  the 
efficiency and effectiveness of the management of recovery orders. The entities sampled 
were  
Directorate-General ENER, Directorate-General CONNECT, Directorate-General COMP 
(in 2018) and EACEA. 

7 

 
 
There  were  no  observations/reservations  in  the  2016  Annual  Activity  Reports  of  the  LS,  
Directorate-General  CONNECT,  EACEA  or  Directorate-General  ENER  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 27 June 2017. All observations and recommendations relate to 
the situation as of that date. 

Strengths (CONNECT) 

The auditors recognised the ongoing efforts made by Directorate-General CNECT in order to 
develop and improve the recovery process at their level. In particular, the auditors identified 
the following strengths: 

a) 

Centralisation of the recovery monitoring activity with unit R2 

Unit  R2's  mandate  is  to  monitor  the  overdue  recovery  orders  issued  by  the  Directorate-
General as well as to liaise with operational Directorates, the Directorate-General Budget and 
LS.  Therefore,  the  roles  and  responsibilities  of  each  actor  for  the  recovery  orders  process 
within  Directorate-General  CNECT  are  clearly  established  and  the  audit  did  not  identify 
overlaps among the tasks assigned to the services intervening in the process. 

b) 

Customised IT tools used 

Directorate-General  CNECT  uses  an  appropriate  IT  tool  to  support  the  recovery  orders 
process (iFlow), which automates some of the controls (for example, recovery orders coming 
from implementation of ex-post controls are encoded as Irregularities by default). 

c) 

Checklists used by unit R2 

Directorate-General  CNECT  uses  detailed  checklists  for  the  recovery  orders,  including 
necessary steps, guidance and actors involved in the process.  

d) 

Pro-activeness in searching for off-setting possibilities  

Directorate-General  CNECT  proactively  searches  for  offsetting  possibilities  with  other 
Directorates-General,  in  particular  for  Horizon  2020.  When  Directorate-General  CNECT 
identifies  upcoming  payments  to  the  same  beneficiaries  in  other  Directorates-General  (by 
using the Corda application available at Commission level), it contacts the other Directorates-
General to inform them of the existence of recovery orders. Directorate-General CNECT also 
informs the Directorate-General Budget in order to ensure that the offsetting is processed. 

Strengths (EACEA) 

The  auditors  recognised  the  ongoing  efforts  made  by  EACEA  in  order  to  develop  and 
improve the recovery process at their level. In particular the auditors identified the following 
strengths: 

a) 

Monitoring of the Recovery Order process 

The monitoring of the recovery orders process in EACEA enables it to follow-up the recovery 
orders (ROs) assigned to the Authorising Officer responsible. This is especially important as 
the recovery orders process is highly decentralised in the Agency: 

8 

 
 
- Ten Operational Units who identify the ROs, encode ROs, send pre-information letters, 
send debit notes and prepare files for enforced recoveries;  

-  This  is  complemented  by  the  central  Unit  R2  "Finance  Accounting  Programming" 
which verifies waivers, cancellations of recovery orders, the files for enforced recoveries, 
monitors the workload of the Executive Agency regarding recoveries and sets priorities 
for the Operational Units based on appropriate criteria. 

b) 

Measurement of the performance of the Recovery Order process 

The Agency has defined an appropriate objective, with indicators and targets to measure the 
performance  of  the  Recovery  Order  process  across  the  Agency.  These  are  presented  to  the 
management of the Agency as part of a monthly dashboard.    

c) 

Analysis of the performance of the Recovery Order process 

The Finance Coordinators within the Central Unit R2 provide the Accounting Sector with an 
analysis of the quarterly targets and also identify the root causes in case of not achieving the 
quarterly  targets.  This  explanation  is  provided  to  the  Director  of  EACEA  and  also  to  the 
relevant actors in the Operational Units. 

Strengths (ENER) 

The auditors recognised the ongoing efforts made by Directorate-General ENER in order to 
develop and improve the recovery process at their level. In particular, the auditors identified 
the following strengths: 

a) 

Use of checklist 

Directorate-General  ENER  has  developed  and  uses  a  detailed  checklist  that  includes  the 
necessary steps, guidance and actors involved in the recovery order process.   

b) 

Roles and responsibilities are well defined 

The  roles  of  each  actor,  as  well  as  the  related  responsibilities,  are  clearly  established.  The 
audit did not identify overlaps among the tasks assigned to the Directorates-General/Services 
intervening in the process, or aspects not covered. 

Strengths (LS) 

The  auditors  recognised  the  ongoing  efforts  made  by  the  Legal  Service  in  order  to  develop 
and  improve  the  recovery  process  at  their  level.  In  particular,  the  auditors  identified  the 
following strengths: 

a) 

Procedures and guidelines 

Procedures  for  the  enforcement  of  recovery  orders  are  well  established  and  defined,  and 
supported by the Guide to the enforced recovery of Commission entitlements, information on 
BUDGWEB and case law. 

9 

 
 
b) 

IT tools 

The Legal Service uses a number of IT tools (RECO database, Base contentieux and NAT) to 
support the process of enforcement of recovery orders.  

Major audit findings 

Following  on  from  Phase  1,  the  Internal  Audit  Service  did  not  identify  any  critical  or  very 
important issues in Directorate-General CONNECT, Directorate-General ENER, EACEA or 
the LS. 

1.2.  Audit on HR management and staff allocation in Directorate-General HOME and 
Directorate-General JUST 

Audit objectives and scope 

The objective of the audit was to assess whether Directorate-General HOME and Directorate-
General JUST have put in place adequate governance, risk management and internal control 
processes  for allocating and managing its human resources (HR), enabling the Directorates-
General to deliver on their policy priorities, objectives and core tasks. 

The  scope  of  the  audit  did  not  include  the  allocation  of  establishment  plan  posts  to  the 
Directorates-General  at  corporate  level  or  an  in-depth  assessment  of  the  Commission's  new 
HR management (HRM) delivery model.  

There were no observations/reservations in the 2016 Annual Activity Reports of Directorate-
General HOME or Directorate-General JUST that relate to the area/process audited.  

The  fieldwork  was  finalised  on  22  September  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths (HOME) 

The auditors recognised the ongoing efforts made by Directorate-General HOME to: 

assess and communicate to the corporate level its staff needs for responding to its new 

a) 
tasks and responsibilities;  

b) 

c)  

align its organisational structure to its priorities;  

follow up on the 2016 Staff Survey results with a detailed Action Plan; 

support  the  corporate  initiative  on  the  prevention  of  psychosocial  risks  at  the 

d) 
workplace through its participation in Directorate-General HR's pilot project on that topic. 

Strengths (JUST) 

The auditors recognised the ongoing efforts made by Directorate-General JUST to: 

10 

 
 
 
provide  a  quick  and  effective  response  to  a  number  of  areas  for  improvement 
a) 
identified  in  the  2016  Commission  Staff  Survey.  In  particular,  the  Directorate-General  has 
taken effective measures to increase the efficiency and effectiveness of its business processes 
in three priority areas; 

b) 
involve  and  engage  its  staff  in  an  open  dialogue  with  senior  management  through 
regular  staff  consultation  on  key  areas  and  in  particular  through  consultation  and 
communication activities aimed at making the reorganisation as transparent and as democratic 
as possible. 

Major audit findings 

The  Internal  Audit  Service  identified  two  very  important  issues  for  Directorate-General 
HOME and one very important issue for Directorate-General JUST: 

Directorate-General HOME's strategic approach to HRM 

The Internal Audit Service found that HR management in Directorate-General HOME is not 
supported by a comprehensive HR strategy or policy. The Directorate-General had not yet put 
in  place  an  established  framework  defining  its  main  challenges  related  to  HRM,  its  main 
objectives,  the  measures  that  it  intends  to  take  to  achieve  its  goals,  and  the  tools  through 
which it plans to ensure the effective implementation of HR measures, including monitoring 
mechanisms.  Furthermore,  important  strategic  HRM  processes  had  not  yet  been  defined  in 
sufficient  detail,  in  particular  on  internally  matching  human  resources  to  needs  and  on 
increasing staff performance through sustainable people management measures. The Internal 
Audit Service also underlined the inherent link between HRM and the Directorate's-General 
broader organisational culture.  

Allocation of HR (for both Directorate-General HOME and Directorate-General JUST) 

The Internal Audit Service found that neither of the Directorates-General had put in place a 
robust  and  transparent  system  for  taking  HR  allocation  decisions.  More  specifically,  staff 
allocation decisions did not adequately take into account the Directorates’-General core tasks 
and priorities; the workload affecting different parts of the organisation; and information on 
existing  talents  and  special  competencies  of  the  workforce.  Furthermore,  the  Directorates-
General  had  not  yet  put  in  place  an  established  system  or  mechanism  that  would  facilitate 
closing  the  gaps  between  identified  needs  and  available  resources,  in  particular  through 
measures  of  flexible  and  rapid  redeployment  of  existing  staff  to  areas  where  they  are  most 
needed.  

Recommendations 

Directorate-General HOME's strategic approach to HRM 

Directorate-General  HOME  should  establish  an  HR  strategy/policy  that  brings  together 
existing  HRM  processes  and  measures  into  a  comprehensive  framework,  sets  out  the 
Directorate's-General  main  HRM  related  objectives,  identifies  key  HR  challenges/risks  and 
mitigating measures/actions, and defines the arrangements for monitoring its implementation. 
The  Directorate-General  should  also  strengthen  its  organisational  culture  by  addressing  key 
weaknesses  in  communication  between  senior  management  and  staff,  leadership  style, 
respect, fair treatment and development of the workforce. 

11 

 
 
Allocation of HR 

Both  Directorates-General  should  strengthen  their  HR  allocation  system  by  establishing  a 
structure/mechanism for identifying HR needs and for rapidly deciding on solutions to close 
gaps.  HR  allocation  decisions  should  be  supported  by  relevant  information  on  (1)  tasks, 
priorities  and  resources  attached  to  them;  (2)  workload  affecting  the  Directorate's-General 
units;  and  (3)  skills  and  competencies  of  staff;  and  should  be  made  more  transparent  and 
objective through the use of  quantifiable data and objective criteria. Finally, the Directorates-
General  are  encouraged  to  establish  a  process  for  prioritising  work  (including  the 
identification  of  negative  priorities)  in  order  to  use  their  existing  workforce  in  the  most 
efficient manner. 

Additional  information  provided  by  Directorates-General  HOME  and  JUST  on  the 
measures defined and/or implemented following the Internal Audit Service audit 

The two recommendations to be followed regarding DG HOME's strategic approach to human 
resource  management  (recommending  the  development  of  a  Human  Resources  strategy  or 
plan,  and  strengthening  the  DG's  broader  organisational  culture),  and  to  the  allocation  of 
human resources (recommending the establishment of a structure / mechanism for identifying 
human resources needs in both Directorates-General), as well as one recommendation relating 
to sustainable people management are being followed up by DG HOME in accordance with 
the Action Plan which was considered satisfactory by the Internal Audit Service. Most of the 
actions will be implemented by the end of 2018. 

In accordance with DG JUST’s action plan, preparatory research has been carried out to seek 
corporate guidance and identify best practices. Furthermore, different possible data to provide 
objective  criteria  for  assessing  workloads  have  been  considered  and  discussed  with  senior 
management  (including  overtime  and  sick-leave).  Talent  management  initiatives  have  been 
studied and the first measure in the form of an internal expression of interest to change post 
within the DG has been launched.  Further improvements are expected after full deployment 
of ATLAS, a centralised IT tool for human resources. 

1.3.  Audit  on  amendments  of  2014-2020  OPs  in  Directorates-General  REGIO,  EMPL 
and MARE   

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  whether  the  design  of  the  Directorates'-General 
internal control systems for approving requests for European Structural and Investment Fund 
(ESIF)  Operational  Programme  Amendments  (OPA)  is  adequate  and  is  effectively 
implemented in a consistent and timely manner at this early stage of OP implementation. The 
Internal Audit Service addressed this  objective by assessing whether  the design of the OPA 
process  is  adequate  in  order  to  ensure  an  effective,  timely,  and  consistent  assessment  and 
approval of the amendment requests submitted by Member States (MS), in compliance with 
the  Common  Provisions  Regulation  (CPR)  and  Fund-specific  rules,  and  whether  the 
implementation of the OPA process is effective, timely, and consistent. 

12 

 
 
 
There  were  no  observations/reservations  in  the  2016  Annual  Activity  Reports  of  the  three 
Directorates-General that relate to the process audited. 

The fieldwork was finalised on 20 April 2017. All observations and recommendations relate 
to the situation as of that date, except in relation to the new procedure on issuing observations 
on  OPAs.  The  inter  service  consultation  relating  to  this  new  procedure  closed  after  the 
Internal Audit Service had finalised the fieldwork (19 May 2017). 

Strengths 

The  auditors  recognised  the  ongoing  efforts  made  by  the  audited  Directorates-General  to 
ensure  a  coordinated  approach  to  processing  OPA  requests.  During  the  audit,  the  Internal 
Audit Service identified the following strengths:  

a) 
The  guidance  in  place  at  the  three  Directorates-General  was  coordinated  jointly 
between the ESIF Directorates-General by the Stock-Taking Group, which meets on a weekly 
basis to coordinate common positions between the ESIF Directorates-General. 

b) 
There is joint legal interpretation of the applicable regulations by ESIF Directorates-
General. Answers on questions from MS and Desk Officers (DOs) on regulatory matters are 
available on Directorate-General REGIO's SharePoint ''Interpretation site'', and on the REGIO 
wiki. 

At  Directorate-General  EMPL,  upstream  work  on  the  analysis  of  an  OPA  request  is 
c) 
performed  and  documented  prior  to  the  official  submission  through  SFC2014  (System  for 
fund management for the 2014-2020 programming period). This is formalised and is part of 
the OPA process.  

d) 

Internal coordination meetings at the 3 Directorates-General:  

- At Directorate-General REGIO, the monthly "Implementation Network" is a forum for 
discussion  among  Geographical  Units  (GUs)  and  coordination  and  policy  units,  and 
Directorate-General  REGIO's  hierarchy  on  topics  concerning  fund  programming  and 
implementation.  

- At Directorate-General EMPL, ESF Coordination Support Group (CSG) meetings take 
place on a monthly basis. The CSG's mission is to provide guidance on ESF and policy 
related issues, and is a forum for discussion among the GUs and coordination and policy 
units, and Directorate-General EMPL hierarchy.  

-  At  Directorate-General  MARE,  the  EMFF  Coordination  Group  takes  place  twice  per 
month, with the objective of enhancing efficiency and ensuring consistency across units 
in policy development and implementation.  

Existence  of  a  strategy  towards  a  more  performance  based  culture,  and  evaluation 

e) 
strategy in Directorates-General REGIO and EMPL. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

13 

 
 
Consistency, effectiveness, and timeliness of the OPA process 

OP amendment requests submitted by the MS may require significant changes to the funding 
priorities  of  the  OP  and  therefore  need  to  be  analysed  thoroughly  before  adoption  by  the 
Commission.  The  deadlines  prescribed  by  the  regulation  for  issuing  observations  and 
adopting  OP  amendments  means  that  the  process  is  very  time  pressured,  with  little  or  no 
margins  for  delay  on  the  part  of  the  Commission.  This  time  pressure  has  been  further 
compounded by the Legal Service's opinion that observations on OP amendments need to be 
adopted  by  Commission  Decision,  which  was  not  envisaged  by  the  Directorates-General 
when  proposing  the  2014-2020  CPR.  Directorate-General  REGIO  in  particular  has  faced 
considerable  delays  in  adopting  OP  amendments  within  the  regulatory  deadline  of  three 
months,  whereas  delays  were  less  pronounced  at  Directorate-General  EMPL  and  at 
Directorate-General  MARE.  To  gain  time,  the  Directorates-General  made  use  of  "technical 
observations"  as  a  way  of  making  observations  on  OP  amendments  (instead  of  by 
Commission  Decision),  even  though  these  often  involved  substantive  rather  than  routine 
issues.  More  recently,  the  Directorates-General  adopted  a  new  procedure  of  issuing 
observations by "service letter" signed by the Director-General.  

Recommendation 

The  process  of  issuing  observations  should  be  strengthened,  including  their  timing  and 
monitoring  by  management,  and  putting  in  place  a  framework  to  guide  the  desk  officers 
decision-making  process  when  deciding  at  what  level  observations  should  be  sent  to  MS 
(either as "technical observations", as a service level letter signed by the Director-General, or 
as  a  Commission  Decision).  In  addition  and  looking  forward  to  the  preparation  of  the  post 
2020  programming  period  legislation,  the  Directorates-General  need  to  propose  realistic 
deadlines  for  making  observations  on  OPAs  and  clarify  the  level  at  which  these  need  to  be 
approved  (Commission  Decision  or  service  letter).  Improvements  are  also  needed  for  the 
coordination of multi-fund OPs and in formalising the upstream work done by desk officers in 
Directorate-General  REGIO  and  Directorate-General  MARE  as  part  of  the  OP  amendment 
procedure. 

Additional  information  provided  by  Directorates-General  REGIO,  EMPL  and  MARE 
on the measures defined and/or implemented following the Internal Audit Service audit 

Since  the  issuance  of  the  corresponding  final  report  by  the  Internal  Audit  Service,  and 
according  to  the  agreed  Action  Plan,  actions  have  been  carried  out  by  Directorate-General 
REGIO in order to better define, strengthen and streamline the working arrangements related 
to the processing of Operational Programme Amendments so as to ensure the respect of the 
regulatory  deadline  for  issuing  observations  and  adopting  the  amendments.  In  this  regard, 
among  other  measures,  the  upstream  work  by  desk  officers  in  processing  Operational 
Programmes  modifications  requests  has  been  formalised.  As  for  internal  methodology  and 
horizontal  aspects  of the  Operational Programme  Amendment process, targeted efforts have 
been  made  to  improve  the  related  process  workflow  and  guidance,  as  well  as  to  harmonise 
them among the concerned DGs.   

In  response  to  the  Internal  Audit  Service  recommendations,  DG  EMPL  has  undertaken  the 
following actions: 

14 

 
 
 
  DG EMPL has set up a monitoring system in the Rural Development Information System. 
It  has  closely  monitored  the  Operational  Programme  Amendments  resulting  from  the 
Youth  Employment  Initiative  increase  and  the  Technical  Adjustment  and  reported  any 
risks and delays in the Dynamic Diversified Growth Funds Management Meeting (as well 
as  in  the  Stock-taking  group  for  the  multi-fund  Operational  Programmes).  As  a  result, 
despite the tight deadlines, all Operational Programme Amendments were adopted on time 
by the end of 2017.  

  The  Operational  Programme  Amendments  report  in  the  Rural  Development  Information 
System  monitors  the  use  of  observations.  In  addition,  the  Operational  Programme 
Amendment Roadmaps now include new guidance on use of observations. 

  Geographical  units  assess  the  associated  risks  when  making  the  Operational  Programme 

Amendment analysis using the quality assessment checklist. 

  DG EMPL's Roadmaps and Rural Development Information System instruct the units to 
specify the question they want to raise as well as their own preliminary assessment if they 
consider that there may be a particular issue. 

  DG EMPL monitors the regulatory and internal process/task deadlines through the Rural 
Development  Information  System.  The  Rural  Development  Information  System  team  is 
collecting a  log  of ’issues’ and how they were  resolved/addressed. Based on the  regular 
monitoring the coordination unit identifies the potential problematic elements/bottlenecks 
of  the  processes  and  follows  them  up  with  the  Senior  Management  of  DG  EMPL,  and 
with the Cabinet and Stock-taking group if needed. 

  DG  EMPL  continue  cooperating  closely  to  ensure  that  IT  systems  are  in  line  with  the 

processes agreed in the Stock-taking group and internally. 

  The  coordination  unit  disseminates  information  and  changes  through  regular  'info  flash' 
emails to geographical units; in the monthly European Social Fund newsletter; and in the 
6-weekly  meetings  with  geographical  units  in  the  context  of  the  Coordination  Support 
Group. 
In addition, when there is a need, DG EMPL organises ad-hoc trainings. Since the Internal 
Audit  Service  audit,  DG  EMPL  has  organised  two  trainings  of  geographical  units  on 
Operational  Programme  Amendments  resulting  from  the  Youth  Employment  Initiative 
increase and the Technical adjustment. 

 

  DG  EMPL  has  set  up  a  Rural  Development  Information  System  helpdesk  and  accepts 
direct calls, offering immediate support and assistance on this information system and the 
processes covered to DG EMPL geographical units. 

  The  dedicated  Operational  Programme  Amendments  space  on  the  Intracomm  is  updated 

when necessary. 

  DG EMPL has prepared the update of the Partnership Agreements amendment process to 
be  put  in  place  following  the  Omnibus  Regulation’s  adoption.  The  topic  has  been 
discussed  with  the  other  Directorates-General  dealing  with  the  European  Structural  and 
Investment Fund in the Stock-taking group. 

  DG  EMPL  continues  to  cooperate  with  DG  REGIO  on  updating  and  streamlining  the 
Operational Programme Amendment process in the Stock-taking group and bilaterally. 
  The Rural Development Information System Support Team updates the access to IT tool 

WAVE for DG EMPL staff dealing with multi-fund programmes. 

  The  instructions  in  the  Rural  Development  Information  System  include  the  list  of 

documents that are mandatory for each task as specified in the related roadmaps. 

15 

 
 
 
 
  The  Commission  has  proposed  realistic  deadlines  for  making  observations  on 
amendments in the next post-2020 programming period - in Article 19(2) of the Proposal 
for a Regulation COM(2018) 375 the Commission proposes that the deadline for making 
observations on a programme amendment requested by a Member State is extended from 
1 month to 3 months. 

  The proposal also provides clarity on the level at which observations need to be approved 
(Commission  Decision  or  service  letter).  Article  19  of  the  Proposal  concerning 
amendment  of  programmes  removes  the  obligation  for  the  Commission  to  adopt  an 
amendment  ‘provided  that  any  observations  made  by  the  Commission  have  been 
adequately taken into account’ (current Article 30(2) of Common Provisions Regulation). 
This means that observations will be sent by the Commission services, as the Commission 
itself is no longer bound by the observations to adopt the amendment.  
In  addition,  compared  to  the  current  Common  Provisions  Regulation,  the  scope  of 
Article 3 of the Proposal on calculation of time limits for Commission actions is extended 
to  cover  not  only  Commission  decisions  but  all  Commission  actions.  Thus,  it  covers 
observations sent as service letters. 

 

Directorate-General MARE considers that the issues relating to 2014-2020 and pertaining to 
its  remit  have  been  implemented.  Internal  guidance  has  been  updated  and  endorsed  within 
MARE  and  training  organised  thereafter  for  desk  officers.  Directorate-General  MARE 
considers  that  there  is  no  impact  on  its  internal  control  systems.  The  two  recommendations 
were  sent  for  review  to  the  Internal  Audit  Service,  which  will  follow-up  once  all  DGs  will 
have sent their recommendations for review as well. 

The implementation by Directorates-General REGIO, MARE and EMPL is ongoing and the 
related action plans for the recommendations will be completed in 2018. 

1.4.  Audit on the Commission's framework/arrangements for the estimation, assessment 
and reporting on the cost-effectiveness of controls (Directorates-General BUDG, NEAR, 
REGIO, RTD) 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  whether  the  Commission  has  put  in  place  an 
appropriate corporate framework that enables Authorising Officers by Delegation (AODs) to 
reliably  estimate,  assess  and  report  annually  in  the  Annual  Activity  Reports  (AAR)  on  the 
cost-effectiveness of controls. Furthermore, it assessed if such an initiative met its objectives, 
as  laid  down  in  the  draft  guidance  issued  by  the  Directorate-General  Budget,  and  if  it  adds 
value to the Commission's initiative on a budget focussed on results (BFOR). 

Given the distinct responsibilities at central and local level, the audit was planned around two 
pillars, as follows: 

  At  the  corporate  level  the  audit  covered  the  Directorate-General  Budget  and  assessed 
whether the current framework put in place for this process enables Authorising Officers 
by Delegation to reliably estimate, assess and report on the cost-effectiveness of controls 
in  line  with  the  Financial  Regulation  and  use  this  information  in  making  decisions 
(adjusting control systems, influencing Commission proposals for legislative initiatives); 

16 

 
 
 
  At  the  local  level  the  audit  covered  a  sample  of  Directorates-General  (Directorates-
General  RTD,  REGIO  and  NEAR),  comprising  all  budget  management  modes  (shared, 
indirect, direct). The audit assessed the actual implementation of the corporate framework 
on the estimation,  assessment and reporting  of the cost-effectiveness of controls  in their 
Annual Activity Reports. 

There  were  no  observations/reservations  in  the  2016  Annual  Activity  Reports  of  all  the 
Directorates-General audited that relate to the area/process audited. 

The fieldwork was finalised on 22 June 2017. All observations and recommendations relate to 
the situation as of that date. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Achievement of the objectives of the framework 

The  objectives  initially  set  by  the  Directorate-General  Budget  for  the  exercise  to  estimate, 
assess and report on the cost-effectiveness of controls were, from the outset, very challenging 
with the result that, overall, most were only partly met in practice. 

Definition of the key concepts and implications for the methodology 

  The  definition  of  "controls"  was  very  wide,  which  resulted  in  uncertainty  and 
misinterpretation in the Directorates-General charged with actually applying the concept in 
practice.  Furthermore,  in  principle,  Directorates-General  were  required  to  report  on  the 
costs of controls in Member States (shared management) or at the level of entrusted entities 
(indirect management). However, there are practical limitations on how much they can do. 
In addition, the concept of "benefits" was mainly built on the understanding that the bodies 
responsible  for  exercising  controls  would  be  similar  to  "profit  centres",  whereby 
quantifiable benefits, such as financial corrections and recoveries, could be calculated. In 
practice, however, the objectives of a Directorate's-General control functions, such as those 
in Directorates-General NEAR, REGIO and RTD are more about providing assurance on 
whether the internal control systems of the bodies managing EU funds are working well or 
not and as such the extent to which any real benefits can be readily quantifiable is limited. 

Added value of the reporting on the cost-effectiveness of controls and link to other on-going 
initiatives 

  The  Directorates-General  did  not  actually  make  significant  use  of  the  information 
generated  through  this  process,  either  as  a  tool  for  management  or  to  support  policy 
development. Instead, they relied on existing tools and measures. 

Guidance and support for the reporting on cost-effectiveness of controls 

The  Internal  Audit  Service  also  identified  scope  for  providing  strengthened  guidance  and 
support  to  the  Directorates-General  in  order  to  arrive  at  a  more  consistent  estimation  of  the 
cost of controls across the Commission. 

17 

 
 
Recommendation 

The  Directorate-General  Budget  should  redesign 
the  existing  framework  by  better 
distinguishing between a narrower operational dimension on the one hand, and a wider policy 
dimension  on  the  other  (The  'policy  dimension'  refers  to  the  phase  of  developing  the 
legislation  that  sets  the  boundaries  within  which  the  Commission  have  to  operate.  The 
'operational  dimension'  refers  to  the  actual  implementation  phase.).  For  the  operational 
dimension, the methodology for estimating the costs should be simplified by at least adopting 
a narrower and more realistic definition of the term "control", inspired by the Synergies and 
Efficiency Review initiative for financial management, and which should be the basis for the 
annual Annual Activity Report reporting exercise.  

For the purpose of the policy dimension, the current (broader) definition of the term "control" 
could  still  be  used,  but  it  would  also  need  to  incorporate  the  Member  States  and  entrusted 
entities,  where  it  is  feasible  and  cost-efficient,  in  order  to  provide  policy  makers  with  an 
estimate  of  the  "cost  to  control  EU  spending"  which  could  in  turn  be  used  as  part  of  the 
legislative debate.  

For reporting on information on cost of controls at Member State level in shared management 
and entrusted entity level in the Annual Activity Report, where feasible and cost-efficient, the 
Directorate-General Budget should modify its guidance by either requesting that Directorates-
General no longer report on them or, at least, in the interests of transparency, to present them 
separately  from  those  of  the  Commission.  The  source  of  these  figures  and  how  they  were 
estimated should be explained clearly.  

Furthermore, Directorate-General BUDG should initiate and facilitate a debate on a case-by-
case basis on defining the way forward regarding the materiality threshold in the context of 
the specific legislative procedures.  

For  both  dimensions,  and  to  complement  any  quantitative  analysis,  the  Directorate-General 
Budget  should  steer  Directorates-General  by  encouraging  them  to  explain  the  benefits  of 
controls  and  to  assess  whether  costs  can  be  lowered  (i.e.  by  adopting  a  “cost  centre” 
approach). 

The Directorate-General Budget should set achievable objectives for the exercise to estimate, 
assess and report on cost-effectiveness of controls and provide strengthened guidance to the 
Directorates-General.  It  should  also  take  on  a  more  active  role  in  steering  Directorates-
General to apply the guidance in a more consistent way. 

Additional information provided by Directorate-General BUDG on the measures 
defined and/or implemented following the Internal Audit Service audit 

At  this  stage  the  recommendation  has  been  partly  implemented  –  a  corporate  guidance  to 
calculate  the  cost-effectiveness  of  controls  has  been  partially  revised  for  the  2017  Annual 
Activity Report exercise, and to be completed for the 2018 Annual Activity Report exercise. 

18 

 
 
 
1.5.  Audit  on  the  Commission's  supervision  of  the  implementation  of  CEF  financial 
instruments in Directorate-General ENER and Directorate-General MOVE 

Further to the note announcing the launch of the audit on the Commission's supervision of the 
implementation of Connecting Europe Facility (CEF) financial instruments, the Internal Audit 
Service conducted a preliminary survey with the aim of gaining a better understanding of the 
activities  and  the  related  risks  and  in  order  to  define  the  objectives  and  scope  of  the 
engagement. 

The preliminary survey confirmed that the main risk in this area relates to the ineffectiveness 
of  the  supervisory  activities  that  should  be  performed  by  Directorates-General  ENER  and 
MOVE on how the European Investment Bank (EIB) implements and manages CEF financial 
instruments.  This  corroborates  the  results  of  the  Internal  Audit  Service  risk  assessment 
performed  in  2015  and  2016  in  the  context  of  the  preparation  of  the  Internal  Audit  Service 
annual audit plans. 

However, during the preliminary survey it became clear that to date there had been a very low 
rate of implementation of financial instruments under CEF. Only one specific agreement with 
one subsequent transaction with a final beneficiary had been signed and one payment made to 
EIB in this respect (for EUR 37 500 000). Moreover, according to the latest work programmes 
of Directorates-General ENER and MOVE, the majority of the budget originally allocated to 
CEF  financial  instruments  (EUR  2.43  billion)  was  re-allocated  to  CEF  grants  budget  lines. 
Consequently,  until  2020  only  EUR  296  million  will  be  available  for  CEF  financial 
instruments. 

The low implementation (and the decision to reallocate to the grants budget lines) is partially 
due to the fact that as far as Directorates-General ENER and MOVE projects are concerned, 
the eligibility criteria of the CEF financial instruments and of the European Fund for Strategic 
Investments  (EFSI)  largely  overlap  and  potential  CEF  eligible  projects  have  in  fact  been 
financed by EFSI as it has greater political priority and a larger remit.  

Given the low implementation of CEF financial instruments to date, the effective exercise of 
the  supervisory  role  of  the  Directorates-General  cannot  be  satisfactorily  audited.  For  this 
reason, the Internal Audit Service decided to close the audit after the preliminary survey. 

1.6.  Audit  on  the  Commission’s  governance/oversight  arrangements  concerning  risk 
function 
management, 
(Secretariat-General and Directorate-General Budget)   

the  ex-post  verification/audit 

financial  reporting  and 

Audit objectives and scope 

The objective of the audit was to assess whether the Commission has put in place appropriate 
governance/oversight  arrangements  at  corporate  level  on  (1)  risk  management,  (2)  financial 
reporting  and  (3)  ex-post  verifications/audits,  which  enable  the  College  to  take  its  political 
responsibility  for  the  management  of  the  EU  budget  (by  the  Authorising  Officers  by 
Delegation - AOD).  

The  scope  of  the  audit  covered  the  governance/oversight  arrangements  for  the  three  areas 
indicated above. It also covered certain general aspects on the current 'Governance set-up' as 
regards the political responsibility for the management of the EU budget taken by the College 

19 

 
 
through the adoption of the Annual Management and Performance Report (AMPR), the role 
of  the  Central  Services,  the  working  arrangements  between  the  Commissioners  and  the 
Directorates-General and the role and functioning of key corporate bodies (i.e. two oversight 
bodies, namely: the Audit Progress Committee (APC) and the Corporate Management Board 
(CMB) and one corporate body with no oversight function, namely  the Group of Resources 
Directors  (GDR)).  Governance  and  oversight  arrangements  referring  to  performance,  ethics, 
better regulation and openness and transparency were out of the scope of this audit.  

There were no reservations that relate to the area/process audited in the 2016 Annual Activity 
Reports (AAR) of the Directorates-General under the scope of this audit (i.e. the Secretariat-
General,  the  Directorate-General  Budget  and  the  operational  Directorates-General  AGRI, 
DEVCO,  EMPL,  REGIO  and  RTD).  However,  the  Secretariat-General  and  the  Directorate-
General Budget reported on the European Court of Auditors' (ECA) observations included in 
the special report N° 27/2016 on 'Governance at the European Commission – best practice?'. 

The fieldwork was finalised on 14 July 2017. All observations and recommendations related 
to the situation as of that date with the exception of the revised Governance Statement, which 
was adopted on 11 October 2017 (i.e. after the end of the audit fieldwork) and was taken into 
consideration in the audit report. 

Strengths 

The Internal Audit Service noted a number of strengths as regards the Commission's current 
governance arrangements. 

Decentralised model – accountability and assurance building process 

The  Commission  uses  a  decentralised  model  for  financial  management  with  clearly  framed 
and  well  understood  accountability  instruments  at  the  Directorate-General  level  through  the 
Annual Activity Report and at the College level through the AMPR. It has a robust assurance 
building  process,  the  cornerstone  of  which  is  the  Authorising  Officers'  by  Delegation 
Declarations  of  Assurance,  which  has  developed  over  time  into  a  very  mature  and  well-
understood process  and  demonstrates  in  a  very  transparent  fashion  the  extent  to  which  they 
are held accountable.  

Working arrangements Directorate-General – Commissioner' 

There  is  a  clear  and  well  established  vertical  reporting  process,  supported  by  working 
arrangements,  whereby  the  Directorate-General  informs  on  a  timely  basis  its  responsible 
Commissioner  on  matters  which  may  call  into  question  his/her  responsibility  or  that  of  the 
College as a whole.  

EU consolidated accounts  

The process for preparing the EU consolidated accounts is mature and well established within 
the  Commission  under  the  lead  of  the  Directorate-General  Budget.  In  particular,  the 
respective  roles  and  responsibilities  are  well  understood,  the  instructions  and  guidance 
provided by the Directorate-General Budget are clear, quality checks are carried out and there 
is a proper analysis of the various assurance sources, including certificates and Management 
Representation Letters provided by the consolidated entities. The European Court of Auditors 
has issued a clean opinion on the reliability of the accounts since 2007. 

20 

 
 
Major audit findings 

The Internal Audit Service identified two very important issues: 

Risk management 

Effective risk management is about identifying and ensuring an appropriate response to issues 
which  can  threaten  the  Commission's  ability  to  achieve  its  objectives  and  which  could 
severely  damage  its  reputation.  This  is  the  responsibility  of  management  and  constitutes  an 
organisation's first line of defence (in the 'Three Lines of Defence' model3). A second line of 
defence  aims  to  support  or  steer  this  process  through  the  provision  of  frameworks  and 
guidance.  At  the  corporate  level  in  the  Commission,  this  role  is  exercised  by  the  Central 
Services,  the  Secretariat-General  and  the  Directorate-General  Budget.  As  a  third  line  of 
defence, the  Internal  Audit  Service  provides  independent  audit assurance and advice.  While 
neither the second nor the third line of defence can or should dilute the primary responsibility 
of management (i.e. the first line of defence) to address adequately those risks, corporate or 
central  oversight  of  these  practices  can  improve  their  effectiveness  and  help  to  provide 
assurances  to  the  College  that  those  processes  are  well-managed  in  practice.  This  is 
particularly  important  given  that,  in  recent  years,  Internal  Audit  Service  audits  of  the 
Commission's risk management processes have found them to be still lacking in maturity. 

However,  oversight  on  risk  management  is  currently  mainly  embedded  in  the  vertical 
reporting  lines  between  individual  Authorising  Officers  by  Delegation  and  their  respective 
Commissioners.  The  Corporate  Management  Board  only  takes  note  of  the  cross-cutting 
critical risks and coverage of risk management is not explicitly embedded in its mandate. The 
Central  Services  identify  cross-cutting  critical  risks  among  the  critical  risks  reported  by  the 
Directorates-General and bring them to the attention of the Corporate Management Board, but 
this does not include any risks identified by Directorates-General, which are not cross-cutting, 
but  critical  at  Directorate-General  level  including  those  operational  risks  at  Directorate-
General level which are linked to individual  actions contributing to  the "Juncker  priorities". 
As regards the Audit Progress Committee, its oversight on risk management is limited to the 
risks identified by the Internal Audit Service through its risk-based audit planning process and 
through  the  audit  reports  themselves.  For  the  Audit  Progress  Committee,  this  means  that 
currently  it  is  not  in  a  position  to  cross-check  the  Internal  Audit  Service’s  audit  risk 
assessment and audit plan to management's risk assessment. Consequently, it does not have an 
overall view on the extent to which the risks of the Commission (as assessed by management 
as  well  as  by  the  Internal  Audit  Service)  are  being  adequately  addressed  by  management 
and/or through Internal Audit Service or European Court of Auditors audits in practice. 

From  the  central  coordination  perspective,  the  Secretariat-General  and  the  Directorate-
General  Budget  provide  guidance  and  instructions  to  support  the  Directorates'-General  risk 
management  process.  However,  the  Internal  Audit  Service  has  found  that  there  is  scope  for 
improving the guidance and the process in key areas: the application of 'Risk Tolerance' and 

3   The  three  lines  of  defence  (3LoD)  model  in  effective  risk  management  and  control  (IIA  position  paper) 
distinguishes among three groups (or lines) involved in effective risk management: 1st line - functions that 
own and manage risks; 2nd line - functions that oversee risks. The responsibilities of these functions vary on 
their  specific  nature,  but  can  include:  defining  roles  and  responsibilities,  providing  risk  management 
frameworks, providing guidance and training on risk management processes and facilitating and monitoring 
implementation of effective risk management practices by operational management and 3rd line - functions 
that provide independent assurance (i.e. Internal Audit). 

21 

 
 
                                                            
'Materiality'  concepts  when  reporting  critical  risks,  the  need  for  a  more  differentiated/risk-
based approach when supporting Directorates-General and the role envisaged in Directorates-
General for the 'Director in charge of risk management and internal control' as created under 
the revised Internal Control Framework. 

Governance set-up  

Corporate (oversight) bodies 

Apart from the College, which is the ultimate decision-making body within the Commission, 
currently there are three main corporate bodies for the areas within the scope of this audit: two 
oversight  bodies,  namely  the  Audit  Progress  Committee  and  the  Corporate  Management 
Board and one corporate body with  no oversight functions, namely the Group of Resources 
Directors. 

While the Audit Progress Committee has no decision-making power it is a key oversight body 
in the Commission and provides valuable advice to the College. It has a unique composition 
with  both  internal  and  external,  independent  members4  and  the  Internal  Audit  Service 
welcomes  the  positive  evolution  as  regards  the  functioning  and  composition  of  the  APC. 
Currently, its mandate does not include risk management and neither does it include the EU 
consolidated  accounts.  The  Internal  Audit  Service  acknowledges  that  the  Audit  Progress 
Committee  was  never  originally  conceived  to  be  a  fully-fledged  audit  committee  in  the 
conventional  sense.  Its  mandate  was  deliberately  limited  to  ensuring,  inter  alia,  the  proper 
follow-up of the Internal Audit Service and ECA audit recommendations. This practice is in 
line with the new legal requirement, which has been introduced following the recent revision 
of  the  Financial  Regulation.  Recognised  professional  standards/frameworks  allow  certain 
flexibility.  However,  both  areas  (i.e.  risk  management  and  the  EU  consolidated  accounts) 
would be typically covered by modern-day audit committees. 

Despite the Audit Progress Committee's limited  role, the audit has  found that  implementing 
this can be challenging in practice within the current set-up. In particular, although the Audit 
Progress  Committee  mandate  includes  the  follow-up  of  European  Court  of  Auditors  audit 
recommendations,  European  Court  of  Auditors  reports  were  until  recently  only  very  rarely 
discussed and follow-up work was limited, mainly due to inadequate information on the state 
of play in implementing these recommendations. Also, it is clear that it is largely the agenda-
setting and steering briefings prepared by the Audit Progress Committee secretariat under the 
supervision of the Audit Progress Committee Preparatory Group (PG) Chair as well as input 
of  the  external  members  which  drive  the  discussions  during  the  Audit  Progress  Committee 
Preparatory  Group  meetings.  The  internal  Preparatory  Group  members,  who  come  from  the 
respective  Cabinets,  are  often  constrained  by  the  time  they  can  devote  to  preparing  and 
attending meetings and their expertise in the areas covered by the Audit Progress Committee 
varies. There is also the inherent risk of potential conflicts of interest, although there are some 
mitigating measures in place to avoid this. In addition, there is an inherent potential conflict of 
interest  in  having  the  Audit  Progress  Committee  secretariat  administratively  linked  to  the 
Internal  Audit  Service.  Finally,  despite  the  key  roles  of  both  the  Audit  Progress  Committee 

4     In  this  context,  the  applicable  reference  frameworks  define  independence  as  follows:  "An 
independent  audit  committee  member  is  a  person  who  is  not  employed  by,  or  providing  any 
services to, the organization beyond  his or her duties as a  committee  member."  See IIA Global 
Public Sector Insight: Independent Audit Committees in Public Sector Organizations, page 12. 

22 

 
 
                                                            
and the Corporate Management Board in the Commission's governance structure, there is no 
systematic flow of information between both bodies. 

Although the Corporate Management Board is expected to play a central role in the corporate 
governance of the Commission as per the 2017 Commission's Governance Statement, its role 
and added value do not seem to be entirely clear for a number of the interviewees selected by 
the  Internal  Audit  Service  and  as  noted  above,  its  oversight  role  on  risk  management  is 
limited  in  practice  to  just  the  cross-cutting  critical  risks.  Furthermore,  its  mandate  has  not 
been updated since 2007. Although Corporate Management Board documents are shared with 
all  Cabinets,  there  is  no  systematic  reporting  from  the  Corporate  Management  Board  to  the 
College on the results of its work, which would be comparable to the reporting mechanisms of 
the Audit Progress Committee. 

The Group of Resources Directors mandate has yet to be updated to reflect the results of the 
report on the 'Evolution of the Group of Resources Directors'. As indicated above, the Group 
of  Resources  Directors  has  no  oversight  function  and  has  no  decision  making  powers.  It  is 
mainly  a  platform  to  share  information  and  knowledge  amongst  Resources  Directorates. 
Members  of  the  group  have  expressed  concerns  about  the  lack  of  formal  reporting  lines, 
insufficient  use  being  made  of  its  members'  experience  and instances  when  it  was mainly  a 
vehicle for sharing information on decisions already taken rather than actually contributing to 
those decisions in the first instance. This may be explained by a misperception about the role 
of the Group of Resources Directors, which calls for the need to clarify/update its mandate. 

Governance statement  

On  11  October  2017,  the  Commission  adopted  the  Communication  on  Governance  in  the 
European  Commission.  The  Internal  Audit  Service  welcomes  this  positive  step.  Given  the 
importance  of  this  document,  it  is  key  to  raise  awareness  within  the  Commission. 
Furthermore, the Governance Statement will need to be updated to reflect necessary changes 
resulting from implementing the accepted recommendations of this report (e.g. as regards the 
mandates of the Audit Progress Committee and/or the Corporate Management Board). 

Role of the Central Services in the Authorising Officer by Delegation decentralised model 

Following  the  'Three  Lines  of  Defence'  model  and  bearing  in  mind  the  Commission's 
decentralised  structure,  the  2nd  line  of  defence  in  the  Commission  exists  both  at  the  local 
Directorate-General level and the corporate level. The Central Services contribute to the 2nd 
line of defence  from the corporate point of view by advising/supporting and monitoring the 
effective  implementation  of  prescribed  frameworks.  It  is  a  question  of  finding  the  right 
balance  between  taking  a  more  hands-on,  directional  approach  and  a  more  hands-off, 
facilitating  approach.  Getting  this  balance  is  a  perennial  challenge,  particularly  in  the 
Commission  where  the  basic  principle  of  decentralised  Authorising  Officer  by  Delegation 
responsibility is key, but also in terms of their role in helping the College to take its political 
responsibility.  However,  the  audit  found  that  whilst  the  Central  Services  are  generally  very 
much appreciated by the Directorates-General and Services, there is scope for strengthening 
their roles in key areas such as Risk Management.  

23 

 
 
Recommendations5 

Audit Recommendation on risk management 

1.1  The  Commission  should  strengthen  its  corporate  oversight  on  risk  management, 
including critical risks which are not cross-cutting. 

As  suggested  by  professional  reference  frameworks,  the  corporate  oversight  role  on  risk 
management  should  be  exercised  by  an  Audit  Committee  or  an  equivalent  body.  In  the 
Commission's  environment,  this  role  could  be  exercised  either  by  the  Audit  Progress 
Committee alone ('Option A') or by the Corporate Management Board ('Option B'). 
Currently, the Commission's Audit Progress Committee has a limited mandate. An expansion 
of  the  Audit  Progress  Committee's  mandate  to  include risk  management  ('Option  A')  would 
represent  a  considerable  strengthening  of  its  oversight  role,  particularly  given  that  external 
members are independent from the Commission's management. However, the Audit Progress 
Committee already faces a number of challenges to exercising its existing mandate to the full 
within the limitations of the present set-up and resourcing, and an expanded mandate would 
only serve to compound these. Therefore, while this would be more in line with the reference 
frameworks,  the  success  of  an  expanded  mandate  would  require  the  Audit  Progress 
Committee to be adequately equipped to deal with the increased responsibilities. With this in 
mind,  the  Internal  Audit  Service  sets  out  in  Recommendation  no  4  proposals  aimed  at 
reinforcing  the  Audit  Progress  Committee  function  in  order  to  strengthen  the  oversight 
exercised by the Audit Progress Committee. 

If this strengthened oversight role were to be exercised by the Corporate Management Board 
('Option  B'),  this  would  require  expanding  the  Corporate  Management  Board's  current 
oversight on the cross-cutting critical risks to include also the (Directorate-General-specific) 
critical risks which are not cross-cutting. There would need to be clear procedures allowing 
the  Board  to  invite  the  responsible  Directorate-General  for  discussions  on  their  response  to 
critical risks while ensuring that the responsibility for managing the risk continues to lie with 
the specific Directorate-General and their responsibility is not shifted to the oversight body. 
For  this  alternative  scenario  to  be  effective,  the  Corporate  Management  Board  should  also 
provide  the  Audit  Progress  Committee  with  meaningful,  consolidated  information  on  the 
critical  risks  as  assessed  by  management  to  allow  the  Audit  Progress  Committee  to  make  a 
cross-check to the Internal Audit Service's audit risk assessment and in turn to the audit plan 
to identify possible gaps between the two sources. 

1.2 Central  Services  (Secretariat-General  and  Directorate-General  BUDG)  should 

reinforce their role on risk management.  

The Central Services  should  facilitate the sharing of best practices on risk management and 
provide  support  to  those  Directorates-General  with  less  mature  processes.  More  guidance 
should  be  provided  to  Directorates-General  on  cross-cutting  risks  and  how  to  apply  the 

5     The presentation in this Staff Working Document of the acceptance of the audit recommendations reflects 
the situation, following the communication in September 2018 by the auditees to the Internal Audit Service 
of  an  action plan  confirming the  full acceptance of  all recommendations stemming  from  the  audit report; 
this action plan was assessed as satisfactory by the Internal Audit Service 

24 

 
 
 
 
 
                                                            
concepts  of  'risk  tolerance'  and  'materiality'  when  identifying  and  reporting  critical  risks,  to 
guide Directorates-General on how to better link operational risks to the achievement of the 
Directorate's-General  objectives  and,  in  particular,  where  the  latter  are  contributing  to  the 
Juncker priorities6. In addition, there needs to be guidance to support the new role envisaged 
under the revised Internal Control Framework for the 'Director in charge of Risk Management 
and Internal Control'. 

The Central Services should establish a list of all  critical risks. This list should be based on 
the  critical  risks  reported  by  the  individual  Directorates-General  and  should  be  prepared  in 
cooperation with the operational Directorates-General. The critical risks linked to the Juncker 
Priorities should be specifically identified. The resulting information should be reported to the 
Corporate Management Board and the Audit Progress Committee should have access to this 
information. 

It  is  essential  that  the  reinforced  role  of  the  Central  Services  is  not  perceived  by  the 
Authorising  Officer  by  Delegation  as  diluting  the  responsibility  of  the  Directorate-General 
responsible  for  managing  the  risk.  Therefore,  the  Central  Services  should  build  in  the 
necessary safeguards to ensure this, for example, by drawing attention to this fact in meetings, 
guidelines and minutes. 

Audit Recommendation on Governance set-up 

4.1 The  APC should exercise greater oversight on the follow up of  ECA audits, in line 
with its current mandate. 

The  Audit  Progress  Committee  should  exercise  greater  oversight  on  the  follow  up  of 
European Court of Auditors audits, in line with its current mandate, but for this to happen the 
Directorate-General  Budget  should  continue  improving  its  reporting  to  the  Audit  Progress 
Committee on the follow-up of European Court of Auditors recommendations. 

The  Internal  Auditor  takes  note  that  the  Audit  Progress  Committee  has  recently  started  to 
examine the follow-up of the European Court of Auditors recommendations. In this context, 
the  Directorate-General  Budget  prepared  for  the  Audit  Progress  Committee  Preparatory 
Group  meeting  on  27  September  2017  a  more  refined  report  on  the  follow-up  of  European 
Court of Auditors recommendations. It was concluded that further actions will be decided by 
the Audit Progress Committee in due time. It should be noted that the Directorate’s-General 
Budget role is to provide the relevant overview reports to the Audit Progress Committee while 
the responsibility for the follow-up and implementation of the recommendations lies with the 
Directorates-General. 

4.2  The  APC  function  should  be  further  reinforced  in  order  to  provide  more  effective 
oversight.  

To  be  more  effective  in  its  current  advisory  role  and  to  be  better  prepared  to  accommodate 
any  future  changes,  the  Internal  Audit  Service  recommends  that  the  Audit  Progress 
Committee  function  is  further  strengthened  through  either  one  or  a  combination  of  the 
following two options: 

6     This  recommendation  is  not  intended  to  cover/duplicate  the  Commission's  high-level  risk  assessment  at 
political level, but merely to link operational risks identified by the Directorates-General to the respective 
general or specific objectives, which (may) contribute to the Juncker priorities. 

25 

 
 
                                                            
Option 1: A reinforcement of the Audit Progress Committee Secretariat through the addition 
of  technically  skilled  and  experienced  EU  officials  drawn  from  across  the  Commission 
services. A reinforced Secretariat would contribute to the quality and quantity of the oversight 
needed, provide a tailored support service for external members and Cabinet members of the 
Preparatory Group and Commissioners, whilst ensuring the support capacity needed to enable 
the  Audit  Progress  Committee  to  both  fulfil  all  the  tasks  in  its  Charter  and  take  on  the 
additional tasks referred to in this report. 

Option  2:  A  change  in  the  basic  structure  of  the  Audit  Progress  Committee’s  Preparatory 
Group, but at the same time retaining the current composition and Chair of the Audit Progress 
Committee itself in order to maintain the vital link to the College. As regards the composition 
of  the  Audit  Progress  Committee’s  Preparatory  Group,  the  secondment  of  a  number  of 
appropriately skilled, experienced Commission officials alongside externally-recruited experts 
to  play  a  standing  role  as  Preparatory  Group  members  (the  chair  of  the  Audit  Progress 
Committee’s  Preparatory  Group  would  be  one  of  the  seconded  officials)  should  be 
considered.  Cabinet  members  of  Commissioners  designated  as  Audit  Progress  Committee 
members would be debriefed after each Preparatory Group session to ensure transparency and 
to  enable  them  to  prepare  their  Commissioners  for  the  meetings  of  the  Audit  Progress 
Committee. 

Beyond this, consideration could be given to increasing the number of external members from 
three to four, a measure, which would be in line with the existing Audit Progress Committee 
Charter. 

4.3 The mandates of the corporate (oversight) bodies should be updated 

The respective mandates of the Audit Progress Committee (APC), the Corporate Management 
Board  and  the  Group  of  Resources  Directors  (GDR)  should  be  updated.  For  the  Audit 
Progress  Committee  and  the  Corporate  Management  Board,  this  should  be  based  on  a 
decision of the College, in line with the Internal Audit Service recommendations. This should 
include  clarifying  the  reporting  mechanisms  of  the  Corporate  Management  Board  and  the 
reporting lines of the Resource Directors Group. 

4.4 The APC secretariat  should be  both administratively and functionally independent 
of the Internal Audit Service.   

To  address  the  potential  conflicts  of  interest  in  having  the  Audit  Progress  Committee’s 
the  secretariat  should  be  both 
secretariat 
administratively and functionally independent of the Internal Audit Service .  

the  Internal  Audit  Service, 

located 

in 

4.5  The  Commission's  'Governance  Statement'  of  October  2017  should  be  amended  to 
reflect  any  changes  resulting  from  implementing  the  accepted  recommendations  and 
communicated.  

The revised Governance Statement should be amended to reflect necessary changes resulting 
from implementing Internal Audit Service recommendations contained in this report.  

Once  the  2017  'Governance  Statement'  is  updated,  Central  Services  should  raise  awareness 
within the Commission, including the College, on these governance arrangements. 

In  parallel,  the  Directorate-General  Budget  should  adapt  the  'Implementation  guide'  of  the 
new Internal Control Framework to clearly reflect in section II ("Roles and Responsibilities in 

26 

 
 
the implementation of Internal Control Framework in the Commission") in the Chart as well 
as in the text that:  

- The 2nd line of defence in the Commission exists both at the local Directorate-General level 
and the central level  
- The Central Services contribute to the 2nd line of defence from the corporate point of view 
by  advising/supporting  and  monitoring 
implementation  of  prescribed 
frameworks.   

the  effective 

4.6  SG,  Directorate-General  BUDG  and  Internal  Audit  Service  should  cooperate  more 
effectively  in  sharing  knowledge  and  identifying  best  practices,  while  respecting  each 
other's roles and in particular the independence of the Internal Audit Service.  

Cooperation  and  coordination  should,  in  particular,  be  further  strengthened  during  the 
planning phase of the Internal Audit Service audit plan by sharing more actively knowledge 
on risks and during the Peer review exercise by coordinating more efficiently the comments 
on the Directorates'-General Annual Activity Reports.7  

Additional  information  provided  by  the  Secretariat-General  and  the  Directorate-
General  Budget,  on  the  measures  defined  and/or  implemented  following  the  Internal 
Audit Service audit 

The  Secretariat-General  and  the  Directorate-General  Budget  accepted  all  recommendations 
and developed an action plan in response to this audit which was assessed as satisfactory by 
the  Internal  Audit  Service.  The  action  plan  incorporated,  where  applicable,  the  advice  the 
Audit Progress Committee provided when discussing the follow-up to those recommendations 
which directly touch on its role and work. Some actions will require the endorsement of the 
College of Commissioners. 

For  several  recommendations,  follow-up  action  has  already  been  taken  or  will  be 
implemented shortly.  

Notably, as regards the very important recommendations: 

Risk management 

The  central  services  (Secretariat-General  and  Directorate-General  Budget)  will  continue  to 
provide risk management guidance to the Directors in charge of risk management and internal 
control  (‘RMIC’).  This  will  include:  1)  facilitating  the  share  of  best  practices;  2)  providing 
support to DGs with less mature risk management processes; and 3) updating, where needed, 
the  Risk  Management  Implementation  Guide  (e.g.  on  the  application  of  concepts  such  as 
‘cross-cutting’ risks, ‘risk tolerance’ and ‘materiality’ of critical risks). 

7     For example, the Internal Audit Service is available to discuss with the Directorate-General Budget and the 
Secretariat-General  the  results  of  specific  audit  reports,  upon  request.  Furthermore,  in  the  context  of  the 
Internal Audit Service Risk Assessment preceding the audit plan, there should be a closer discussion with 
the central services to mutually exchange information on risks. 

27 

 
 
 
 
                                                            
The oversight and approach on risk management will be reinforced through the organisation 
of  peer  reviews  to  examine  the  critical  risks  identified  by  the  Directorates-General.  Where 
needed, meetings will be organised by families of DGs. In accordance with the decentralised 
governance  structure  of  the  Commission,  Authorising  Officers  by  Delegation  will  remain 
fully responsible for the identification and management of their critical risks. 

Also  the  oversight  role  of  the  Corporate  Management  Board  will  be  strengthened.  It  will 
review  the  list  of  critical  risks  and  decide  on  a  case-by-case  basis  on  the  need  to  invite  the 
responsible  Directorates-General  for  discussions  of  their  response  to  the  critical  risks 
identified. 

There  will  also  be  more  extensive  sharing  of  information  on  risk  management  with  the 
Internal Audit Service and the Audit Progress Committee. The latter can use this information 
when assessing the audit plan of the Internal Auditor. 

Governance set-up 

The current Governance document was updated in  the course of the audit  in  anticipation  of 
this  recommendation  (C(2017)6915  of  11.10.2017).  When  appropriate,  the  Secretariat-
General  and  the  Directorate-General  Budget  will  (1)  propose  future  updates  of  the 
Governance document to the College and (2) raise awareness within the Commission on the 
Governance document. 

The Secretariat-General and the Directorate-General Budget will submit for adoption by the 
College  in  the  coming  months  a  revised  Communication  on  the  Commission’s  governance 
arrangements,  proposing  to  review  and  update  the  mandates  of  the  Commission’s  corporate 
governance  bodies  (for  example  the  Corporate  Management  Board  and  Group  of  Resource 
Directors). 

As regards the Audit Progress Committee: 

An  updated  charter  of  the  Audit  Progress  Committee  will  be  submitted  for  approval  by  the 
College reflecting the improvements identified to address the IAS recommendations. 

-  The  Audit  Progress  Committee’s  practice  of  examining  the  state  of  play  of  the 
implementation  of  the  recommendations  issued  by  the  European  Court  of  Auditors  is 
expected to continue. The Directorate-General Budget will continue to make available for the 
Audit  Progress  Committee  a  report  on  the  follow-up  of  the  European  Court  of  Auditors 
recommendations.  

- The Audit Progress Committee Secretariat will be appropriately reinforced with technically 
skilled and experienced staff to ensure the effectiveness of the Audit Progress Committee and 
reinforce  its  oversight  in  key  areas,  namely  through  the  work  on  the  follow  up  of  the 
recommendations  of  the  European  Court  of  Auditors  related  to  the  reliability  of  the  'EU 
consolidated accounts'.  

- Adequate working arrangements will be put in place between the Internal Audit Service, the 
Audit  Progress  Committee  Preparatory  Group  Chair  and  the  Head  of  the  Audit  Progress 

28 

 
 
 
 
Committee  Secretariat,  in  cooperation  with  the  Secretariat-General  and  the  Directorate-
General  for  Human  Resources,  to  ensure  that  the  identified  risk  of  conflicts  of  interest  is 
appropriately mitigated. 

1.7. Audit  on  the  production  process  and  the  quality  of  statistics  not  produced  by 
Eurostat (ESTAT and Directorates-General ENER, FISMA, GROW and JUST) 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  whether  the  Commission  has  in  place  an  effective 
process to ensure the quality of statistics not produced by Eurostat (i.e. produced or acquired, 
and used, by Directorates-General and Services) to support its key policies. 

The  audit  assessed  in  particular  (1) Eurostat  coordination  role  and  the provision  of  support, 
advice  and  guidance  to  the  services;  and  (2)  the  designed  and  implementation  of  adequate 
processes 
the 
level 
production/acquisition and dissemination of statistics. 

individual  Directorates-General/Services 

the 

for 

of 

at 

The  audit  was  conducted  in  Eurostat  (for  it  central  role  in  the  process)  as  well  as  in  four 
operational Directorates-General ENER, FISMA, GROW and JUST. 

There were no observations/reservations in the 2016 Annual Activity Reports of the audited 
Directorates-General that relate to the area/process audited. 

The  fieldwork  was  finalised  on  18  December  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

(1) At corporate level 

(2)  Eurostat  has  developed  "Methodological  Guidelines  to  Commission  Directorates-
General  to  produce  reliable  estimates  from  sample  surveys  outsourced  to  private 
companies"  for  Directorates-General/Services,  which  are  available  to  the  operational 
services together with the Inventory.  

(3)  The  need  for  Other  Statistics  are  discussed  between  Eurostat  and  the  operational 

Directorates-General in the context of the Annual Hearings; 

(4)  Eurostat manages and monitors the use of the methodological framework contracts for 
outsourced statistical methodological support, which are then used by Eurostat and other 
Commission Directorates-General and services. 

(5)  When  requested  by  Directorates-General/Services,  Eurostat  provides  methodological 
guidance and support (e.g. on the development of statistical surveys, for the preparation 
of  the  Terms  of  Reference  for  external  acquisition  of  statistics  and  on  data  source 
issues). 

29 

 
 
 
(6)  A  dedicated  Task  Force  "Statistical  Products  and  Services"  was  established  in  2017 
with the aim of creating a "Service Catalogue" listing the statistical services offered by 
Eurostat  to  the  Commission.  The  Task  force  will  develop  a  service  delivery  model 
(including  monitoring  and  customer  satisfaction  evaluation)  and  establish  a  service 
management model (including governance and funding aspects). 

(7) 

In March 2017, Eurostat launched a new project on "Rationalisation of purchasing data 
from external sources", which is designed to achieve synergies in the Commission. 

(8)  At operational Directorate-General level 

(9)  The  Internal  Audit  Service  identified  a  number  of  good  practices  at  the  level  of  the 
operational Directorates-General audited, which could be adopted by other Directorates-
General/Services to further improve the quality of the processes for planning, producing 
or  acquiring,  and  disseminating  statistics  not  produced  by  Eurostat.  While  those  best 
practices are described for each of the Directorates-General audited in their respective 
Annex  4  of  the  Final  Audit  Report,  the  Internal  Audit  Service  wishes  to  highlight  the 
following:  

(10)  Some  operational  Directorates-General  have  developed  internal  expertise  in  data 
analytics,  which  is  used  (to  various  degrees  depending  on  the  Directorate-General) 
when  producing  and  acquiring  statistics.  In  one  case,  experts  from  the  Directorate-
General  regularly  participated  in  the  evaluation  committees  for  tender  procedures  for 
provision of statistics launched by other Directorates-General. 

(11)  One  Directorate-General  systematically  included  the  following  disclaimer  statement 
when  publishing  statistics  not  produced  by  Eurostat:  "This  report  (…)  aims  at 
enhancing  public  access  to  information  […..].  Our  goal  is  to  keep  this  information 
timely and accurate. If errors are brought to our attention, we will try to correct them. 
However, the Commission accepts no responsibility or liability whatsoever with regard 
to the information contained in this publication." 

(12)  One Directorate-General included a footnote for each graph/chart with a description of 
the data source, as well as a reference to methodological notes used in its reports. 

Major audit findings 

The  Internal  Audit  Service  identified  three  very  important  issues  at  corporate  level  and  one 
very important issue at operational Directorate-General (Directorate-General GROW) level: 

ESTAT 

Framework for statistical production in the Commission and Eurostat's coordination role 
in the development and production of statistics by other Commission services  

The  current  framework  for  statistical  production  in  the  Commission,  as  established  by  the 
2012 Commission Decision, does not define a quality assurance framework for statistics not 
produced  by  Eurostat  and  does  not  provide  a  specific  role  for  Eurostat  in  this  respect. 
Furthermore it does not set clear obligations for the Directorates-General to inform Eurostat 
about  their  statistical  production.  Finally,  Eurostat  does  not  coordinate  the  development  and 
production of the statistics in the Commission effectively.  

30 

 
 
 
Completion of the Statistical Inventory and Masterplan  

The  Statistical  Inventory,  maintained  by  Eurostat  and  updated  by  operational  Directorates-
General, does not provide a complete and reliable overview of the statistics that are produced 
or acquired and disseminated by the Commission Services. Since it is not complete and not 
always  fully  correct,  Eurostat  cannot  effectively  steer  the  planning  and  coordination  of 
statistical activities as required by the 2012 Commission Decision. In addition, Eurostat had 
not implemented a Statistical Masterplan including the statistics produced by Eurostat as well 
as the Other Statistics. 

Referencing and use of a disclaimer when publishing Other Statistics  

Eurostat  has  not  issued  guidance  or  instructions  to  the  Directorates-General  on  how  to 
reference  the  statistics  used  in  official  publications  and  how  to  use  a  disclaimer  when 
presenting  statistics  for  which  the  Directorates-General  cannot  guarantee  the  accuracy.  In 
addition, there were inconsistent practices at Directorate-General level in terms of referencing 
and use of a disclaimer. 

GROW 

Management of the statistical process by DG GROW 

Unit 01 of Directorate-General GROW has not been formally identified as a 'knowledge and 
competence  centre'  in  statistical  matters,  responsible  for  coordinating  and  monitoring  the 
statistical  production  and  acquisition  process  at  Directorate-General  level  as  well  as  for  the 
providing 
specific 
guidance/instructions for the staff in the operational units which are involved in the collection 
of data, production and dissemination of statistics. Finally, there is no systematic use of the 
expertise available within Eurostat and no specific training path for developing the expertise 
of the staff in operational units. 

the  Directorate-General  has  not 

advice.  Moreover, 

issued 

Recommendations 

Framework for statistical production in the Commission and Eurostat's coordination role 
in the development and production of statistics by other Commission services 

Eurostat  should  address  the  limitations  of  the  2012  Commission  Decision  and  to  take  the 
necessary steps to  coordinate effectively the development and production of statistics in  the 
Commission and to prepare a quality framework for the statistics different from the European 
ones. 

Completion of the Statistical Inventory and Masterplan 

Eurostat  should  revise  the  structure  of  the  database,  establish  a  formal  and  effective  review 
process and define the purpose and format of the Statistical Masterplan and its integration into 
Eurostat's planning process. 

Referencing and use of a disclaimer when publishing Other Statistics 

Eurostat should prepare and provide guidance to the Directorates-General on how to clearly 
reference  statistics  and  explain  which  disclaimer  has  to  be  used  if  the  Directorates-General 
cannot guarantee the accuracy. 

31 

 
 
 
Directorate-General GROW  

Directorate-General  GROW  should  define  a  process  for  statistics  management  with  clear 
central  responsibility  for  coordinating  the  delivery  of  activities  in  this  domain,  provide 
guidelines/instruction  to  the  units  involved  in  the  statistical  production/  acquisition,  ensure 
that  the  available  expertise,  in  house  or  in  Eurostat,  is  adequately  exploited  and  promote 
attendance  at  specific  training  courses  to  increase  the  expertise  of  staff  involved  in  the 
statistical production. 

Additional  information  provided  by  ESTAT  and  Directorate-General  GROW  on  the 
measures defined and/or implemented following the Internal Audit Service audit 

Eurostat  already  established  a  portfolio  of  statistical  services  and  published  them  in  a 
transparent  and  easy-to-access  online  catalogue  available  to  all  Commission  Directorates-
General.  Furthermore,  Eurostat  will  establish  a  reference  quality  framework  for  other 
Directorates-General  for  "Other  Statistics"  that  includes  guidance  and  checklists  on 
production  and  acquisition  procedures,  methodologies  and  characteristics  of  data  produced 
/acquired. 

Eurostat will elaborate, in cooperation with the network of DGs statistical correspondents, a 
clear and easy-to-use definition of statistics, clear and detailed instructions on the types and 
nature  of  items  to  be  included  or  excluded  from  the  Statistical  Inventory,  including  those 
related  to  future  needs  not  yet  covered  by  current  production  or  acquisition.  Furthermore, 
Eurostat will develop clear instructions on how to fill in the different fields of the statistical 
inventory, including those related to financial and contractual information and to the end year. 

Eurostat  already  started  to  develop  guidance  on  referencing  statistical  data,  coming  from 
Eurostat  or  from  other  sources.  Additionally  Eurostat  will  develop  guidance  on  types  of 
disclaimer  DGs  could  use  for  warning  users  about  quality  aspects  of  the  statistical  data 
presented.  

Directorate-General GROW will take by end 2018 the following actions: 

-  Directorate-General  GROW  01  will  be  reaffirmed  in  its  role  of  the  official  liaison  unit 
between  Directorate-General  GROW  and  Eurostat  (a  so  called  “mirror  unit”).  For  that 
purpose,  a  note  will  be  prepared  by  GROW  01  in  which  its  role  and  responsibility  will  be 
explained  with  regard  to  different  Eurostat  related  activities  (Inventory,  annual  hearings, 
production of data, acquisition of data etc.). 

-  Directorate-General  GROW  will  prepare  guidelines  that  will  set  out  the  methodological 
framework for assuring the quality of the statistics produced/acquired by Directorate-General 
GROW.  These  guidelines  will  include  contact  points  within  GROW  and  Eurostat  and 
instructions on when specific expertise is needed from GROW.01 or Eurostat in the context of 
the procurement process or assessment of contractual deliverables. 

-  GROW  01  will  create  a  dedicated  page  on  GROWNet  for  statistics  where  the  above 
mentioned  guidelines  will  be  available  as  well  as  presentations  on  data/statistics  and  good 
practice examples will be shared 

-  Directorate-General  GROW  will  deliver  twice  a  year  a  full  day  training  course  on 
Introduction to Statistics and Indicators. 

32 

 
 
2.  AGRICULTURE, NATURAL RESOURCES AND HEALTH 

2.1. Audit on Directorate-General AGRI's management of agricultural market crises 

Audit objectives and scope 

The objective of the audit was to assess whether Directorate-General AGRI has put in place 
adequate processes  for managing agricultural market crises. In  particular,  the audit assessed 
whether  Directorate-General  AGRI  has  developed  systems  to  a)  forecast  and/or  prevent 
agricultural market crises to the extent possible, b) be able to react effectively and in a timely 
manner  to  crises  and  c)  monitor  the  effects  of  measures  taken  to  address  crises  and  draw 
lessons for the future.  

The  audit  covered  Directorate-General  AGRI's  processes  for  managing  agricultural  market 
crises. As the legislator has not defined what an agricultural market crisis is in the Regulation 
establishing a common organisation of the markets in agricultural products, (Regulation (EU) 
1308/2013), for the purpose of the audit, "agricultural market crisis" refers to severe market 
disturbances  that  have  led  but  are  not  limited  to  the  adoption  of  temporary  "exceptional 
measures".  This  is  in  contrast  to  regular  market  management  measures  that  are  taken 
following normal market movements. 

It covered the following processes:  

  Directorate-General AGRI's approach and internal processes for forecasting market crises 
and  reacting  on  a  timely  basis  (e.g.  use  of  market  monitoring  tools,  risk  management 
process, rationale for proposing mitigating measures); 

  Directorate-General AGRI's ability to adequately support the decision making process in 
the event of a crisis, in terms of procedures, availability of necessary staff, knowledge and 
budget. 

  Directorate-General AGRI's arrangements following a crisis to move into the phasing-out 

period, monitor the markets and draw lessons for the future.  

Directorate-General  AGRI's  2015  Annual  Activity  Report  contains  a  reservation  relating  to 
temporary  exceptional  support  measures  in  the  fruit  and  vegetables  sector  and  concerns 
Poland.  

The fieldwork was finalised on 4 April 2017. All observations and recommendations relate to 
the situation as of that date. 

Strengths 

The auditors acknowledged the efforts made by Directorate-General AGRI in responding to 
the agricultural market crises experienced since mid-2014. The audit identified the following 
strengths in particular:  

Responding  to  crises  situations  implies  a  certain  pressure  on  Directorate-General 
a) 
AGRI's staff to react on time to tight deadlines and those involved in the management of the 
dairy, livestock and fruit and vegetable markets in particular have demonstrated high levels of 

33 

 
 
 
commitment and have worked under considerable pressure for a long time, including working 
during the normal holiday periods. 

b) 
Directorate-General  AGRI  has  put  in  place  a  variety  of  monitoring  tools.  These 
include  dashboards  presenting  key  data  relating  to  particular  agricultural  markets,  market 
observatories  that  gather  together  experts  from  the  field  and  which  disseminate  market  data 
and  short-term  analysis,  including  the  minutes  of  the  meetings  of  their  various  economic 
boards. This information is publicly available and regularly updated on the Europa website.  

c) 
During  the  period  audited,  Directorate-General  AGRI  prepared  comprehensive 
information notes for the Commissioner, backed up by extensive analyses (including graphs 
and  historical  data)  of  available  information  for  the  sectors  and  measures  concerned.  These 
notes,  together  with  the  reports  of  the  meetings  held  at  cabinet  level,  are  duly  handled  in 
accordance with document management rules. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Risk management and performance follow-up in the context of agricultural market crises 

To  address  crisis  situations  Directorate-General  AGRI  has  used  a  range  of  instruments 
available  under  the  Common  Agricultural  Policy  (CAP).  However,  certain  measures  pose 
particular  management  and  control  risks  as  they  do  not  sufficiently  target  the  actual 
problem/product  or  because  they  allow  very  high  levels  of  flexibility  in  defining  the  exact 
scope and design of the aid to their farmers. These measures can also have a knock-on effect 
on  other  sectors  or  policies.  The  Internal  Audit  Service  acknowledged  that  the  final  design 
and  adoption  of  the  crisis  packages  is  ultimately  influenced  by  political  decisions  that  are 
largely  outside  the  control  of  Directorate-General  AGRI.  However,  operational  and 
management  considerations  can  help  to  inform  these  political  decisions.  In  this  respect,  the 
Internal Audit Service found that in practice Directorate-General AGRI has made only very 
limited analyses of the management implications of the various crisis packages implemented 
to  date  and  that  the  related  risks  have  not  been  adequately  reflected  in  Directorate-General 
AGRI's risk management process. Moreover, the follow-up given to crisis measures has so far 
concentrated more on reporting the uptake of the measures involved and on the main sectors 
impacted, but is lacking in terms of the analysis on the potential broader impact including on 
other sectors/policies.   

Recommendation 

Directorate-General AGRI should ensure that risks stemming from the adopted measures for 
its  management  and  control  system  are  properly  taken  into  account  in  its  risk  management 
process. In addition, in following up the implementation of crisis measures, it should analyse 
the  role  of  all  CAP  tools  used  and  their  structural  impact,  including  their  impact  on  other 
farming  sectors  and  policies.  This  should  help  Directorate-General  AGRI  to  propose 
adjustments  or  to  discontinue  existing  measures  or  even  propose  policy  changes.  Finally,  it 
should  undertake  an  evaluation  of  the  prevention  and  management  of  crises  aimed  at 
assessing the appropriateness of the methods, tools and measures used as soon as possible. 

34 

 
 
Additional information provided by Directorate-General AGRI on the measures defined 
and/or implemented following the Internal Audit Service audit 

In  response  to  the  Internal  Audit  Service  recommendations,  Directorate-General  AGRI  has 
undertaken  several  actions  to  enhance  the  coordination  inside  Directorate-General  AGRI  to 
better react to future crises including preparing a guide of procedures and setting up of a task 
force.  A  guide  of  procedures  has  been  adopted  at  the  end  of  2017.  It  established  (1)  a 
taskforce  ready-to-act in  case  of  new  agricultural  market  crises  with  large  economic  impact 
and  (2)  a  periodical  review  mechanism  (every  six  months)  of  the  different  exceptional 
measures in place for market reasons and of the main risk scenarios identified for agricultural 
markets. This periodical review mechanism will report to the RMIC of DG AGRI (who leads 
the  above  mentioned  taskforce)  and  will  feed  the  annual  risk  assessment  exercise  of  DG 
AGRI  In  addition,  a  study  on  “improving  crisis  prevention  and  management  criteria  and 
strategies  in  the  agricultural  sector”  is  currently  on-going.  It  aims  at  providing  a  critical 
review  of  all  aspects  related  to  the  crisis  prevention  and  management  mechanisms  in  the 
Common Agricultural Policy. 

2.2. Audit on Directorate-General AGRI's implementation of RDPs 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  whether  Directorate-General  AGRI's  internal 
processes  for  monitoring  the implementation  of  Rural  Development  Programmes  (RDP)  are 
well  designed  and  consistently  implemented,  whether  they  ensure  that  weaknesses  in  RDP 
implementation  are  detected  and  addressed  in  time  and  whether  they  reduce  (as  much  as 
possible) the risks of errors and/or poor performance. 

The  audit  covered  Directorate-General  AGRI's  management  processes  for  monitoring  the 
implementation and performance of RDPs. 

The audit took place during the initial phase of the implementation period and focused on the 
processes  Directorate-General  AGRI  has  put  in  place  to  ensure  its  supervisory  role  for  the 
implementation of the Rural Development (RD) policy under shared management. It did not 
cover  the  ex-post  audit  processes,  which  were  included  in  the  scope  of  a  separate  Internal 
Audit Service audit on the Directorate's-General control strategy. 

In  Directorate-General  AGRI's  2016  Annual  Activity  Report,  a  reservation  was  issued  in 
respect  of  significant  weaknesses  in  the  underlying  transactions  (legality  and  regularity)  of 
RD expenditure (ABB 04) for 20 Paying Agencies, comprising 19 Member States. 

The  fieldwork  was  finalised  on  28  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

The Internal Audit Service recognised the ongoing efforts made by Directorate-General AGRI 
to improve their internal processes for monitoring the implementation of RDPs. In particular, 
the audit identified the following strengths: 

35 

 
 
 
Directorate-General AGRI has invested in  knowledge management in RD policy and 

a) 
programming: 

The internal IT knowledge management tool, RD Wiki, which is accessible to all Directorate-
General  AGRI  staff,  has  been  subject  to  further  development.  It  contains  the  applicable 
legislation  as  well  as  any  related  legal  interpretations.  Guidance  documents  and  technical 
explanations are posted in RD Wiki to share knowledge and ensure a consistent approach. The 
Directorate-General  also  organises  regular  thematic  training  sessions  on  specific  issues 
(“Q&A sessions”) for RD staff. 

Directorate-General AGRI has drafted guidance documents for Member States (MS) that are 
shared  online.  It  also  organises  seminars  and/or  networking  events  on  a  regular  basis  that 
bring together MS representatives.  

Directorate-General AGRI has designed specific tools and mechanisms to strengthen 

b) 
its internal monitoring and supervision of the RDP implementation: 

The  responsible  geographical  desk  officer  prepares  a  working  document  in  English  and/or 
French  summarising  the  main  points  of  an  amendment,  which  in  turn  helps  to  facilitate  the 
consultation process.  

Once the Annual Implementation  Report have been  received and analysed,  annual  overview 
meetings are held for each MS. They bring together the geographical units and the responsible 
director  and  are  chaired  by  the  Deputy  Director-General  responsible  for  rural  development 
policy. They aim to take stock of the progress of RDP implementation to prepare the Annual 
Review Meetings (ARM) with the MS that take place every autumn. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

2.3. Audit on Directorate-General AGRI's control strategy for the CAP 2014-2020 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  whether  Directorate-General  AGRI  has  adequately 
designed  and  implemented  its  control  strategy  to  be  able  to  provide  assurance  on  the 
implementation of the Common Agricultural Policy (CAP) 2014-2020 budget in compliance 
with EU rules. 

The audit focused on the following processes: 

  Processes  for  handling  Member  State  (MS)  reporting  requirements  related  to  their 

management and control system; 

  Processes for managing conformity clearance  audits/inquiries, as well as audits/inquiries 

in the context of the financial clearance procedure; 

  Processes for following up deficiencies identified in the management and control system 

of the MS and ensuring remedial action (including financial corrections). 

36 

 
 
The  fieldwork  was  finalised  on  13  October  2017.  All  observations  and  recommendations 
relate  to  the  situation  as  of  that  date,  except  for  some  limited  additional  testing  which  was 
performed following Directorate-General AGRI's comments to the findings validation table.  

Strengths 

The  Internal  Audit  Service  recognised  the  efforts  and  commitment  made  by  Directorate-
General AGRI to design and implement a robust system for the control strategy for the CAP 
2014-2020. The Internal Audit Service noted that the processes have significantly improved 
compared to what it had observed in its audits of Directorate-General AGRI's control strategy 
for  the  CAP  2007-2013.  In  particular,  the  Internal  Audit  Service  identified  the  following 
strengths: 

a) 
Directorate-General  AGRI  has  adopted  an  audit  strategy  for  the  CAP  2014-2020 
which  details  the  audit  approach  and  sets  objectives  for  the  audit  activities  as  well  as 
indicators to follow-up their implementation. 

b) 
Directorate AGRI-H "Assurance and Audit" has developed detailed procedures for the 
implementation of the audit activities, which are set out in a comprehensive audit manual and 
regularly updated. In December 2015 it also put in place a quality assurance policy. 

Directorate  AGRI-H's  procedures  include  a  strong  monitoring  of  the  audit  activities 

c) 
which has allowed it to:  

- implement the audit work programme as planned; 

- tackle the backlog of conformity inquiries which had accumulated in the past. By the end 
of  2016,  all  contradictory  procedures  related  to  audits  conducted  in  2013  or  before  had 
been closed; 

- prepare the Commission decisions adopting the financial corrections in a timely manner.  

d) 
Directorate  AGRI-H  has  a  Financial  Correction  Board  which  examines  all  the 
proposals  of  the  audit  units  before  the  closing  of  the  contradictory  procedure  in  order  "to 
ensure  that  they  are  legally  sound,  proportionate  and  in  line  with  the  established 
administrative practices of the Directorate and consistent with other cases." Detailed minutes 
of  the  Financial  Correction  Board  are  prepared  recording  its  decision  and  recommendations 
regarding each inquiry. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Financial corrections 

The Internal Audit Service identified a number of weaknesses in the process for calculating 
financial corrections and at the time of the fieldwork, Directorate-General AGRI was not in a 
position  to  confirm  that  these  are  not  systemic  in  nature.  In  one  of  the  cases  examined, 
Directorate-General  AGRI  did  not  apply  the  financial  correction  to  all  the  expenditure 
concerned. This was due to a technical error caused by modifications in 2016 in the matches 
of budget codes and audit fields attached to the audits in the IT system used by Directorate-

37 

 
 
General  AGRI  (COMBO).  The  checks  that  Directorate-General  AGRI  had  put  in  place  did 
not  detect the error. Subsequent  to the  Internal Audit  Service’s finding, Directorate-General 
AGRI  found  three  other  similar  errors.  The  calculation  for  offsetting  overlapping  financial 
corrections  also  contained  a  number  of  errors,  including  one  case  where  the  offsetting  was 
significantly larger than it should have been. All detected errors are either corrected or under 
correction. 

Directorate-General  AGRI  informed  the  Internal  Audit  Service  that  it  had  set  up  internal 
working  groups  to  look  into  these  issues.  Their  work  was  still  ongoing  when  the  fieldwork 
was finalised. 

Recommendation 

Based  on  the  outcome  of  the  working  groups'  analysis,  Directorate-General  AGRI  should 
strengthen  its  procedures  for  the  calculation  of  financial  corrections  and  update  the  audit 
manual where necessary. 

Additional information provided by Directorate-General AGRI on the measures defined 
and/or implemented following the Internal Audit Service audit 

By  the  time  the  audit  report  was  finalised,  Directorate-General  AGRI  had  made  significant 
efforts to address these  issues. With one exception that was not  material, all errors detected 
had  been  either  corrected  or  were  under  correction.  In  addition,  Directorate-General  AGRI 
had  set  up  internal  working  groups  to  further  analyse  the  issue  and  Directorate-General 
AGRI's  audit  Directorate  is  looking  at  how  to  strengthen  its  procedures  to  address  such 
matters. 

The internal working groups established by DG AGRI have already presented their analysis 
and tabled proposals for addressing the issues (including guidelines, checklists, training and 
IT solutions). These proposals are currently being implemented. 

2.4. Audit on CHAFEA's management and control system for the implementation of the 
measures for the promotion of agricultural products  

Audit objectives and scope 

The  objective  of  this  audit,  which took  place  at  an  early  stage  of  CHAFEA  taking  over  the 
management  of  the  promotion  activities,  was  to  assess  the  design  and  implementation  of 
CHAFEA's control system and management processes for implementing promotion measures 
for agricultural products to ensure that the proposals selected best meet the objectives of the 
promotion policy and to ensure the legality and regularity of the financial transactions. 

This audit covered, in particular: 

  The design and implementation of controls regarding the preparation of calls for proposals 
– from the adoption of the annual work programme to the publication of the calls up to the 
submission deadline (i.e. including guidance to applicants), for calls launched in 2016 and 
2017; 

38 

 
 
 
  The design and implementation of controls regarding the selection and evaluation process 
from reception of the proposals up to communication of the ranking lists to Directorate-
General AGRI and the communication of selected proposals to Member States (for simple 
programmes) or up to the signature of grant agreements (for multi programmes); 

  The design and implementation of controls for pre-financing payments for selected multi 

programmes in the 2016 call; 

  The design of the controls for the interim and final payments of the programmes, as well 

as the monitoring of the implementation for multi programmes; 

  The design and implementation of the controls for procurement procedures related to the 
2016  high-level  mission  to  South  East  Asia  and  the  preparation  of  the  2017  high  level 
mission to Canada, as well as payment procedures for the former; 

  CHAFEA's  preparations  for  the  replacement  of  the  current  framework  contract  for  the 

organisation of high-level missions and participation in trade fairs; 

  The  design  and  implementation  of  cooperation  and  reporting  arrangements  between 
the  Memorandum  of 

CHAFEA  and  Directorate-General  AGRI  as  set  out 
Understanding. 

in 

The fieldwork was finalised on 23 June 2017. All observations and recommendations relate to 
the situation as of that date.  

Strengths 

The auditors identified the following specific strengths:  

a) 
Even though the unit was built from the ground up, starting in August 2015 (before the 
unit  was  officially  established),  with  one  person  and  has  grown  since  then    to  10  posts  by  
31  December  2016,  it  quickly  became  fully  operational,  largely  due  to  the  skills  and 
commitment  of  the  staff  concerned.  The  publication  and  management  of  the  first  calls  took 
place as planned. 

b) 
CHAFEA  AGRI  Unit  has  been  proactive  in  drawing  lessons  from  their  experience 
from the first campaign of calls for proposal in 2016. On the basis of shortcomings identified, 
CHAFEA  AGRI  Unit  has  corrected  the  guidance  documents  and  methods  put  in  place  to 
manage the 2017 campaign. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

2.5. Audit on LIFE + phasing out in Directorate-General ENV 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  efficiency  and 
effectiveness  of  the  governance,  risk  management  and  control  process  put  in  place  by  
Directorate-General ENV for the management of the phasing out of LIFE+ projects. 

More specifically, the audit assessed whether the Directorate's-General internal control system 
put  in  place  for  the  audited  processes  provided  reasonable  assurance  for  achieving  the 
following objectives: 

39 

 
 
  Economy, efficiency and effectiveness of operations; 
  Adequate  management  of  risks  related  to  legality  and  regularity  of  underlying 

transactions, taking into account the nature of the payments concerned. 

The audit covered 2016 financial transactions, in particular: 

The  effectiveness  of  the  internal  control  processes  in  ensuring  the  legality  and  regularity  of 
the  financial  transactions  and  the  roles  of  the  different  actors  in  the  financial  circuit  as 
regards: 

  Mid-term pre-financing payments; 
  Final payments; 
  Additional payments; 
  Recovery  orders:  recovery  of  pre-financing  at  the  final  payment  stage  and  recovery  of 

amounts as a result of the implementation of ex post audits; 

  De-commitments; 
  The  management  of  amendments  to  the  grant  agreement  leading  to  an  extension  of  the 
project duration and their compliance with the applicable legal and contractual provisions; 
  The monitoring and reporting on the progress of the phasing out of LIFE+ projects and the 

archiving of closed files. 

Strengths 

The auditors recognised the ongoing efforts made by Directorate-General ENV to manage the 
phasing out of the programme LIFE+ in the context of an increasing workload linked to the 
current staff reduction. A number of strengths have been identified in the course of the audit, 
in particular: 

a) 
Directorate-General  ENV  has  made  significant  efforts  to  limit  payment  delays:  in 
2016,  3.92%  of  all  Directorate-General  ENV's  payments  were  paid  late  in  comparison  with 
legal deadlines. This represents a considerable improvement compared to a figure of 12.5% in 
2013. 

The  yearly  detected  error  rate  resulting  from  the  sampled  LIFE  project  submitted  to 

b) 
ex-post audits has gradually decreased from 2.27% in 2012 to 0.44% in 2016. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Recovery orders and recovery context 

The  audit  identified  a  number  of  weaknesses  in  the  implementation  of  the  recovery  order 
process:  inconsistencies  were  noted  in  the  time  given  to  beneficiaries  to  reply  to  the  pre-
information letter, there were delays at key stages in the treatment of recovery orders and a 
lack of effective monitoring and follow-up. Moreover, the auditors found deficiencies in the 
encoding of specific information related to recovery orders in ABAC. 

40 

 
 
Recommendation 

Directorate-General  ENV  should  provide  beneficiaries  consistently  and  equitably  with 
sufficient  time  for  replying  to  pre-information  letters.  Moreover,  Directorate-General  ENV 
should  strengthen  the  monitoring  of  the  recovery  process  to  ensure  that  recovery  orders  are 
treated  promptly.  Finally,  Directorate-General  ENV  should  implement  the  Directorate’s  -
General Budget instructions on encoding the recovery context. 

Additional information provided by Directorate-General ENV on the measures defined 
and/or implemented following the Internal Audit Service audit 

The recommendations made on this audit have been addressed and a follow-up audit by the 
Internal Audit Service is planned in July 2018. 

New procedures have been introduced in order to strengthen the monitoring of the recovery 
process,  which  is  also  followed  through  IT  tools.  In  addition,  the  financial  officers  of  the 
LIFE  unit  have  been  put  into  disposal  at  ENV.A5,  ENV's  Finance  Unit,  to  ensure  close 
collaboration  between  financial  actors  on  the  remaining  LIFE  legacy  files  and  their  proper 
closure.  This  involves  the  finalisation  of  all  LIFE+  grant  agreements  established,  the  final 
payments  that  need  to  be  done  and  the  respective  de-commitments  when  needed.  Finally, 
trainings have been organised on the "recovery context", while the Directorate-General ENV 
accountant is further monitoring this. 

Directorate-General Environment is progressively implementing the agreed with the Internal 
Audit Service action plans and taking measures to assure the mitigation of any residual risks 
that could potentially affect one or several internal control principles and/or components.   

2.6. Audit on monitoring and enforcement of EU environmental law in Directorate-
General ENV  

Audit objectives and scope 

The objective of the audit was to assess whether Directorate-General ENV has put in place an 
adequate  internal  control  system  that  ensures  effective  and  efficient  monitoring  and 
enforcement of EU environmental law. 

The scope of the audit included a review of the range of procedures, guidance, arrangements 
and  mechanisms  used  by  Directorate-General  ENV  to  monitor  the  timely,  correct  and 
complete  implementation  and  enforcement  of  EU  law.  It  notably  covered  the  internal 
organisation  of  Directorate-General  ENV  related  to  the  handling  of  complaints  and 
infringements  procedures.  The  audit  focussed  on  the  general  processes  exercised  by 
Directorate-General ENV to ensure the effective application of EU environmental law. 

There were no reservations in  Directorate-General ENV's 2016 Annual  Activity  Report that 
relate to the processes audited.  

The fieldwork was finalised on 20 March 2017. All observations and recommendations relate 
to the situation as of that date.  

41 

 
 
 
Strengths 

The Internal Audit Service found that Directorate-General ENV has a proactive approach to 
supporting the proper transposition of environmental law, though a combination of preventive 
and corrective actions. The Internal Audit Service also recognised the ongoing efforts made 
by  Directorate-General  ENV  to  improve  the  treatment  of  complaints  and  infringements.  In 
particular, the audit identified the following strengths: 

Creation  of  Task  Forces:  As  early  as  2005,  Directorate-General  ENV  put  in  place 
a) 
thematic  Task  Forces  composed  of  representatives  from  legal  and  technical/policy  units, 
which  contributed  to  improving  the  internal  coordination  and  the  setting  of  a  strategic 
overview in key environmental sectors. 

b) 
Horizontal  infringement  cases:  In  order  to  be  more  effective  in  the  handling  of 
infringements,  Directorate-General  ENV  gives  priority  to  tackling  structural  problems  in 
Member  States  by  grouping  together  cases  concerning  the  same  subject  matter  and  then 
launching "horizontal cases" addressing systemic implementation problems. This has helped 
to reduce the number of open infringements. 

Package  Meetings:  These  are  meetings  between  Directorate-General  ENV  and 
c) 
Member  States'  representatives.  They  take  place  annually  and  involve  the  Management  of 
Directorate-General  ENV  (legal  Director  and  legal  and/or  technical  Heads  of  Units)  and 
technical experts at national level. They discuss the main complex on-going complaints, EU 
Pilot  and  infringement  cases.  Overall,  these  meetings  are  considered  to  be  very  effective  in 
promoting a faster and easier resolution of cases when compared to cases which are referred 
to the Court of Justice. 

Major audit findings 

The Internal Audit Service identified two very important issues: 

Complaints handling 

Directorate-General  ENV  continues  to  experience  considerable  difficulties  in  respecting  the 
Commission deadline of 15 working days for the acknowledgement of receipt of a complaint 
and  the  12-month  benchmark  for  the  closure  of  the  complaint  and/or  issuance  of  a  formal 
notice.  Currently,  there  is  no  formal,  internal  operational  guidance  tailored  to  Directorate-
General ENV's specific needs explaining how complaints should be handled, in particular in 
order to facilitate the distinction between systemic and individual complaints. There is also no 
repository of individual complaints not followed up at the time of their submission, but which 
could,  through  repetition,  lead  to  structural  cases.  Moreover,  in  terms  of  organisation,  the 
handling of complaints is still only partially centralised and needs to be streamlined further. 
Finally, there are no quantitative indicators aimed at helping to measure Directorate-General 
ENV's performance on the achievement of key targets. 

Enforcement of EU environmental law 

The Internal Audit Service identified weaknesses regarding the measurement and reporting of 
Directorate-General  ENV  internal  performance,  including  case  handlers'  workload  and  the 
work  and  results  of  the  Task  Forces.  Furthermore,  the  current  mandate  and  working 
modalities of the Task Forces do not sufficiently reflect their key coordination and knowledge 
building roles. Finally, the Internal Audit Service noted that due to the difficulties in finding 

42 

 
 
staff  with  the  necessary  skills,  Directorate-General  ENV  had  to  use  Seconded  National 
Experts (SNEs) on legal cases involving their own country of origin.  

Recommendations 

Complaints handling 

Taking into account the recent Commission communication, Directorate-General ENV should 
develop  a  complaints  handling  internal  procedure  that  includes  criteria  aimed  at  helping 
identify potentially systemic issues. It should also extend the use of more targeted complaint 
forms  (subject  to  clarification  from  the  Secretariat-General)  and  further  streamline  case 
handling  administrative  tasks  (such  as  monitoring  of  acknowledgements  of  receipt). 
Moreover,  Directorate-General  ENV  should  reinforce  the  monitoring  and  reporting  on 
complaints  handling  by  developing  appropriate  Key  Performance  Indicators  and  reporting 
more regularly on the state of play. Finally, Directorate-General ENV should ensure that key 
information  on cases that are not  pursued at the time, is  kept  centrally so this can be easily 
retrieved in order to help identify structural cases. 

Enforcement of EU environmental law 

Directorate-General ENV should strengthen its monitoring and reporting on the enforcement 
of  EU  law  by  defining  internal  quantitative  targets  to  measure  progress  towards  the 
achievement of corporate targets and consider reporting these in its management documents. 
It  should  also  periodically  report  the  results  of  the  coherence  exercise  to  the  Management 
Board  and  strengthen  the  monitoring  of  the  case  handler  workload  to  help  avoid  potential 
bottlenecks. 

Directorate-General  ENV  should  review  the  mandate  and  working  modalities  of  the  Task 
Forces to better reflect their coordinating and knowledge building roles. This should include 
the need to periodically analyse the cases examined by the Task Forces, including sensitive or 
complex cases as well as those cases highlighted in the coherence exercise calling for urgent 
steps  to  be  taken.  The  results  of  the  work  of  the  Task  Forces  should  be  communicated  to 
senior  management  at  least  once  a  year.  Directorate-General  ENV  should  also  avoid  using 
SNEs to handle legal matters in situations where they are working alone when dealing with 
their country of origin. 

Additional information provided by Directorate-General ENV on the measures defined 
and/or implemented following the Internal Audit Service audit 

Actions to address the two recommendations rated as "very important" have now been fully 
put in place and are being implemented by Directorate-General ENV. A number of supporting 
documents  have  been  submitted  to  the  Internal  Audit  Service  to  demonstrate  the 
implementation and for Internal Audit Service follow-up and assessment. The actions carried 
out include: 

a) Complaints forms are available on Directorate-General ENV internet.  

b)  An  updated  mandate  for  the  implementation  and  working  modalities  that  apply  to  task 
forces has been prepared.  

c)  Discussions  with  the  hierarchy  and  Commissioner/Cabinet  are  being  scheduled  regularly 
for each sector/Task Force. 

43 

 
 
d)  The  most  relevant  benchmarks  and  statistical  elements  have  been  selected,  and  internal 
quantitative and qualitative KPIs have been prepared, which will be used to internally monitor 
the performance of work. These KPIs can be used for assessing performance in the context of 
the  semester  'coherence  meetings'  and  for  reporting  to  the  Directorate-General  Management 
and/or Commissioner.  

Following  the  audit,  SNEs  are  no  longer  handling  legal  matters  alone  or  un-supervised  in 
cases where they would be dealing directly with their country of origin.  

Within  the  specificities  of  its  legal  framework,  DG  ENV  further  improved  its  handling  of 
complaints and streamlined the administrative tasks relating to complaints handling. 

2.7. Audit on Directorate-General SANTE’s food safety crisis preparedness 

Audit objectives and scope 

The objective of the audit was to assess whether Directorate-General SANTE has put in place 
adequate processes for its preparedness to react to food safety crises. 

In particular the audit assessed whether Directorate-General SANTE:  

  Has  a  "general  plan"  for  crisis  management  and  supporting  procedures  that  provide  the 

necessary specifications to react to and manage a food crisis,  

  Maintains  the  "general  plan"  and  supporting  procedures  to  ensure  that  they  are  fit  for 

purpose; 

  Coordinates adequately with stakeholders. 

The audit covered the following processes:  

  Directorate-General  SANTE's  "general  plan"  for  food  crisis  and  (related)  supporting 
(standing)  operating  procedures  for  crisis  preparedness  and  management  as  well  as  the 
processes for reviewing them; 

  Directorate-General  SANTE's  arrangements  for  maintaining  the  "general  plan"  and 

supporting procedures in Directorate-General SANTE as fit for purpose; 

  Directorate-General  SANTE's  internal  coordination  processes  and  those  with  other 
stakeholders  in  relation  to  food  crisis  preparedness  and  management  as  well  as  with 
respect to the potential impact of such a crisis to other EU policies.  

The  scope  of  this  audit  also  included  some  actions  that  were  considered  as  not  fully 
implemented  in  the  Internal  Audit  Service  follow  up  on  the  ex-IAC  "Audit  on  business 
continuity in Directorate-General SANTE". 

There  were  no  reservations  in  the  2016  Annual  Activity  Report  of  Directorate-General 
SANTE that relate to the process audited. 

44 

 
 
 
 
The  fieldwork  was  finalised  on  15  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

The  auditors  identified  the  following  strengths  in  relation  to  Directorate-General  SANTE's 
preparedness for a food safety crisis. In particular: 

Directorate-General SANTE's crisis management team is composed of competent and 
a) 
committed colleagues who have gained experience in managing prior incidents that included 
handling  situations  involving  certain  pressure  and  requiring  coordination  with  other 
stakeholders.   

b) 
In  March  2015  Directorate-General  SANTE  produced  an  overview  report  on 
emergency  preparedness  following  a  series  of  fact-finding  missions  carried  out  in  five 
Member  States  (MS).  They  were  able  to  identify  good  practices  and  lessons  learned  which 
come from real cases in the MS. 

Major audit findings 

The Internal Audit Service identified two very important issues:  

Adequacy of the "general plan" and related mechanisms to respond to food safety crises 

The  Internal  Audit  Service  found  that  that  the "general  plan"  for  food  crisis  and  the  related 
procedures and arrangements have not been updated on a regular basis. As a result, there were 
some inconsistencies in the roles of staff involved in food safety crises in Directorate-General 
SANTE  and  in  the  associated  business  continuity  and  crisis  management  procedures. 
Furthermore,  there  were  only  two  staff  members  directly  responsible  for  managing  food-
related  incidents  and  related  crises,  which  might  be  insufficient  in  the  event  of  prolonged 
and/or  simultaneous  crises  situations.  The  Internal  Audit  Service  also  found  gaps  in  the 
method  for  communicating  food  safety  crises  as  well  as  ensuring  consistency  and 
complementarity with related actions that are under the responsibility of EU Agencies (EFSA 
and  ECDC).  Also,  the  list  of  MS  crisis  coordinators  had  not  been  updated  since  November 
2014  and  these  crisis  coordinators  do  not  meet  on  a  regular  basis  to  exchange  ideas  and 
promote  understanding  of  their  role.  Finally,  Directorate-General  SANTE  lacked  the 
necessary  procedures  to  allow  its  food  safety  crisis  management  team  to  better  use  the 
information  contained  in  MS  contingency  plans  to  be  able  to,  if  appropriate,  propose 
harmonised rules. 

Exercising the "general plan" in practice 

Although Directorate-General SANTE has gained experience in managing serious food safety 
incidents  since  the  establishment  of  the  "general  plan"  in  2004,  the  arrangements  for  crisis 
management have been tested only once since then (in 2013). Even then, this exercise did not 
actually  involve  the  majority  of  the  main  stakeholders  responsible  for  crisis  management  at 
MS  and  Commission  levels.  In  addition,  pending  what  is  already  a  significantly  delayed 
revision  of  the  "general  plan",  at  the  time  of  the  audit  Directorate-General  SANTE  had  no 
concrete plans in place for exercising the "general plan" (together with its related procedures). 

45 

 
 
Recommendations 

Adequacy of the "general plan" and related mechanisms to respond to food safety crises 

In order to ensure that Directorate-General SANTE is effectively and efficiently prepared for 
a food safety crisis, it should: 

  Update  the  relevant  operating  procedures  for  crisis  management,  without  delay,  and 
communicate them to all Directorate-General SANTE staff involved; update the relevant 
staff job descriptions and set up redeployment arrangements in line with existing business 
continuity  procedures.  Request  MS  to  update  the  list  of  crisis  coordinators  (including 
alternates) and remind them of their role in crisis management; 
In  parallel  with  the  on-going  revision  of  the  "general  plan",  define  the  communication 
tasks of the crisis coordinators and issue guidelines on how and what to communicate in 
the  event  of  a  food/feed  safety  crisis  situation.  Clarify  with  the  European  Food  Safety 
Authority and the European Centre for Disease Prevention and Control how the specific 
arrangements  for  rapid  outbreak  assessments  would  be  applied  in  cases  of  food  safety 
crises; 

 

  As part of the business continuity procedures, ensure that staff involved in food/feed crisis 
management  receive  relevant  training  and  participate  in  business  continuity  exercises  to 
acquire and maintain high levels of competence in implementing the business continuity 
procedures; 

  Encourage MS to share information on their contingency plans. Design internal working 
arrangements to ensure that the food safety crisis management team is able to make use of 
the  information  regarding  those  plans  so  that  Directorate-General  SANTE  may  propose 
harmonised  rules  when  appropriate.  In  addition,  follow  up  instances  of  potential  non-
compliance with the applicable legislation, as identified in MS contingency plans. 

Exercising the "general plan" in practice 

Directorate-General  SANTE  should  develop  a  multi  annual  plan  for  exercising  and 
maintaining the "general plan". This plan should be based on identified needs and involve key 
stakeholders as appropriate in function of their roles and responsibilities. 

Additional  information  provided  by  Directorate-General  SANTE  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

Directorate-General  SANTE  accepted  all  recommendations  and  produced  an  action  plan  in 
January 2018. Most of the actions are already on-going and are expected to be completed in 
2018. 

As  regards  the  adequacy  of  the  "general  plan"  and  related  mechanisms  to  respond  to  food 
safety  crises,  Directorate-General  SANTE  is  in  the  process  of  preparing  a  Commission 
Decision on a general plan for crisis management in the field of the safety of food and feed. 
The external consultation with Member States and EFSA on the draft Commission Decision is 
expected  to  be  launched  in  the  first  half  of  2018.  Subsequently,  the  existing  Standard 
Operating  Procedures  will  be  adapted  to  experience  learnt.  In  addition,  the  next  meeting  of 
crisis coordinators will address the role of Member States crisis coordinators. 

46 

 
 
 
As regards the exercise of the "general plan" in practice, Directorate-General SANTE plans to 
conduct an exercise in late 2018, will identify the needs on the basis of lessons learned and 
discussions with the Member States crisis coordinators. The needs analysis will feed into the 
design of subsequent exercises to address emerging issues as well as the timing and frequency 
of such exercises. 

3.  COHESION 

3.1. Audit on policy and funding for youth employment in Directorate-General EMPL 

Audit objectives and scope 

The objective of the audit was to assess whether Directorate-General EMPL has put in place 
effective  mechanisms  that  ensure  consistency  between  policy  initiatives  and  objectives  and 
EU funding in the area of youth employment.  

The audit focused on the following three areas: 

  The  adequacy  of  the  processes  for  youth  employment  policy  design  and  for  youth 
employment  funding  to  ensure  that  policy  design  and  budget  implementation  in  these 
areas are adequately aligned so that they support and reinforce each other;  

  The  adequacy  of  the  alignment  between  the  processes  for  coordinating  and  monitoring 
policy  and  funding  in  the  area  of  youth  employment  so  that  they  support  and  reinforce 
each other;  

  The  effectiveness  of  current  mechanisms  for  reprogramming  or  reallocation  of  funds  in 

the area of youth employment. 

The 2016 Annual Activity Report of Directorate-General EMPL contains a reservation on the 
management  and  control  systems  for  three  European  Social  Funds  (ESF)  /  Youth 
Employment Initiative (YEI) operational programmes (OPs) in Bulgaria, Croatia and Italy for 
the 2014-2020 programming period. The reason for the reservation was due to deficiencies in 
the management and control systems set up for the Common Provisions Regulation (CPR) for 
the European Structural and Investment Funds (ESIF). 

The  fieldwork  was  finalised  on  4  December  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

The auditors recognised the ongoing efforts made by Directorate-General EMPL to strengthen 
the  link  between  funding  and  policy  activities  related  to  youth  employment.  More 
specifically:  

a) 

Coordinated approach to youth employment policy  

Since 2013, the link between youth employment policy and EU funding has been significantly 
strengthened through the Youth Guarantee policy recommendation, supported by the YEI as a 
dedicated  funding  resource,  which  is  considered  to  be  an  innovative  approach.  The  youth 
employment  policy  is  further  supported  through  policy  coordination  and  surveillance  in  the 

47 

 
 
 
context  of  the  European  Semester,  including  policy recommendations  to  the  Member  States 
(MS) (Country Specific Recommendations – CSRs). Various units across Directorate-General 
EMPL,  including  Unit  A1  (European  Semester),  Unit  B1  (Employment  Strategy),  Unit  F1 
(ESF policy) and Geographical Units (GUs) work together to achieve the youth employment 
policy objectives.  

b) 

Country teams  

In the context of the European Semester, Directorate-General EMPL has established country 
teams bringing together Desk Officers (DOs) from GUs, who have the best knowledge of the 
situation in each MS, and Policy Officers (POs) from Policy and Analytical Units, who have 
the  economic  or  policy  expertise.  The  Internal  Audit  Service  audit  team  attended  the  first 
country  team  meetings  for  the  European  Semester  (ES)  2017/18  for  Romania  and  Spain  as 
observer and witnessed very active exchanges between DOs and POs on funding and policy 
issues.  Moreover,  CSRs  in  Directorate-General  EMPL  are  drafted  by  the  same  DOs  who 
monitor  the  implementation  of  ESF  OPs  on  the  ground  which  is  an  important  advantage  in 
terms of linking policy and funding issues. 

c) 

Organisational structure   

On 1 November 2015, Directorate-General EMPL was reorganised with the aim to improve 
the  link  between  the  Directorate's-General  policy  and  its  funding  activities.  Previously  all 
GUs for shared management funds were located in two Geographical Directorates. In the new 
structure,  the  GUs  are  attached  to  the  different  thematic  policy  Directorates,  which  are 
organised according to the Juncker priorities: employment, social affairs, labour mobility and 
skills.  The  Internal  Audit  Service  acknowledged  that  Directorate-General  EMPL's  new 
structure serves to encourage coordination between its policy and funding activities. 

d) 

Skills mapping  

Unit  E5  has  carried  out  a  mapping  exercise  to  determine  which  actions  of  the  New  Skills 
Agenda (NSA) are not covered under the current ESF OPs and which changes are needed to 
align  the  OPs  with  the  NSA.  The  skills  mapping  has  already  resulted  in  changes  in  the 
Poland's ESF OP and is part of the negotiations that are currently ongoing to amend the Czech 
Republic's ESF OP. The mapping exercise helps detect funding gaps and is the first step for 
aligning  new  policy  initiatives  with  existing  EU  funding.  This  analysis  can  be  used  at 
different stages of the policy/funding cycle: (1) at policy preparation to demonstrate how the 
new  policy  will  be  financed  in  concrete  terms;  (2)  in  the  framework  of  an  OP  amendment 
request by MS (which is the context in which Unit E5 carried out this exercise) or (3) in the 
context of the ES. 

e) 

Your first Eures job 

Your first Eures job (YfEj) is the only dedicated pan-European scheme to supporting intra-EU 
job mobility. YfEj supports young jobseekers looking for a job in another MS by providing 
information  and  financial  support  to  help  reduce  mobility  obstacles  such  as  travel  expenses 
for job interviews or relocation costs. YfEj is managed by Unit D1 under the EU Programme 
for  Employment  and  Social  Innovation  programme.  A  total  of  seven  projects  have  already 
been  financed  to  date, with  a combined target of around  6700 work  placements. Despite its 
small  size,  a  recent  study  has  highlighted  the  benefits  of  this  programme  and  its  clear  EU 
added value with respect to other EU programmes. 

48 

 
 
Major audit findings 

The Internal Audit Service identified three very important issues: 

Policy preparation 

Directorate-General  EMPL  did  not  prepare  an  impact  assessment  (IA)  for  the  Youth 
Guarantee (YG) and the New Skills Agenda, and the justifications for not doing so were not 
documented in sufficient detail. In addition, when preparing policy and funding initiatives, the 
Directorate-General did not fully consider the implications of the delivery mechanism chosen. 
Furthermore,  Directorate-General  EMPL  did  not  sufficiently  consider  certain  key  aspects 
relevant to youth unemployment challenges when preparing new initiatives, such as the extent 
to which eligibility criteria used to allocate EU funding address social challenges or how best 
to support mobility at the EU level. In addition, the involvement of the GUs in the early stages 
of policy design was limited. 

Implementation of funding for youth employment 

Although the YEI was meant to deliver results quickly, the implementation on the ground is 
very slow in those MS with the highest levels of youth unemployment and young people not 
in education, employment or training. In addition, the indicators used for monitoring the YEI 
have  a  number  of  shortcomings,  which  limit  their  usefulness  in  demonstrating  the  results 
achieved. 

Reprogramming (Article 23.1 CPR) 

Directorate-General  EMPL  did  not  undertake  the  formal  and  systematic  assessment  of 
relevant  CSRs  after  their  adoption  by  the  Council  in  order  to  determine  whether  any 
reprogramming  is  needed  under  Article  23.1(a)  of  the  CPR.  In  fact,  no  reprogramming 
requests  on the  basis  of  Article  23.1  (a)  have  actually  been  made  in  practice.  In  reality,  the 
mechanism set out in this article is not sufficiently flexible to facilitate reprogramming when 
needed  to  react  to  new  or  urgent  policy  priorities.  There  are  a  number  of  obstacles  to  the 
practical  implementation  of  reprogramming  requests,  such  as  resistance  from  the  MS, 
complex procedures, resources constraints in the GUs to manage reprogramming requests and 
a mismatch between the ESF and the Multi-annual Financial Framework in terms of relevant 
time  window  (annual  vs  multi-annual  cycles)  and  relevant  levels  of  government  in  the  MS 
(national vs regional OPs). 

Recommendations 

Policy preparation 

When preparing new policy and funding initiatives, Directorate-General EMPL should: 

  Perform and document an assessment of the need to carry out an IA and ensure the related 

decision is endorsed by senior management; 

  Ensure that the supporting analytical documents for new initiatives properly address key 
aspects such as policy objectives, the financing implications, consideration of alternative 
delivery mechanisms and potential impacts. Also, to involve GUs as soon as possible in 
preparation stages; 

  For the post 2020 programming period, take into account criteria for allocating funding to 
address social challenges and their impact on mobility (internal and at the EU level) and 

49 

 
 
consider  including  incentives  for  MS  to  invest  through  their  ESF/YEI  OPs  in  measures 
supporting labour mobility at EU level. 

Implementation of funding for youth employment 

Directorate-General EMPL should: 

  Monitor closely MS with a high risk of decommitment of YEI funds, in order to mitigate 
the  risk  that  these  MS  approve  low  EU  added-value  projects  with  the  purpose  of  funds 
absorption; 

  Ensure  that  YG  and  YEI  indicators  are  taken  into  account  by  GUs  and  unit  B1  when 

analysing the information reported on the YEI and the YG respectively;  

  Carry out a fully-fledged evaluation of the YEI once MS submit their second evaluation of 

the YEI OPs; 
  For post 2020: 

o  Propose  a  simplification  of  the  monitoring  system  with  a  view  to  reducing  the 
number  of  indicators,  having  up-to-date  information  on  implementation  on  the 
ground and placing more emphasis on the sustainability of the measures financed;  
o  Propose  to  better  align  the  incentives  of  the  MS  under  shared  management 
programmes  for  achieving  timely  results  that  produce  EU  added  value  (i.e.: 
payment for results, application of the N+2 rule, etc.); 

o  Propose a clear rule in the legal base for the calculation of decommitment and how 

to take into account refunded pre-financing. 

Reprogramming (Article 23.1 CPR) 

Directorate-General EMPL should: 

  Prepare a formal analysis, after the CSRs have been  adopted by the Council, to identify 

cases where reprogramming of ESIF may be needed under Article 23.1; 

  Use  OP  amendments  proposed  by  MS  themselves  to  request  additional  elements  to  be 

included in the OPs based on the Commission assessment. 

  For  the  post  2020  programming  period,  based  on  the  experience  of  the  current 
programming  period,  develop  proposals  for  a  more  flexible  mechanism  which,  together 
with  measures  to  further  simplify  the  programming  architecture,  would  allow  the 
Commission to initiate the redirection of EU funds in an efficient and effective manner to 
urgent needs or new policy priorities. 

Additional  information  provided  by  Directorate-General  EMPL  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

In  response  to  the  Internal  Audit  Service  recommendations  DG  EMPL  has  undertaken  the 
following actions: 

 

In  accordance  with  the Better  Regulation  Guidelines  and  the  Better  Regulation  Toolbox 
DG EMPL carried out an Impact Assessment to accompany the proposals for adoption of 
new legislation.  

  For the new initiatives for which an impact assessment is not prepared, DG EMPL have 
ensured that the supporting analytical documents properly address key aspects such as the 
policy  objectives,  the  financing  of  the  new  initiatives  in  concrete  terms,  alternative 
delivery mechanisms and potential impacts. 

50 

 
 
  Geographical  units  are  involved  at  the  earliest  stage  of  preparation  of  new  major  policy 
initiatives,  taking  into  account  their  time  constraints,  through  task  forces  focusing  on 
specific themes in order to contribute to the shaping of the new initiatives. 

  The  policy  unit  in  charge  of  youth  employment  organised  a  discussion  with  Youth 
Guarantee  coordinators  on  the  role  of  mobility  in  the  implementation  of  the  Youth 
Guarantee to collect ideas for future initiatives on youth mobility. 

  Concerning  finalisation  of  the  staff  efficiency  review  for  geographical  units,  it  was 
decided at senior management level that due to limitations in increasing of staff, possible 
staff  changes  can  only  be  done  by  internal  moves.  However,  general  simplification 
measures in the management of the European Social Fund/Youth Employment Initiative 
will be considered, mostly within the DG EMPL internal processes. 
In  order  to  avoid  inconsistencies  between  geographical  units,  internal  coordination 
improved. 

 

  DG EMPL has continued to monitor decommitment risk through the ongoing work by the 
their  discussions  on  operational  programme 

through 
geographical  units  and 
implementation progress in the context of annual review meetings. 

  For  the  preparation  of  youth  employment  policies  and  initiatives  in  the  next  post-2020 
programming  period,  DG  EMPL  took  into  account  criteria  for  allocating  funding  to 
address social challenges and their impact on mobility (at internal and at the EU level). 
  The European Social Fund+ proposal includes incentives for Member States to invest in 
mobility  measures  through  their  European  Social  Fund/Youth  Employment  Initiative 
Operational  Programmes,  for  example,  recital  15  of  the  proposal  states  that  “Synergies 
with  the  Erasmus  programme,  notably  to  facilitate  the  participation  of  disadvantaged 
learners in learning mobility, should be supported within this context.” 

  The Commission’s proposal also includes a simplification of the monitoring system with a 
view to having fewer indicators and an up-to-date information on implementation on the 
ground, for example Article 27 of the Commission’s proposal for the post 2020 Common 
Provisions  Regulation  obliges  Managing  Authorities  to  submit  data  six  times  a  year 
electronically, which will allow the Commission to have a clear view of progress on the 
ground.   

  The  Commission’s  proposal  also  includes  many  measures  to  simplify  the  programming 
architecture including a midterm review (Article 14 of the Common Provisions Regulation 
proposal)  which  is  a  more  flexible  mechanism  to  allow  the  Commission  to  initiate  the 
redirection of EU funds in an efficient and effective manner to urgent needs or new policy 
priorities.  

  The  proposed  rules  on  decommitment  are  much  clearer  (chapter  IV  of  the  Common 

Provisions Regulation proposal.  

  Efforts have also been made in the proposals to better align the incentives of the MS under 
shared management programmes for achieving timely results that produce EU added value 
for example through financing not linked to costs (Article 89) and the application of the 
N+2 rule (Article 99). 

51 

 
 
 
 
 
3.2. Audit  on  monitoring  the  implementation  and  performance  of  FEAD  OPs  in 
Directorate-General EMPL 

Audit objective and scope 

The  objective  of  this  audit  was  to  assess  whether  Directorate-General  EMPL  monitors 
effectively the implementation and performance of FEAD (Fund for European Aid to the most 
Deprived) Operational Programmes (OPs) in the early stages of the 2014-2020 programming 
period. 

The scope of the audit focused on the following three areas: 

  The  appropriateness  of  the  legal  base,  together  with  the  monitoring  arrangements  put  in 
place  by  Directorate-General  EMPL,  to  provide  a  sound  basis  to  monitor  the 
implementation and performance of FEAD OPs; 

  The  appropriateness  of  the  adopted  FEAD  OPs  to  provide  a  sound  basis  for  monitoring 

their implementation and performance; 

  The  effectiveness  of  Directorate-General  EMPL’s  monitoring  activities  of 

the 

implementation and performance of FEAD OPs. 

The 2015 Annual Activity Report of Directorate-General EMPL contains a reservation on the 
FEAD OP for France due to material deficiencies in some key elements of the management 
and  control  systems  set  up  in  relation  to  the  FEAD  regulation,  as  well  as  legality  and 
regularity issues revealed by an audit of Directorate-General EMPL. 

The  fieldwork  was  finalised  on  15  December  2016.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

The Internal Audit Service acknowledged the efforts made by Directorate-General EMPL to 
set  up  a  new  fund  for  the  2014-20  programing  period,  which  builds  on  the  previous  food 
distribution  programme  managed  by  Directorate-General  AGRI,  but  with  a  broader  scope 
which includes social inclusion objectives. More specifically: 

a) 
The FEAD is implemented across Europe through large PO such as Food Banks or the 
Red  Cross  and  also  by  smaller  PO  staffed  by  volunteers  who  deliver  food  to  the  end 
recipients.  Without  the  dedicated  support  of  thousands  of  volunteers,  Directorate-General 
EMPL  would  face  an  even  greater  challenge  in  ensuring  the  effectiveness  of  the  fund  in 
practice. During the fieldwork the audit team visited one of the food bank distribution centre 
and noted the professionalism and dedication of the volunteers. 

b) 
Directorate-General  EMPL  has  put  in  place  a  number  of  initiatives,  including  the 
FEAD  network,  annual  meetings  with  stakeholders  at  EU  level  and  consulting  POs  in  the 
preparation  of  the  Annual  Work  Programme  for  the  FEAD  operational  technical  assistance. 
The purpose of these initiatives is to support cooperation and engagement with organisations 
at the European level to help improve performance on the ground. The audit team participated 
in three meetings of the FEAD network and witnessed very active exchanges of experiences 
and good practices in initiatives tackling poverty and social exclusion between a wide range 
of  stakeholders.  These  meetings  also  allow  the  Directorate-General  to  gather  valuable 
information on implementation on the ground. 

52 

 
 
Recognising  that  the  aim  was  to  keep  the  rules  simple  to  limit  the  administrative 
c) 
burden for the beneficiaries and the underlying legislation only requires Member States (MS) 
to  provide  limited  financial  information  to  the  Commission,  Directorate-General  EMPL  has 
applied  a  pragmatic  approach  to  monitoring  the  implementation  of  the  fund,  including 
requesting periodic payment forecasts from MS on a voluntary basis, which about 75% of the 
MS do in practice. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Performance measurement and reporting  

The  FEAD  regulatory  framework  lacks  key  elements  of  a  performance  measurement 
framework,  such  as  milestones  and  targets  for  common  indicators  or  specific  objectives  for 
type  I  programmes.  Also,  the  indicators  and  data  reported  for  the  FEAD  have  a  number  of 
inherent  limitations, such as  non-comparability of data or incomplete reporting for common 
indicators, which makes them less useful for reporting on the overall performance of the fund. 
Moreover,  the  legal  basis  lacks  mechanisms  to  monitor  the  uptake  of  accompanying 
measures,  namely  specific  indicators  and  data  on  participants.  Finally,  information  on 
implementation  on  the  ground  is  currently  not  received  on  a  regular  basis  to  facilitate  the 
effective monitoring of the programme. 

Recommendation 

Directorate-General  EMPL  should  strengthen  the  plausibility  checks  for  the  indicator 
data/information  reported  by  MS  in  the  Annual  Implementation  Reports  and  ensure,  to  the 
extent  possible,  the  comparability  of  data  included  in  the  Summary  Report  (or  explain  the 
limitations of the data used). The report should be presented on a timely basis. It should also 
work with MS to obtain, on a voluntary basis, information on the implementation of the OPs 
on the ground. 

Going  forward,  for  the  post  2020  programming  period,  the  Directorate-General  should 
propose the basic elements of a performance measurement system, including those relating to 
accompanying  measures,  to  be  included  in  the  legal  base.  In  addition,  it  should  assess  the 
need to include a provision requiring MS to submit information on the implementation on the 
ground on a regular basis. Finally, it should assess the need to have a more flexible approach 
for accompanying measures and ensure these are more closely linked to the European Social 
Fund. 

Additional  information  provided  by  Directorate-General  EMPL  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

In  response  to  the  Internal  Audit  Service  recommendations,  Directorate-General  EMPL  has 
undertaken several actions. In the area of monitoring and evaluation, DG EMPL: 

53 

 
 
 
 
 
  Ensured that Desk Officers assess and confirm the plausibility of the indicators reported, 
including through requesting key supporting information from the Member States on data 
sources and/or estimation methodologies where relevant. DG EMPL have also developed 
plausibility  checks  at  the  aggregate  level  to  the  extent  possible  taking  into  account  the 
differences  between  Operational  Programmes.  These  assessments  are  documented  to 
allow consistency checks. 

  Ensured that the summary report to the European Parliament and the Council is accurate, 
based  on  comparable  data  and  is  presented  before  the  end  of  the  year  following  the 
reporting  period  (N+1);  if  there  are  shortcomings  in  the  data  reported  or  reliable  data 
cannot  be  obtained  for  some  indicators,  DG  EMPL  will  include  an  explanation  on  the 
limitations of the data reported. 

  Explored  the  possibilities  to  request  the  Member  States  to  submit,  on  a  voluntary  and 
more  regular  basis,  key  information  on  the  implementation  of  the  Operational 
Programmes.  However,  taking  into  account  how  the  operations  financed  from  the  Fund 
for  European  Aid  to  the  Most  Deprived  are  implemented,  it  was  considered  that  such 
request  for  further  data  would  not  have  any  added  value  and  would  imply  unnecessary 
additional burden to authorities. 

  Ensured  that  accompanying  measures  are  covered  in  the  performance  checklist  for  the 
review of the Annual Implementation Report, monitor their uptake taking into account the 
proportionality  principle  and  recommend  corrective  measures  to  Member  States  if 
necessary. 
Introduced  in  the  acceptance  letter  of  Annual  Implementation  Reports  a  reminder  about 
the  obligation  of  Managing  Authorities  to  make  public  a summary  of  the  content of  the 
report. 

 

  Ensured  that  the  relevant  stakeholders  are  invited  to  participate  in  Annual  Review 

Meetings for Operational Programme I. 

  Ensured that the relevant geographical units in DG EMPL s are copied on questions sent 
by MS and the replies given, in particular those submitted in the context of the different 
expert  groups,  and  that  relevant  questions  directly  addressed  to  the  geographical  units  s 
and their answers are adequately filed.  

  Put in place coordination mechanisms at the operational level to ensure consistency in the 
management  of  the  Fund  for  European  Aid  to  the  Most  Deprived  by  the  geographical 
units  and  to  share  best  practices/implementation  problems.  This  has  been  done  by 
organising periodic meetings and exchanging views, coordinating and taking decisions on 
relevant matters within the Dynamic Diversified Growth Funds Management meeting. 

  Further promoted the participation of geographical units in Expert Group meetings. 
  Monitored tightly the timely submission of the Annual Implementation Report by the MS. 
 
Introduced additional automated controls in the electronic data exchange system SFC2014 
for the areas identified by the Internal Audit Service and encouraged the use of SFC2014 
web services to link it to Member States' IT systems. 
Improved the access to existing documents by making all final guidance, ‘Questions and 
Answers’ and regulations available to Member States in a user-friendly environment using 
existing IT resources. 

 

  Further developed guidance to Member States on flat rates in particular with regard to the 
methodologies used for the calculation of flat rates and the related audit trail and guidance 
to Desk Officers on Annual Review Meetings. 

54 

 
 
 
 

In  order  to  promote  complementarity  with  the  European  Social  Fund,  the  Commission 
Proposal for the next programming period (2021-2027- ESF +) envisages the merger of 
the Fund for European Aid to the most Deprived with the European Social Fund, also as a 
response  to  the  findings  of  the  Fund  for  European  Aid  to  the  most  Deprived  mid-term 
evaluation. 

  The  proposal  for  the  legal  base  post  2020  sets  out  the  basic  elements  of  a  performance 
measurement  system,  namely  objectives,  targets  and  where  relevant  baselines  and 
milestones  and  still  ensures  that  a  simplified  system  will  be  applied  for  ex-FEAD 
operations. To this effect, provisions and derogations have been inserted in the proposals, 
notably the ones concerning the new specific objective addressing material deprivation. 
  The proposal includes also the take up of stakeholder discussions (Open Consultation) and 

findings of the mid-term evaluation as regards accompanying measures. 

3.3. Audit on major projects in Directorate-General REGIO  

Audit objectives and scope 

The objective of the audit was to assess compliance with the applicable regulatory framework 
and  the  efficiency  and  effectiveness  of  the  controls  put  in  place  by  Directorate-General 
REGIO  for  the  approval  and  early  monitoring  of  major  projects  (MPs)  in  the  new 
programming period (PP). 

The  scope  of  this  audit  included  a  review  of  the  processes  and  controls  put  in  place  by 
Directorate-General REGIO to approve and monitor MP in the 2014-2020 PP. 

Given  the  role  of  the  Joint  Assistance  to  Support  Projects  in  the  European  Regions 
(JASPERS)  Independent  Quality  Review  (IQR)  team  in  the  overall  appraisal  process,  the 
Internal Audit Service also carried out: 

  A  review  of  the  governance  arrangements,  processes  and  controls  put  in  place  by  

Directorate-General REGIO to supervise the activities of the JASPERS IQR team; 

  An assessment of the efficiency and effectiveness of the use of the JASPERS IQR team as 
outlined in  the 2014-2020 legal framework. This  included an  assessment of whether the 
completeness  and  quality  checks  carried  out  by  JASPERS  IQR  of  MP  are  adequately 
performed and whether these procedures resulted in a faster appraisal of MP applications 
compared to the past. 

Scope limitation on JASPERS 

Even  though  JASPERS  IQR  was  not  our  main  auditee  and  was  very  cooperative  overall  in 
providing documents and explanations on its working methods, which allowed us to carry out 
our  review,  it  should  be  noted  that  the  Internal  Audit  Service  was  refused  full  access  to 
JASPERS IQR internal procedures, files and systems. Specifically, the Internal Audit Service 
was not provided access to information contained in the European Investment Bank's (EIB) IT 
platform,  where  JASPERS  IQR  stores  project  documentation,  internal  working  notes  and 
benchmark  data. Neither  was full access granted to  the internal  manual of procedures.  As a 
result, the Internal Audit  Service could  not  obtain reasonable assurance on the audit trail  of 
project  appraisals  and  on  the  adequacy  of  the  internal  procedures,  including  on  the 

55 

 
 
 
management of conflicts of interest between JASPERS IQR, JASPERS Advisory (which is a 
separate department in JASPERS in charge of providing support to the Member States (MS) 
for preparing MPs) and the EIB's lending activities. 

Reservations  were  made  in  Directorate-General  REGIO's  2016  Annual  Activity  Report 
concerning serious deficiencies in the management and control systems of OPs for the 2007-
2013  PP  by  MS.  These  deficiencies  covered  inter  alia,  the  compliance  with  public 
procurement  rules,  state  aid  rules,  revenue  generated  by  projects  and  eligibility  rules, 
including  MP.  For  the  2014-20  PP,  reservations  were  made  on  management  and  control 
systems of specific OPs, but MP are not specifically mentioned. 

The fieldwork was finalised on 28 April 2017. All observations and recommendations relate 
to the situation as of that date. 

Strengths 

The centralisation of the approval of MP in the newly created (March 2016) 'Closure & Major 
Project'  unit  (F1)  in  Directorate-General  REGIO  has  contributed  to  the  streamlining  of  the 
processes  in  this  area.  Furthermore,  the  delegation  of  the  MP  appraisals  to  JASPERS  IQR 
during  the  current  PP,  with  dedicated  JASPERS  staff/experts  carrying  out  the  qualitative 
appraisals  of  MP  applications,  has  contributed  to  the  implementation  of  a  common  and 
consistent  approach.  MP  assessments  are  carried  out  against  the  quality  criteria  that  are 
included in the relevant EU Regulations. 

JASPERS IQR has contributed to a drop in the average approval times, under Article 102(2) 
of  the  Common  Provisions  Regulation  (CPR),  from  340  calendar  days  (including 
interruptions)  in  the  2007-2013  period    to  approximately  112  calendar  days  (including 
interruptions) as at the time of the completion of the fieldwork. The share of MP where the 
appraisal process was interrupted was significantly reduced from 82% in the previous PP to 
22 % in the current PP up until the date of the audit. In the majority of the files tested by the 
Internal  Audit  Service,  JASPERS  submitted  the  post  submission  appraisals  (PSA)  reports 
within  the  30-calendar  days'  deadline  and  prepared  the  IQR  reports  (for  which  no  formal 
deadlines are set out in the regulation) within a reasonable time. 

The  modified  role  and  increased  responsibilities  of  JASPERS  in  the  MP  process  has  been 
counter-balanced  by  closer  and  more  systematic  cooperation  between  the  Commission  and 
JASPERS.  The  following  measures  have  been  put  in  place  in  the  new  PP  to  ensure  that  a 
coherent approach is followed:  

• 
For  the  first  time,  the  main  principles  of  the  Cost  Benefit  Analysis  (CBA) 
methodology were enshrined in the Commission Implementing Regulation N° 2015/207 and 
in  the  Delegated  Regulation  N°  480/2014.  These  principles  need  to  be  followed  by  all  MS 
submitting  MP  applications.  A  CBA  guidance  document  on  investment  projects  was 
published in December 2014. 
• 
methodological issues linked to the application of the CBA of the projects. 
• 
desk officers meeting periodically to discuss issues of concern.  
Tripartite meetings between the Member States, JASPERS and the Commission have 
• 
been organised for all MS with a large number of MP and for a selected number of other MS. 

Establishment of an MP matrix in Directorate-General REGIO, which is a network of 

Creation  of  a  CBA  Forum,  where  the  Commission,  JASPERS  and  the  MS  discuss 

56 

 
 
Annual  stakeholders meetings  are organised, presenting a unique  opportunity  for the 
• 
Commission,  EIB,  and  Managing  Authorities to  meet  together  to  exchange  experiences  and 
opinions about how the Commission led technical assistance can meet their needs. 
• 
JASPERS  has  been  given  full  access  to  the  IT  platform  SFC2014  used  for  the 
exchange  of  information  between  MS  and  the  Commission  and  has  been  provided  with 
updates  on  the  latest  CBA  and  MP  guidance  available  on  ESIF  (European  Structural  and 
Investment  Funds)  Questions  &  Answers.  In  addition,  a  CBA  working  group  between 
JASPERS  and  Directorate-General  REGIO  meets  regularly  to  discuss  all  issues  that  are 
subject to interpretation. 
Major audit findings  

The Internal Audit Service identified one very important issue: 

Governance: JASPERS contractual and supervision arrangements 

Directorate-General  REGIO  is  ultimately  responsible  for  the  management  and  adoption  of 
MPs and therefore needs to effectively supervise the appraisal activities that are performed by 
JASPERS IQR. However, the Commission's access rights to audit and supervise the appraisal 
activities that are carried out by JASPERS IQR are not well defined in the relevant contractual 
arrangements. Moreover, the role and tasks entrusted to JASPERS IQR in the current period 
are  not  clearly  explained  in  the  contractual  arrangements,  particularly  for  the  PSA  that  are 
performed under Article 102(2) of the Common Provisions Regulation (CPR). Furthermore, 
Directorate-General  REGIO  has  not  yet  defined  a  strategy,  for  carrying  out  supervisory 
checks of JASPERS IQR's internal procedures and appraisal documentation. 

Also,  the  dual  role  of  JASPERS  both  as  an  advisor  to  MS  and  as  the  IQR  of  project 
applications  submitted  by  MS  raises  questions  concerning  potential  conflicts  of  interest 
between its Advisory and IQR Divisions,  which have  not  been adequately addressed by the 
quality checks performed by Directorate-General REGIO when adopting projects. 

Recommendation 

Directorate-General REGIO should use its powers as a partner in JASPERS to: 

For the 2014-2020 period: 

  Strengthen its supervision of JASPERS IQR activities by, where appropriate, carrying out 
documentary and on-the-spot checks of JASPERS IQR internal procedures and appraisal 
documentation  and  by  reviewing  key  documents  on  the  functioning  of  the  JASPERS 
internal control system; 

  Plan  and  launch  a  mid-term  evaluation  of  JASPERS  as  required  by  Article  2.4  of  the 
framework partnership agreement (FPA) and ensure that there will be adequate access to 
JASPERS records and IT tools to facilitate this evaluation; 

  Clarify  the  Commission's  access  rights  to  JASPERS  IQR  within  the  contractual 
arrangements  between  the  Commission  and  the  EIB,  in  particular  the  access  rights  to 
information systems, documents and records for performing supervisory checks; 
Improve the contractual arrangements with respect to the PSA function by specifying the 
role and key tasks of JASPERS IQR in the FPA and/or specific grant agreement, and the 

 

57 

 
 
 
methodological requirements to be followed by JASPERS IQR when appraising the MP 
applications that are submitted under Article 102(2) of the CPR; 

  Analyse  actual  and  perceived  conflicts  of  interest  between  JASPERS  IQR,  JASPERS 
Advisory  and  EIB  lending  activities  and  develop  appropriate  mitigating  measures  if 
necessary. 

For the post-2020 period: 

If  MPs  will  be  part  of  the  post-2020  legislative  proposals,  propose  that  any  legislative 
proposal  for  the  streamlining  of  technical  facilities  clarifies  the  Commission's  supervisory 
arrangements over JASPERS IQR. 

Additional  information  provided  by  Directorate-General  REGIO  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

Since the issuance of the corresponding Internal Audit Service final report, and according to 
the agreed action plan, targeted actions have been carried out by Directorate-General REGIO, 
in close cooperation with JASPERS, in order to strengthen the governance of the management 
and adoption of Major Projects, in particular to better define the contractual arrangements and 
the Commission's access rights to audit/supervise JASPERS’ appraisal of projects, as well as 
to further reduce any risk of potential conflicts of interest between JASPERS IQR, JASPERS 
Advisory and EIB lending activities. At the same time efforts have been made, in cooperation 
with JASPERS, in order to improve the planning and reception of Major Projects applications 
as well as the monitoring of MPs physical and financial implementation.  

4.  RESEARCH, ENERGY AND TRANSPORT 

4.1. Audit on H2020 project management in Directorate-General CONNECT  

Audit objectives and scope 

The objective of the audit was to assess whether Directorate-General CONNECT has put in place 
an  effective  project  management  process  to  ensure  that  H2020  projects  are  effectively 
implemented by the beneficiaries in line with the grant agreement.  

The audit covered: 

  The monitoring approach (desk or on the spot checks or reviews, using internal or external 
expertise, including frequency of review) in line with the inherent risks of the projects; 

  Assessment of the activities of the projects based on deliverables and reports; 
  Selection of the appropriate course of action for underperforming projects; 
  Amendments to the grant agreements. 

The  audit  assessed  how  Directorate-General  CONNECT  ensures  that  project  activities  were 
carried  out  as  agreed  and  that  the  project  deliverables  are  produced  as  envisaged.  Existing 
automated controls were considered as part of the audited process. 

58 

 
 
 
Regarding  the  Strategy  for  an  effective  dissemination  and  exploitation  of  Horizon  2020 
research  results,  the  audit  fieldwork  only  covered  the  aspects  of  dissemination  to  be 
addressed  during  the  assessment  of  the  periodic  reporting, i.e.  mainly  the  assessment  of  the 
publishable  summary  and  the  review  of  the  progress  reached  in  the  implementation  of  the 
project dissemination plan. 

There  were  no  observations/reservations  in  Directorate-General  CONNECT's  2016  Annual 
Activity Report that relate to the area/process audited.  

The fieldwork was finalised on 9 June 2017. All observations and recommendations relate to 
the situation as of that date. 

Strengths 

The  auditors  recognised  Directorate-General  CONNECT's  ongoing  efforts  to  implement  the 
H2020  programme  in  the  context  of  an  increasing  workload.  The  Internal  Audit  Service 
identified the following strengths: 

a) 
Central  point  of  contact  with  the  Common  Support  Centre  (CSC):  unit  CNECT.R5  
acts  as  a  single  point  of  contact  with  the  CSC  to  discuss  issues  relating  in  particular  to 
guidance and IT functionalities, and with the Directorate-General CONNECT Project Officers 
(POs) to actively collect good practices and know-how. 

Amendments:  in  the  management  of  project  amendments,  detailed  comments, 
b) 
justifications  and  additional  checks  related  to  the  approval  process  are  recorded  in  the  IT 
system COMPASS. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Addressing the risk of irregularities and fraud 

Concerning  the  detection  and  management  of  plagiarism  cases,  there  is  no  adequate 
operational  solution  available  for  its  POs  enabling  them  to  perform  effective  plagiarism 
checks  of  project  deliverables.  Consequently,  the  POs  can  perform  only  limited  manual 
checks  on  deliverables.  Furthermore,  the  current  IT  system  SyGMa/COMPASS  does  not 
immediately  notify  the  POs  that  a  beneficiary  participating  in  a  project  under  their 
responsibility  has  been  flagged  in  the  Early  Detection  and  Exclusion  System  (EDES)  for 
plagiarism in other projects. Finally, Directorate-General CONNECT's anti-fraud strategy and 
related  action  plan  do  not  define  the  course  of  actions  to  be  followed  when  a  beneficiary 
participating in several projects is flagged in EDES. 

Recommendation 

Directorate-General  CONNECT  should  ensure  that  adequate  solutions  for  performing 
effective plagiarism checks are available and are regularly used by the POs. The Directorate-
General  should  also  ensure  that  the  POs  are  immediately  notified  once  an  EDES  flag  is 
entered in the SYGMA/COMPASS system. Moreover, the Directorate-General should update 
its anti-fraud strategy/action plan to address the risk of plagiarism involving a beneficiary who 
participates in several projects financed by the Directorate-General. 

59 

 
 
Additional  information  provided  by  Directorate-General  CONNECT  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

DG CONNECT considers that this recommendation has been partially implemented. 

A new anti-plagiarism tool is available to the Project Officers since late 2017. Dedicated anti-
fraud training sessions have been organised for the project officers. New guidance to project 
officers  and  operational  units  on  performing  plagiarism  checks  was  issued.  This  guidance 
explains the concept, the workflow and the use of the software tool for detection of plagiarism 
in deliverables as well as the actions and follow-up to take in positive cases. 

The  EDES  guidance  was  updated  and  now  clearly  mentions  that  Directorate-General 
CONNECT notifies the concerned project officers as soon as an EDES flag is entered on the 
grounds of plagiarism. 

The action plan linked to Directorate-General CONNECT anti-fraud strategy was updated to 
address the risk of plagiarism.  

Finally,  DG  CONNECT  has  performed  plagiarism  checks  on  a  sample  of  projects  and  will 
perform further checks by September 2018. 

4.2. Audit on procurement in Directorate-General CONNECT 

Audit objective and scope 

The  objective  of  the  audit  was  to  assess  whether  the  internal  control  system  in  place  in  
Directorate-General  CONNECT  is  effective  in  ensuring  the  legality  and  regularity  of 
procurement and of the underlying transactions managed by Directorate-General CONNECT. 

In  particular,  the  audit  assessed  whether  the  internal  control  system  provides  reasonable 
assurance  regarding  compliance  with  the  Financial  Regulation,  its  Rules  of  Application  and 
the relevant specific legal basis. 

The scope of the audit covered the procurement process, from the identification of the needs 
to the contract execution. 

There  were  no  observations/reservations 
Directorate-General CONNECT that relate to the area/process audited. 

in 

the  2016  Annual  Activity  Report  of  

The  fieldwork  was  finalised  on  9  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths  

The Internal Audit Service identified the following strengths: 

Directorate-General  CONNECT's  Single  Centre  of  Procurement  (SCP)  provides 
a) 
proactive support to the operational units: the SCP in CNECT.R2 acts as a centralised sector 
treating  consistently  all  procurement  files  and  supporting  all  operations  dealing  with 

60 

 
 
 
procurement.  The  nine  operational  units  interviewed  expressed  satisfaction  with  the  SCP 
service and appreciation for its work. The SCP has been very reactive to auditors' preliminary 
findings and has already addressed a number of issues found during the fieldwork. 

Studies  approved  by  management  are  clearly  identified:  the  SMART  tool  (Studies 
b) 
Management  And  Retrieval  Tool)  developed  in  Directorate-General  CONNECT  allows  to 
clearly identify all the studies  planned in  an effective manner, and to  ensure that all studies 
procured have been validated at Director-General level. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

4.3. Audit on closure of FP7 projects in ERCEA 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  processes  for  closing 
ERCEA's FP7 projects. 

The  audit  covered  the  monitoring  and  reporting  on  the  closure  of  FP7  projects,  the 
management  of  the  final  distribution  report,  de-commitments,  document  management  and 
archiving of project information, extensions of project duration, beneficiaries' complaints, and 
the implementation of ex-post audit results. 

There  were  no  observations  and/or  reservations  in  ERCEA's  2016  Annual  Activity  Report 
relating to the area/process audited. 

The fieldwork was finalised on 2 March 2017. All observations and recommendations relate 
to the situation as of that date. 

Strengths 

The  Internal  Audit  Service  acknowledged  the  ongoing  efforts  made  by  ERCEA  in  ensuring 
the effective and timely closure of FP7 projects. In particular, the auditors noted the following 
strengths: 

ERCEA  has  a  robust  system  for  implementing  audit  results  in  an  appropriate  and 
a) 
timely manner. Exception-based management is established for occasional cases necessitating 
delays  and/or  deviations  from  the  auditors'  recommendations,  with  the  involvement  of 
ERCEA's ex-post control unit and the final decision of the Agency's director. 

b) 
The  archiving  process  ensures  that  project  files  are  complete  and  appropriately 
safeguarded.  Only  the  necessary  documentation  is  kept,  which  results  in  an  efficient  use  of 
storage space. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

61 

 
 
4.4. Audit on grant management - phase 2: project management and payments for CEF 
in INEA 

Audit objective and scope 

The overall objective of the audit was to assess if INEA has put in place project management 
and payment processes for the Connecting Europe Facility (CEF), which provide reasonable 
assurance to the Authorising Officer by Delegation on the effectiveness of operations and the 
legality and regularity of the underlying transactions. 

The audit engagement focused on the internal controls in place for the following stages in the 
grant management cycle: 

  Grant amendments; 
  Pre-financing; 
  Project monitoring; 
 

Intermediate and final payments. 

The scope focused on projects for which payments were made in 2016. 

There  were  no  observations/reservations  in  the  2016  Annual  Activity  Report  of  INEA  that 
relate to the area/process audited. 

Strengths 

The  Internal  Audit  Service  recognised  the  continuous  efforts  made  by  INEA  to  ensure  a 
correct  and  effective  CEF  grant  management.  The  following  strengths  were  specifically 
identified during the audit: 

a) 
INEA  has  developed  a  complete  guide  on  amending  CEF  grant  agreements,  which 
provides  information  on  the  principles  governing  amendments,  when  and  how  to  amend  a 
grant agreement and a description of the process and tips to avoid common mistakes. 

INEA has developed detailed guidance for the assessment of the Action Status Reports  

b) 
enabling a harmonised approach for monitoring the implementation of the projects. 

c) 
INEA  has  a  robust  risk-based  ex-ante  control  strategy  building  on  good  practices 
gained  under  TEN-T  (predecessor  Agency  of  INEA).  It  ensures  a  balance  between  cost  of 
controls  and  available  resources  with  regard  to  the  level  of  ex-ante  controls  (frequency  and 
intensity). INEA has translated this strategy into detailed internal guidelines. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

62 

 
 
4.5. Audit on HR management in INEA 

Audit objective and scope 

The  objective  of  the  audit  was  to  assess  if  INEA  designed  and  implemented  an  adequate 
Human  Resource  (HR)  management  process  to  deploy  a  competent  (knowledgeable)  and 
engaged workforce in order to deliver its priorities and core business. 

In particular, the audit assessed the effectiveness of the following processes:  

  The design and implementation of the HR strategy; 
  The HR planning process, including workload assessment and staff allocation; 
  Selection, recruitment and retention of staff; 
  Knowledge  management  (learning  and  development,  competence  management,  and 

coaching); 

  Monitoring and reporting on HR. 

There were no observations and/or reservations in the 2016 Annual Activity Report of INEA 
that relate to the area/process audited. 

The  fieldwork  was  finalised  on  16  October  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

The Internal Audit Service acknowledged the ongoing efforts made by INEA in ensuring the 
effective and efficient operation of the HR function. In particular, the Internal Audit Service 
highlighted the following strengths: 

a) 

Strong control environment 

As  noted  in  previous  Internal  Audit  Service  audits,  INEA  benefits  from  a  strong  control 
environment, which represents a solid foundation for the internal control system as  a whole 
and ensures the effective management of resources.    

b) 

Human resources strategy  

INEA  established  a  comprehensive  and  coherent  multi-annual  human  resources  strategy  for 
the period 2016-2020. The INEA HR strategy links the HR strategic objectives to the agency's 
business objectives and priorities. It also highlights the current and future challenges for HR 
and establishes a multi-annual action plan with concrete actions and precise deadlines.  

c) 

Service-oriented approach 

The  HR  team  in  INEA  has  adopted  a  service-oriented  approach,  providing  valuable  and 
timely  support  to  the  operational  units:  all  the  heads  of  units  and  heads  of  departments 
interviewed during the audit were positive about the support received from the HR team. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues.  

63 

 
 
4.6. Audit on scientific project management in JRC 

Audit objective and scope 

The objective of this audit was to assess whether the management and control systems put in 
place by the JRC for its scientific project management activities are adequately designed and 
effectively implemented. 

The  scope  included  the  overall  JRC's  set-up  for  managing  its  scientific  work  packages 
(WPKs) as well as all phases of the WPKs' life cycle, namely: (1) planning; (2) execution and 
monitoring; (3) closure and the management of their results. 

There were no observations or reservations in JRC's 2016 Annual Activity Report related to 
the audited processes. 

The  fieldwork  was  finalised  on  8  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

The  auditors  recognised  the  ongoing  efforts  made  by  the  JRC  to  continuously  improve  its 
scientific project management practices and highlighted the following good practices, which 
contribute to effective operations of the audited process: 

a) 
All former scientific institutes were ISO 9001:2008 certified. This gave structure and 
coherence to JRC's work as each institute developed its own documentary framework (quality 
manual,  procedures  and  work  instructions,  templates)  to  support  its  activities,  appointed  a 
quality  manager  and  in  some  cases  a  quality  officer  per  unit.  This  structure  has  been 
maintained after the re-organisation, thus ensuring a smooth transition from the former site-
based scientific institutes to the current thematically formed scientific directorates. 

b) 
In 2012 JRC launched the development of the Integrated Management System (IMS), 
an integrated framework of processes intended to enable the Directorate-General to work as a 
single  entity  and  to  achieve  its  unified  objectives.  After  several  years  of  slow  progress, 
recently  its  development  has  gathered  pace.  The  JRC  has  finalised  the  IMS  manual,  the 
updated process map, and the updated list of the process owners. Other documents, like the 
scientific knowledge production and management process description are in the pipeline. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Monitoring of scientific projects' and WPKs' execution 

The  JRC  has  no  complete  and  sufficiently  detailed  guidance  on  monitoring  of  scientific 
projects and WPKs. Moreover, the actual monitoring of the WPKs' execution is not adequate 
and the system in place results in overstating the deliverables’ completion rate.  

There  is  no  regular  and  accurate  overview  of  the  actual  time  spent  by  the  scientists  on  the 
WPKs  as  the  time  spent  on  the  institutional  WPKs  is  not  monitored  against  the  plan.  In 
addition, the time reported as spent on the contractual WPKs does not always correspond to 

64 

 
 
the  actual  time  worked  (in  order  to  match  what  was  agreed  in  the  Administrative 
Arrangements).  

Recommendation 

JRC  should  improve  the  monitoring  of  the  WPK  execution  by:  (1)  designing  and 
implementing  adequate project management  monitoring practices  for the  WPK execution as 
part  of  the  new  scientific  project  management  methodology  and  guidance  implementation; 
and (2) providing a JRC-wide guidance for monitoring at WPK, unit and scientific directorate 
levels. 

Additional  information  provided  by  the  JRC  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The JRC action plan was approved by the Internal Audit Service on 9 March 2018. The JRC 
is  in  the  process  of  setting  up  a  Working  Group  to  address  the  audit  recommendations  and 
provide the JRC management with  concrete suggestions for reviewing the Scientific Project 
Management  in  the  DG.  The  draft  'Terms  of  Reference'  of  the  working  group  are  available 
and have been distributed to different categories of stakeholders and interested parties within 
the  JRC  in  order  to  have  as  many  parties  informed  and  involved  in  the  business  process 
improvement  activities  of  this  working  group.  The  Working  Group  is  expected  to  start  its 
activities in September 2018. 

4.7. Audit on HR management – recruitment of scientists in JRC 

Further  to  the  note  announcing  the  launch  of  the  audit  on  HR  management-  requirement  of 
scientists in JRC, the Internal Audit Service conducted a preliminary survey with the aim of 
gaining a better understanding of the activities and the related risks and in order to define the 
objectives  and  scope  of  the  engagement.  At  the  end  of  the  preliminary  review,  the  Internal 
Audit Service postponed the audit to the end of 2017 as at that time the HR process in the JRC 
was under significant transformation and both the future interactions among the actors (JRC, 
Directorate-General  HR)  and  JRC’s  working  practices,  underlying  procedures  and 
communication channels were not yet fully defined. 

Meanwhile  Directorate-General  HR  had  announced  that  the  pilot  phase  of  the  new  HR 
delivery mode will continue in 2018 and is foreseen to be concluded mid-2018.  

Given  these  developments  and  after  discussion  with  the  Director  JRC.A,  the  Internal  Audit 
Service decided to close the audit and to include the audit topic in the planning for 2018. 

4.8. Audit  on  the  effectiveness  of  the  set-up  and  supervision  of  Shift2Rail  by  
Directorate-General MOVE 

Audit objective and scope 

The  objective  of  the  audit  was  to  assess  if  the  set-up  of  the  Shift2Rail  (S2R)  Joint 
Undertaking (JU) and Directorate-General MOVE's supervision ensure that the JU's activities 

65 

 
 
 
contribute  to  the  achievement  of  the  policy  objectives  of  Directorate-General  MOVE  and 
Directorate-General  RTD and  that  the internal control objectives  for the indirectly managed 
funds are achieved.  

The audit focused on the following processes: 

  The  set-up  of  S2R  (including  governance,  internal  control  system  and  initial  operations, 
organisational  structure  and  staffing)  and  whether  this  enables  the  JU  to  perform  the 
entrusted tasks; 

  The  supervision  strategy  of  Directorate-General  MOVE  (including  the  monitoring  and 
steering  of  performance,  the  assurance  building  process  and  reporting)  and  the 
coordination with Directorate-General RTD; 

  The  organisation  and  procedures 

in  Directorate-General  MOVE  supporting 

the 

supervision strategy. 

There were no observations/reservations in the  2016 Annual Activity Report of Directorate-
General MOVE relating to the area/process audited. 

The  fieldwork  was  finalised  on  8  September  2017.  All  observations  and  recommendations 
relate to the situation at that date. 

Strengths 

The  Internal  Audit  Service  recognised  the  efforts  made  by  Directorate-General  MOVE  to 
ensure  the  effective  set-up  of  S2R  and  the  supervision  of  its  activities.  In  particular,  the 
Internal Audit Service identified the following strengths: 

a) 
Directorate-General  MOVE  staff  involved  in  S2R  supervision  are  competent, 
experienced  and  motivated.  They  collaborate  effectively  with  the  staff  of  S2R  and 
Directorate-General  RTD.  Moreover,  MOVE/ENER  Shared  Resource  Directorate  (SRD)  is 
setting up a team to be in charge of coordinating and supporting the supervision strategy and 
activities for the decentralised agencies and JUs. 

Directorate-General MOVE has a good understanding of its role and responsibilities in 

b) 
the S2R Governing Board and carries out this function effectively.   

Major audit findings 

The Internal Audit Service identified one very important issue: 

Supervision strategy: design and implementation 

Directorate-General  MOVE  has  not  established  a  formalised,  consolidated,  risk  based 
supervision strategy for S2R which sets out the Directorate's -General supervision objectives 
and  how  the  different  supervision  tools  contribute  to  building  assurance  on  achievement  of 
policy objectives and  adequate protection of the financial interests of the Union. Except for 
the  "Procedure  to  define  the  Commission  position  within  the  Governing  Board  of  S2R  JU", 
there  is  no  formal  allocation  of  tasks  between  MOVE.C4  (operational  unit)  and  SRD.3 
(finance and administration) and no formal division of supervisory tasks between Directorate-
General MOVE and Directorate-General RTD. Moreover, Directorate-General MOVE has not 
carried out a formal mapping exercise of the S2R-related tasks and corresponding estimation 
of the resources needed. 

66 

 
 
Recommendation 

Directorate-General  MOVE  should  establish  a  comprehensive,  risk  based  supervision 
strategy, describing how the available supervision tools and control mechanisms will be used 
and  including  a  formal  allocation  of  tasks.  The  Directorate-General  should  also  carry  out  a 
mapping  exercise  of  the  tasks  related  to  the  supervision  of  S2R  and  estimate  the  resources 
necessary for performing them. 

Additional  information  provided  by  Directorate-General  MOVE  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

 As regards the Internal Audit Service recommendation on "Supervision strategy: design and 
implementation",  Directorate-General  MOVE's  strategy  on  its  relations  with  Decentralised 
Agencies and Joint Undertakings was adopted by Directorate-General MOVE's Control Board 
on 4 December 2017 and was followed by immediate implementation and monitoring. Further 
actions to be implemented aim at formal clarification of allocation of the supervision activities 
within Directorate-General MOVE and between Directorate-General MOVE and Directorate-
General RTD; development of formal guidelines for the participation of Directorate-General 
MOVE in the different governing bodies; and identification and assessment of risks that could 
impair the achievement of main objectives. 

4.9. Audit on closure of FP7 projects in REA 

Audit objective and scope 

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  process  for  the  closure  of 
REA's FP7 projects.  

The  audit  covered  the  monitoring  and  reporting  on  the  closure  of  projects  and  the 
management  of  the  final  distribution  report,  de-commitments,  archiving  and  document 
management, amendments, complaints and the implementation of ex-post audit results. 

As regards FP7, there were two reservations in REA's 2016 Annual Activity Report: 

Reservation  concerning  the  rate  of  the  residual  errors  with  regard  to  the  accuracy  of  cost 
claims  impacting  on  granted  EU  funding  for  Space  and  Security  themes  of  the  Cooperation 
Specific Programme financed under FP7. 

Reservation  concerning  the  rate  of  the  residual  errors  with  regard  to  the  accuracy  of  cost 
claims impacting on granted EU funding for Research for the benefit of SMEs actions of the 
Capacities Specific Programme financed under FP7. 

The fieldwork was finalised on 9 March 2017. All observations and recommendations relate 
to the situation as of that date. 

Strengths 

REA  has  implemented  a  robust  monitoring  system  for  the  financial  aspects  of  the 
implementation of FP7 projects, which covers the most sensitive areas such as invoice ageing, 

67 

 
 
 
de-commitments,  closed  and  terminated  projects  with  open  budget  amount  (RAL),  and 
projects  with  expired  final  dates  of  implementation  .  The  controls  are  performed  by  the 
verifying sector throughout the year, as part of the corporate accounting quality exercise. This 
allows  to  timely  identify  any  potential  abnormal  situations  and  whenever  necessary  to  send 
queries to the operational units for the appropriate follow-up. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

4.10. Audit on HR management in Directorate-General RTD 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  Directorate-General  RTD's 
Human  Resource  Management  (HRM)  system  to  ensure  that  it  responds  effectively  to  the 
changing  business  environment  and  supports  the  Directorate-General  in  achieving  its 
objectives while promoting staff engagement and motivation. 

The scope of the audit covered:  

  The design and implementation of the strategic and operational HRM process; 
  HRM support for the decision making process on the organisational changes; 
  The knowledge sharing initiatives aimed to address HRM challenges; 
  The actions taken to improve staff engagement and satisfaction. 

There were no observations/reservations in the 2016 Annual Activity Report that relate to the 
area/process audited. 

The  fieldwork  was  finalised  on  13  September  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

a) 
Continuous  efforts  made  by  Directorate-General  RTD  to  develop  a  non-linear 
approach to the distribution of  staff reduction requirements between the Directorates which is 
based on the projected reduction of the programme management related activities.  

b) 
Introduction, in 2014, of an annual task mapping exercise based on the Unit HR report 
for  the  previous  year.  This  provides  Directorate-General  RTD  with  a  sound  picture  of  the 
human  resource  allocation  (in  Full  Time  Equivalent)  to  the  activities  of  the  Directorate-
General.  

c) 
Development of a workload assessment methodology in use since 2014 to i) identify 
the  number  of  staff  needed  to  manage  the  framework  programmes  and  ii)  to  balance  the 
workload  between  the  Directorates.  This  approach  proved  to  be  effective  in  identifying  the 
staffing  levels  needed  for  the  activities  related  to  the  implementation  of  the  framework 
programmes. 

68 

 
 
Recognition  of  the  importance  of  knowledge  management  (KM)  by  explicitly 
d) 
including  it  in  the  mission  of  unit  RTD.R.1  (former  RTD.R.5)  and  by  setting  up  a  KM 
Steering Committee led by Directorate-General RTD senior management. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

5.  EXTERNAL ACTIONS  

5.1. Audit on management of investment facilities (financial instruments) in Directorate-
General DEVCO 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  effectiveness  of  the  part  of  the 
management  of  the  investment  facilities  falling  within  Directorate-General  DEVCO's  remit. 
This  audit  focussed  on  three  facilities  (LAIF  -  Latin  America  Investment  Facility,  IFCA  - 
Investment Facility for Central Asia and AfIF - African Investment Facility) and on the whole 
blending cycle, from the identification/preparation phase till the payment schedule of projects. 
The audit covered blending operations launched in the period 2010 to 2016. 

The  fieldwork  was  finalised  on  25  January  2018.  All  observations  and  recommendations 
relate to the situation as of that date. 

Major audit findings 

The Internal Audit Service identified the following two very important issues: 

Blending project cycle: post-contract signature phase – monitoring project implementation 

Directorate-General  DEVCO  does  not  systematically  monitor  the  International  Financial 
Institutions' (IFIs) operational performance and the key aspects of the blending operations it 
has to report on annually to the European Parliament and the Council. Moreover, the reports 
submitted  by  the  IFIs  at  the  level  of  the  EU  Delegations  (EUD)  are  of  a  varying  quality. 
Hence,  the  EUD  does  not  always  have  relevant  information  to  supervise  appropriately  the 
operational and financial aspects of the projects. 

Pre-financing 

Due to unavailability of the declaration of expenses incurred by the IFIs, Directorate-General 
DEVCO clears pre-financing for blending operations at a very late stage (up to ten years after 
the  last  payment).  Moreover,  the  amounts  of  pre-financing  paid,  remain  unused  for  a  long 
period. 

69 

 
 
 
Recommendations 

Blending project cycle: post-contract signature phase – monitoring project implementation  

Directorate-General  DEVCO  should  (1)  improve  the  monitoring  at  Headquarter  level 
regarding  financial  and  operational  performance  of  the  IFIs,  (2)  improve  the  quality  of  the 
monitoring  database,  (3)  set  up  measures  to  ensure  that  reporting  from  the  IFIs  is 
appropriately and timely produced, analysed, commented upon and used, and (4) ensure that 
the contractual clauses are appropriately enforced. 

Pre-financing  

Directorate-General  DEVCO  should  address  the  root  causes  leading  to  pre-financing 
exceeding  the  needs  by  ensuring  that  the  new  provisions  are  adequately  implemented. 
Moreover,  it  should  adapt  the  reporting  requirements  for  the  IFIs  to  obtain  timely  the 
necessary  information  for  the  clearing  of  pre-financing  for  all  types  of  blending  operations. 
Finally, the Directorate-General has to ensure timely clearing of the pre-financing. 

Additional information provided Directorate-General DEVCO on the measures defined 
and/or implemented following the Internal Audit Service audit 

DEVCO  management  has  been  regularly  informed  on  the  results  regarding  financial  and 
operational  performance  of  projects/IFIs  through  established  mechanisms:  the  EAMRs 
(External  Assistance  Management  Reports),  the  monitoring  results  of  the  Results  Oriented 
Monitoring (ROM) System, the results of the aggregated analysis carried-out by the relevant 
unit on the state of play of projects shared in the frame of the Blending Steering Committees. 
The  blending  project  cycle  and  guidance  provided  to  our  implementing  partners  (IFs)  have 
already  strengthened  project  monitoring  in  the  new  blending  framework.  DEVCO  will 
continue applying ongoing measures and systems to ensure the quality and timeliness of the 
reports submitted by the IFIs. 

In this respect, both recommendations will be addressed through the update of the guidelines 
on EU blending operations.  

Furthermore,  a  number  of  additional  actions  will  be  taken.  A  pilot  exercise  on  screening 
blending  projects  through  the  ROM  system  has  been  launched  in  2018.  Following  its 
outcome, (i) a revised version of the methodology will be adopted; (ii) a ROM consolidated 
report on blending projects will be made available to DEVCO Management yearly. Besides, 
(iii) an annual report based on the traffic lights of the EAMRs at blending level, as well as (iv) 
a  consolidated  report  integrating  all  above  and  other  information,  will  be  produced  and 
presented yearly to DEVCO Management from 2019 onwards.  

In the meantime, as a safeguard measure, (v) a note will be issued with a view to stressing the 
need to ensure proper follow up of IFIs’ reporting and the enforcement of contractual clauses, 
the  need  to  avoid  pre-financing  exceeding  the  needs  and  to  clear  pre-financing  of  blending 
projects in a reasonable time in order to reduce the clearing periods. 

70 

 
 
 
 
 
5.2. Audit on Directorate-General ECHO’s grant management in response to the Syrian 
crisis in the Middle East (Headquarters and Field Offices) 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  whether  Directorate-General  ECHO  selects  and 
monitors effectively the actions it funds in order to achieve its humanitarian aid objectives in 
response to the Syrian crisis in the Middle East. 

The specific objectives included an assessment of: 

  The  analysis  and  selection  of  grant  proposals  submitted  by  the  partners  of  Directorate-
General  ECHO  for actions to  be handled through Remote  Management and Exceptional 
Extreme Operational Conditions (RM/EEOC); 

  The monitoring of and reporting on the implementation of the actions, both under normal 
monitoring  arrangements  and  under  RM/  EEOC,  including  the  assessment  of  their  final 
results. 

The audit covered grants with activities ending in 2015, 2016 and 2017.  

There were no observations/reservations  in the 2016 Annual Activity Report of Directorate-
General ECHO that relate to the area/process audited. 

Strengths 

The auditors recognised the ongoing efforts made by Directorate-General ECHO to enhance 
the selection and management of grants in order to ensure the selection of the most relevant 
projects and hence, the achievement of Directorate-General ECHO's humanitarian objectives. 
In particular, the Internal Audit Service noted the following strengths: 

Thorough assessment of the grant proposals for actions to be implemented under RM 

a) 
or EEOC against Directorate-General ECHO’s eligibility criteria. 

b) 
Robust  monitoring  system  for  the  implementation  of  Directorate-General  ECHO’s 
funded operations based on different monitoring tools,(e.g. field monitoring visits of the Field 
Experts  (FEs)  and  Desk  Officers  (DOs),  analysis  of  the  Interim  Reports    and  Final  Reports  
submitted by partners, regular discussions, meetings and correspondence with the partners and 
the  national  authorities,  analysis  of  the  post-distribution  reports  and  evaluation  reports  for 
lessons learnt). 

High quality documentation of the monitoring and appraisal process carried out by the 

c) 
DOs and FEs in one centralised tool, called Fiche Operationelle ("FichOp"). 

Specialised knowledge and expertise (e.g. health, food, protection, wash and shelter) 

d) 
provided by the Regional Sectorial Experts to the Field Offices. 

Close cooperation and sharing of information between the DOs (ECHO HQ) and the 

e) 
Field Offices. 

High  level  of  professionalism  and  commitment  shown  by  the  DOs  and  the  Field 

f) 
Offices. 

71 

 
 
g) 

Effective cooperation between the Regional Support Office and the Field Offices. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

5.3. Audit on procurement under Instrument for Pre-Accession (direct management and 
indirect  management  with  beneficiary  countries)  –  phase  II  in  Directorate-General 
NEAR 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  whether  the  control  system  put  in  place  for  the 
management of procurement under indirect management with beneficiary countries (IMBC) is 
adequate  and  effectively  implemented  to  ensure  the  legality  and  regularity  of  operations 
carried out by Turkey under IMBC with ex ante and ex post controls. 

The specific objectives included an assessment of: 

  The design by NEAR Headquarters (HQ) of the control system under IMBC; 
  The  coordination,  planning  and  monitoring  by  the  EU  Delegation  (EUD)  to  Turkey  of 
procurement  process  under  the  Instrument  for  Pre-Accession  Assistance  (IPA)  with  ex-
ante control; 

  The  implementation  by  Directorate-General  NEAR  staff  in  the  EUD  of  ex-ante  controls 

on procurement procedures managed by Turkey under IMBC with ex ante control; 

  The  conduct  of  ex-post  controls  on  procurement  procedures  by  Directorate-General 

NEAR staff in the EUD. 

The audit covered: 

  Directorate-General  NEAR  control  system  under  IMBC  including  the  guidance  on  the 

reduction of ex-ante controls; 

  The  performance  by  the  EUD's  staff  of  ex-ante  and  ex-post  controls  on  procurement 
procedures managed under IMBC by the Turkish Central Contracting and Financing Unit 
(CFCU)  (the  only  Turkish  contracting  authority  for  which  the  reduction  of  ex-ante 
controls has started); 

  The audit focused primarily on the activity of the EUD. 

There  were  no  observations/reservations  in  Directorate-General  NEAR's  2016  Annual 
Activity Report that relate to the area/process audited. 

The fieldwork was finalised on 14 June 2017. All observations and recommendations relate to 
the situation as of that date. 

Strengths 

The Internal Audit Service identified the following strengths in the EUD: 

Operational  and  financial  staff 

a) 
is 
knowledgeable about the subject and can in general efficiently manage their files in the often 
complicated political context. 

implementation  of  IPA 

involved 

the 

in 

72 

 
 
Systematic  and  accurate  use  of  checklists  and  project  lifecycles  generated  from  the 

b) 
Management Information System (MIS). 

c) 
Systematic  registration  of  "Transmission  Notes"  (documentation  submitted  by  the 
CFCU,  e.g.  for  ex  ante  approval)  and  "Annexes  to  Transmission  Notes"  (EUD's  replies)  in 
Ares. 

d) 
Regular  drafting  of  a  "Note  to  the  file"  which  represents  a  valuable  source  of 
information  for  staff  members  in  case  of  an  absence  or  a  permanent  departure  of  the  desk 
officer responsible from the EUD. 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Implementation of control plans by the EUD to Turkey 

Ex-ante  and  ex-post  controls  performed  by  the  EUDs  are  an  important  building  block  to 
provide  reasonable  assurance  on  the  procurement  activities.  Although  the  controls 
implemented in the EUD to Turkey were in most cases able to identify deficiencies and non-
compliance,  the  Internal  Audit  Service  found  procurement  files  where  the  ex-post  controls 
failed  to  detect  issues,  in  particular  during  the  evaluation  phase  of  the  procurement 
procedures.  Moreover,  the  Internal  Audit  Service  noted  that  in  some  cases  ex-ante  controls 
detected  irregularities  that  were  overruled  (mainly  due  to  the  necessity  to  comply  with  the 
time to contract) but such exceptions were not always properly documented. 

Recommendation 

Directorate-General  NEAR  should  follow  up  with  the  EUD  to  Turkey  on  the  findings 
resulting from the Internal Audit Service' transaction testing by taking appropriate actions to 
address the issues identified and verify, via transaction testing during supervisory missions, if 
they have been adequately addressed. 

Additional  information  provided  by  the  Directorate-General  NEAR  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

The implementation by Directorate-General NEAR of this recommendation is in progress. A 
supervision mission was carried out to the EU Delegation  to Turkey in January 2018 where 
one of the issues which was discussed was the implementation of ex-ante and ex-post controls 
in IMBC (Indirect Management with Beneficiary Countries). A follow-up mission was carried 
out to the EU Delegation to Turkey at the end of April 2018, where the management of the 
ex-ante and ex-post controls in the EU Delegation were further analysed with the purpose to 
clarify  and  strengthen  the  Directorate-General  NEAR  guidelines  on  ex-ante  and  ex-post 
controls. An instruction note will be issued to all staff in the EU Delegation to clarify some of 
the  internal  procedures  to  be  followed  and  to  remind  staff  to  respect  and  follow  all 
procurement procedures 

73 

 
 
 
5.4. Limited  review  of  grant  and  procurement  procedures  in  the  EU  Delegation  of 
Armenia – Directorate-General NEAR 

Audit objectives and scope 

The  objective  of  the  limited  review  was  to  assess  whether  procurement  and  grant  award 
procedures  under  European  Neighbourhood  Partnership  Instrument  (ENPI)  /  European 
Neighbourhood  Instrument  (ENI)  are  managed  by  the  EU  Delegation  (EUD)  to  Armenia  in 
accordance  with  the  applicable  procedures  and  guidelines  (Financial  Regulation,  the 
Procurement and Grants for European Union external actions – A Practical Guide (PRAG)). 

The  limited  review  covered  selected  elements  of  grant  and  procurement  procedures,  from 
drafting  the  guidelines  for  applicants/  terms  of  reference  to  the  signature  of  the  grant 
agreement/ contract and its amendments. 

Major audit findings and recommendations 

No  formal  audit  report  was  addressed  to  Directorate-General  NEAR.  The  consolidated 
findings and recommendations (including inter alia those related to the EUD to Armenia) will 
be  presented  in  the  final  report  for  the  Audit  on  the  implementation  of  ENI  which  will  be 
completed in 2018. 

5.5. Audit  on  preparedness  for  the  mid-term  review  of  ENI  and  IPA  Regulations  in 
Directorate-General NEAR 

Further  to  the  note  announcing  the  launch  of  the  audit  on  preparedness  for  the  mid-term 
review  of  the  European  Neighbourhood  Instrument  (ENI)  and  the  Instrument  for  Pre-
Accession  Assistance  (IPA)  II  Regulations in  Directorate-General  NEAR,  the  Internal  Audit 
Service conducted a preliminary survey with the aim of gaining a better understanding of the 
activities  and  the  related  risks  and  in  order  to  define  the  objectives  and  scope  of  the 
engagement. 

The  Internal  Audit  Service  noted  that  at  the  time  of  the  preliminary  survey  the  mid-term 
review  of  the  ENI  and  IPA  Regulations  was  ongoing  and  had  reached  an  advanced  stage. 
Consequently,  the  original  scope  of  the  audit  (i.e.  Directorate-General  NEAR  preparedness 
for the mid-term review) was obsolete and would be of limited value for Directorate-General 
NEAR. 

The Internal Audit Service analysed the remaining phases of the process until the end of the 
year  (i.e.  the  finalisation  of  the  evaluation  and  its  consolidation  into  a  Staff  Working 
Document):  

(1)  governance,  (2)  monitoring,  (3)  contractual  set  up,  (4)  supervision  of  the  consultant's 
work, and (5) compliance with the Better  Regulation package and noted that the main risks 
under Directorate-General NEAR's control in these areas are either not very significant or that 
mitigating actions have already been implemented. 

Consequently, the Internal Audit Service decided to close the audit.  

74 

 
 
6.  EDUCATION AND CITIZENSHIP 

6.1. Consulting  report  on  Directorate-General  EAC's  process  to  granting  full  financial 
autonomy to the EIT 

Objectives and scope 

The objective of the consulting engagement was to review the methodology applied and the 
procedures  and  processes  followed  by  Directorate-General  EAC  to  grant  full  financial 
autonomy to the European Institute of Innovation and Technology (EIT) and provide advice 
to  Directorate-General  EAC  on  how  it  could  improve  its  methodology  to  make  it  fit  for 
purpose. 

The scope of the consulting engagement covered the key elements and phases of the readiness 
assessment, notably: 

  The  methodology  used  by  Directorate-General  EAC  to  assess  if  all  conditions  for 
delegating  the  budget  implementation  (Article  60  of  the  Financial  Regulation)  and  for 
granting full financial autonomy to the EIT are fulfilled; 

  The  processes  and  procedures  followed  by  Directorate-General  EAC  to  implement  the 

methodology; 

  Directorate-General EAC's analysis of open issues from the 2011 decision to grant partial 
financial autonomy as well as the state of play of the implementation of European Court 
of Auditors, Internal Audit Service and the EIT's IAC audit findings. 

Issues for consideration 

The  consulting  engagement  resulted  in  a  number  of  issues  for  consideration.  As  this  was  a 
consulting  engagement  and  not  an  audit,  the  Internal  Audit  Service  will  not  follow-up  on 
these issues.  

6.2. Audit  on  Erasmus+  and  Creative  Europe  –  grant  management  phase  1  (from  the 
call to the signature of contracts) in EACEA  

Audit objectives and scope 

The objective of the audit was to assess the adequacy of the  design and the effectiveness of 
EACEA's  internal  control  system  for  the  first  phase  (from  call  to  contract)  of  the  grant 
management process for Erasmus+  and Creative Europe  under the 2014-2020 programming 
period. 

In particular, the audit assessed whether: 

  The controls that are in place provide reasonable assurance regarding compliance with the 

relevant legal framework;  

  The calls for proposals effectively support the achievement of the programmes' objectives; 
  The processes in place ensure that the highest quality projects are selected and translated 

into grant agreements, in compliance with the applicable rules. 

75 

 
 
There were no reservations in the 2016 Annual Activity Report of EACEA that relate to the 
audited area. 

The  fieldwork  was  finalised  on  21  September  2017.  All  observations  and  recommendations 
relate to the situation up to this date. 

Strengths 

The  Internal  Audit  Service  recognised  the  ongoing  efforts  made  by  EACEA  to  perform  a 
timely  selection  of  grant  proposals.  Despite  significant  workload  and  time  pressure,  the 
Agency effectively reacted to requests from applicants throughout the submission process and 
provided  the  necessary  information,  thus  facilitating  the  application  process  for  potential 
applicants. The Agency continuously provided information  and clarifications to the external 
experts  using  a  dedicated  electronic  platform  (Ning)  to  ensure  they  acquire  an  in-depth 
understanding of the policy objectives of the evaluated actions. 

Major audit findings 

The Internal Audit Service identified one critical and eight very important issues: 

Control environment (one very important issue) 

A  comprehensive  risk  analysis  for  the  financial  circuits  for  the  current  programming  period 
had  not  been  performed  and  in  addition,  procedures  and  guidance  documents  were 
incomplete, outdated, inconsistent or not adequately approved. 

Evaluation process (one critical and three very important issues) 

The critical issue concerned the lack of evidence that the evaluation committees had actually 
performed their evaluations as stipulated by the Financial Regulation, i.e. had based their final 
conclusions on reviews and deliberation of all the proposals and not by simply endorsing the 
work of external experts who assist them. 

The three  very important  issues  relate to  the lack of an  appropriate evaluation methodology 
for each individual call, no checks for conflict of interest with the experts as well as confusion 
between selection and award criteria. Moreover, the award decisions taken by the Agency did 
not contain the names of the rejected candidates and the reason for their rejection. 

Contracting phase (three very important issues)  

Adjustments to the grant proposals were made without the required recommendations by the 
evaluation committee, there were derogations from the non-retroactivity principle applicable 
to grants and application of a wrong methodology for calculating the time to grant. 

MEDIA sub-programme (one very important issue) 

The Internal Audit Service found deficiencies specific to the implementation of actions under 
the  Creative  Europe  Media  programme.  In  particular,  non-appointment  of  an  evaluation 
committee  for  the  evaluation  of  reinvestment  proposals,  adjustments  to  proposals  based  on 
criteria not announced to applicants, as well as weaknesses in the performance of eligibility 
checks. 

76 

 
 
Recommendations 

Control environment 

EACEA  should  perform  a  comprehensive  risk  analysis  to  assess  which  financial  circuits 
model(s)  would  be  the  most  appropriate  for  the  current  programmes  that  the  Agency  is 
managing.  In  addition,  the  Agency  should  (1)  update  and  complete  its  guidance  on  grants 
management and ensure they are approved in line with the formal requirements, (2) update its 
procedures for registering exceptions in line with the corporate requirements, and ensure that 
all  instances  of  overriding  controls or  deviations  from  established  processes  and  procedures 
are duly documented and reported and (3) update its anti-fraud strategy. 

Evaluation process 

Role of the evaluation committee 

The Agency should ensure that the evaluation committees form final conclusive opinions on 
all  the  grant  applications  based  on  review  and  deliberations  as  required  by  the  legal 
framework.  As  a  minimum,  the  evaluation  committees  should  review  all  the  consolidated 
assessments  from  the  external  experts  assisting  them.  Furthermore,  the  evaluation  reports 
produced  by  the  evaluation  committees  should  contain  for  all  the  evaluated  applications  an 
assessment of their quality (justification). 

Organisation of the evaluation process 

The  Agency  should  develop  an  evaluation  methodology  and  ensure  that  it  is  effectively 
applied  by  the  evaluation  committees.  It  should  also  ensure  the  use  of  an  evaluation  report 
template that contains the minimum information the Authorising Officer needs to be able to 
take  an  informed  decision  when  signing  the  award  decision.  Moreover,  the  Agency  should 
establish a procedure for systematically collecting and analysing feedback from the external 
evaluation experts, which should serve to improve the design and the implementation of the 
evaluation process. Implementation of these corrective actions should be regularly monitored. 

External Experts  

As  mitigating  measures,  the  Agency  should  establish  a  methodology  for  performing  checks 
aimed at timely detecting and addressing problems with the reliability of the declarations of 
conflicts of interests of experts evaluating proposals. In addition, the EACEA should structure 
and  harmonise  the  tasks  performed  by  its  staff  to  monitor  the  quality  of  the  experts'  work, 
document  this  monitoring  and  share  the  results  with  the  members  of  the  evaluation 
committee. 

Effectiveness of the evaluation process 

The  Agency  should  ensure  that  (1)  call  documents  and  the  ensuing  evaluation  clearly 
distinguish between selection criteria and award criteria; (2) the electronic grant management 
system is used consistently for eligibility checks and appropriate checklists are drawn up for 
each call; (3) the award decisions contain the names of the rejected applicants and the reasons 
for their rejection; and (4) rejected applicants are notified in line with the procedure adopted 
by the parent Directorates-General. 

77 

 
 
Contracting phase 

Actions preceding the award decision 

EACEA  should  modify  its  guidance  on  adjustments  to  grant  proposals  and  ensure  that 
adjustments  to  grant  proposals  are  only  proposed  on  the  basis  of  recommendations  of  the 
evaluation  committee.  Furthermore,  EACEA  should  review  its  processes  to  ensure  that 
contracts are not signed with organisations for which the Participant Identification Code has 
not been validated. 

Non-retroactivity principle 

EACEA should consult the Directorate-General Budget on the legality of derogating from the 
principle of non-retroactivity applied so far for Erasmus+ and Creative Europe and, based on 
their advice, revise its related internal procedures accordingly. The Agency should also ensure 
that derogations from the principle of non-retroactivity are duly justified and formally adopted 
as  required  by  Article  130(1)  of  the  Financial  Regulation  and  the  basic  act  and  do  not  go 
beyond the cases permitted by the legislation. 

Calculation of the Time-to-Inform (TTI) and Time-to-Contract (TTC)  

EACEA should apply the Commission guidance for calculating the time-to-grant, basing the 
calculation  at  call  level  on  the  time  when  the  last  applicant  has  been  informed  and  the  last 
grant  agreement  has  been  signed.  It  should  also  report  in  the  Annual  Activity  Report  the 
percentage of the applications for which the deadlines/targets have been met. 

MEDIA sub-programme 

Distribution schemes under the MEDIA sub-programme 

EACEA  should  systematically  set  up  an  evaluation  committee  to  assess  the  eligibility  and 
award criteria for the second phase of the Automatic scheme (re-investment). In addition, the 
Agency should strictly apply the pre-announced award criteria when evaluating applications. 

Additional  information  provided  by  the  EACEA  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The Agency has put in place an action plan, which has been accepted by the Internal Audit 
Service. Whilst the present audit is limited to the Erasmus+ and Creative Europe programmes, 
EACEA applies the action plan to all delegated programmes.  

Concerning the critical recommendation, the Agency has revised the relevant procedures, 
guidelines and templates on the evaluation/selection process and applied them to all the new 
calls of the year 2018. 

The  Internal  Audit  Service  conducted  a  limited  follow-up  in  March  2018  to  assess  the 
progress in the implementation of the action plan.  

Following  the  above  mentioned  limited  follow  up  audit,  the  critical  recommendation  (very 
high risk) was downgraded to 'very important' (high risk) level. 

Concerning the other recommendations, the Agency has in particular updated and adopted: 

78 

 
 
- its General Grant Management Procedures; 
- Guidelines to prepare an award decision and on providing feedback to applicants; 
- Guidelines on recording exceptions and non-compliance events; 
- the Anti-Fraud Strategy; 
-  the  Internal  Review  System  to  ensure  a  fair  and  transparent  procedure  to  deal  with 
complaints challenging the rejection of grant applications;  
- Guidelines on governance of documents. 
The risk assessment on financial circuit will be completed by mid-2018. 

In  addition,  the  rules  to  calculate  "time  to  inform"  and  "time-to-contract"  KPIs  have  been 
updated, in line with Directorate-General BUDG guidance and already used to calculate the 
2017 AAR KPIs. The Internal Audit Service checked them in the limited follow-up audit and 
the related recommendation was downgraded from 'very important' (high risk) to 'important' 
(medium risk) level. 

Furthermore, for the Creative Europe/MEDIA programme, the Agency has issued instructions 
to  assure  that  derogations  to  the  non-retroactivity  principle  are  duly  justified  and  formally 
adopted.  In  addition,  the  sampling  on  eligibility  checks  has  been  abolished,  an  evaluation 
committee  for  the  second  step  of  evaluation  (for  Automatic  Scheme)  has  been  already 
nominated and the call guidelines have  been  updated to  ensure transparency  (all criteria are 
now  published  in  the  call).  The  recommendation  related  to  Distribution  Schemes  under  the 
MEDIA  sub-programme  was  downgraded  from  'very  important'  (high  risk)  to  'important' 
(medium risk) level following the Internal Audit Service limited follow up audit. 

Beyond the measures included in the action plan, the Agency put in place further actions, 
such as the dedicated training of all staff involved in the selection process, additional ex-ante 
controls and information  sessions by the Agency's Director  and the RMIC, aimed at raising 
awareness among the staff over the importance of the action plan. 

All the Internal Audit Service recommendations stay open for the time being, while waiting 
for  a  full  Internal  Audit  Service  follow  up  audit  in  the  second  half  of  2018.  At  that  time,  a 
critical  mass  of  finalised  calls,  evaluation  reports  and  award  decisions  will  allow  for  a 
complete opinion on the level of implementation of the action plan. 

6.3. Audit on HR management in EACEA 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  if  EACEA  designed  and  implemented  an  adequate 
Human  Resource  (HR)  management  process  to  deploy  a  competent  (knowledgeable)  and 
engaged workforce in order to deliver its priorities and core business. 

In particular, the audit assessed the effectiveness of the following processes: 

  The design and implementation of the HR Strategy; 
  The HR planning process, including workload assessment and staff allocation; 
  Selection, recruitment and retention of staff; 

79 

 
 
 
  Knowledge  management  (learning  and  development,  competence  management  and 

coaching); 

  Monitoring, reporting and communication on HR. 

There  were  no  observations  and/or  reservations  in  the  2016  Annual  Activity  Report  of 
EACEA that relate to the area/process audited. 

The  fieldwork  was  finalised  on  16  October  2017.  All  observations  and  recommendations 
relate to the situation as of that date.  

Major audit findings 

The Internal Audit Service identified three very important issues: 

Strategic HR management (HR strategy, monitoring and reporting on HR objectives) 

The  various  components  of  the  HR  strategic  framework  (HR  strategy,  Learning  and 
Development  Framework  and  Knowledge  Management  Strategy)  are  not  fully  coherent. 
Moreover,  the  strategic objectives  are  not  accompanied  by  specific indicators and targets  to 
enable monitoring and reporting on the progress made toward their achievement. Finally, the 
Agency  has  not  translated  its  HR-related  strategies  into  an  annual  HR  plan  presenting  the 
short-term  operational  activities  that  need  to  be  implemented  in  order  to  respond  to  HR 
challenges and to contribute to the achievement of the overall strategic HR goals. 

Organisational structure 

The organisational structure in place in the Agency, where sectors are created in each unit, is 
not  formally  reflected  in  SYSPER2.  Consequently,  the  delegation  of  HR-related  tasks  from 
the Head of Unit to the Head of Sector (management of leave and absences, annual appraisal 
exercise)  are  not  encoded  in  the  system  and  thus  the  tasks  are  managed  manually  which  is 
both inefficient and prone to error. Additionally, job descriptions are not harmonised across 
the agency and the internal guidelines on establishing job objectives do not cover all the job 
profiles currently present in the Agency. 

Selection process for contract agents 

The  selection  process  for  contract  agents  as  designed  and  implemented  in  the  Agency  does 
not always ensure the respect of the principles of transparency, objectivity and fairness. The 
Internal Instructions do not cover important steps of the selection process and do not assign 
clear responsibilities to the key actors, in particular the Selection Committee and its members. 
Moreover,  the  selection  procedures  sampled  do  not  always  comply  with  the  existing 
instructions/guidance and are not adequately documented. 

Recommendations 

Strategic HR management (HR strategy, monitoring and reporting on HR objectives) 

The  Agency  should  complete  the  HR  strategy  ensuring  that  the  priorities  and  strategic 
objectives  are  well  identified  and  translated  into  short  to  medium  term  actions  in  an  HR 
annual  plan  where  indicators  and  target  are  set  in  order  to  measure  the  progress  toward  the 
achievement  of  these  objectives.  The  current  HR  dashboard  should  also  be  reviewed  and 
enhanced with additional data in order to serve as a performance monitoring tool. 

80 

 
 
Organisational structure 

The  Agency  should  update  the  organisational  structure  in  SYSPER2  by  formally  creating 
sectors within the units and assigning staff to them so that delegated powers can be officially 
recognised and used within the system. Additionally, EACEA should review the existing job 
profiles, titles, descriptions and objectives and on this basis develop standardised ones for the 
whole Agency. 

Selection process for contract agents 

The Agency should revise, update and consistently implement its Internal Instructions for the 
selection  of  Contract  Agents,  clearly  define  the roles,  responsibilities and  obligations  of  the 
main  actors  of  the  process  (including  reporting  on  conflict  of  interest  and  adhering  to  the 
principle of confidentiality) and better document the selection process, including the approval 
decision taken by the Director. 

Additional 
implemented following the Internal Audit Service audit 

information  provided  by  EACEA  on  the  measures  defined  and/or 

The  Agency  has  put  in  place  a  detailed  action  plan  including  the  actions  presented  (as  per 
21/6/2018) below. 

- Regarding the recommendation N°1, a revised HR Strategy has been prepared, which aligns 
the  HR  policies  with  the  EACEA  strategic  objectives.  Stemming  from  this  revised  HR 
Strategy  document,  an  Annual  HR  Plan  including  operational  objectives  and  actions  with 
KPIs  and  clear  target  dates,  responsible  actors  and  progress  status,  has  been  finalised.  A 
reviewed  HR  dashboard,  complemented  by  additional  statistics,  has  been  prepared  and  is 
being presented to the Management meeting on a quarterly basis. 

-  Concerning  the  recommendation  N°2,  the  Agency  has  tabled  the  validation  of  the  current 
organisational  structure  at  the  first  Steering  Committee  meeting  of  2018  (26/02/2018);  the 
validated  organisational  structure  has  been  subsequently  encoded 
in 
collaboration with the parent DGs, with entry into effect as of 01/04/2018 . Existing job titles, 
job  descriptions  and  objectives  have  been  reviewed  in  order  to  ensure harmonisation  across 
the Agency and the updated catalogue covering all Agency's functions have been endorsed by 
the Management meetings of 31/01/2018 and 07/06/2018. 

in  SYSPER2 

- Regarding recommendation N° 3, Internal instructions concerning Selection procedures for 
Contract  agents  have  been  fully  reviewed  and  updated  taking  into  account  all  audit 
recommendations  and  the  new  Implementing  Rules  on  employment  conditions  of  contract 
staff which entered into force for the EACEA on 1 January 2018. 

81 

 
 
 
7.  ECONOMIC AND FINANCIAL AFFAIRS 

7.1. Audit  on  enforcement  of  the  EU  antitrust  policy  in  Directorate-General  COMP: 
cooperation with EU national competition authorities and national courts 

Audit objectives and scope 

The objective of the audit was to assess the arrangements put in place by Directorate-General 
COMP  to  ensure  an  effective  cooperation  with  the  EU  national  competition  authorities  and 
national courts in order and to enable a consistent enforcement of the antitrust policy at EU 
level. 

The  audit  covered  Directorate-General  COMP's  activities  contributing  to  the  consistent 
application  of  the  EU  antitrust  policy,  including  the  operational  procedures  underlying  the 
cooperation  with  the  EU  national  competition  authorities  and  the  national  courts,  and  the 
Commission's initiative to foster cooperation. 

This audit focused on the process under the responsibility of Directorate-General COMP.  

There  were  no  observations/reservations  in  Directorate-General  COMP's  2016  Annual 
Activity Report that relate to the area/process audited. 

The  fieldwork  was  finalised  on  26  January  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths  

a) 
Support beyond the formal obligations under Regulation 1/2003. Directorate-General 
COMP not only provides a formal assessment of the envisaged decisions on antitrust drafted 
by  the  national  competition  authorities,  but  also  provides  informal  comments  and  support, 
with  the  aim  of  establishing  a  trusting  and  respectful  relationship.  In  addition,  Directorate-
General COMP coordinates a large network of Working Groups, to ensure knowledge sharing 
and  to  enhance  consistency.  These  two  activities  go  beyond  the  formal  obligations  under 
Regulation  1/2003  and  have  been  positively  assessed  by  the  main  stakeholders  in  the  2014 
survey on 'EU competition policy'. 

Effective  management  of  cooperation  with  National  Competition  Authorities  and 
b) 
National  Courts.  Directorate-General  COMP  succeeded 
in  establishing  an  effective 
relationship  with  its  counterparts  in  the  Member  States.  In  particular,  the  Internal  Audit 
Service observed  the following, in terms of Directorate-General COMP's performance:  

1. 
Commission's time-to-reply in 2016 to the envisaged decisions of the national 
competition authorities: on average, within the threshold of 30 days defined under Art. 
11(4) Regulation 1/2003; 

2. 
Commission's  time-to-reply  to  the  information  or  opinion  requests  of  the 
national  courts  during  the  last  5  years:  on  average,  more  than  8  days  lower  than  the 
thresholds defined under art. 22 and 28 of the Commission Notice 2004/C 101/04 (four 
months for the opinion requests, and one month for the information requests); 

82 

 
 
3. 
to requests for opinions (2015): 100%; 

Compliance  rate  of  national  judgments  measured  against  Commission  replies 

4. 
(2015): 100%; 

Compliance rate of national judgments with Commission 'amicus curiae' briefs 

5. 
comments provided by Commission (2015): 90%. 

Acceptance rate of the national competition authorities' final decision with the 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Cooperation with the national courts  

The  Commission  has  not  received  complete  information  from  some  Member  States  on  the 
content of the national judgments related to the enforcement of EU antitrust law, as required 
by  Regulation  1/2003.  The  Internal  Audit  Service  observed  that  the  Commission  has  never 
performed  an  adequate  evaluation  of  the  root-causes  for  non-cooperation,  such  as  assessing 
whether  appropriate  procedural  rules  were  adopted  by  the  Member  States,  as  required  by 
Commission Notice 2004/C 101/04. 

Recommendation 

Directorate-General  COMP  should  perform  an  assessment  of  the  root  causes  of  the  limited 
cooperation  from  the  national  courts.  Based  on  the  results  of  this  assessment,  Directorate-
General COMP should take appropriate actions to enhance cooperation. 

Additional  information  provided  by  Directorate-General  COMP  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

In response to the audit finding by Internal Audit Service, Directorate-General COMP 
developed an action plan that the Internal Audit Service assessed as satisfactory. 

7.2. Audit  on 
in  Directorate-General COMP 

financial  management  of  procurement  contracts  and  grants 

Audit objectives and scope 

The  audit  assessed  the  adequacy  of  Directorate-General  COMP's  management  of  grants, 
procurement  and  the  related  financial  transactions.  In  particular,  it  reviewed  the  design  and 
implementation  of  the  controls  in  place  to  assess  whether  they  ensure  the  legality  and 
regularity  of  the  financial  procedures  and  transactions  and  whether  they  are  effective  and 
efficient. 

The audit covered the controls carried out on procurement and grants procedures completed in 
2016 and on the financial transactions executed in 2016.  

83 

 
 
 
There  were  no  observations  or  reservations  in  Directorate-General  COMP’s  2016  Annual 
Activity Report that relate to the audited process. 

The fieldwork was finalised on 9 June 2017. All observations and recommendations relate to 
the situation as of that date. 

Strengths 

Overall,  Directorate-General  COMP's  management  of  grants,  procurement  and  the  related 
financial transactions complies with the applicable rules and regulations.  Directorate-General 
COMP  manages  the  calls  for  proposals  and  tenders  effectively  and  has  in  place  adequate 
controls to review, report and monitor the expected results.  

In particular, the audit team identified the following good practices:  

a) 

Grants:  

  A  dedicated  team  in  Unit  A4,  composed  of  three  staff  members,  manages  the  grant 

process, from the publication of the call to the closing of the grant; 

  The staff members attended appropriate training from the Directorate-General Budget on 

management of grants and are adequately trained; 

  The  finance  Unit  (Unit  R2)  provides  an  active  support  to  Unit  A4,  responsible  for  the 
grants  management,  and  acts  as  a  quality  reviewer  for  the  preparation  of  the  calls  for 
proposals,  the  evaluation  and  awarding  process  and  the  financial  management  of  the 
grants along their lifecycle. 

b) 

Procurement: 

  The financial circuit for procurement is centralised and the financial team in Unit R2 plays 
a  key  role.  The  members  of  the  financial  team  have  a  very  good  expertise  and  a  long 
experience  in  procurement  management  and  in  Directorate-General  COMP  and  provide  
an active support to the operational units throughout the procurement life-cycle (from the 
identification  of  needs  through  the  drafting  of  the  tender  documents  up  to  the  final 
payment and closing of the procurement procedure); 

  All purchase, renting, move of IT equipment and IT services must be requested through 
ABAC Assets Forms of Directorate-General DIGIT. Each request follows the workflow in 
ABAC Assets, which includes a number of controls and validation checks.  

c) 

Financial Management: 

  A  strong  ex-post  control  strategy  and  reporting  is  in  place,  with  a  combination  of  risk-
based and random sampling, and a clear description of the control approach and of the test 
results; 

  Pre-financing  (as  a  percentage  of  total  funding)  allocated  for  grants  was  reduced  from 
80% to 50% in 2011 to avoid recoveries and to encourage beneficiaries to reduce delays 
of submission of their final deliverables. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

84 

 
 
7.3. Audit  on  the  governance  and  operational  organisation  of  the  Investment  Plan  for 
Europe in Directorate-General ECFIN 

Further  to  the  note  announcing  the  launch  of  the  audit  on  the  Governance  and  operational 
organisation  of  the  Investment  Plan  for  Europe,  the  Internal  Audit  Service  conducted  a 
preliminary  survey  with  the  aim  of  gaining  a  better  understanding  of  the  activities  and  the 
related risks and in order to define the objectives and scope of the engagement. 

During the preliminary survey phase, the Internal Audit Service was in close contact with the 
European  Court  of  Auditors    which  was  performing  a  performance  audit  on  the  European 
Fund for Strategic Investments, for which it plans to publish a Special Report in 2018. It was 
confirmed that the scope of the Internal Audit Service audit will be covered by the audit work 
planned  by  the  European  Court  of  Auditors.  In  order  to  avoid  overlaps  with  the  European 
Court of Auditors' work, the Internal Audit Service decided to close the audit. 

7.4. Audit on HR management in EASME 

Audit objectives and scope 

The objective of the audit was to assess the effectiveness of the Human Resource (HR) 
management process in EASME. In particular: 

  The design and implementation of the HR strategy; 
  The HR planning process, including workload assessment and staff allocation; 
  Selection, recruitment and retention of staff; 
  Knowledge  management  (competency  management,  learning  &  development  and 

coaching); 

  Monitoring and reporting on HR. 

There were no observations/reservations in the 2016 Annual Activity Report of EASME that 
relate to the area/process audited. 

The fieldwork was finalised on 24 March 2017. All observations and recommendations relate 
to the situation as of that date. 

Strengths 

The Internal Audit Service recognised the continuous efforts made by EASME to ensure that 
all  posts  are  filled  with  qualified  staff.  The  following  strengths  were  specifically  identified 
during the audit: 

Service  oriented  support.  All  the  staff  interviewed  during  the  audit  gave  a  positive 

a) 
assessment of the support given by the HR sector. 

b) 
Learning  and  Development.  All  operational  Heads  of  units/sector  interviewed  gave 
positive  feedback  about  the  newcomer  integration  programmes,  learning  and  development 
strategy, organisation of training sessions and well-being actions. 

85 

 
 
IT tools. Development of a local monitoring and reporting tool HERO used to report 
c) 
on  HR  indicators,  and  the  use  of  the  Cornerstone  IT  tool  to  overcome  the  problems  with 
EPSO CAST (Contract Agents Selection Tool) database. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

7.5. Audit on H2020 project management in EASME 

Audit objective and scope 

The objective of the audit was to assess the effectiveness of the project management process 
in EASME. 

In particular, the audit assessed whether: 

  The  internal  control  system  related  to  the  project  management  process  was  adequately 
designed (for the parts which are specific to the Agency and not defined centrally by the 
Common Support Center) and effectively implemented;  

  EASME was effectively monitoring project implementation by the beneficiaries; 
  The  grant  amendment  process  was  effective  and  ensured  compliance  with  the  legal 

provisions; 

  The  existing  procedures  ensured  effective  monitoring  of  the  dissemination  and 
exploitation activities and identification of the projects with potential for communication 
by the Commission. 

There were no reservations in the 2016 Annual Activity Report of EASME that relate to the 
audited area. 

The  fieldwork  was  finalised  on  12  December  2017.  All  observations  and  recommendations 
relate to the situation up to this date. 

Strengths 

The Internal Audit Service identified the following strengths: 

a) 
Representatives  of  EASME  participate  in  different  working  groups  of  the  Common 
Support  Centre,  which  enables  EASME  to  put  forward  the  specificities  of  its  sub-
programmes.  This  also  confirms  EASME's  efforts  for  the  continuous  improvement  of  its 
processes. 

b) 
There is good cooperation between the operational units and the central financial unit, 
with the financial team providing active support to the operational units throughout the grant 
life-cycle. 

The  project  officers  attended  appropriate  training  courses  on  grant  management  and 

c) 
are adequately qualified and experienced. 

For  the  management  of  project  amendments,  detailed  comments,  justifications  and 

d) 
additional checks related to the approval process are recorded in the IT system COMPASS. 

86 

 
 
Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

7.6. Audit on evaluation in Directorate-General ECFIN 

The  objective  of  the  audit  was  to  assess  if  Directorate-General  ECFIN  is  carrying  out 
evaluations  in  compliance  with  the  Better  Regulation  requirements  and  if  the  evaluation 
process is effective and efficient. 

The  audit  covered  the key  controls  designed  and  implemented  for  the  evaluation  process  in 
Directorate-General ECFIN, including the internal organisation of the process as well as the 
monitoring and reporting activities related to it.  

The  audit  engagement  covered  evaluations  finalised  by  Directorate-General  ECFIN  during 
2015 and 2016 as well as ongoing evaluations as at the end of July 2017 (i.e. only evaluations 
performed  completely  or  at  least  partially,  which  are  based  on  the  Better  Regulation 
framework that entered into force in May 2015). 

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-
General ECFIN that relate to the area/process audited. 

The  fieldwork  was  finalised  on  23  October  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

The Internal Audit Service acknowledged the improvements made in the internal evaluation 
procedures following the entry into force of the Better Regulation. In particular:  

The evaluation function was moved to unit A1 (responsible for policy and economic 

a) 
surveillance) and was better integrated into the policy development cycle as a consequence.  

The  Directorate-General  modified  its  internal  "Evaluation  Charter"  which  is  fully 

b) 
aligned with the Better Regulation requirements. 

In addition, Directorate-General ECFIN's evaluation sector is actively represented in the Inter 
Service  Steering  Groups  (ISGs);  staff  of  the  Directorate-General  actively  participates  in  the 
discussions  within  the  ISGs  by  providing  valuable  expertise  and  thus  influencing  the 
efficiency and effectiveness and the timely completion of evaluations in the Commission. 

Major audit findings  

The Internal Audit Service did not identify any critical or very important issues. 

7.7. Audit on financial management of procurement and grants in Directorate-General 
FISMA  

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective 
implementation of Directorate-General FISMA's internal control systems for the management 

87 

 
 
of the grant and  the procurement process and the effectiveness and efficiency of the related 
financial circuits.  

This audit covered the following processes: 

  The  procurement  process,  from  the  determination  of  the  needs  and  planning  to  the 

effective implementation of the contract; 

  The grants process, from the grant agreement to the management reporting and the closure 

of the grant; 

  The financial circuits for the processing of the transactions under grants, procurement, and 
administrative  expenditure  (commitments,  payments,  de-commitments  and  recovery 
orders), 

  The  corrective  capacity  of  the  Directorate-General  (design  and  implementation  of  the 
capacity of the Directorate-General to detect, correct and recover any undue payment). 

The audit focussed specifically on controls carried out on the financial transactions executed 
by  Directorate-General  FISMA  in  2016-2017  and  procurement  and  grants  procedures 
completed in 2016 and up to 15 May 2017. 

The  engagement  covered  all  types  of  transactions  directly  managed  by  Directorate-General 
FISMA,  i.e.  for  which  the  Director-General  of  Directorate-General  FISMA  acts  as 
Authorising Officer by Sub delegation. 

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-
General FISMA that relate to the area/process audited. 

The  fieldwork  was  finalised  on  16  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

a) 
Directorate-General  FISMA  has  put  strong  controls  in  place  for  the  entire  financial 
management  cycle  and  thereby  ensures  sound  financial  management  in  the  Directorate-
General.   

b) 
Over  the  last  few  years,  Directorate-General  FISMA  has  developed  a  set  of 
standardised  and  comprehensive  procedures  and  related  checklists  for  the  management  of 
both  procurement  and  grants.  They  are  completed,  when  necessary,  by  targeted  guidance 
notes  in  specific  areas  of  concern  (e.g.  factsheets  on  sensitive  and  key  procurement  related 
subjects as well as guidance notes on the management of study contracts). These procedures 
are available on the Directorate's -General intranet and supported by staff training. 

c) 
To  create  an  efficient  audit  trail  for  financial  management,  Directorate-General 
FISMA  uses  dedicated  monitoring  tools  for  example  for  procurement  procedures  and  the 
follow-up of studies procured externally. 

Major audit findings  

The Internal Audit Service did not identify any critical or very important issues. 

88 

 
 
7.8. Limited  review  of  the  calculation  and  the  underlying  methodology  of  the  residual 
error rate for the 2016 reporting year in Directorate-General GROW 

Audit objectives and scope 

The  objective  of  this  limited  review  was  to  examine  the  calculation  and  underlying 
methodology of the residual error rate (RER) reported by Directorate-General GROW in its 
(draft)  2016  Annual  Activity  Report  (AAR),  and  in  doing  so,  help  the  Directorate-General 
mitigate  the  discharge  risk  by  enabling  it  to  take  appropriate  actions,  if  any,  before  their 
disclosure  in  the  final  Annual  Activity  Report  and  Annual  Management  and  Performance 
Report (AMPR). 

The review covered the following aspects: 

  The process and methodology for the calculation of the RER of the different programmes 

managed by Directorate-General GROW; 

  The calculated RERs; 
  The  presentation  of  the  RERs  in  the  draft  and  final  versions  of  the  Annual  Activity 

Report; 

  The  compliance  with  the  Directorate’-General  Budget  instructions  for  the  2016  Annual 

Activity Report. 

The  Internal  Audit  Service  reviewed  the  draft  2016  Annual  Activity  Report  and  the 
preliminary RER calculations available on 20/02/2017, as well as its amended version dated 
24/02/2017.  It  also  reviewed  the  final  2016  Annual  Activity  Report  (dated  31/03/2017)  to 
check  whether  the  issues  detected  and  reported  to  Directorate-General  GROW  during  the 
fieldwork were correctly addressed. 

limited  review  fieldwork  was  finalised  on  17/03/2017.  All  observations  and 

The 
recommendations relate to the situation as of that date. 

Strengths 

The  Internal  Audit  Service  recognised  the  on-going  efforts  made  by  Directorate-General 
GROW to improve its error rate calculation methodologies, despite the high turnover of staff, 
which made the exercise this year particularly challenging for the Directorate-General. 

Major audit findings 

The Internal Audit Service identified two very important issues: 

Methodological guidance, planning and organisation  

Directorate-General  GROW  had  not  established  written  procedures  and  tools  to  guide  the 
process  to  calculate  the  RER  for  all  the  different  programmes  (i.e.  defining  roles  and 
responsibilities  of  the  different  actors,  methodologies  to  be  applied in  the  calculation  of  the 
error rate for all programmes and monitoring arrangements to ensure the quality of the results 
disclosed in the Annual Activity Report). 

89 

 
 
Error rate for space-delegated programmes  

Directorate-General  GROW  used  a  non-statistical  sampling  methodology  for  its  ex-post 
audits  and  calculated  the  error  rate  as  a  ratio  between  the  detected  error  and  the  total 
population  (and  not  the  audited  amount).  Moreover,  Directorate-General  GROW  estimated 
that the RER is equal to zero due to the correction of errors in the framework of the clearing 
of  pre-financing.  However,  the  correction  (cleaning)  only  applies  to  errors  in  the  audited 
population,  while  the  non-audited  amounts,  if  affected  by  errors,  will  not  be  cleaned. 
Consequently, it cannot be assumed that the residual error for the whole population is nil and 
therefore  the  figure  shown  by  the  Directorate-General  is  underestimated.  However,  the 
Internal  Audit  Service  recalculation  of  the  RER  for  2016  did  not  result  in  any  material 
difference impacting the declaration of assurance.  

In addition, Directorate-General GROW calculated a consolidated error rate covering all the 
individual  programmes  implemented  by  the  European  Space  Agency  (ESA),  irrespective  of 
the different underlying and related controls systems. For space programmes implemented by 
other  delegated  bodies  than  ESA,  the  Annual  Activity  Report  did  not  mention  the  elements 
that support Directorate-General GROW's estimated error rate. 

As  a  result  of  the  discussions  during  the  fieldwork  with  the  Internal  Audit  Service  and  the 
Directorate’-General Budget, Directorate-General GROW decided to disclose an error rate for 
the space-related programmes of 0.5% in its final 2016 Annual Activity Report. 

Recommendations 

Methodological guidance, planning and organisation 

Directorate-General GROW should establish a comprehensive Directorate-General-level plan, 
a  calendar  and  a  comprehensive  procedure  for  the  RER  calculation  in  the  context  of  the 
preparation  of  the  Annual  Activity  Report.  In  particular,  the  Directorate-General  should 
clarify roles and responsibilities of the actors involved in the process and the methodologies 
to be followed for calculating error rates for each of the programmes managed.  

Error rate for space delegated programmes 

Directorate-General  GROW  should  ensure  the  completeness,  correctness  and  consistency  of 
the information disclosed in the Annual Activity Report with regard of the methodology used 
for the calculation of the  detected and residual error rates  for  the space-related programmes 
and the conclusion drawn in terms of assurance. 

Additional  information  provided  by  Directorate-General  GROW  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

The actions related to the limited review of the calculation and underlying methodology of the 
residual  error  rate  for  the  2016  reporting  year  in  Directorate-General  GROW  have  been 
postponed to begin 2018.  

90 

 
 
 
 
 
Directorate-General GROW took the following actions in the first quarter of 2018: 

- Directorate-General GROW R1 documented in guidelines the procedure for the calculation 
of the residual error rates (RER) of the programmes managed by Directorate-General GROW. 
In  the  context  of  the  AAR  preparation,  the  document  presented  the  calendar  for  the  RER 
calculation, including the process, clarifying the roles and responsibilities, and the calculation 
of  the  RER  on  the  different  programmes.  Directorate-General  GROW  still  needs  to  detail 
more the sampling methodology in the process of transactions' testing. 

- In the 2017 AAR, the error rate detected was indicated per programme as well as the reasons 
supporting the declaration of assurance. Directorate-General GROW disclosed separate error 
rates per programme in the body of the AAR. 

7.9. Audit on the accuracy of information on the Internal Market in Directorate-General 
GROW  

Further to the note announcing the launch of the audit on the accuracy of the information on 
the  Internal  Market  in  Directorate-General  GROW,  the  Internal  Audit  Service  conducted  a 
preliminary  survey  with  the  aim  of  gaining  a  better  understanding  of  the  activities  and  the 
related risks and in order to define the objectives and scope of the engagement. 

Given the overlap between this engagement and the multi-Directorate-General audit on non-
European statistics, the Internal Audit Service decided to close the audit. 

7.10. Audit  on  the  supervision  of  the  implementation  of  the  Copernicus  programme  in 
Directorate-General GROW – phase 1: control strategy on ESA entrusted budget 

The  objective  of  the  audit  was  to  assess  if  Directorate-General  GROW  had  defined  and 
implemented  an adequate control strategy to  enable it to  obtain assurance  about the legality 
and regularity of the budget implemented by the European Space Agency (ESA). 
In  particular,  the  audit  covered  the  control  activities  performed  by  Directorate-General 
GROW  Units  I.2,  0.2  and  R.1  for  the  period  from  2014  (signature  of  the  Delegation 
Agreements (DA)) to 2017 (end of the fieldwork), with a focus on: 

  The design of the control strategy for the budget entrusted to ESA; 
  The effectiveness of the implementation of the control strategy, including the use of the 
control  tools  provided  for  by  the  DA  to  monitor  ESA's  activities  (i.e.  the  Procurement 
Board, the EU-ESA Copernicus Board, the high level monthly meetings and the planning 
documents and regular reports submitted by ESA); 

  The controls on Directorate-General GROW's payments to ESA and the clearings. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

91 

 
 
 
7.11. Audit  on  internal  processes  supporting  trade  policy  negotiations  in Directorate-
General TRADE 

Audit objectives and scope 

The objective of the audit engagement was to assess if the internal processes supporting trade 
policy negotiations are effective and efficient across the Commission. 

In particular, the audit covered: 

  The  corporate  structure:  roles,  responsibilities  and  tasks  of  the  Commission  actors 
involved  in  trade  negotiations  (Directorate-General  TRADE  and  other  Directorates-
General); 

  The  strategy  for  trade  negotiations:  awareness,  translation  into  specific  objectives  and 

concrete actions, and monitoring; 

  The  internal  organisational  and  operational  processes  and  procedures:  planning, 

monitoring, reporting, Human Resource and quality assurance aspects; 

  Communication and information flows around trade negotiations, within the Commission 

and towards external stakeholders; 

  Security and confidentiality. 

The  main  auditees  were  Directorate-General  TRADE's  horizontal  units  in  Directorate  A, 
Trade  Strategy  unit  G1,  selected  geographical  and  sectorial  units  and  a  sample  of  other 
Directorates-General  involved  in  trade  negotiations  (Directorates-General  AGRI,  GROW, 
TAXUD, SANTE and COMP). 

There  were  no  observations  or  reservations  in  the  2016  Annual  Activity  Report  of 
Directorate-General TRADE that relate to the area/process audited. 

The fieldwork was finalised on 12 July 2017. All observations and recommendations relate to 
the situation as of that date. 

Strengths 

The  Internal  Audit  Service  recognised  the  ongoing  efforts  made  by  Directorate-General 
TRADE to manage trade negotiations, in particular: 

In  October  2015,  the  Commission  adopted  a  new  strategy  called  "Trade  for  all  – 
a) 
Towards  a  more  responsible  trade  and  investment  policy"  which  encompasses  concrete 
actions  to  achieve  the  Commission  trade  objectives.  The  first  progress  report  on  the 
implementation  of  the  Strategy  was  issued  on  13  September  2017  and  in  this  context 
Directorate-General TRADE took stock of recent events and evaluated their impact on future 
trade policy.  

In January 2016, Directorate-General TRADE set up three Working Groups to identify 
b) 
ways to  improve efficiency around trade  negotiations. One of the outcomes  of the  Working 
Groups was the creation in June 2016, of Directorate-General TRADE's Senior Management 
Group  on  Free  Trade  Agreements  Coordination  and  Coherence  (hereinafter  referred  to  as 
FTA Coordination Group).  It has the twofold mandate of ensuring a) resource prioritisation 
(by assessing at tactical and operational level the political objectives and changing priorities) 
and b) internal coherence in trade negotiations and agreements. It has met on a regular basis 

92 

 
 
since  its  creation  and  has  already  taken  some  concrete  actions  resulting  in  efficiency  gains, 
notably: 

- The creation of a rolling Negotiations Calendar for all ongoing trade and investment 
negotiations, which contains the dates of upcoming rounds for all negotiations planned 
for the next three to six months.  

- The establishment of a baseline of two negotiating rounds per year, in order to handle 
increasing  workload  as  well  as  staff  constraints.  This  approach  also  enables  the 
negotiators  to  have  more  time  to  prepare  the  rounds  and  analyse  the  proposals.  This 
results in more in-depth discussions during the rounds. 

- Development  of  policy  standardised  templates  for  the  different  chapters  of  the 
agreements  to  be  used  during  negotiations,  which  ensure  a  consistent  approach  for 
chapters across negotiations, improves the legal quality of the texts already in an early 
stage  of  the  negotiation,  facilitates  the  legal  'scrubbing'  process  and  supports  the 
optimisation of resources. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

8.  GENERAL SERVICES  

8.1. Audit on the procurement process in DIGIT 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective 
implementation of DIGIT's internal control systems for the management of the  procurement 
process and the effectiveness and efficiency of the related financial circuits. 

During  the  audit,  the  Internal  Audit  Service  tested  the  key  controls  embedded  in  the 
procurement  process,  from  the  identification  and  planning  of  the  needs  through  to  the 
signature  of  the  contract,  including  commitments.  In  addition,  the  Internal  Audit  Service 
reviewed a sample of payments, including amendments of contracts and, if applicable, price 
revisions. 

Furthermore, the  Internal Audit Service reviewed DIGIT's  preparations for managing a  new 
framework contract to procure IT services for an estimated amount of EUR 1 200 million. 

There  were  no  observations/reservations  in  the  2016  Annual  Activity  Report  of  DIGIT  that 
relate to the area/process audited. 

The  fieldwork  was  finalised  on  20  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

93 

 
 
Strengths 

The Internal Audit Service recognised the ongoing efforts made by DIGIT to create a strong 
control  environment.  In  particular,  the  Internal  Audit  Service  identified  the  following  good 
practices in relation to high value procurement procedures: 

a) 
DIGIT  prepares  appropriate  strategy  papers  before  the  procedure  is  launched.  These 
take  into  account  the  lessons  learned  from  previous  contract(s)  and  the  analysis  of  the 
different procurement options that exist on the market for acquiring the goods/service needed. 

b) 
DIGIT  holds  debriefing  meetings  with  unsuccessful  tenderers,  aimed  at  obtaining 
feedback  in  order  to  consider  any  suggestions  for  improvement  for  future  procurement 
procedures. In addition, DIGIT sends letters to potential contractors, inquiring as to why they 
did not participate. 

DIGIT's  Procurement  Board  ensures  that  the  procurement  strategy  is  followed.  The 
c) 
Board also monitors the implementation of the high value procurement procedures at different 
key stages (Orientation Document and Evaluation report). 

For  the  new  framework  contract  that  the  Internal  Audit  Service  reviewed  to  assess 
d) 
DIGIT's preparedness to manage it, the Internal Audit Service welcomed that a working group 
was  set  up  to  analyse  in  depth  the  risks  associated  with  this  procedure.  Different 
possibilities/solutions  were  proposed  and  weighed  up,  and  representatives  from  Directorate-
General BUDG.D3 were involved for the financial aspects. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues 

8.2. Audit on the charge-back of services in Directorate-General HR 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  the  effectiveness  and  efficiency  of  the  design  and 
implementation  of  the  charge-back  process  within  Directorate-General  HR  for  the  services 
provided  to  the  Commission's  internal  and  external  clients.  The  audit  also  assessed 
compliance with the fundamental principles as laid down in the corporate guidance. 

The  audit  covered  the  2016  financial  period  (i.e.  revenue  credited  in  2016  for  the  services 
delivered in 2015). However, for the catalogue of services and the costing model, and in order 
to  be more forward-looking,  the Internal Audit Service  reviewed  the current draft catalogue 
and  Directorate-General  HR's  future  costing  model  to  assess  their  compliance  with  the 
recently adopted corporate guidelines. 

The audit scope covered the roles and responsibilities of the various actors within Directorate-
General HR (e.g. operational units, finance units). It included all types of services provided by 
Directorate-General  HR  that  are  subject  to  the  charge-back  mechanism.  It  also  covered  the 
cost recovery mechanism that Directorate-General HR uses for charging costs to its clients. 

There were no observations/reservations in the 2016 Annual Activity Report of Directorate-
General HR that relate to the area/process audited. 

94 

 
 
The  fieldwork  was  finalised  on  10  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

Strengths 

Directorate-General HR anticipated the implementation of the new provisions on the charge-
back of services, in particular as regards the revision of its cost model. Although the corporate 
guidelines  on  the  provision  of  services  to  other  institutions,  agencies  and  bodies  were  only 
adopted in March 2017, Directorate-General HR had already taken important steps to align its 
cost  model  with  the  principle  of  full  cost  recovery  and  to  prepare  a  comprehensive  service 
catalogue.  This  was  done  on  the  basis  of  the  principles  already  defined  in  2014  in  the 
guidelines  on  the  charge-back  of  services  within  the  Commission.  Thus,  by  March  2017, 
Directorate-General HR had already identified the services to be included in the new service 
catalogue as from 2018 and prepared draft underlying costing fiches that determine the price 
for each service based on a full cost methodology. 

Directorate-General HR also set-up an internal cross-cutting Working Group on service-level 
agreements  (SLAs),  with  the  purpose  to  coordinate  internally,  harmonise  practices  and 
smoothly incorporate the provisions of the guidelines into its process. It revised the text of the 
SLAs to be signed with agencies and harmonised them in line with the corporate guidelines. 

Major audit findings  

The Internal Audit Service identified one very important issue: 

Future cost model 

Generally, the draft costing fiches, which underlie the future cost model, did not include the 
details necessary to provide a sufficient audit trail as required by the Financial Regulation. It 
was not clear when they were last updated, what the main assumptions and the source of the 
data  were  and  whether  they  still  reflected  the  latest  state  of  play.  Furthermore,  some  draft 
costing  fiches  still  included  data  from  2015  and  were  therefore  obsolete  at  the  time  of  the 
fieldwork. 

Moreover,  for  some  services,  the  calculation  of  prices  was  erroneous,  as  it  did  not  make 
reference to the correct number of working days per year, the number of working hours per 
day or did not convert man days into Full Time Equivalent correctly. 

A  survey  conducted  during  the  audit  showed  that  Directorate-General  HR's  external  clients 
are  concerned  by  a  possible  significant  increase  in  cost  to  be  borne  by  them,  as  the  new 
corporate  guidelines  require  Directorates-General  to  apply  a  full  cost  model.  However, 
Directorate-General HR has not yet made a comprehensive impact analysis of the new prices 
in  order to increase  the transparency  of  the  process  and  to  smooth  the transition to  the  new 
costing model. This is relevant as, according to the information collected by the Internal Audit 
Service  during  interviews  and  based  on  Directorate-General  HR's  informal  estimations,  the 
increases are expected to be less than those cited by its clients in the survey. 

Finally,  there  is  no  coherent  policy  across  Directorate-General  HR  on  the  frequency  of  the 
update of the costing fiches in the future to ensure that that the parameters continue to be valid 
and, where necessary, prices are updated.  

95 

 
 
Recommendation 

Directorate-General HR should review the draft costing fiches to ensure that the most recent 
available  data  is  used  and  that  calculation  errors  identified  by  the  Internal  Audit  Service 
during  the  audit  are  corrected.  Furthermore,  the  costing  fiches  should  clearly  document  the 
assumptions  made  and  identify  the  source  of  data  and  other  criteria  used  in  the  various 
calculations.  Moreover,  Directorate-General  HR  should  offer  to  its  clients  the  possibility  to 
receive  an  impact  analysis  of  the  price  changes  and  discuss  as  necessary  with  them  any 
potential implications for the SLAs. Finally, Directorate-General HR should perform annual 
updates  of  the  costing  model  on  the  basis  of  an  assessment  of  the  main  cost  drivers  for  all 
services provided.  

Additional  information  provided  by  Directorate-General  HR  on  the  measures  defined 
and/or implemented following the Internal Audit Service audit 

The necessary actions to implement the recommendations have been adopted and validated by 
the Internal Audit Service. All actions are set to be achieved by the deadlines defined in the 
action plan. 

So  far  the  actions  undertaken  have  already  resulted  in  the  development  of  a  new  costing 
model  incorporating  the  needs  identified  during  the  audit.  Together  with  new  procedures 
guiding staff through the new costing and invoicing process, this new model has already been 
presented  to  all  DG  HR  staff  involved  in  the  process.  Staff  have  also  been  informed  of  the 
requirement  to  update/validate  this  costing  model.  The  progress  in  both  recommendations 
issued gives sufficient assurance the deadlines will be met as agreed with the Internal Audit 
Service. 

8.3. Audit on ethics in OLAF 

Audit objectives and scope 

The  objective  of  the  audit  engagement  was  to  assess  if  OLAF  has  adequately  designed  and 
effectively  implemented  an  ethics  framework  in  compliance  with  the  applicable  rules  to 
ensure  that  it  serves  the  EU  interest,  complies  with  ethical  principles  defined  in  the 
Commission's  internal  control  framework  and  in  the  Staff  Regulations  and  ensures  that  its 
staff behaves ethically. 

In particular, the audit covered: 

  The overall control environment for ethics in OLAF;  
  How  OLAF  ensures  that  its  activities  comply  with  ethical  standards  and  rules  including 

regarding its sensitive activities and in its relations with the public; 

  How OLAF ensures that staff comply with ethics rules regarding their behaviour at work 

and their individual obligations including their relations with public. 

There were no observations or reservations in the 2016 Annual Activity Report of OLAF that 
relate to the audited process.  

The  fieldwork  was  finalised  on  26  September  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

96 

 
 
 
Strengths 

Overall, the Internal Audit Service recognised the ongoing efforts made by OLAF to ensure a 
solid ethics framework. In particular: 

a) 
In  April  2014,  OLAF  adopted  an  "Ethics  and  Conduct  Guide  for  OLAF  staff" 
(hereafter, "OLAF's Ethics Guide"), which underlines the importance of ethics in OLAF. For 
the areas of gifts and hospitality, this guide establishes stricter rules (zero tolerance) than the 
standard  for  the  Commission,  in  order  to  avoid  any  reputational  risk  resulting  from  the 
appearance of loss of impartiality. OLAF has also developed detailed instructions to staff on 
how to deal with requests and contacts from the media. 

The compulsory induction course for OLAF's newcomers includes a module on ethics, 

b) 
which covers both the standard Commission rules and OLAF's specificities. 

c) 
Trainees  joining  OLAF  have  to  sign  a  statement  on  ethics.  OLAF  has  been  using 
similar  statements  on  ethics  and  security  of  information  since  2017  for  the  "intra-muros" 
service providers (who represent approximately 16% of OLAF's headcount and are not bound 
by the Staff Regulations). 

Major audit findings 

The Internal Audit Service identified one very important issue: 

Use of social media and contacts with interest groups 

Regarding the use of social media, just less than half (48%) of the respondents to the survey 
the Internal Audit Service conducted during this audit provided correct answers on the type of 
opinions that a staff member can post in a blog. Furthermore, the Internal Audit Service found 
three examples of OLAF staff members commenting on investigations or providing the details 
of their "missions" in social media.  

Concerning contacts with lobbyists and interest groups, 20% of the respondents to the Internal 
Audit  Service  survey  had  an  unclear  understanding  of  the  applicable  rules.  Moreover,  both 
OLAF's  Ethics  Guide  and  the  information  available  on  OLAF's  intranet  do  not  refer  to  the 
Commission's guidelines on contacts with interest groups. 

Recommendation 

OLAF should urgently remind its staff of the mandatory rules and principles on how to use 
the social media. OLAF should increase staff awareness on the Commission Guidelines on the 
use  of  social  media  and  contacts  with  interest  groups,  and  include  guidance  on  this  in  its 
Ethics Guide and training courses on ethics and conduct. 

Additional information provided by OLAF on the measures defined and/or implemented 
following the Internal Audit Service audit 

All  the  actions  foreseen  in  the  comprehensive  action  plan  endorsed  by  OLAF  management 
regarding  the  use  of  social  media  and  the  contacts  with  interest  groups  have  been 
implemented, except the update of OLAF's ethics guide as the deadline is fixed for October 
2018. The Director-General has reminded all staff members, via a message on the Intranet, on 
OLAF's policy on the use of social media.  A specific training course has been organised for 
all  OLAF  staff  on  the  use  of  social  media  as  well  as  a  lunchtime  debate  on  contacts  with 
interests groups. The Commission guidelines on the use of social media and on the guidelines 
on contacts with interests groups have been made more visible on OLAF's Intranet.  

97 

 
 
 
A  reference  to  these  guidelines  has  also  been  added  in  the  Newcomers  package.  The 
Commission  training  on  how  to  use  of  social  media  is  now  part  of  the  training  path  of  the 
investigators.  

8.4. Audit on the procurement process in the Publications Office 

Audit objectives and scope 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective 
implementation of the Publications Office's (OP) internal control systems for the management 
of  the  procurement  process  and  the  effectiveness  and  efficiency  of  the  related  financial 
circuits. 

This audit tested the key controls as well as management and monitoring controls throughout 
the  procurement  process,  from  the  identification  and  planning  of  the  needs  through  to  the 
signature of the contract, including amendments and price revisions, where applicable. 

There  were no  observations/reservations  in  the  2016  Annual  Activity  Report  of the PO  that 
relate to the area/process audited. 

The fieldwork was finalised on 6 October 2017. All observations and recommendations relate 
to the situation as of that date. 

Strengths 

The Internal Audit Service recognised the ongoing efforts made by the OP to create a strong 
control environment. In particular, the following elements were identified as good practices:  

a) 
The principle of segregation of duties and the OP's financial circuit were followed in 
all  transactions  examined.  The  Internal  Audit  Service  did  not  find  any  cases  of  non-
compliance with sub-delegations. 

b) 
The processing of payment transactions is very efficient and the audit did not identify 
any  late  payments  in  the  sample.  Generally,  the  OP  processes  payments  well  before  the 
contractual deadlines.  

The OP has a standardised system for the attribution of titles and references for each payment 
file in ARES, which enables the documents to be retrieved quickly. Equally, the procurement 
files  tested  were  complete  and  well  organised  because  of  this  standardised  document 
management system. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues 

98 

 
 
 
8.5. Consulting  engagement  on  the  efficiency  of  the  workflow  for  parliamentary 
questions in the Secretariat-General 

Audit objectives and scope 

The  objective  of  the  engagement  was  to  assess  the  efficiency  of  the  workflow  for  written 
parliamentary questions (PQs) within the Commission.  

The scope of the engagement covered the workflow of the PQs within the Commission and 
Regulatory Agencies. The scope also included BASIL, the corporate IT tool used to manage 
the PQ workflow. More specifically, the Internal Audit Service assessed whether this IT tool 
meets the business needs, in particular the approval workflow and the reporting functions. 

Major audit findings 

The  consulting  engagement  resulted in  a  number  of  issues  for  consideration.  As  this  was  a 
consulting  engagement  and  not  an  audit,  the  Internal  Audit  Service  will  not  follow-up  on 
these issues. 

8.6. Audit on the financial management of the SRSS  

Audit objectives and scope 

The  objective  of  the  audit  was  twofold  and  encompassed  compliance  and  performance 
elements: 

  Firstly, the audit assessed the adequacy of the design and the effective implementation of 
the  internal  control  system  for  financial  management  (legality  and  regularity  and 
efficiency of the financial workflow); 

  Secondly,  the  audit  assessed  the  state  of  readiness  of  the  Structural  Reform  Support 
Service  (SRSS)  to  take  on  increased  responsibility  for  managing  the  new  SRSP.  In  this 
context, the Internal Audit Service analysed the SRSS's risk assessment, control strategy, 
business  continuity  measures  and  the  implementation  of  the  internal  control  standards 
(ICS).  All  these  elements  were  analysed  in  respect  to  financial  management  in  the 
Structural Reform Support Programme (SRSS). 

The scope of the audit covered the design and implementation of key controls in the following 
processes: 

  The  procurement  process,  from  the  determination  of  the  needs  and  planning  to  the 
effective  implementation  of  the  contract,  including  timely  application  of  corrective 
measures, where necessary; 

  The  grant  process,  from  the  call  for  proposal,  where  applicable,  to  the  effective 
implementation  of  the  contract,  including  timely  application  of  corrective  measures, 
where necessary; 

  The  financial  circuits  of  grants  and  procurements,  including  commitments,  payments 

(including payment deadlines), de-commitments and recovery orders; 

  Recording of exceptions and ensuring ABAC access rights; 
  Reporting of the financial activity in the Annual Activity Report. 

99 

 
 
The engagement covered the year 2016 and the first three months of 2017. 

Major audit findings 

The Internal Audit Service identified two very important issues: 

Public procurement under the Aid programme  

The auditors found that the SRSS does not have a systematic and formally documented needs 
analysis for public procurement procedures under the Aid programme. Such an analysis is key 
to  an  effective  procurement  procedure  and  in  helping  to  ensure  that  projects  are  ultimately 
successful in practice. 

Furthermore,  for  two  of  the  six  procedures  tested,  the  SRSS  did  not  set  the  mandatory 
exclusion, selection or award criteria. These constitute situations of non-compliance with the 
Financial Regulation and its Rules of Application. 

Moreover, the SRSS did not properly justify using the exception to negotiate an extension of 
an existing contract without prior publication. In this case and contrary to the applicable rules, 
the SRSS exceeded the original duration of the contract and the maximum budget. In addition, 
it added new tasks to the contract, which significantly changed its initial objective. 

Finally, the Internal Audit Service identified cases in which the rules on ex-post publication in 
the Official Journal were not complied with. 

Design and application of the internal control system (ex-ante and ex-post) 

At the end of the audit fieldwork, the SRSS had no operating ex-post control function and its 
control  strategy  and  business  continuity  plan  were  not  yet  finalised.  The  Internal  Audit 
Service acknowledges, however, that the SRSS is currently developing them. 

Furthermore,  the  financial  circuit  currently  in  place  allowed  a  Head  of  Unit  to  authorise  an 
exception  he  requested  himself  as  he  was  deputising  for  the  Authorising  Officer  by  sub-
delegation  in  that  specific  period.  This  related  to  the  exceptional  negotiated  procedure 
mentioned in the issue above, that the Internal Audit Service considers unjustified. 

Recommendations 

Procurement procedures under the Aid programme 

The  SRSS  should  significantly  strengthen  its  internal  control  arrangements  in  the  area  of 
public  procurement  under  the  Aid  programme  by  putting  in  place  internal  control 
arrangements  that  ensure  compliance  with  the  provisions  of  the  Financial  Regulation. 
Furthermore, it should undertake a documented, structured and robust needs analysis, at least 
for every high value procurement procedure. It should also ensure compliance with the rules 
on  ex-post  publicity  and  organise  its  procurement  procedure  in  such  a  way  that  there  is  no 
need for the supplier to start the contract before it is signed. 

Design and application of the internal control system (ex-ante and ex-post) 

The  SRSS  should  review  its  financial  circuit  to  ensure  compliance  with  the  principles  of 
segregation of duties and absence of conflicts of interest. Furthermore, it should finalise the 

100 

 
 
development of its ex-post control function and its control strategy and put in place a business 
continuity plan. 

Additional information provided by SRSS on the measures defined and/or implemented 
following the Internal Audit Service audit 

The SRSS duly assessed if the high risks identified by the Internal Audit Service in relation to 
the  procurement  procedures  under  the  Aid  Programme  require  a  reservation.  While  it  is 
considered  that  there  had  been  a  reputational  risk  linked  to  the  incorrect  application  of 
procurement  principles,  it  can  be  demonstrated  that  the  reputational  risk  did  not  materialise 
and there was no impact on the reputation of the Commission. The SRSS is not aware of any 
complaint or other actions which would represent a reputational event.  

As a consequence, the SRSS considers that the risks identified by the Internal Audit Service 
in  relation  to  the  procurement  procedures  under  the  Aid  Programme  do  not  fall  under  the 
scope of a reservation. 

Since the end of the audit, the SRSS has already put in place corrective actions as regards the 
revision  of  the  sub-delegation  for  commitment  and  the  establishment  of  an  ex-post  control 
function. The new ex-post control strategy has been adopted in March 2018. In addition, the 
business continuity plan has been developed and adopted in March 2018. The SRSS started 
the implementation of all corrective actions agreed with the Internal Audit Service. 

9.  IT AUDITS 

9.1. Audit  on  corporate  IT  governance  framework  and  portfolio  management  (DIGIT, 
SG) 

Audit objectives and scope 

The objective of the audit was to evaluate the current corporate IT governance arrangements 
in the Commission, with a particular focus on the following areas: 

  The effectiveness of the oversight for IT-related issues and whether there are clear roles 

and responsibilities in place; 

  The effectiveness and efficiency of the processes which evaluate, direct and monitor value 
contribution  of  IT  systems  and  services  in  the  achievements  of  the  Commission's 
objectives through benefit delivery, risk optimisation and resource optimisation; 

  The effective oversight of IT projects, systems and services. 

There  were  no  reservations  directly  related  to  corporate  IT  governance  arrangements  in  the 
2016 Annual Activity Report of the audited Directorates-General. 

The  fieldwork  was  finalised  on  8  November  2017.  All  observations  and  recommendations 
relate to the situation as of that date. 

101 

 
 
 
Strengths 

In  recent  years,  the  Commission  has  significantly  strengthened  its  corporate  IT  governance 
arrangements  in  recognition  of  the  need  for  greater  cooperation  on  IT  developments  and 
increased  dependency  on  common  systems.  In  particular,  the  audit  noted  the  following 
strengths: 

Members of the respective IT corporate governance bodies appear highly motivated in 

a) 
fulfilling their responsibilities with due care and professionalism. 

b) 
The  mandate  of  the  IT  Board  is  significantly  broader  than  that  of  the  former 
Information  System  Project  Management  Board  (ISPMB)  and  now  covers  IT  investments 
irrespective of their budget lines. The fact that it is under the chair of the Deputy Secretary- 
General  for  Institutional  and  Administrative  Policies  has  clearly  raised  its  profile  and 
prominence. 

Common IT services and re-usable IT components (building blocks) are promoted on 

c) 
an active basis. 

The use of a corporate tool (GovIS2) for managing the inventory of IT assets (systems, 

d) 
projects, services). 

There is close oversight of the Synergies and Efficiencies Review programme for the 

e) 
IT domain. 

Major audit findings 

The Internal Audit Service identified two very important issues: 

Corporate IT governance framework 

The  IT  Board  is  officially  a  sub-group  of  the  Group  of  Resources  Directors  (GDR),  which 
approved its  mandate  without  further  endorsement  by  corporate  IT  governance  bodies.  This 
endorsement  would  help  to  re-inforce  its  position  and  legitimacy  when  it  monitors  and 
evaluates IT investments in the Commission.  

In 2010 the Commission decided to develop a comprehensive IT strategy and a more strategic 
approach to IT investments in the Commission. Although DIGIT has developed a number of 
initiatives  with  a  strategic  dimension,  there  is  still  no  overall  corporate  IT  strategy  for  the 
Commission  as  a  whole.  In  addition,  the  members  of  the  Group  of  Resources  Directors, 
representing the Commission's business activity, were only able to provide limited input at the 
early stages of the development of such initiatives.  

There  is  no  central  guidance  on  how  IT  Steering  Committees  (ITSC)  should  be  set  up  to 
exercise IT governance at a decentralised level. There is also no central oversight on local IT 
governance arrangements aimed at identifying where common improvements may be needed. 

Oversight on corporate IT portfolio 

Although the IT Board has a mandate to review all IT investments, investments for ongoing 
IT operations (about 70% of total IT expenditure) are not subject to any corporate oversight, 
except for those parts which relate to the administrative IT Global Envelope.  

102 

 
 
The IT Board does not oversee active IT projects launched before the entry into force of the 
new corporate IT governance framework in 2015. Furthermore, in some cases inaccurate data 
recorded  by  the  Directorates-General  hampers  initial  assessment  and  ongoing  evaluation  of 
progress over the project life cycle. The IT Board does not receive a regular overview of the 
entire  portfolio  of  IT  assets  (projects,  systems  and  services).  Neither  does  it  receive 
information  as  to  whether  project  costs  and  planning  are  on  track/deviate  from  their  initial 
budget and scheduling. 

Business value, risks and costs are assessed at the inception phase of a project, without further 
assessment  at  regular  intervals  of  the  likelihood  that  projects  will  reach  their  objectives  in 
time  and  within  budget  over  their  full  life  cycle.  In  addition,  there  is  no  review  of  lessons 
learned  and  achievement  of  expected  benefits  at  the  closure  of  a  project,  i.e.  when  the  IT 
system or service becomes operational. 

The  current  processes  for  deciding  the  annual  allocation  of  funding  under  the  IT  Global 
Envelope  consumes  significant  time  and  effort  from  Directorates-General  and  corporate  IT 
governance bodies, which is disproportionate to the amounts at stake (less than 5% of the total 
IT expenditure of the Commission). 

The IT Board promotes the use of common standards services and building blocks to ensure 
IT delivery through synergies and efficiencies  gains. However, the proposed  funding  model 
involves  charging  a  fixed  annual  amount  irrespective  of  the  number  of  actual  end  users, 
meaning that certain users bear a disproportionate amount of the cost. 

Recommendations 

Corporate IT governance framework 

The  Commission  should  further  strengthen  its  corporate  IT  governance  framework  by  
(1) reinforcing and clarifying the role of the IT Board and its relations with other Commission 
corporate bodies and operational departments; (2) defining an overarching Commission-wide 
IT  strategy  providing  a  coherent  view  on  IT  and  its  alignment  with  Commission  objectives  
(3)  developing  guidance  and  support  on  the  functioning  of  local  IT  governance  bodies  
(Directorate-General-level and project-specific IT Steering Committees). 

Corporate oversight over IT portfolio 

The Commission should strengthen its corporate oversight on the portfolio of IT investments, 
based on their respective value, risks and costs, as follows: (1) taking a risk-based approach to 
extend IT Board oversight to significant investments for IT operations, and major IT projects 
launched before the entry into force of the new governance model in 2015 (2) improving the 
quality of information that Commission Directorates-General and Services provide to the IT 
Board so that it provides an accurate and up to date situation of their IT systems, services and 
projects;  
(3) developing a process to assess and monitor the business value (benefits, risks, costs) of IT 
systems, services and projects over their full life cycle (4) streamlining the decision making 
process  regarding  the  allocation  of  the  IT  Global  Envelope;  (5)  ensuring  a  more  equitable 
model of cost sharing for IT building blocks. 

103 

 
 
Additional  information  provided  by  Directorate-General  DIGIT  and  the  Secretariat-
General  on  the  measures  defined  and/or  implemented  following  the  Internal  Audit 
Service audit 

The  two  very  important  recommendations,  which  relate  to  the  corporate  IT  governance 
framework  and  oversight  of  the  corporate  IT  portfolio,  were  fully  accepted  by  the  auditees 
and an action plan was submitted to the Internal Audit Service by the Secretariat-General in 
association  with  Directorate-General  DIGIT  on  8  June  2018  and  was  considered  as 
satisfactory by the Internal Audit Service. The implementation is foreseen respectively by end 
2018 and in the course of 2019. 

The actions aim at clarifying and reinforcing the IT governance arrangements to support and 
monitor  the  implementation  of  a  comprehensive  Digital  Strategy  to  deliver  a  digitally 
transformed, user-focused and data-driven Commission. 

9.2. Audit on management of IT security in DIGIT  

Audit objectives and scope 

The objective of the audit was to assess whether the management and control systems in place 
in  the  areas  of  vulnerability  management  and  privileged  user  access  ensure  that  the  ICT 
(Information and Communications Technology) systems managed by DIGIT in its datacentres 
are adequately protected against cyber-attacks.  

The scope of this audit covered only the DIGIT managed systems, focusing on ICT technical 
inventories  for  systems  and  software,  monitoring  of  known  weaknesses  and  vulnerabilities, 
security  related  upgrade  processes,  management  of  security  exceptions  and  management  of 
privilege access. 

Security  controls  reviewed  in  the  scope  of  this  audit,  both  in  the  area  of  privileged  user 
activity and vulnerability management, can be categorised mainly in two types: (1) preventive 
(e.g. mechanisms to grant access or identify potential vulnerabilities) and (2) integrity checks, 
after  privileged  activities  have  been  performed,  to  enable  the  identification  of  non-
compliances or unauthorised changes once occurred. 

There were no observations/reservations in DIGIT's 2016 Annual Activity Report that relate 
to the area/process audited. 

The fieldwork was finalised on 22 June 2017. All observations and recommendations relate to 
the situation as of that date. 

Strengths 

During the fieldwork a number of strengths and good practices were identified that could be 
more  widely  deployed,  both  inside  DIGIT  and  across  other  Directorates-General.  In 
particular, we found examples of different types of IT security controls, both preventive and 
detective, together with high degrees of expertise and experience which could be used to help 
improve security even further. More specifically: 

104 

 
 
 
Automated  updates:  different  mechanisms  exist  for  the  various  operating  system 
a) 
technologies  to  ensure  automated  updates  of  software  (patches)  upon  publication  by  the 
vendor. 

Job/role  based  authorization  mechanisms:  two  cases  were  noted  which  clearly  prove 
b) 
the  technical  feasibility  of  having  authentication/authorization  models  for  privileged  users, 
based  on  operational/business  functions  and  corresponding  technical  roles  in  the  system.  In 
addition,  we  observed  certain  automated  and  regular  crosscheck  of  users  in  the  HAN 
application  family  (Hermes,  Ares  and  NomCom)  with  the  Commission  staff  reference  user 
database COMREF. 

Secured  administration  environments:  some  of  the  technologies  (notably  networking 
c) 
and operating systems, and partially databases) have implemented secured environments for 
administration workstations (segregation of network to provide enhanced security). 

Automation of configuration deployments: some automated practices are implemented 
d) 
to  maintain  and  refresh  baseline  configurations,  for  example  the  regular  refresh  of 
configuration  files  in  Unix  servers  and  regular  reviews  of  local  administrators  for  end  user 
windows devices.  

Audit trail: certain mechanisms have been put in place for tracing activity in SYSPER 

e) 
production databases, linking technical interventions to change requests. 

Major audit findings 

The Internal Audit Service identified two very important issues: 

Assurance on the legitimacy of actions performed in production systems  

Changes  performed  with  privileged  userids  in  production  systems  during  day-to-day 
operations  can  be  linked  to  formalised  tickets  in  very  few  situations  only.  This  makes  it 
almost  impossible  for  the  Directorate-General  to  initiate  any  attempt  to  detect  or  identify 
suspicious activities. The root cause for this situation is a combination of technical constraints 
and  the  considerable  resources  that  would  be  needed  to  fully  address  manually  the  issue  of 
linking actual changes in the systems with legitimate change requests.  

Mechanisms  to  identify suspicious  activity in  critical  areas  of  the  systems  (e.g.  firmware  of 
appliances  and  integrity  of  critical  configuration  files)  are  generally  not  in  place  or,  if  they 
are,  then  they  are  relatively  immature.  This  is  due  to  a  historical  lack  of  automation 
technology that can facilitate compliance and integrity checks.  

Regular reviews of existing privileged userids are not performed systematically for systems in 
production.  

The  DIGIT.C6  team  (Digital  Workplace  Engineering)  has  made  a  major  effort  in  the  past 
years  in  reducing  local  administrator  accounts  in  Windows  workstations  and  laptops  from 
more than 6 000 to 2 800. However, this is still a high number and represents around 7% of 
the approximately 40 000 Windows devices in the Commission.  

105 

 
 
Technical inventories of management information for security vulnerabilities  

Technical  inventories,  which  contain  for  the  different  technologies  sufficient  and  relevant 
information  to  manage  security  vulnerabilities,  are  not  systematically  maintained  or  lack 
sufficient  information.  They  are  the  necessary  link  between  the  current  implementation  of 
systems  in  DIGIT  datacentres  and  the  corresponding  vendor,  community  or  self-discovered 
security alerts descriptions. 

Proactive  security  vulnerability  detection  in  systems  in  the  network,  in  particular  for  the 
datacentre  systems,  is  still  in  a  very  early  design  phase.  The  observed  and  re-performed 
process  during  the  audit  was  not  fully  effective  because  the  scope  of  the  systems  being 
assessed  is  still  very  small  and  the  mode  of  execution  is  providing  insufficient  information 
due to a suboptimal use of the tool chosen. 

Recommendations 

Assurance on the legitimacy of actions performed in production systems  

DIGIT should improve its assurance on the legitimacy of activities of privileged users in the 
production IT systems. In particular, it should share among the different teams in DIGIT (and 
when  possible  advocate  for  them  to  other  Directorates-General)  the  existing  solutions  and 
initiatives  that  (1)  can  tag  legitimate  session  activities  in  an  automated  or  semi-automated 
way;  (2)  can  identify  and  manage  baseline  configurations,  and  cross-check  them  with 
production running instances to identify any deviations; and (3) extend the use of the current 
mechanisms  for  deploying  configurations/updating  inventories  to  detect  changes  in  the 
production  systems  and  flag  these  changes  as  legitimate  or  potentially  illegitimate.  DIGIT 
should also promote automated mechanisms for regularly reviewing and cleaning up potential 
orphan privileged user IDs by cross-checking the current groups of privileged user IDs with 
valid references of users and roles. 

Technical inventories of management information for security vulnerabilities systems  

DIGIT should improve the management of security vulnerabilities by updating the IT Security 
Framework derived from Commission Decision C(2017)46 with the obligation for all system 
owners/providers, regardless  of the  Directorate-General to which  they belong,  to: (1) define 
upfront the list of technical modules and register them in central repositories, before having 
them connected to the corporate network, and (2) maintain the repositories updated during the 
lifecycle  of  the  system.  In  addition,  DIGIT  should  establish  and  agree  with  the  different 
stakeholders  inside  DIGIT  the  principles  and  strategy  for  using  vulnerability  scanning 
services to increase assurance on the security of the systems. 

Additional  information  provided  by  Directorate-General  DIGIT  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

Two very important and three important recommendations were fully accepted and an action 
plan  was  submitted  to  the  Internal  Audit  Service  by  Directorate-General  DIGIT  and 
considered as satisfactory by the Internal Audit Service in October 2017. The implementation 
is  foreseen  mostly  in  2019  and  2020.  Regarding  the  update  of  the  IT  security  Framework 
derived  from  Commission  Decision  C(2017)46;  the  Implementing  Rules  were  adopted  in 
December 2017. 

106 

 
 
Regarding the two very important recommendations, the following actions have been defined: 

REC 1 Assurance on the legitimacy of actions performed in production systems  

A)  Identify  improvements,  document  and  share  information,  as  well  as,  best  practices  in 
Privileged Access and Configuration Management; 

B)  Link  Privileged  Access  alterations  to  legitimate  request  for  change  in  DWP  and  DC 
services, EU login and reduce privileged user accounts for end-user devices; 

C) Improve capability to identify suspicious activities compromising integrity of IT systems 
in DWP and DC services; 

D)  Improve  the  capability  to  regularly  review  Privileged  Users  rights,  through  automated 
tools, extending operational scope of process orchestration tools. 

REC 2 Technical inventories of management information for security vulnerabilities 

A)  Build  and  improve  the  capability  to  maintain  a  central  repository  of  technical  assets 
supported by the IT security policy framework; 

B)  Build and improve the capability to do vulnerability scanning with automated and manual 
tools and processes, aligned with the IT security policy framework. 

9.3. Audit on security of IT applications supporting nuclear accountancy and inspection 
processes in Directorate-General ENER 

Audit objectives and scope 

The objective of the audit was to assess the adequacy of the design and the effectiveness of 
the  implementation  of  the  management  and  control  systems  put  in  place  by  Directorate-
General  ENER for ensuring the security of its key information systems and data supporting 
nuclear accountancy and inspection processes (Euratom Safeguards). 

To achieve this objective, the audit focused on: 

  The structure in place for the governance of information security, with related roles and 

responsibilities as well as policies, standards and procedures;  

  The management and monitoring of IT security services;  
  The  protection  of  information  systems  from  circumventing  logical  controls  through 

change management processes;  

  The management of continuity and availability of data. the following aspects: 

The  scope  of  the  audit  covered  the  secure  network  infrastructure  and  related  IT  systems 
supporting the business processes of Euratom Safeguards. The audit focused on the following 
aspects: 

 

IT security governance structure; 

107 

 
 
 
  User  access  management  through  identification  and  authentication  mechanisms  with  a 

special focus on privileges used (system and database administrators); 
  Security-related documentation of the IT systems and IT applications; 
  Security  of  servers,  network  components,  remote  connections  and  endpoints  (e.g. 

hardening configuration, encryption, disposal); 

  Monitoring tools and security of log files; 
  Processes to test security of secure network; 
  Processes to manage and test new or modified systems or applications from development 

to deployment into production; 

  Processes ensuring availability of data (back-up procedures and tests). 

The scope covered the main elements of the secure infrastructure, including network devices 
(i.e.  firewall,  routers),  servers,  databases,  and  mobile  endpoints.  In  deciding  on  precisely 
which IT applications to examine in  detail, the  Internal Audit  Service took into account  the 
level  of  confidentiality,  integrity  and/or  availability  (criticality)  declared  in  the  corporate 
inventory as the main criteria. 

Directorate-General  ENER  reported  one  reservation  in  its  2016  Annual  Activity  report:  the 
residual error rate observed by ex-post controls on grant agreements signed under the Seventh 
Research Framework Programme was higher than the control objective (2%). This reservation 
has no impact on the process audited. 

The fieldwork was finalised on 17 March 2017. All observations and recommendations relate 
to the situation as of this date.  

Strengths 

During  the  fieldwork,  the  Internal  Audit  Service  noted  the  ongoing  efforts  made  by 
Directorate-General ENER and MOVE/ENER SRD (Shared Resource Directorate) to secure 
the  IT  infrastructure  and  related  information  supporting  nuclear  accountancy  and  inspection 
processes in Directorate-General ENER. In particular: 

The  physical  controls  in  place  to  prevent  unauthorised  access  to  premises  and  the 

a) 
logical access controls to prevent unauthorised connection to the secure network. 

The  professionalism  and  commitment  of  staff,  with  experience  corresponding  to  the 

b) 
activities performed and exercised under a strong service management culture. 

Major audit findings 

The Internal Audit Service identified two very important issues: 

IT Security Governance 

The IT Steering Committee  (ITSC)  for the Luxembourg  IT operations has  not  met since its 
setup  in  January  2015.  The  current  security  classification  for  Directorate-General  ENER.E 
information  systems  is  based  on  an  assessment  performed  in  2001,  which  has  not  been 
updated  since  then.  Directorate-General  ENER  has  not  yet  accredited  its  IT  systems  for 
storing  and  processing  EURA  RESTRICTED  data  under  the  Commission's  regulatory 
framework  for  handling  EU  classified  information.  In  addition,  certain  organisational 
weaknesses  were  identified  in  relation  to  the  role  of  the  Local  Informatics  Security  officer 

108 

 
 
(LISO),  a  function  which  has  not  been  operational  in  practice  since  December  2015  and 
finally, the Directorate-General does not currently have a security plan for the IT systems. 

IT security risk analysis and security arrangements 

There is no documented analytical basis for the current choice of security measures in place, 
justifying the absence of certain practices such as data encryption for databases and internal 
network traffic. The auditors also found that some internal servers are running a software no 
longer  supported  by  the  supplier,  some  severs  had  limited  protection  against  malicious 
software and that there is a lack of periodic vulnerability testing. 

Recommendations 

IT Security Governance 

Directorate-General  ENER  should  ensure  that  an  IT  governance  body  properly  evaluates, 
directs and oversees effectiveness and efficiency of IT security related activities for the secure 
network. It should define and implement a structured process for assessing IT security threats 
and  vulnerabilities,  their  likelihood  and  potential  impact  on  business.  The  result  of  such 
assessment should guide the definition and implementation of IT security plans. Additionally, 
Directorate-General  ENER  should  analyse  current  EURATOM  and  Commission  regulatory 
frameworks and evaluate how to comply with the obligation to undergo accreditation for IT 
systems handling classified information. 

IT security risk analysis and security arrangements 

Directorate-General ENER should strengthen its controls over the secure network and remote 
connections, notably by assessing the need to encrypt information stored or processed within 
its local secure network, upgrading or  replacing servers running operating system no longer 
supported  by  the  supplier  and  performing  regular  penetration  testing  and  vulnerability 
assessment of its most sensitive infrastructure. 

Additional  information  provided  by  Directorate-General  ENER  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

An action  plan was prepared to  address  the weaknesses  by the end of  December  2018. The 
actions aim at ensuring that an IT governance body properly evaluates, directs and oversees 
effectiveness  and  efficiency  of  IT  security  related  activities  for  the  secure  network  and 
strengthening  Directorate-General  ENER  controls  over  the  secure  network  and  remote 
connections. 

recommendation  on  change  management 

infrastructure  management  was 
One 
implemented.  The  key  actions  were  related  to  the  registration,  monitoring  and  approval 
processes  applicable  to  infrastructure  changes.  The  recommendation  was  closed  by  the 
Internal  Audit  Service  in  June  2018.  One  recommendation  on  user  access  management  is 
reported  as  implemented.  The  key  actions  were  related  to  automated  detection  of  software 
level  conflicts  of  roles  and  a  procedure 
to  verify  profiles  and  delegations.  The 
recommendation is under Internal Audit Service review since June 2018. 

in 

109 

 
 
 
 
Three recommendations on Security governance, Business Continuity and Disaster Recovery 
are  due  in  2018.  The  main  actions  undertaken  are  an  update  of  the  mission  statement  and 
charter of the IT Security Committee, the introduction of a structured process for the analysis 
of IT security risks, an IT security risk assessment as well as subsequent system upgrades and 
the development of specific business continuity and disaster recovery requirements. 

9.4. Audit  on  IT  programme  and  project  management  in  the  HR  family  (DIGIT,  HR, 
EPSO, PMO) 

Audit objectives and scope 

The objective of the audit was to assess the adequacy of the design and the effectiveness and 
the  efficiency  of  the  governance,  management  and  control  systems  put  in  place  by  the  HR 
family  (Directorate-General  HR,  PMO  and  EPSO)  and  DIGIT  to  manage  IT  related  or 
enabled programmes and projects. 

The audit focused on: 

  The  alignment,  coordination  and  collaboration  in  managing  common  programmes  and 

projects by selected HR family members; 

  The  programme  and  project  management  practices  of  individual,  selected  HR  family 

members; 

  DIGIT's  role  and  practices  in  providing  support  to  the  needs  and  requirements  of  HR 

family's programme and project management. 

The scope of the audit included a review of:  

  Data,  information  and  technology  related  governance  structures,  decision-making 

 

 

processes, roles, responsibilities and accountabilities; 
IT  programme  and  project  related  governance  structures,  decision-making  processes, 
roles, responsibilities and accountabilities; 
IT  programme  management  related  principles,  policies,  processes,  procedures  and 
capabilities; 
 
IT project management related principles, policies, processes, procedures and capabilities; 
  The  IT  tools/systems  used  to  support/automate  the  related  governance  and  management 

processes. 

There  were  no  observations/reservations  in  the  2016  Annual  Activity  Reports  of  the 
Directorates-General analysed that relate to the area/process audited. 

The fieldwork was finalised on 2 October 2017. All observations and recommendations relate 
to the situation as of that date. 

Strengths 

The Internal Audit Service survey clearly identified that "customer-oriented service culture" is 
the main business priority for all the members of the HR family included in the scope of the 

110 

 
 
 
audit  and  which,  together  with  DIGIT,  have  significant  collective  experience  in  serving  an 
extended, diverse and demanding customer base. 

In  addition,  during  both  the  preliminary  and  the  fieldwork  phases,  Internal  Audit  Service 
became aware of the commitment of the Directorates-General to address the challenges in this 
domain though a range of initiatives as follows:  

a) 
The  HR  family  members  have  assessed  the  IT  service  provided  by  DIGIT  and 
communicated  the  results  to  DIGIT.  Furthermore,  they  also  performed  IT  related  customer 
satisfaction surveys. 

The HR family members have discussed with DIGIT the possibilities of revising the 
b) 
existing IT governance models, service agreements and reporting arrangements, with a  view 
to  further  improve  coordination  and  alignment  through  more  transparent  communication, 
identification of synergies and efficiencies, while at the same time ensuring IT service quality.  

c) 
DIGIT's  Directorate  B  in  cooperation  with  the  members  of  the  HR  family  has 
developed a monthly IT portfolio dashboard aiming at gradually covering its entire customer 
base.  It  is  also  working  on  its  new  "service  delivery  model"  focusing  on  "end  to  end"  IT 
service delivery and which aims to gradually cover its entire customer base. 

d) 
The  HR  family  members  have  started  to  adopt  agile  software  development 
methodologies. Furthermore, they have trained part of their staff in the Commission's project 
management methodology (PM2). 

e) 
The  HR  family  members  and  DIGIT  have  started  to  share  and  assess  relevant  best 
practices.  They  have  also  started  to  evaluate  possibilities  for  automating  selected  project 
management related tasks though the use of already available Commission tools. 

f) 
EPSO  in  close  cooperation  with  DIGIT  is  finalising  its  programme  management 
framework  according  to  international  best  practices  (e.g.  vision,  blueprints,  roadmaps, 
benefits realisation plans). 

In addition, as domain leaders  and permanent members of the IT Board and of the Corporate 
Management Board, Directorate-General HR and DIGIT work with the services involved to 
set benchmarks and provide steer on best practices to other Directorates-General and services. 

Major audit findings 

The Internal Audit Service identified two very important issues: 

Information and related technologies (IT) governance 

Despite  the  fact  that  the  HRMIS  Steering  Committee  has  a  key  role  in  aligning  and 
coordinating  the  members  of  the  HR  family  and  identifying  and  exploiting  synergies  and 
efficiencies, it has not convened  since  February 2015. Neither has there been any update of 
the  HRMIS  strategy.  Moreover,  the  various  existing  governance  bodies  currently  focus 
mainly  on  IT  investment  decisions  and  on  monitoring  the  status  of  IT  projects  rather  than 
actually assessing IT performance and/or whether those investments have yielded the benefits 
envisaged.  In  addition,  there  is  no  IT  service  governance  framework  in  place  that  aims  to 
ensure  consistency  across  the  HR  family  and  DIGIT  in  terms  of  the  management  of  IT 
services  levels  and  the  evaluation  of  customers  (business)  and  end-user  satisfaction.  This 

111 

 
 
relates to both IT services provided by the members of the HR family to other Commission 
Directorates-General/Services,  EU  Institutions  or  EU  Agencies  and  to  the  IT  services 
provided  by  DIGIT  to  the  members  of  the  HR  family.  Finally,  there  is  no  data  governance 
framework in place aimed at ensuring consistency across the HR family and DIGIT in terms 
of  decision  rights,  roles  and  responsibilities  around  data  assets.  Moreover,  there  is  no  data 
management strategy at the level of either the individual members or the HR family.  

IT project management 

There are no guidelines in place to differentiate between the management of IT projects and 
operational  IT  services  and  to  ensure  that  a  balanced  approach  is  consistently  followed.  In 
addition, there are no defined criteria and guidelines which specify the level of documentation 
needed  to  ensure  that  system  changes  are  well-managed  and  that  knowledge  is  effectively 
shared  and  business  continuity  maintained.  Although  the  quality  of  an  IT  project's 
deliverables is one of the key factors of its success, which directly affects the quality of the 
associated IT services provided, currently the quality management of software deliverables is 
not  sufficiently  defined,  monitored,  reported  and  evaluated.  More  specifically,  there  are  no 
key performance indicators (KPIs)  and corresponding quality reports focusing on functional 
and  structural  software  quality  aspects.  In  addition,  there  are  no  quality  related  KPIs  and 
corresponding  reports  regarding  the  quality  of  the  software  development  process.  Finally, 
even  though  there  is  a  range  of  different  tools  available, the  project  management  process is 
not sufficiently automated in a consistent way across the HR family to cover the lifecycle of 
an IT project. 

Recommendations 

Information and related technologies (IT) governance 

Members  of  the  HR  family  should  strengthen  the  existing  IT  governance  arrangements,  for 
example  through  revising  the  mandate  of  the  HRMIS  Steering  Committee,  to  ensure  more 
effective  strategic  alignment  both  within  the  HR  family  and  with  DIGIT  and  to  provide  a 
better  steer  on  key  aspects  such  as  IT  performance  and  stakeholder  satisfaction,  potential 
synergies  and  risk  mitigation.  In  addition,  the  Internal  Audit  Service  recommended 
developing governance frameworks for both data governance and IT service governance, with 
a  particular  focus  on  the  areas  where  there  is  either  co-ownership  of  data  assets,  IT  service 
dependencies or other common interests. In this context, the existing skills and competencies 
in the relevant domains should be assessed, possible gaps (in both business and IT) identified 
and appropriate action taken (e.g. through awareness or training courses). 

IT project management 

Members  of  the  HR  family  should  develop  and  adopt  working  definitions  of  project  and 
service  modes,  together  with  appropriately  tailored  criteria  and  corresponding  guidance  on 
how to manage the different types/categories of projects or service changes. In addition, the 
members  of  the  HR  family  should  develop  solution  guidance  in  order  to  manage  more 
effectively  the  technical  debt  (it  relates,  inter  alia,  to  decisions/compromises  made  in 
response to business constraints or pressing priorities in the short run, which may materialise 
as  a  cost  at  some  point  in  the  future),  and  to  ensure  that  project  deliverables  meet 
stakeholders'  expectations  as  regards  performance  and  value  for  money.  They  should  also 
evaluate options for automating project management activities as well as internal and external 
stakeholder  information/reporting  needs  in  a  consistent  way  across  the  HR  family.  Finally, 

112 

 
 
they should assess training/awareness raising needs and develop plans accordingly to ensure 
that staff from both business and IT has the necessary skills and competencies in IT project 
management. 

Additional  information  provided  by  the  HR  family  (DIGIT,  HR,  EPSO,  PMO)  on  the 
measures defined and/or implemented following the Internal Audit Service audit 

Concerning  Directorate-General  DIGIT,  the  two  very  important  recommendations,  which 
relate  to  IT  governance  and  IT  project  management,  as  well  as  a  third  important 
recommendation on IT programme management were fully accepted and an action plan was 
submitted to the Internal Audit Service by HR in association with Directorate-General DIGIT 
and  considered  as  satisfactory  by  the  Internal  Audit  Service  in  February  2018.  Its 
implementation is foreseen end 2018 and in 2019. 

Regarding the 2nd recommendation – IT project management for which DIGIT is responsible, 
the following actions are foreseen:  

  To define project and service modes, together with common tailoring criteria (related e.g. 

to benefits, priorities/deadlines, cost, duration…) and to elaborate guidance  

  To  define  software  quality  together  with  metrics/KPIs  to  be  reported  and  to  elaborate 

guidance including raising awareness with different stakeholders on technical debt 

  To  automate  project  management  and  internal  and  external  stakeholders'  related 

information/ reporting 

  Use  of  existing  tools/platforms  (Confluence,  JIRA,  Folio,  MS  Excel,  MS  SharePoint, 
GovIS)  will  be  further  optimised  (also  thanks  to  harmonizing  common  glossary);  e.g. 
CITNet and TEMPO integration, enhanced reporting using FOLIO and detailed reporting 
on service provisioning will be aspects to be looked at. If needed, solutions on other tools 
/ platforms will be made. 

  To ensure necessary skills and competencies are at place through the following actions: 

- To identify all jobs (per relevant entity both on the IT and business side) for which IT 
project  management  is  or  should  be  a  key  qualification.•  To  update,  if  necessary,  the 
concerned job descriptions. 
- To assess whether the skills and competencies of the job holder match the qualifications 
of the job and, if needed, to implement relevant training. 

Concerning  Directorate-General  HR, 
the 
recommendations have been adopted and validated by the Internal Audit Service. All actions 
are set to be achieved by the deadlines defined in the action plan.  

the  necessary 

implement 

actions 

to 

Concerning  EPSO,  in  order  to  help  tackle  IT  governance  weaknesses  (as  identified  by  the 
Internal  Audit  Service  audit  on  the  management  of  IT  programmes  and  projects  in  the  HR 
family at the end of 2017), preparation for an external study was initiated at the end of 2017 to 
enable EPSO to assess the best possible way forward with finalising the development of the 
Candidate  Portal  and  Talent  Pool  internally  (with  DIGIT)  or  outside  (buy-in),  or  a 
combination of both. 

113 

 
 
 
 
 
 
Concerning  PMO,  in  the  framework  of  the  HR  family's  development  of  IT  systems,  a  new 
governance between DIGIT and PMO has been established (several meetings at Director and 
HoU level between DIGIT and the HR family have  taken place since June  2017). After  the 
Internal  Audit  Service  audit  on  this  subject,  an  action  plan  is  currently  being  implemented 
between  the  different  departments  under  the  leadership  of  Directorate-General  HR  (HR, 
DIGIT, PMO ...). It also includes the implementation of an SLA / MoU. 

9.5. Audit on IT logical security controls in OLAF 

Audit objectives and scope 

The objective of the audit was to assess the adequacy of the design and the effectiveness of 
the implementation of the management and control systems put in place by OLAF for its IT 
logical  security  arrangements.  This  includes  (normal  and  privileged)  user  identification  and 
password access, authenticating, access rights and authority levels, as well as infrastructure, 
network and end-points security. These measures are intended to ensure that only authorised 
users are able to perform actions in the IT systems or access information. The aim of the audit 
was  to  identify  weaknesses,  if  any,  in  OLAF's  IT  processes,  procedures  and  controls  for 
protecting its sensitive information and the related IT systems. 

The audit focused on the following aspects: 

  Roles and responsibilities as well as policies, standards, procedures and other controls of 

the information security process; 

  The awareness of IT security by OLAF staff; 
  The process, including the controls, used to identify and classify information / systems; 
  The  process,  including  the  controls,  used  to  administer  the  access  right  for  normal  and 

privileged / administrative accounts; 

  The  process,  including  the  controls,  to  define,  implement  and  operate  the  OLAF  IT 

systems and networks in a secured manner; 

  The process, including the technical controls, to ensure availability of data.  

The  Internal  Audit  Service  examined  a  sample  of  IT  systems  that,  should  any  security 
weaknesses  exist,  could  have  very  serious  legal  and/or  reputational  implications.  This 
included the following systems: 

  The OLAF Content Management (OCM) system which was brought into production mid-

September 2016; 

  The Core Business Information System (CBIS) (now renamed Identity and Authentication 
Management  System  (IAMS)  which  is  a  secure  IT  infrastructure  protected  by  a  kind  of 
gateway; 

  The  Investigative  Data  Consultation  Platform  (IDCP)  which  stores  and  shares  data 

between OLAF and the World Bank related to investigations; 

  Central parts of AFIS (Anti-Fraud Information System). 
  AFIS had been audited previously by the Internal Audit Service, including an assessment 
of  the  account  management  of  Member  States'  users.  Hence,  the  Internal  Audit  Service 
focused only on the central parts (databases and servers) of this system.  

114 

 
 
 
There were no observations/reservations in OLAF's 2015 Annual Activity Report that relate 
to the area/process audited. 

The  fieldwork  was  finalised  on  21  December  2016.  However,  prior  to  finalising  the 
fieldwork,  the  Internal  Audit  Service  identified  a  number  of  issues  of  particular  importance 
concerning  the  OCM  system  which,  in  view  of  their  seriousness  and  urgent  nature,  were 
brought  to  the  attention  of  OLAF's  Management  in  a  meeting  at  Director  level  on  30 
November  2016  and  in  a  note  to  the  Director-General  of  OLAF  (Ares(2016)6943435  - 
13/12/2016). 

Strengths 

The  Internal  Audit  Service  recognised  the  ongoing  efforts  made  by  OLAF  to  manage  the 
OLAF IT systems.  

AFIS is well documented. The auditors recognise that the documentation of the AFIS 

a) 
domain is well structured and was up-to-date. 

Logical  controls  for  AFIS  central  components  (servers  and  databases)  were  in  place 

b) 
and effective. 

Knowledgeable staff in IT operations. OLAF staff working in IT operations are very 

c) 
knowledgeable and experienced. 

d) 

OLAF unit C.5 is aiming to gain certification based on ISO20000 in 2017. 

Major audit findings 

The Internal Audit Service identified four very important issues: 

Excessive access rights granted to a number of OCM user accounts 

OLAF  did  not  implement  a  user  access  policy  for  the  OCM  application  to  document  and 
justify the access privileges granted to the users. In particular, OLAF granted excessive access 
rights  to  a  number  of  OCM  user  accounts.  Moreover,  developers  of  an  external  contractor 
intervened manually on the production systems to remedy blocking incidents on a daily basis. 
Although  OLAF  took  technical  and  organisational  measures  to  mitigate  the  risks  associated 
with these interventions, it did not proactively check the log files for potential anomalies.  

Gaps in key OCM documentation and logging controls 

The OCM IT security plan was never officially endorsed and kept up-to-date. When the OCM 
system  was  brought  into  production,  OLAF  did  not  assess  if  the  IT  security  measures  were 
implemented  effectively.  Moreover,  OLAF  did  not  define  and  endorse  a  logging  policy, 
assign roles and responsibilities for logging and determine the log retention time. 

Conflict of interest for LISO and deputy LISO 

The LISO and  Deputy LISO were  both  located in  OLAF's Directorate C which at the same 
time  was  responsible  for  IT  activities.  Moreover,  the  deputy  LISO  was  at  the  same  time 
System Security Officer of OCM and OCM project manager which represents a clear conflict 
of interest. The LISO and the Deputy LISO did  not  coordinate their  work effectively on IT 

115 

 
 
security  of  the  OCM  project.  In  addition,  neither  the  LISO  nor  the  deputy  LISO  formally 
informed the Director-General about the security situation of the OCM project. 

Overall IT security roles not properly assigned and procedures not fully compliant with the 
implementing rules of the Commission Decision on information security 

While acknowledging the existence of two specific IT security policies endorsed at operation 
level, the Internal Audit Service noted the absence of an overarching policy endorsed at the 
level  of  senior  management,  which  would  clearly  demonstrate  the  importance  it  attaches  to 
having a strong focus on IT security. IT security plans were either not officially endorsed or 
missing  for  some  applications.  Moreover,  OLAF  did  not  keep  the  inventory  of  IT  systems 
updated  and  responsibilities  of  system  owners  were  not  always  properly  assigned.  Finally, 
OLAF  did  not  provide  the  necessary  IT  security  awareness  training  which  contributed  to 
system owners not being sufficiently aware of their responsibilities. 

Recommendations 

Excessive access rights granted to a number of OCM user accounts 

OLAF  should  reduce  the  number  of  users  with  high  privileges,  lay  down  OCM  user  access 
rights  in  a  user  access  policy  and  officially  endorse  it.  Moreover,  OLAF  should  ensure  that 
any intervention conducted by developers can be clearly identified in the log files. 

Gaps in key OCM documentation and logging controls 

OLAF  should  update  and  officially  endorse  the  OCM  IT  security  plan.  The  OCM  system 
owner  should  ensure  that  the  necessary  IT  security  measures  are  implemented  and  properly 
documented. Moreover, OLAF should endorse a formal logging policy in which all logging 
arrangements are laid down.  

Conflict of interest for LISO and deputy LISO 

OLAF  should  assign  the  roles  of  both  the  LISO  and  Deputy  LISO  so  that  they  are  located 
outside Directorate C. OLAF should ensure that the LISO monitors the implementation of the 
IT security plans more closely and regularly reports the results to the Director-General.  

Overall  IT  security  roles  not  clearly  assigned  and  procedures  not  fully  compliant  with 
implementing rules of the Commission Decision on information security 

OLAF should re-inforce its overall IT security management system through clear ownership 
and commitment, by implementing a general information security policy that is endorsed by 
Senior Management. It should clearly assign key roles and responsibilities and strengthen IT 
security awareness across the Directorate-General. 

Additional  information  provided  by  the  OLAF  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

It should be noted that OLAF is implementing an action plan to tackle the recommendations 
received.  An  access  control  policy  for  OCM  and  its  underlying  IT  infrastructure  have  been 
approved  by  the  Director-General  and  operational  procedures  to  implement  it  are  gradually 
put in place. The number of OCM users with privileged access rights has been reduced and is 
well controlled and monitored.  

116 

 
 
An  OCM  security  plan  has  been  approved  and  its  implementation  is  on-going,  whereas  a 
logging policy is in draft and will be approved shortly. The functions of the LISO and deputy 
LISO  have  been  moved  outside  Directory  C  and  they  now  report  directly  to  the  Director-
General. An overarching OLAF IT Security Policy is in draft and will be shortly approved by 
the Director-General.  

9.6. Audit on supervision of outsourced IT operations in Directorate-General TAXUD 

Audit objectives and scope 

The objective of the audit was to assess the efficiency and effectiveness of the measures put in 
place by Directorate-General TAXUD to exercise due control on its outsourced IT operations. 
To achieve this objective, the audit focused on identifying whether: 

  Business requirements are properly defined and translated into IT operations services; 
  Outsourcing  contracts  include  provisions  to  ensure  effective and  efficient  delivery  of  IT 

operations and management services; 

  A system is in place to monitor, evaluate and assess the effectiveness and efficiency of the 

outsourced IT services;  

  Expedient  actions  are  planned  for  possible  hand-over  of  IT  operations,  in  the  case  of 

change in service provider. 

The  audit  addressed  the  adequacy  of  controls  designed  by  Directorate-General  TAXUD  to 
manage the risks relating to outsourcing arrangements for the management of its IT operations 
for  connectivity  services,  IT  service  management  services  (data  centre  IT  operations  & 
continuous service) and quality services. 

Therefore,  the  scope  covered,  on  the  one  hand,  the  definition  of  business  requirements  and 
their  translation  in  IT  operations  terms,  and  on  the  other  hand,  the  processes  Directorate-
General TAXUD put in place to ensure proper supervision, monitoring and measurement of 
external provider performance. The assessment of the actual work performed by contractors 
was out of scope. 

There  were  no  observations/reservations  in  Directorate-General  TAXUD's  2016  Annual 
Activity Report that relate to the area/process audited. 

The fieldwork was finalised on 3 March 2017. All observations and recommendations relate 
to the situation as of that date. 

117 

 
 
 
 
 
 
Strengths 

The  Internal  Audit  Service  recognised  the  ongoing  efforts  made  by  Directorate-General 
TAXUD to: 

a) 
Define and implement a model for outsourcing IT services and operations based on the 
achievement of measurable outcome (output-based model of outsourcing) rather than resource 
consumption (input-based model) whenever possible. 

b) 
Define and maintain its own methodology, called TEMPO, to which contractors have 
to  comply  in  the  execution  of  their  IT  activities.  This  ensures  the  consistent  and  efficient 
management, set-up, development, operation and support of IT projects and services. 

Exercise strong governance on aligning IT operations, projects and resources with its 

c) 
work programme, through the IT Steering Committee. 

Setup  a  process  which  drives  all  activities  of  contractors  related  to  continuous 

d) 
improvement of services under a structured programme. 

Major audit findings 

The Internal Audit Service did not identify any critical or very important issues. 

118 

 
 
 
 
 
PART 2: FOLLOW-UP ENGAGEMENTS (SUMMARISED) 

1. 

Follow-up audit on the management of intra-muros contractors 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Directorate-General  COMM  -  Recommendation  N°  2  (Very  Important):  value  for  money  in 
Time&Means contracts 

Directorate-General  HR  -  Recommendation  N°  3  (Important):  physical  security  and  intra 
muros contractors 

2. 

Follow-up audit on the new Better Regulation (BR) agenda in the Commission 

Secretariat-General 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
Secretariat-General  had made  good progress towards  implementing  the recommendations as 
all (intermediate) milestones of the action plan had been met at the time of this engagement. 
Specifically; 

Recommendation  N°  1  (Very  Important):  state  of  play  of  the  main  Better  Regulation 
components  

In view of the progress made and the on-going actions, the Internal Audit Service considered 
that the recommendation could be downgraded from Very Important to Important. 

Recommendation N° 2 (Very Important): fostering the BR culture 

Based on the actions taken, the recommendation has been closed. However, the Internal Audit 
Service emphasised the importance of the BR collaborative workspace as an ongoing process 
which still needs to be finalised to ensure that it is comprehensive. Whilst a lot of material has 
already  been  stored  there,  this  should  eventually  contain  relevant  information  and  good 
practices for every phase of the BR process. 

Recommendation N° 3 (Important): exemption process 

Based on the actions taken, the recommendation has been closed. Nevertheless, the  Internal 
Audit  Service  suggested  that  the  Secretariat-General  screens  these  lists  regularly  to  identify 
patterns and take remedial actions as necessary. 

Recommendation N° 4 (Important): measurement, monitoring and reporting 

In line with the original action plan, an evaluation of the BR package is planned for 2019. 

119 

 
 
 
Other Directorates-General/Services 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Directorate-General GROW - Recommendation N° 2 (Important): fostering the BR culture 

Directorate-General EMPL - Recommendation N° 3 (Important): exemption process 

Directorate-General ENV - Recommendation N° 2 (Important): fostering the BR culture 

During our work, we noted that that some information on the intranet had not been updated 
following a recent re-organisation. The Internal Audit Service underlined that it is important 
to continuously update the intranet. 

Directorate-General ENV - Recommendation N° 3 (Important): exemption process  

RSB - Recommendation N° 1B (Very Important): state of play of the main BR components 

Follow-up audit on effectiveness of the management of absenteeism in the Offices 

3. 
(OIB, OIL and Directorate-General HR) 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

OIB - Recommendation N° 2 (Important): sickness absence management by line managers 

OIL - Recommendation N° 2 (Important): sickness absence management by line managers 

OIL - Recommendation N° 3 (Important): preventive measures for sickness absences without 
medical certificate 

Directorate-General  HR  -  Recommendation  N°  3  (Important):  corporate  guidelines  on 
sickness absence management 

Directorate-General  HR  -  Recommendation  N°  4  (Very  Important):  verification  of  sickness 
absences by the Medical Service 

Directorate-General  HR  -  Recommendation  N°  5  (Important):  communication  on  new  IT 
functionalities for the management of sickness absences 

Directorate-General HR - Recommendation N° 6 (Important): calculation of sickness absence 
rate 

120 

 
 
Follow-up  audit  on  early  implementation  of  the  ESIF  control  strategy  in 

4. 
Directorates-General REGIO, EMPL and MARE 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Directorate-General REGIO, EMPL, MARE - Recommendation No 1 (Very Important): design 
of the ESIF control strategy 2014-2020 - assurance aspects  

Directorate-General  REGIO,  EMPL,  MARE  -  Recommendation  N°  2  (Very  Important): 
design of the ESIF Control strategy 2014-2020 - Directorates-General audit plans 

Directorate-General  MARE  -  Recommendation  No  3  (Very  Important):  design  of  the  ESIF 
control strategy 2014-2020 – Directorate-General MARE ad-hoc control approach 

Directorate-General  EMPL  -  Recommendation  N°  6  (Very  Important):  reimbursement  of 
additional pre-financing for Youth Employment Initiative 

5. 

Follow-up audit on information security governance in the Commission 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Very Important): information security governance structure 

Recommendation N° 3 (Very Important): reference framework for information security 

Recommendation N° 4 (Very Important): information security programme 

For  Recommendation  N°  2  (Very  Important):  information  security  risk  treatment,  note 
Ares(2018)93394  of  8  January  2018  stated  that  the  initial  action  plan  could  not  be 
implemented  by  31  December  2017  as  expected.  Nevertheless,  the  Internal  Audit  Service 
reviewed  its  status  of  implementation.  The  Internal  Audit  Service  welcomed  the  good 
progress made to date in implementing recommendation N° 2. However, given that not all the 
risks  identified  had  not  been  mitigated,  it  considered  that  it  was  appropriate  to  keep  this 
recommendation open without downgrading its rating. 

Follow-up audit on the Participant Guarantee Fund for FP7 and Horizon 2020 in 

6. 
Directorate-General RTD, Directorate-General ECFIN and ERCEA 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Directorate-General  RTD  -  Recommendation  N°  1  (Important):  monitoring  the  effectiveness 
of the Participant Guarantee Fund set up 

121 

 
 
Directorate-General ECFIN - Recommendation N° 2 (Important): Regular assessment of the 
PGF benchmark 

Follow-up audit on Directorate-General AGRI's management and control system 

7. 
for Voluntary Coupled Support (VCS) 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Important): assessment of notifications - guidance 

Recommendation  N°  3  (Very  Important):  monitoring  and control  of  the 2015  VCS  financial 
ceilings 

Recommendation N° 4 (Very Important): monitoring of VCS performance 

The recommendation listed below had not been fully and/or adequately implemented and was 
therefore re-opened. 

Recommendation  N°  2  (Very  Important):  follow-up  of  VCS  notification  assessments,  with 
original target date for implementation of 31 March 2017. 

Although  the  Internal  Audit  Service  was  aware  that  additional  efforts  were    on-going  and 
should be completed shortly, Directorate-General AGRI had not yet sufficiently demonstrated 
that  the  risks  of  potential  double-funding  between  VCS  and  rural  development  programme 
measures,  which  have  been  identified  during  the  VCS  assessments,  are  systematically  and 
effectively followed-up on time. Furthermore, Directorate-General AGRI had yet to decide on 
the  lead  unit  to  be  in  charge  of  this  follow-up.  Therefore,  the  Internal  Audit  Service 
considered that the recommendation should remain open, but in light of the progress made in 
key areas, the rating was downgraded to Important. 

Follow-up  audit  on  the  management  of  grants  under  2014-2020  consumer  and 

8. 
health programmes in CHAFEA 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations were not fully implemented and would be re-opened: 

Recommendation N° 1 (Very Important): internal grant management procedures 

The  third  action  (on  the  update,  finalisation  and  consolidation  of  the  procedures  on  grant 
management)  was  assessed  as  not  implemented  as  the  draft  chapters  of  the  Handbook  on 
Procedures did not cover the later steps of the grant management cycle and were still awaiting 
formal approval. The recommendation was therefore re-opened. 

Recommendation N° 2 (Important): evaluation committees for the Consumer Programme 

One  of  the  two  actions  (on  ensuring  that  evaluation  committees  exercise  their  functions  in 
accordance with the rules, in a transparent way, and respecting the roles of their members) 
was  assessed  as  not  implemented  as  the  Handbook  on  Procedures  was  awaiting  formal 

122 

 
 
approval  and  evaluation  reports  had  not  been  signed  by  all  attending  members  of  the 
Evaluation Committee. The recommendation was therefore re-opened. 

Recommendation N° 3 (Important): evaluation process 

One  of  the  two  actions  (on  the  documentation  of  modifications  of  evaluation  results)  was 
partially implemented. The Internal Audit Service could not fully assessed on the basis of the 
evidence  submitted,  whether  changes  of  the  scores  during  the  evaluation  process  had  been 
documented in a transparent way. The recommendation was therefore re-opened. 

Recommendation N° 4 (Important):  guidance and interpretation 

One of the three actions ((on the extension of checks on potential conflicts of interests for self-
employed experts) was assessed as not implemented as the evidence submitted did not allow 
the  Internal  Audit  Service  to  confirm  if  checks  on  potential  conflicts  of  interest  had  been 
extended to other contractual relations with applicants. The recommendation was therefore re-
opened. 

Recommendations N° 5 (Important): double funding and N° 6 (Important): grant agreement  

All actions were assessed as not implemented as the different sub-recommendations had not 
been  taken  up  in  the  financial  control  strategy  or  were  not  fully  covered  by  the  draft 
Handbook on Procedures. Therefore the recommendations were re-opened. 

9. 

Follow-up audit on public procurement in Directorate-General CLIMA 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendation was adequately and effectively implemented and would be closed: 

Recommendation N° 1 (Important): issues in relation to Directorate-General CLIMA control 
environment for public procurement 

The recommendations listed below were not fully implemented and were therefore re-opened. 

Recommendation N° 2 (Very Important): procurement process, with original target date for 
implementation of 30 June 2017 

Directorate-General CLIMA had not fully identified training needs on procurement and had 
not  delivered  training  accordingly.  The  Internal  Audit  Service  understood    that  the 
reorganisation  of  the  financial  function  in  Directorate-General  CLIMA  had  delayed  this 
action, but noted that some progress has already been made, notably by emphasising this point 
in  the  Directors  meeting  and  exploring  possibilities  of  shared  training  sessions  with 
Directorate-General  ENV  to  speed  up  the  process.  Therefore,  the  Internal  Audit  Service 
considered that the recommendation should remain open, but in the light of the progress made 
in key areas, the rating was downgraded to Important.  

Recommendation N° 3 (Important): contract management and payments, original target date 
for implementation of 31 January 2017 

Directorate-General CLIMA had issued a practical handbook on authorisation and validation 
of  expenditure,  but  the  Directorate-General  had  yet  to  perform  a  comprehensive  analysis  of 

123 

 
 
the financial training followed so far and any training that might be needed in the future by 
authorising  officers.  Therefore,  the  Internal  Audit  Service  considered  that  this  part  of  the 
recommendation had not been addressed and that the recommendation should remain open.  

 Follow-up  audit  on  Human  Resources  management  in  Directorate-General 

10. 
CNECT  

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendation was adequately and effectively implemented and would be closed: 

Recommendation  N°  2  (Important):  measures  to  cope  with  changes  and  HR  targets 
(taxations, staff cuts in embedded overheads, Luxembourg agreement). 

Follow-up  audit  on  strategic  planning  and  programming/  activity  based 

11. 
management (SPP/ABM) in JRC 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 2 (Important): work programme, project management and management 
plan 

Recommendation N° 4 (Very Important): objectives, indicators and targets 

12. 

Follow-up audit of the ex-IAC audit on document management in JRC 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation  N°  1  (Important):  JRC-wide  definition  of  the  content  of  the  standard 
scientific Project File 

Recommendation N° 4 (Important): JRC 'dormant' files closure procedure and paper archive 
management procedure 

Recommendation N° 6 (Important): function of an archives service in Ispra  

Follow-up  audit  of  the  ex-IAC  audit  on  on  nuclear  decommissioning  and  waste 

13. 
management programme in JRC 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following  recommendation  had  been  adequately  and  effectively  implemented  and  would  be 
closed: 

Recommendation  N°  3  (Very  Important):  relationship  with  authorities,  licensing  and 
insurance 

124 

 
 
14. 

Follow-up audit of former IAC recommendations in Directorate-General JRC 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Ex-IAC audit on decommissioning – risk and project management at the ISPRA site: 

Recommendation  N°  7  (Very  Important):  full  strategy  for  guaranteeing  a  pool  of  qualified 
Project Leaders 

Recommendation N° 8 (Important): document management requirements 

15. 

Follow-up audit on H2020 grant management in the REA 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Very Important): managing of conflicts of interest 

Recommendation N° 2 (Important): evaluations' lessons learned 

Recommendation N° 4 (Important): IT tools used for the specific evaluations in REA 

 Follow-up audit on H2020 grant management in Directorate-General RTD: from 

16. 
the preparation of the work programme to the signature of the grant agreements 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N  1.b (Important): double funding and plagiarism 

Recommendation N  3 (Important): management of conflicts of interest 

Recommendation N  5.a (Important): grant management preparation 

Recommendation N° 5.b (Important): grant agreement preparation 

The  recommendations  listed  below  had  not  been  fully  implemented  and  were  therefore  re-
opened: 

Recommendation N  1.a (Important): double funding and plagiarism, with original target date 
for implementation: 30/04/2017 

The  Common  Support  Centre  (CSC)  had  developed  guidance  on  the  double  funding  and 
plagiarism checks. However this new process depends on the use of IT tool ARIS, the release 
of which had been postponed from 2017 to the third quarter of 2018 due to the demanding IT 
development schedule. 

125 

 
 
Recommendation  N°  4.a  (Important):  evaluation  procedures  and  lessons  learned,  with 
original target date for implementation: 31/01/2017 

The  CSC  had  implemented  one  of  four  actions  covered  by  this  recommendation,  i.e.  the 
approval  of  the  panel  review  guide,  which  explains  the  key  steps  of  the  process.  The 
remaining  three  actions  were  not  implemented,  as  the  prepared  guidance  documents  were  
being reviewed by the CLSS but had not been finalised. 

17. 

Follow-up audit on the set up of the Common Support Centre (CSC) for H2020 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following  recommendation  had  been  adequately  and  effectively  implemented  and  would  be 
closed: 

Recommendation  N°  2  (Important):  staff  allocation  and  performance  measurement  and 
monitoring 

18. 

Follow-up audit on grant management in Directorate-General JUST  

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 2 (Very Important): contracting phase 

Recommendation N° 3 (Important): annual work programme and calls for proposals 

Follow -up audit on the management of the African Peace Facility in Directorate-

19. 
General DEVCO 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendations N° 6 (Important): payments to troop Contributing Countries 

Recommendation N° 7 (Important): retroactivity - impact on sound financial management 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been partially implemented and would be re-opened: 

Recommendation N° 2 (Very Important): design and effectiveness of the remedial/mitigating 
measures at contract level 

Specific remedial measures had been introduced to mitigate the financial risks related to the 
weaknesses identified in the pillar assessments and the risk of illegal and irregular payments. 
However,  it  was  still  premature  to  conclude  that  they  had  been  effectively  implemented. 
Furthermore, the implementation of the new long-term Technical Assistance was still pending 
and the related contract had not yet been (re)designed. 

126 

 
 
Recommendation N° 3 (Very Important): governance and coordination between Directorate-
General DEVCO- EU delegations – EEAS 

For  some  of  the  actions  in  the  ‘Aide  memoire’  action  plan,  the  work  regarding  monitoring 
was  on-going  and  no  EU  staff  had  been  deployed  to  advise  and  assist  the  African  Union 
Commission  (AUC)  due  to  difficulties  to  free  up  human  resources.  Consequently  the 
recommendation was not considered fully implemented. However, given the actions already 
implemented, it was downgraded to Important. 

Follow-up  audit  of  the  limited  review  of  Directorate-General  NEAR’s  residual 

20. 
error rate (RER) methodology and calculation  

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Very Important): indirect management with Beneficiary Countries  – 
IPA  

Recommendation N° 2 (Very Important): enlargement – direct management 

Recommendation  N°  5  (Important):  presentation  of  the  RER  in  the  Annual  Activity  Report 
(AAR) 

Recommendation  N°  3  (Important):  planning  and  organisation  was  assessed  as  not 
implemented and was re-opened. 

The  Internal  Audit  Service  recommended  that  Directorate-General  NEAR  establishes  and 
follows  a  comprehensive  Directorate-General-level  plan  and  calendar  for  the  calculation  of 
the  RER  and  the  preparation  of  the  Annual  Activity  Report.  The  Internal  Audit  Service 
observed that Directorate-General NEAR issued two notes setting out the time-table and the 
roles  for  the  preparation  of  the  Annual  Activity  Report,  however  they  did  not  include 
sufficient  details  on  the  calculation  of  the  RER.  They  also  set  unrealistic  deadlines  which 
were not consistent with the timing of the RER study outsourced to an external contractor. In 
addition,  the  deadline  for  the  delivery  of  the  results  of  the  RER  study  by  the  external 
contractor was set too late resulting in the late availability of data and the late submission of 
the final Annual Activity Report. 

For  its  2017  Annual  Activity  Report,  Directorate-General  NEAR  should  establish  a  more 
realistic  schedule  for  the  provision  of  the  RER  study  specifying  deliverables,  intermediate 
milestones  and  target  dates  for  the  production,  validation  and  proper  reflection  of  the  RER 
results in the Annual Activity Report. Directorate-General NEAR had already taken action in 
this regard by setting the deadline for the delivery of the final 2017 RER study by the external 
contractor to 31 December 2017. 

Recommendation  N°  4  (Important):  ENI  and  thematic  lines  RER  was  assessed  as  partially 
implemented and was re-opened. 

The following parts of the recommendation had not been implemented: 

127 

 
 
Reduction  of  the  heterogeneous  nature  of  the  population  through  stratification  or  split  per 
expenditure category: as from the 2017 RER, Directorate-General NEAR planned to use risk 
indices which would follow Directorate-General DEVCO's approach. 

Improvement of the data quality of the populations used for the RER measurement: although 
both  Directorate-General  NEAR  and  the  external  contractor  had  performed  checks  on  the 
completeness and correctness of the populations, 24 transactions covering 46 intervals had to 
be replaced due to quality issues. 

21. 

Follow-up audit on control strategy in Directorate-General NEAR 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Very Important): assurance building process for Entrustment (IPA)  

Recommendation N° 2 (Important): other building blocks of assurance 

22. 
Follow-up audit on the effectiveness and efficiency of Erasmus+ control strategy 
in the Education, Audio-visual and Culture Executive Agency (EACEA) and in National 
Agencies (Directorate-General EAC)  

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following  recommendation  had  been  adequately  and  effectively  implemented  and  would  be 
closed: 

Recommendation N° 2 (Important): guidelines for NAs 

Follow-up  audit  on  financial  management  and  grant  processes  in  Directorate-

23. 
General ECFIN. 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following  recommendation  had  been  adequately  and  effectively  implemented  and  would  be 
closed: 

Recommendation  N°  2  (Important):  justification  for  negotiated  procedures  without  prior 
publication of a contract notice  

24. 

Follow-up audit on former IAC recommendations in ESTAT 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Ex-IAC audit on ESTAT's business continuity management: 

128 

 
 
Recommendation  N°  4  (Very  Important):  ‘Disaster  Recovery  Planning  and  IT  Business 
Continuity 

Ex-IAC audit on sensitive information: 

Recommendation  N°  3  (Important):  ‘Security  of  sensitive  information  in  the  production 
environment’ 

Ex-IAC audit on Statistical Process III - Agriculture Statistics: 

Recommendation  N°  2  (Important):  ‘FSS  statistical  production  -  collection,  validation, 
processing and dissemination’ 

25. 

Follow-up audit on the procurement process in Directorate-General COMM 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed.  

Recommendation N° 1 (Important): procurement needs analysis – adherence to best practice 

Recommendation  N°  2  (Important):  call  for  tender  documents  for  high  value  procurement 
procedures 

Recommendation  N°  3  (Important):  ex  post  controls  on  procurement  procedures,  was 
assessed as partially implemented and was re-opened. While some elements have been put in 
place,  the  part  linked  to  the  development  and  documentation  of  a  systematic  risk-based 
approach to support the planning of ex post controls had not been implemented. The Internal 
Audit  Service  noted  that  Directorate-General  COMM  was  still  working  on  the  design  of  a 
risk-based  planning  for  the  ex-post  controls,  and  as  a  result  the  planning  for  2017  was  not 
based on a documented risk assessment. 

26. 

Follow-up audit on former IAC recommendations in PMO 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Ex-IAC Audit on contracts related to the management of missions in the PMO: 

Recommendation N° 1 (Very Important): fully automate the CAF process 

Ex-IAC  audit  on  the  effectiveness  and  efficiency  of  the  mission  management  workflow  in 
PMO: 

Recommendation N° 5 (Very Important): MIPS as managerial tool 

129 

 
 
27. 

Follow-up audit on business continuity management in OP 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Very Important): physical security shortcomings in the secondary OP 
data centre 

Recommendation N° 6 (Important): insufficient measures to raise user awareness of business 
continuity 

Recommendation  N°  2  (Very  Important):  business  continuity  arrangements  with  DIGIT  are 
not consistent with OP's recovery time objective (RTO) 

Follow-up  audit  on  management  of  European  Commission  Authentication 

28. 
Service - ECAS 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendation had been partially implemented and was therefore re-opened: 

Recommendation N° 4 (Very Important): security requirements for ECAS 

The Internal Audit Service noted that certain very important security controls included in the 
Security Plan had not yet been satisfactorily implemented in practice. In particular, according 
to  the  implementation  roadmap  for  the  Security  Plan,  the  ECAS  Business  Continuity  Plan 
(BCP) and Disaster Recovery plan (DRP) needed to be updated. Nevertheless, as the current 
BCP  and  DRP  was  based  on  a  Risk  Analysis  (RA)  and  a  Business  Impact  Analysis  (BIA) 
performed  back  in  2014,  the Internal  Audit  Service recommended  that the  RA  and  BIA  are 
revised  initially  to  fully  take  into  consideration  current  business  needs  and,  eventually,  to 
update the BCP and DRP accordingly. 

Taking  into  consideration  the  progress  made  and  the  extent  to  which  the  risks  had  been 
the 
mitigated 
recommendation from Very Important to Important. 

the  Internal  Audit  Service  downgraded 

the  criticality  of 

to  date, 

29. 

Follow-up audit on the management of the security of EU ETS IT system 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following  recommendation  had  been  adequately  and  effectively  implemented  and  would  be 
closed: 

Recommendation N° 6 (Important): security services of ETS 

Recommendation N° 7 (Important): direct access at ETS's DB level 

Recommendation  N°  9  (Important):  relationship  between  Directorate-General  CLIMA  and 
DIGIT 

130 

 
 
Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendation had been partially implemented and would be re-opened: 

Recommendation N° 1 (Very Important): implementation of the ETS's Security Controls 

The Internal Audit Service acknowledges the progress made in defining a Security Plan and 
the  corresponding  implementation  roadmap  for  the  key  security  controls  of  the  ETS. 
However, two sub items of the action plan were still open. Firstly, the actual implementation 
of the key security controls listed in the roadmap had not been launched. The Internal Audit 
Service  therefore  urged  Directorate-General  CLIMA,  in  cooperation  with  DIGIT  as  service 
provider, to ensure the preparation of the migration of the ETS platforms to the new Secured 
Hosting  Services  (SHS)  provided  by  DIGIT.  In  particular,  the  ETS  specific  requirements 
should be assessed against the standard SHS and the gaps identified and solutions agreed by 
end of 2017, as per the plan. This is a necessary prerequisite for the migration to the DIGIT 
secured platforms and the actual implementation of the controls during 2018, as defined in the 
roadmap approved in January 2017. 

As  regards  the  second  sub  item  still  open,  based  on  the  preparation  work  in  2017  for  the 
migration  to  the  secured  platforms  and  the  gaps  identified,  Directorate-General  CLIMA 
should re-assess the significance of the security controls that would still be missing at the end 
of  2018  (because  of  cost  effectiveness  issues,  other  technical  constraints)  together  with  the 
associated services (DIGIT and Directorate-General HR.DS).  

Without the full implementation of these two sub items, the EU ETS system is still vulnerable 
to the high risks identified at the time of the audit. 

Additional  information  provided  by  the  DG  CLIMA  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The Internal Audit Service concluded that only two key sub items of the original action plan 
remained  open.  In  the  meantime,  the  first  one,  the  migration  of  the  Emmission  Trading 
Scheme  platforms  to  the  new  Secured  Hosting  Services  (SHS)  has  been  completed.  The 
second  one,  the  update  of  the  risk  assessment,  will  determine  whether  the  EU  Emmission 
Trading Scheme system is still vulnerable to the high risks identified at the time of the audit. 

30. 

Follow-up audit on management of local IT in Directorate-General COMP 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed. 

Recommendation N° 1 (Very Important): IT financing sources 

Recommendation N° 2 (Very Important): alignment of business and IT strategies 

Recommendation N° 3 (Important): IT governance 

Recommendation N° 4 (Important): management of IT risks 

131 

 
 
 
Recommendation N° 7 (Very Important): the role of the LISO in Directorate-General COMP 

Recommendation N° 8 (Important): management of IT continuity 

Recommendation N° 9 (Important): firewall and network services management 

Recommendation N° 10 (Important): database management 

For Recommendation N° 5 (Very Important): project management and quality assurance the 
Internal Audit Service observed that Directorate-General COMP has  made good progress in 
implementing  the  recommendation.  Therefore  the  rating  of  this  recommendation  will  be 
downgraded to Important. The project on management of support activities still needs to be 
finalised  and  the  key  IT  processes  and  quality  requirements,  together  with  the  criteria  to 
measure them, identified before the recommendation can be considered fully implemented. 

Follow-up audit on management and supervision of contracts for outsourced IT 

31. 
services (IT contract management) in DIGIT  

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Very Important): estimation of needs before establishing a framework 
contract 

Recommendation N° 3 (Very Important): guideline of the choice of the type of outsourcing 

Recommendation N° 4 (Important): knowledge management of contract management 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendation had been partially implemented and would be re-opened: 

For Recommendation N° 2 (Very Important): quality management of services outsourced on a 
time  and  means  basis,  while  some  adequate  measures  had  been  taken  to  improve  the 
performance  measurement  of  external  IT  service  providers,  for  example  through  better  IT 
tools  that  allow  obtaining  more  relevant  statistics,  DIGIT  had  not  translated  new  key 
performance  indicators  into  its  framework  contracts.  A  strategy  paper  had  already  been 
drafted  to  set  out  the  possible  solutions  to  this  issue,  but  the  procedures  for  the  new 
framework  contracts  will  only  be  launched  at  a  later  stage.  Given  that  the  risk  originally 
identified  was  partially  mitigated,  the  rating  of  the  recommendation  was  downgraded  to 
important. 

Follow-up  audit  on  effectiveness  of  measures  to  handle  manual  interventions  in 

32. 
ABAC 

Based  on  the  results  of  our  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the 
following recommendations had been adequately and effectively implemented and would be 
closed: 

Recommendation N° 1 (Very Important): extensive use of the manual intervention procedures 

132 

 
 
Recommendation N° 3 (Important): lack of clear, formalised manual intervention procedures 

The recommendation below has not yet been fully implemented. The original due date was 30 
June 2017 and it has been revised to 31 March 2018. Nevertheless, the Internal Audit Service 
assessed  the  progress  made  in  mitigating  the  related  risks  for  this  recommendation.  This 
recommendation will remain open. 

Recommendation N° 2 (Very Important): too few controls over privileged users, with original 
target date for implementation of 30 June 2017. 

The Internal Audit Service acknowledged the progress made in enhancing the preventive and 
detective  controls  on  privileged  users.  19  sub-items  out  of  24  from  the  original  action  plan 
had been completed and 5 remained open. Specifically, the actual implementation of the key 
security  controls  linked  to  the  SAP  'most  powerful  and  privileged  userids'  had  not  been 
finalised. In addition, the implementation of the log analysis for reviewing privileged activity 
in cooperation with DIGIT was still ongoing. 

The Internal Audit Service downgraded the rating to Important, since 19 out of the planned 24 
actions had been completed and this effectively reduced the related residual risk. In particular, 
a  thorough  analysis  of  existing  high  privileged  userids  had  been  performed,  limiting  their 
number  to  the  minimum  needed  for  operations  and  ensuring  that  preventive  and  detective 
controls  exist  for  their  creation  and  usage.  Procedures  were  updated  and  the  relevant  staff 
briefed  on  them.  Moreover,  existing  manual  interventions  were  being  reviewed  to  identify 
enhancements in ABAC that could reduce the need for manual interventions. 

List  of  follow-up  audits  performed  in  2017  for  which  all  recommendations  have  been 
closed after the follow-up 

Based  on  the  results  of  the  follow-up  audits  performed  in  2017,  the  Internal  Audit  Service 
assessed  that  the  following  audits  listed  below  could  be  fully  closed  as  all  the 
recommendations had been adequately implemented. 

Audit Title 

the  design  of  Directorate-General  AGRI's 

33.  Follow-up  audit  of  the  limited  review  of  the  calculation  and  the 
underlying  methodology  of  Directorate-General  AGRI's  residual  error  rates 
for the 2012 reporting year 
34.  Follow-up  audit  on 
management and control system for greening 
35.  Follow-up  audit  on  the  objective  setting  process  in  Directorate-General 
MARE 
36. Follow-up audit on gap analysis of new legislation / design of 2014-2020 
programming period  European Structural and Investment funds  – phase 2 in 
Directorate-General MARE 
37.  Follow-up  audit  of  management  and  supervision  of  contracts  for  the 
outsourced  IT  Services  (IT  contract  management)  in  Directorate-General 
SANTE 
38. Follow-up audit on Directorate-General EMPL's closure of the 2000-2006 
ESF programming period 
39.  Follow-up  audit  on  the  gap  analysis  phase  II  in  Directorate-General 

133 

 
 
and  

REGIO 
Directorate-General EMPL 
40. Follow-up audit on the monitoring of the action plans for unfulfilled ex-
ante  conditionalities  in  Directorate-General  REGIO  and  Directorate-General 
EMPL 
41.  Follow-up  audit  on  Directorate-General  REGIO's  closure  of  the  2000-
2006 ERDF programming period 
42. Follow-up audit on Directorate-General REGIO's preparations for use of 
Financial Instruments in 2014-2020 
43.  Follow-up  audit  on  closure  of  projects  of  legacy  programmes  in  
Directorate-General CONNECT 
44.  Follow-up  audit  on  preparedness  of  the  management  and  control  system 
for Connecting Europe Facility and Horizon 2020 in INEA 
45. Follow-up audit of procurement management in JRC 
46. Follow-up audit of the ex-IAC audit on security and safety in the JRC 
47  Follow-up  audit  of  the  ex-IAC  audit  on  intellectual  property  rights 
management in JRC 
48. Follow-up audit on the ex-IAC audit on management of expert groups 
49. Follow-up audit on setting of objectives and measurement of performance 
in Directorate-General MOVE 
50.  Follow-up  audit  of  the  limited  review  of  the  calculation  and  the 
underlying methodology of the residual error rate for the 2015 reporting year 
in the REA 
51. Follow-up audit on procurement in Directorate-General RTD 
52.  Follow-up  audit  on  H2020  grant  management  in  ERCEA:  from  the 
evaluation of proposals to the signature of the grant agreements 
53.  Follow-up  audit  of  former  IAC  recommendations  in  Directorate-General 
ECHO  (Legality  and  regularity  of  payments  for  the  year  2012,  Legality  and 
regularity of payments for the year 2013) 
54.  Follow-up  audit  on  financial  management  Humanitarian  Aid 
Directorate-General ECHO 
55. Follow-up audit of the ex-IAC audit on the communication flows between 
DEVCO's HQ and EU Delegations 
56. Follow-up audit of Budget Support in Directorate-General DEVCO 
57.  Follow-up  audit  on  contribution  agreements  with  UN  Bodies  and  other 
international organisations in Directorate-General DEVCO 
58. Follow-up audit on risk management in Directorate-General NEAR 
59. Follow-up audit on preparedness for IPA II in Directorate-General NEAR 
60. Follow-up audit of the ex-IAC audit on special approvals and derogations 
in Directorate-General NEAR 
61.  Follow-up  audit  of  the  ex-IAC  audit  on  country  analysis  in  Directorate-
General EAC 
62.  Follow-up  audit  of  the  ex-IAC  audit  on  document  management  in  
Directorate-General EAC 
63.  Follow-up  audit  on  the  objective  setting  process  in  Directorate-General 
JUST 
64.  Follow-up  audit  of  the  ex-IAC  audit  on  procurement  in  Directorate-
General JUST 

in  

134 

 
 
65.  Follow-up  audit  on  knowledge  management  in  Directorate-General 
COMP 
66.  Follow-up  audit  on  the  preparedness  of  the  management  and  control 
systems for the SME instrument in EASME  
67. Follow-up audit on HR management in response to the financial crisis in 
Directorate-General ECFIN  
68.  Follow-up  audit  of  the  ex-IAC  Audit  on  Directorate-General  ECFIN's 
document management 
69.  Follow-up  audit  on  risk  management  and  planning  processes  in  
Directorate-General ECFIN in the new economic governance context 
70.  Follow-up  audit  on  the  effectiveness  of  HR  management  in  response  to 
the financial crisis in FISMA 
71.  Follow-up  audit  on  financial  management  and  IT  procurement  in  
Directorate-General TAXUD 
72.  Follow-up  audit  of  the  ex-IAC  audit  on  Directorate-General  TAXUD's 
external communication strategy 
73.  Follow-up  audit  on  performance  measurement  system  in  Directorate-
General TAXUD customs activities 
74. Follow-up audit on "Are the European Trade Defence Instruments (TDIs) 
managed  effectively  and  efficiently  to  defend  the  European  Union  against 
trade distortions?" in Directorate-General TRADE 
75.  Follow-up  audit  on  the  procurement  process  in  Directorate-General 
BUDG 
76. Follow-up audit on charge-back process in the Commission (Directorate-
General BUDG) 
77. Follow-up audit on the procurement process in DGT 
78. Follow-up audit on financial management in the EPSC 
79. Follow-up audit on the procurement process in EPSO/EUSA 
80.  Follow-up  audit  of  former  IAC  recommendations  in  Directorate-General 
ESTAT 
81.  Follow-up  audit  of  the  ex-IAC  audit  on  the  management  of  the  income 
process for the childcare facilities in OIB 
82. Follow-up audit of te ex-IAC audit on 'sécurité et santé au travail' in OIL 
83.  Follow-up  audit  on  financial  management  of  procurement  and  grants  in 
OLAF 
84. Follow-up audit on the objective setting process in SG 
85. Follow-up audit on management of local IT in Directorate-General AGRI 
86. Follow-up audit of the ex-IAC audit on policy design and management of 
IT access rights in Directorate-General CONNECT 
87. Follow-up audit of the ex-IAC audit on IT security in Directorate-General 
ECFIN 
88. Follow-up audit on management of local IT in Directorate-General MARE 
89. Follow-up audit on IT governance in Directorate-General BUDG 
90.  Follow-up  audit  on  management  of  local  IT  in  Directorate-General 
TRADE 

135 

 
 
 
PART 3: SUMMARY OF LONG OUTSTANDING RECOMMENDATIONS AS AT 31 JANUARY 2018 

No. 

Directo
rate-
General 

Audit title 

Recommendation 

I 

EMPL 

Internal Audit 
Service Audit on 
Management of 
EESSI project in 
Directorate-General 
EMPL - Execution 
phase 

Gaps in the Project Plan 
update and Limited 
Reporting compared to 
baselines (A480511) 

II 

OLAF 

Internal Audit 
Service audit on IT 
Logical security 
controls in OLAF 

Access rights granted to 
a number of OCM user 
accounts (A482451) 

III 

PMO 

Internal Audit 
Service Audit on 
effectiveness of the 
management of 
absenteeism in the 
Offices (OIB, OIL 
and PMO) 

Monitoring and analysis 
of absences at Office 
level (A457169) 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

The  action  plan  submitted  by  Directorate-General  EMPL  for  this  recommendation 
included  five  tasks,  of  which  three  have  been  reported  as  completed.  The  remaining 
two are related to a) the definition of mode of operation (i.e. roles and responsibilities) 
for the transition period and the first years of solution in full production mode; and b) 
estimation  for  the  teams'  size  and  expected  workload  for  the  operation  phase 
(maintenance,  support,  training  and  infrastructure  including  hosting  and  licences),  as 
well as their associated cost.  

The Internal Audit Service will perform a follow-up of this recommendation when the 
Directorate-General  will  fully  declare  it  'ready  for  review'  (revised  completion  date 
12/04/2018),  together  with  the  other  two  recommendations  issued  in  the  original 
report.  

Expected delay compared to the original due date of nine and a half months. 

This  report  was  discussed  at  the  preparatory  group  meeting  of  the  Audit  Progress 
Committee  of  11  October  2017.  The  representative  of  OLAF  pointed  out  that  the 
"need-to-know"  principle  is  strictly  applied.  In  exceptional  cases,  external  service 
providers  still  need  access  to  the  OCM  system  (OLAF  IT  system  used  for  case 
management  and  document  management)  on  the  production  site.  OLAF  ensures 
security by applying a "four-eyes-principle". However, neither a user access policy nor 
proactive  log  file  checks  were  implemented  at  the  time  of  the  audit  fieldwork.  The 
Internal  Audit  Service  will  perform  a  follow-up  audit  on  this  recommendation  in  the 
first half of 2018 after the implementation of the missing security controls. 

Expected delay compared to the original due date of nine months. 

According  to  PMO,  so  far,  the  Office  has  communicated  to  Directorate-General  HR 
(responsible  for  the  development  of  the  new  statistical  reports  in  this  domain)  the 
specific  factors  of  influence,  specific  to  PMO.  Currently  PMO  is  dependent  on 
Directorate-General HR which is expected to provide them with information and tools 
to enable them to perform the monitoring of absenteeism by the end of 2018. 

The  Internal  Audit  Service  will  monitor  carefully  the  implementation  of  this 
recommendation and may decide to carry out a follow-up early next year provided the 
corresponding recommendation in Directorate-General HR has been assessed as 'ready 
for review'. 

Expected  delay  compared  to  the  original  due  date  of  one  year  and  six 
months. 

8/07/2016 

30/06/2017 

12/04/2018 

5/05/2017 

31/07/2017 

30/04/2018 

6/10/2015 

30/06/2017 

31/12/2018 

136 

 
 
 
No. 

Directo
rate-
General 

Audit title 

Recommendation 

IV 

RTD 

Internal Audit 
Service audit on 
H2020 Project 
Management in RTD 

Determining the level of 
monitoring for projects 
(CSC) (A482390) 

V 

RTD 

Internal Audit 
Service audit on 
H2020 Project 
Management in RTD 

Determining the level of 
monitoring for projects 
(RTD) (A482392) 

VI 

SG 

Internal Audit 
Service audit on 
Information Security 
Governance in the 
Commission 
(HR,DIGIT and SG) 

Information security risk 
treatment (A466262) 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

According to the CSC, the project monitoring strategy has been developed and revised 
by  the  Legal  Services.  However,  the  concept  of  technical  audits  still  needs  to  be 
clarified.  The  revision  of  the  corresponding  guidance  (Vademecum)  will  take  place  in 
the first quarter of 2018. 

A  follow-up  will  take  place  as  soon  as  the  recommendation  is  reported  as  'ready  for 
review' by Directorate-General RTD. 

Expected delay compared to the original due date of nine months. 

At  the  level  of  Directorate-General  RTD,  the  rules  on  missions  and  experts  were 
amended to ensure that they do not hamper the application of the common rules for 
project  monitoring.  The  remaining  actions,  including  a  workshop  with  the  project 
officers, are in progress and will be finalised once the aforementioned guidance will be 
made available. 

A  follow-up  will  take  place  as  soon  as  the  recommendation  is  reported  as  'ready  for 
review' by Directorate-General RTD. 

Expected delay compared to the original due date of eleven months. 

A first follow-up at the end of 2017 revealed that the ISSB adopted a Commission-wide 
IT Security Strategy8 in November 2016, along with related activities to be undertaken. 
However, these activities are planned to be completed by the end of 2018. In parallel, 
DIGIT should deliver in 2018 a common methodology for IT risk management and its 
supporting  tool,  making  system  owners  in  a  position  to  assess  and  report  IT-related 
risks in a consistent manner. 

The  Internal  Audit  Service  will  perform  a  second 
follow-up  audit  on  this 
recommendation  in  the  second  half  of  2018  after  the  implementation  of  the  risk 
assessment methodology. 

Expected  delay  compared  to  the  original  due  date  of  one  year  and  three 
months. 

20/01/2017 

31/07/2017 

30/04/2018 

20/01/2017 

31/07/2017 

30/06/2018 

12/10/2015 

30/06/2017 

30/09/2018 

8 IT Security Strategy for the European Commission – ref. Ares(2016)6693919 – 29/11/2016. 

137 

 
 
 
 
                                                            
No. 

Directo
rate-
General 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

VII 

DEVCO 

Internal Audit 
Service Audit on 
Design and 
Implementation of 
EU Trust Funds 

Performance 
Measurement and 
Management (A469075) 

No. 

Directo
rate-
General 

Audit title 

Recommendation 

VIII 

CLIMA 

Audit on the 
management of the 
security of EU ETS 
IT system 

Implementation of the 
ETS's security controls 
(A411483) 

IX 

DEVCO 

Internal Audit 
Service Audit on 
Design and 
Implementation of 
EU Trust Funds(TF) 

Governance of the TF 
(A469065) 

The  Internal  Audit  Service  audit  report  was  discussed  at  the  84th  Audit  Progress 
Committee round (April 2016). 

According to Directorate-General DEVCO, the implementation of this recommendation 
is dependent on the revision of the EU Trust Funds guidelines and templates. Although 
good  progress  has  been  made  in  revising  the  guidelines  and  templates,  their 
finalisation  is  dependent  on  the  finalisation  and  entry  into  force  of  the  new  Financial 
Regulation  (finalised  in  December  2017).  For  this  reason  Directorate-General  DEVCO 
postponed the target date a second time, from 31/12/2017 to 31/03/2018.  

This recommendation has not yet been followed up by the Internal Audit Service. The 
Internal Audit Service will follow up this recommendation once it is declared 'ready for 
review' by Directorate-General DEVCO. 

Expected delay compared to the original due date of one year. 
Comments 

A second follow-up audit was performed in the first quarter of 2017, which concluded 
that two key sub items of the action plan still remained open.  

The  Internal Audit Service inquired in January 2018 about the progress of the action 
plans  and  Directorate-General  CLIMA  confirmed  the  finalisation  of  the  set-up  of  test 
environments  and  the  delivery  of  the  future  production  environment  through  the 
Secure  Hosting  Services  (SHS)  of  DIGIT.  Directorate-General  CLIMA  still  has  to  fully 
migrate  the  ETS  production  environment  into  SHS  and  perform  a  gap  analysis  to 
assess if additional, non-SHS standard controls should be implemented. 

Expected delay compared to the original due date of two years. 
The  Internal  Audit  Service  audit  report  was  discussed  at  the  84th  Audit  Progress 
Committee round (April 2016). 

The implementation of the recommendation is dependent on the final text of the new 
Financial  Regulation.  The trilogues  for  the  new  Financial  Regulation  were  finalised  in 
December 2017 and included several points related to the EUTF. The outcome of these 
trilogues will thus have an impact on the revised EUTF guidelines and templates and 
therefore the target date for their completion has been postponed a second time, now 
to the first quarter of 2018. 

This recommendation has not yet been followed up by the Internal Audit Service . The 
Internal Audit Service will follow up this recommendation once it is declared 'ready for 
review' by Directorate-General DEVCO.  

Expected  delay  compared  to  the  original  due  date  of  one  year  and  three 
months. 

29/01/2016 

31/03/2017 

31/03/2018 

Final report 
date 

Original 
due date 

Revised 
due date 

29/01/2014 

31/12/2016 

31/12/2018 

29/01/2016 

31/12/2016 

31/03/2018 

138 

 
 
 
No. 

Directo
rate-
General 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

X 

DEVCO 

Internal Audit 
Service Audit on 
Design and 
Implementation of 
EU Trust Funds 

Performance 
measurement and 
management (A469069) 

The  Internal  Audit  Service  audit  report  was  discussed  at  the  84th  Audit  Progress 
Committee round (April 2016). 

According  to  Directorate-General  DEVCO,  the  establishment  of  the  overarching 
performance  frameworks  for  the  TFs  is  dependent  on  the  revision  of  the  EUTF 
Guidelines.  Although  good  progress  has  been  made  in  revising  the  EUTF  guidelines 
and templates, the performance frameworks can only be finalised once the final text of 
the  new  Financial  Regulation  has  been  made  available  (trilogues  completed  in 
December  2017).  For  this  reason  Directorate-General  DEVCO  postponed  the  target 
date for a second time, now to 31/03/2018.  

This recommendation has not yet been followed up by the Internal Audit Service. The 
Internal Audit Service will follow up this recommendation once it is declared 'ready for 
review' by Directorate-General DEVCO.  

Expected  delay  compared  to  the  original  due  date  of  one  year  and  three 
months. 
The  Internal  Audit  Service  audit  report  was  discussed  at  the  84th  Audit  Progress 
Committee round (April and May 2016). 

29/01/2016 

31/12/2016 

31/03/2018 

XI 

DEVCO 

Internal Audit 
Service Audit on 
African Peace 
Facility in African 
Union Commission 

Institutional assessment 
and monitoring by 
Directorate-General 
DEVCO of the 
partnership with the 
AUC (A470932) 

This  recommendation  was  followed  up  by  the  Internal  Audit  Service  in  March  2017. 
The follow-up confirmed that despite steps taken to implement the agreed action plan, 
the underlying risks were not fully mitigated and therefore it remains open in view of 
the actions which still need to be completed. The Internal Audit Service will follow up 
this  recommendation  once  it  is  declared  'ready  for  review'  by  Directorate-General 
DEVCO. 

Expected  delay  compared  to  the  original  due  date  of  one  year  and  three 
months. 

21/01/2016 

31/12/2016 

31/03/2018 

139 

 
 
 
No. 

Directo
rate-
General 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

XII 

PMO 

IAC Audit on PMO 
management of 
accidents' insurance 

Reimbursement of 
accident costs 
(A451667) 

This recommendation was discussed at the 87th Audit Progress Committee round (April 
2017). 

The  implementation  of  the  recommendation  is  dependent  on  the  development  of 
Assmal29  software,  under  development  by  DIGIT.  As  a  consequence,  the  target  date 
for  the  implementation  of  the  recommendation  is  postponed  accordingly.  Meanwhile, 
PMO is using a set of custom-made reports for the accident file’s reporting purposes. 

The  recommendation  was  followed  up  for  the  first  time  in  December  2015.  The 
Internal Audit Service reopened this recommendation as no sufficient information was 
provided to assess whether there has been sufficient progress to adequately mitigate 
the risks.  

The  Internal  Audit  Service  recently  finalised  a  follow-up  of  the  recommendation  and 
concluded that the action plan had not been fully implemented. The recommendation 
is still rated Very Important.  

Expected  delay  compared  to  the  original  due  date  of  five  years  and  three 
months. 

21/02/2012 

31/12/2012 

30/03/2018 

9 Assmal2 aims to modernise the administration of the sickness and accident insurance scheme. 

140