COMMISSION STAFF WORKING DOCUMENT Internal audit engagements finalised by the Internal Audit Service in 2018 Accompanying the document Report from the Commission to the European Parliament, the Council and the Court of Auditors Annual report to the Discharge Authority on internal audits carried out in 2018
Date: 2019-06-25
Institutions: European Commission, Secretariat-General
Subjects: administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 25.6.2019 SWD(2019) 300 final  COMMISSION STAFF WORKING DOCUMENT Internal audit engagements finalised by the Internal Audit Service in 2018 Accompanying the document Report from the Commission to the European Parliament, the Council and the Court of Auditors  Annual report to the Discharge Authority on internal audits carried out in 2018  {COM(2019) 350 final}  
 
 
Table of contents 

CONTENT OF THIS STAFF WORKING DOCUMENT ............................................................................................................................................4 

Section 1 Final reports .....................................................................................................................................................................................................5 

HORIZONTAL AUDITS ...........................................................................................................................................................................................................5 
  Audit on LIFE financial instruments: effectiveness and efficiency of the current framework in DGs 

1.

CLIMA and ENV ...............................................................................................................................................................................................5 

2.

  Limited review on the reporting on the corrective capacity in DGs AGRI, BUDG, DEVCO, EMPL, REGIO, 

RTD and EASME ..............................................................................................................................................................................................6 
  Audit on EC-EEAS coordination in DGs DEVCO and NEAR and FPI .................................................................................7 
  Audit on business continuity in DG COMM (DGs COMM and DIGIT) ...............................................................................9 
  Audit on ‘synergies and efficiencies review’ in DGs BUDG, COMM, DIGIT, HR, JRC, OIB, SCIC and SG . 10 
  Audit on dissemination and exploitation of Horizon 2020 results in  DGs CNECT, RTD and CSC,  REA 

3.
4.
5.
6.

7.

and ERCEA ...................................................................................................................................................................................................... 14 
  Consolidated report on Horizon 2020 project management and ex ante control audits in DGs RTD, DG 
CNECT, REA, ERCEA, INEA and EASME .......................................................................................................................................... 15 

8.

  Audit on Connecting Europe Facility telecom governance in DGs CNECT, DGT, DIGIT, EMPL, GROW, 

JUST and SANTE ........................................................................................................................................................................................ 16 

9.

  Audit on the effectiveness and efficiency of the new Early Detection and Exclusion System in 

10.

protecting the EU financial interests in DGs BUDG, DEVCO, REGIO and RTD ....................................................... 17 
  Audit on Intellectual Property Rights supporting activities in DGs COMM, DIGIT, GROW, JRC and OP 19 
AGRICULTURE, NATURAL RESOURCES AND HEALTH ................................................................................................................................................. 21 
  Limited review of the adjustment of the reported error rate by DG AGRI and the calculation of the 

1.

1.
2.

2.
3.
4.
5.
6.
7.

amounts at risk at payment ............................................................................................................................................................... 21 
  Audit on the implementation of payments and corrections in DG AGRI (shared management) ............. 22 
  Audit on the management of Instrument of Pre-Accession for Rural Development II in DG AGRI ........ 22 
  Audit on the evaluation process in DG AGRI ............................................................................................................................. 22 
  Audit on closure of the 2007-2013 European Fisheries Fund Operational Programmes in DG MARE23 
  Audit on TRACES in DG SANTE........................................................................................................................................................... 23 
  Audit on monitoring and enforcement of EU health law in DG SANTE .................................................................... 25 
COHESION .......................................................................................................................................................................................................................... 26 
  Audit on the evaluation process in DG EMPL and DG REGIO ......................................................................................... 26 
  Review of the annual assurance packages by DGs EMPL, MARE and REGIO....................................................... 26 
RESEARCH, ENERGY AND TRANSPORT .......................................................................................................................................................................... 29 
  Audit on ex ante controls on Horizon 2020 grant payments in DG CNECT .......................................................... 29 
  Audit on legacy programmes in DG ENER - management of final payments and closure ......................... 29 
  Audit on H2020 grant management (phase II) in ERCEA ................................................................................................. 30 
  Audit on grants management phase II: project management and payments for H2020 in INEA.......... 30 
  Audit on nuclear decommissioning and waste management programme implementation in JRC ....... 30 
  Audit on HR management - recruitment of temporary scientific staff in Joint Research Centre ........... 31 
  Audit on REA’s preparedness to deliver SEDIA-related services .................................................................................. 32 
  Audit on H2020 grant management (phase II - project monitoring and ex ante controls) in REA ........ 33 
  Audit on ex ante controls on H2020 grant payments in DG RTD ................................................................................ 33 
EXTERNAL ACTION ............................................................................................................................................................................................................ 35 
  Audit on the Partnership Instrument in FPI ............................................................................................................................... 35 
  Audit on the Neighbourhood Investment Facility and the Western Balkans Investment Framework in 

1.
2.
3.
4.
5.
6.
7.
8.
9.

1.
2.

DG NEAR .......................................................................................................................................................................................................... 35 

3.

  Audit on grant and procurement award process under European Neighbourhood Instrument direct 

management in DG NEAR..................................................................................................................................................................... 37 
  Audit on the assurance building process in headquarters in DG DEVCO................................................................ 38 
EDUCATION AND CITIZENSHIP ....................................................................................................................................................................................... 40 

4.

1.

  Audit on DG EAC’s ex post financial audits, independent audit bodies’ opinions and controls on grant 

proposal evaluation for Erasmus+ actions implemented by national agencies ................................................ 40 

2.

  Audit on Erasmus+ and Creative Europe grant management Phase II (from project monitoring to 

payment) in EACEA ................................................................................................................................................................................... 40 

1 

  
 
 
 
3.

  Audit on monitoring the implementation and performance of 2014-2020 national programmes by 

4.
5.
6.

DG HOME ........................................................................................................................................................................................................ 42 
  Audit on risk management in DG HOME ..................................................................................................................................... 43 
  Audit on risk management in DG JUST ....................................................................................................................................... 44 
  Audit on procurement in DG JUST .................................................................................................................................................. 45 
ECONOMIC AND FINANCIAL AFFAIRS ............................................................................................................................................................................ 47 
  Consulting engagement on document management in DG ECFIN ............................................................................. 47 
  Audit on effectiveness and efficiency of DG FISMA’s performance management system ......................... 47 
  Audit on the adequacy of DG GROW’s preparation and supervision of the parts of the COSME work 

1.
2.
3.

6.
7.

4.
5.

programmes delegated to EASME .................................................................................................................................................. 47 
  Audit on supervision of project management and payment for Galileo in  DG GROW .................................. 48 
  Audit on the supervision of the implementation of the Copernicus Programme in DG GROW - Phase II: 
management of the cooperation and coordination between the different implementing entities ........ 48 
  Audit on DG TAXUD’s preparation of legislative initiatives ............................................................................................. 48 
  Audit on financial management of procurement contracts and grants in  DG TRADE .................................. 49 
GENERAL SERVICES .......................................................................................................................................................................................................... 50 
  Audit on financial management of grants in DG ESTAT ................................................................................................... 50 
  Audit on effectiveness of DG ESTAT’s cooperation with external stakeholders ................................................. 50 
  Consulting engagement on accounting for JSIS direct billing in PMO ..................................................................... 51 
  Audit on control strategy for the Joint Sickness and Insurance Scheme, including accidents insurance 
(design and implementation) in PMO............................................................................................................................................ 51 
INFORMATION TECHNOLOGY AUDITS ........................................................................................................................................................................... 54 
  Audit on information technology project management in DG REGIO ....................................................................... 54 
  Audit on information technology governance at DG DEVCO .......................................................................................... 54 
  Audit on IT security management for Common Support Centre H2020 grant lifecycle systems in DG 

1.
2.
3.
4.

1.
2.
3.

RTD ..................................................................................................................................................................................................................... 56 
Section 2  Follow-up engagements (summarised) .................................................................................................................................... 57 

1.

  Follow-up audit on the management of grants under the 2014-2020 consumer and health 

programmes in CHAFEA ........................................................................................................................................................................ 57 

2.

  Follow-up audit on CHAFEA’s management and control system for the implementation of the 

measures for the promotion of agricultural products ........................................................................................................ 57 

3.

  Follow-up audit on staff allocation and process management in response to staff reduction in DG 

ENV ..................................................................................................................................................................................................................... 58 

4.

  Follow-up audit on early implementation of European Structural and Investment Funds control 

strategy 2014-2020 in DG MARE ................................................................................................................................................... 58 

5.

  Follow-up audit on amendments of 2014-2020 operational programmes in DGs REGIO, EMPL and 

MARE - DG EMPL ........................................................................................................................................................................................ 58 

6.

  Follow-up audit on early implementation of European Structural and Investment Funds control 

strategy 2014-2020 in DG EMPL .................................................................................................................................................... 59 

7.

  Follow-up audit on amendments of 2014-2020 operational programmes in DGs REGIO, EMPL and 

MARE - DG REGIO ...................................................................................................................................................................................... 59 

8.

  Follow-up audit on early implementation of European Structural and Investment Funds control 

9.
10.
11.
12.
13.

14.
15.

16.
17.
18.
19.

strategy 2014-2020 in DG REGIO .................................................................................................................................................. 59 
  Follow-up audit on major projects in DG REGIO .................................................................................................................... 59 
  Follow-up audit on the supervision of ITER in DG ENER ................................................................................................... 60 
  Follow-up audit on the supervision of ITER in DG ENER ................................................................................................... 60 
  Follow-up audit on competitive activities in Joint Research Centre.......................................................................... 60 
  Follow-up audit on the implementation of the FP7 ex post audit strategy by the Common Audit 
Service in DG RTD ...................................................................................................................................................................................... 60 
  Follow-up audit on the H2020 project management in DG RTD................................................................................. 61 
  Follow-up audit on the design and set-up of the internal control systems for Horizon 2020 in DG RTD
  62 
  Follow-up audit on DG DEVCO payment deadlines ............................................................................................................. 62 
  Follow-up audit on the management of the African Peace Facility in DG DEVCO ........................................... 63 
  Follow-up audit on the performance management system in DG DEVCO ........................................................... 63 
  Follow-up audit on procurement under Instrument for Pre-Accession (direct management and 
indirect management with beneficiary countries) – Phase I – in DG NEAR .......................................................... 63 
  Follow-up audit on procurement under Instrument for Pre-Accession (direct management and 
indirect management with beneficiary countries) – Phase II – in DG NEAR ......................................................... 63 
  Follow-up audit on past Internal Audit Service audits in DG HOME .......................................................................... 64 

20.

21.

2 

  
 
 
22.

23.

24.

25.

26.

27.
28.
29.
30.
31.

32.

33.
34.

35.
36.
37.

38.

39.

40.

41.
42.
43.

44.

45.
46.
47.

  Follow-up audit on enforcement of the EU antitrust policy in DG COMP: cooperation with EU national 
competition authorities and national courts............................................................................................................................. 65 
  Follow-up audit on enforcement of the EU antitrust policy in DG COMP: cooperation with EU national 
competition authorities and national courts............................................................................................................................. 65 
  Follow-up audit on past Internal Audit Service audits in DG EAC: performance management systems 
in DG EAC, including the contributions of executive Agencies and national Agencies to the 
achievement of policy objectives .................................................................................................................................................... 66 
  Follow-up audit on Erasmus+ and Creative Europe – grant management phase I (from the call to the 
signature of contracts) in EACEA ..................................................................................................................................................... 66 
  Follow-up audit on Erasmus+ and Creative Europe – grant management phase I (from the call to the 
signature of contracts) in EACEA () ................................................................................................................................................. 66 
  Follow-up audit on past Internal Audit Service audits in DG ECFIN .......................................................................... 66 
  Follow-up audit on the setting of objectives and measurement of performances in DG GROW ............ 67 
  Follow-up audit on the performance of DG GROW’s supervision of ESA’s implementation of Galileo 67 
  Follow-up audit on ethics in DG TRADE ....................................................................................................................................... 67 
  Follow-up audit on performance of Anti-Fraud activities in the own resource and taxation areas in 
DG BUDG ......................................................................................................................................................................................................... 68 
  Follow-up audit on performance of Anti-Fraud activities in the own resource and taxation areas in 
DG BUDG ......................................................................................................................................................................................................... 68 
  Follow-up audit on the procurement process in DG DIGIT .............................................................................................. 68 
  Follow-up audit on performance of EUROSTAT’s support to the Europe 2020 strategy and the new 
Commission priorities ............................................................................................................................................................................. 68 
  Follow-up audit on former IAC and Internal Audit Service audits in OIB ............................................................... 68 
  Follow-up audit on the procurement process in OIL ........................................................................................................... 68 
  Follow-up audit on the governance, planning, monitoring and implementation of the budget line of 
the OLAF Supervisory Committee ................................................................................................................................................... 68 
  Follow-up audit on the governance, planning, monitoring and implementation of the budget line of 
the OLAF Supervisory Committee ................................................................................................................................................... 69 
  Follow-up audit on performance and coordination of Anti-Fraud activities in the Traditional Own 
Resources areas in OLAF ...................................................................................................................................................................... 69 
  Follow-up audit on performance and coordination of Anti-Fraud activities in the Traditional Own 
Resources area in OLAF ......................................................................................................................................................................... 69 
  Follow-up audit on former IAC audits in PMO ......................................................................................................................... 70 
  Follow-up audit on business continuity in DG COMM ......................................................................................................... 70 
  Follow-up audit on security of IT applications supporting nuclear accountancy and inspection 
processes in DG ENER ............................................................................................................................................................................. 70 
  Follow-up audit on security of IT applications supporting nuclear accountancy and inspection 
processes in DG ENER ............................................................................................................................................................................. 71 
  Follow-up audit on management of local IT in DG ESTAT............................................................................................... 71 
  Follow-up audit on IT governance and portfolio management in DG GROW ...................................................... 71 
  Follow-up audit on the former IAC audit on the performance of the Anti-Fraud information system 
(AFIS) in OLAF .............................................................................................................................................................................................. 71 
  Follow-up audit on IT logical security controls in OLAF .................................................................................................... 71 
  Follow-up audit on business continuity management in Publications Office of the European Union . 72 
  Follow-up audit on business continuity management in Publications Office of the European Union . 72 
  Follow-up audit on HR IT corporate application – NAP in PMO .................................................................................... 72 
  Follow-up audit on supervision of outsourced IT operations in DG TAXUD .......................................................... 73 

48.
49.
50.
51.
52.
List of follow-up audits performed in 2018 for which all recommendations have been closed after the 

follow-up ......................................................................................................................................................................................................... 74 

3 

  
 
 
CONTENT OF THIS STAFF WORKING 
DOCUMENT

Section 1 of this document contains a summary of the internal audit engagements performed as part of the 
2018 Internal Audit Service audit plan (reports issued in the period 1 February 2018 to 31 January 2019) and 
the principal recommendations (critical and very important recommendations (1).  

The  information  contained  in  this  document  reflects  the  state  of  play  when  the  audit  engagements  were 
finalised.  Each  audit  followed  the  applicable  standard  professional  validation  and  contradictory  procedures 
between  auditor  and  auditee  at  the  time  of  the  finalisation  of  the  engagement.  The  enclosed  summary  of 
each engagement aims to provide a quick understanding of the audits and their main results and additional, 
up-to-date  information  is  provided  in  specific  sections  by  the  auditees  on  the  measures  defined  and/or 
already implemented after the finalisation of the internal audit engagements. 

Section  2  of  this  document  contains  a  summary  of  the  results  of  the  Internal  Audit  Service  follow-up 
engagements performed in the period from 1 February 2018 to 31 January 2019 (2). 

Section  3  provides  a  summarised  overview  of  the  18  long  overdue  very  important  recommendations  as  at 
31 January 2019. 

1  
2  

Important recommendations are not reproduced in this staff working document. 
The summary reflects the assessment of the Internal Audit Service on the status of implementation of the audit recommendations 
at the end of the follow-up assignment. It does not take into account any further actions that may have been undertaken by the 
auditee and reported to the Internal Audit Service since the release of the Internal Audit Service follow-up note or report, which 
may have an impact on the status of the recommendation. 

4 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Section 1 
Final reports 

Horizontal audits 

1.

  Audit  on  LIFE  financial  instruments:  effectiveness  and  efficiency  of  the 

current framework in DGs CLIMA and ENV 

The objective of the audit was to assess the adequacy, efficiency and effectiveness of internal controls put in 
place by the Directorate-General for Climate Action and the Directorate-General for Environment to monitor 
and  supervise  the  implementation  and  performance  of  the  two  financial  instruments  under  the  LIFE  2014-
2020 Programme.  

No  reservations  regarding  financial  instruments  under  the  LIFE  Programme  2014-2020  were  made  in  the 
2017  annual  activity  reports  of  the  Directorates-General  for  Climate  Action  and  for  Environment.  The 
fieldwork was finalised on 21 September 2018. All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  recognises  the  ongoing  efforts  made  by  these  two  directorates-general  to 
coordinate  their  monitoring  activities  and  decisions  towards  the  European  Investment  Bank.  In  addition,  the 
Internal  Audit  Service  acknowledges the  good  cooperation  and exchange  of  best  practices between  the  two 
directorates-general, such as the use of internally developed excel tools for monitoring the management of 
the funds for both instruments. 

The Internal Audit Service identified one issue concerning the visibility and promotion of the EU contribution to 
the financial instruments and formulated the following very important recommendation: 

The directorates-general should verify on a regular basis that the requirements of the delegation agreements 
are respected in practice and raise any issues with the European Investment Bank as appropriate. They should 
agree,  together  with  the  European  Investment  Bank,  on  a  communication  plan  which  builds  on  existing 
communication  channels  and  which  provides  for  a  stronger  role  of  the  LIFE  programme  national  contact 
points. This should be regularly monitored in the Steering Committee meetings and adjusted as necessary. 

Additional information provided by Directorates-General CLIMA and ENV on the measures defined 
and/or implemented following the Internal Audit Service audit 

The Directorate-General for Climate Action provided an action plan that was assessed as satisfactory by the 
Internal  Audit  Service  to  mitigate  the  risks  identified.  It  has  developed  a  communication  plan  for  the 
promotion and visibility, which has been discussed in the Steering Committee meeting of November and will 
be  further  debated  in  the  next  Steering  Committee.  A  task  force  group  has  been  established  in  order  to 
facilitate  a  more  technical  discussion  with  the  European  Investment  Bank.  The  first  meeting  took  place  in 
March  2019.  A  new  call  for  proposals  was  published  on  21 December 2018,  which  has  sparked  interest  in 
various Member States (Germany, Ireland, France, Latvia, Austria, Poland) (3).  

The  Directorate-General  for  Environment  has  submitted  an  action  plan  for  the  ‘Natural  Capital  Financing 
Facility’,  the  Financial  Instrument  it  manages,  but  both  the  Directorates-General  for  Climate  Action  and  for 
Environment  provide  the  necessary  funding,  that  the  Internal  Audit  Service  has  assessed  as  satisfactory  to 
mitigate the risks identified for the audited process. 

3  

https://www.eib.org/attachments/documents/pf4ee_second_call_request_for_proposals_en.pdf. 

5 

 
 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The audit, the action plan and its implementation were discussed and agreed with the European Investment 
Bank in the Natural Capital Financing Facility Steering Committee on 12 February 2019. Visibility of the most 
recent  operation  was  ensured  through  a  signature  event  at  the  Biodiversity  Conference  on  23 May 2019  in 
Brussels and an  accompanying  press-release. An  update  of  the  communication  plan  is under preparation  in 
view of agreement in the next Steering Committee. 

2.

  Limited  review  on  the  reporting  on  the  corrective  capacity  in  DGs  AGRI, 

BUDG, DEVCO, EMPL, REGIO, RTD and EASME 

The objective of the limited review was to assess (i) the validity  of the concept of the estimated amounts at 
risk at closure, (ii) how it is being applied and reported on by operational directorates-general/services in their 
respective annual activity reports, and, (iii) how it feeds into and is presented in the Annual Management and 
Performance Report. 

There  are  no  observations/reservations  in  the  2016  annual  activity  reports  of  the  directorates-general  and 
services reviewed that relate to the area/process reviewed. The fieldwork was finalised on 1 December 2017. 
All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  identified  one  issue  concerning  the  Implementation  of  the  reporting  on  the 
corrective capacity and formulated the following very important recommendation: 

The  Directorate-General  for  Budget  should  modify  the  corporate  instructions  and  instruct  the  directorates-
general  and the  services to  consider  more  carefully  whether  historical  data  is a  sound  basis for estimating 
future  recoveries  and  corrections.  Furthermore,  it  should  require  the  directorates-general  and  services  to 
disclose  the  main  underlying  assumptions  in  their  annual  activity  reports  and  refer  to  those  in  the  Annual 
Management and Performance Report. 

The operational directorates-general should use more relevant data/information, where available, other than 
the historical averages to estimate future corrections or otherwise, use more recent data, which is likely to be 
more relevant for current programmes. Similarly, those directorates-general and services who faced historical 
data  encoding  issues,  should  use  more  recent  data  to  ensure  that  the  estimations  are  based  on  the  most 
accurate data available. 

Additional  information  provided  by  Directorate-General  BUDG  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The  Directorate-General  for  Budget  has  further  clarified  the  2017  and  2018  corporate  instructions  and 
guidance for estimating the future corrective capacity in the annual activity reports.  

The estimated future corrections are to be based, to some extent, on the actual historical average recoveries 
and corrections, but these are to be adjusted or replaced in order to come to the best conservative estimate 
of the future ex post corrections relevant for the current programmes. 

The  directorates-general  duly  disclose  their  main  underlying  assumptions  of  their  estimate  in  their  annual 
activity report. Those approaches are summarised in the Annual Management and Performance Report. 

The  recommendation  regarding  adapting  the  methodology  for  estimating  corrective  capacity  of  the 
Directorate-General for Agriculture and Rural Development, and disclosure thereof has been adequately and 
effectively  implemented.  In  line  with  the  agreed  action  plan,  in  its  2017  annual  activity  report,  the 
Directorate-General for Agriculture and Rural Development based its estimated future recoveries, corrections 
and amount at risk on the historic average of the executed recovery orders and financial corrections over the 
period 2013-2017 and adapted it by excluding factors from the past years which are no longer relevant for 
the current common agricultural policy measures. 

6 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

One part of an important recommendation concerning ‘presentational issues in the annual activity report’ (for 
example to explain the main underlying assumptions having an impact on the estimated amounts at risk) was 
addressed  to  the  Directorate-General  for  Employment,  Social  Affairs  and  Inclusion.  These  issues  were 
implemented in the framework of the 2018 annual activity report and the Internal Audit Service subsequently 
closed the recommendation. 

3.

  Audit on EC-EEAS coordination in DGs DEVCO and NEAR and FPI 

The objective of the audit was to assess the effectiveness and efficiency of coordination activities between 
the Commission services (specifically, the Directorate-General for International Cooperation and Development, 
the Directorate-General for Neighbourhood and Enlargement Negotiations and the Service for Foreign Policy 
Instruments)  and  the  European  External  Action  Service  (EEAS)  in  areas  relating  to  management  of  the  EU 
delegations as well as programming and implementing external instruments. 

There are no observations/reservations in the 2017 annual activity reports of the audited directorates-general 
and services that relate to the area/process audited. The fieldwork was finalised on 10 April 2018 for the work 
performed in EU delegations and on 11 September 2018 for headquarters. All recommendations relate to the 
situation as of this date. 

The audit highlighted the following strengths: 

  coordination in the management of EU delegations: The attendance and participation of all required 
services to the meetings of the EU delegations Committee and the comprehensive EU delegations 
minutes reflecting discussions held and positions expressed by all parties attending; the feedback 
provided  by  the  Directorate-General  for 
International  Cooperation  and  Development,  the 
Directorate-General for Neighbourhood and Enlargement Negotiations headquarters to the External 
Assistance  Management  Reports  submitted  by  EU  delegations;  the  enhanced  coordination  on  EU 
economic diplomacy between Commission services and the European External Action Service; 

  multiannual programming of the external assistance instruments: the  practice  put in  place by the 
European External Action Service and the Directorate-General for Neighbourhood and Enlargement 
Negotiations  to  perform  joint  programming  missions  to  the  respective/eligible  countries  in  the 
context  of  the  update  (mid-term  review)  of  the  multiannual  programming  for  the  European 
Neighbourhood  Instrument;  the  practice  put  in  place  in  the  EU  delegation  Senegal  to  establish 
informal quality support groups / quality reviews of programming documents with the involvement 
and participation of both cooperation and political sections; 

 

risk management in general, and specifically on the budget support risk-management framework : 
the interaction in all sampled EU delegations (visited on the spot and analysed via desk review) of 
the  cooperation  and  political  section,  with  the  latter  being  in  charge  for  the  assessment  of  the 
political risks, for the annual update of the Risk Management Framework; 

  Service  for  Foreign  Policy  Instruments  and  Instrument  contributing  to  Stability  and  Peace  (IcSP) 
regional teams: the efforts undertaken by the Service for Foreign Policy Instruments regional teams 
to ensure efficient transfer of physical project files from EU delegations as well as the efficiency, 
despite the limited time since their set-up, in drafting authorising officer by sub-delegation (AOSD) 
reports (for Foreign Policy Instruments funding) and/or contributions to authorising officer by sub-
delegation reports of Heads of Delegations; 

  coordination and/or exchange of information regarding implementation of external assistance: the 
set-up  of  the  budget  support  implementation  modality  in  both  the  Directorate-General  for 
Neighbourhood  and  Enlargement  Negotiations  and  the  Directorate-General  for  International 
Cooperation and Development: the involvement of the European External Action Service as well as 
the  interaction  between  the  European  External  Action  Service,  the  EU  delegations  and  the 
Commission  is  fully  formalised  and  each  party  has  a  clear  mandate  in  the  Budget  Support 
Steering/Financial Assistance Steering (BSSC/FAST) Committees, which is considered a best practice 
in terms of coordination; for Egypt, a Permanent country team has been put in place to identify how 
best to define a strategic relationship with Egypt. The Permanent Country Team is co-chaired by the 

7 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  and  the  European  External 
Action Service. The minutes, distribution list and agenda items are considered as a good practice.  

The  Internal  Audit  Service  identified  one  issue  concerning  the  country-level  coordination  between  the 
Commission services and formulated the following very important recommendations: 

The  Directorate-General  for  International  Cooperation  and  Development  and  the  Directorate-General  for 
Neighbourhood and Enlargement Negotiations should: 

  enhance/further  develop  the  aid  implementation  dashboard  in  order  to  establish  a  consolidated 

portfolio of EU funded projects; 

  undertake  a  feasibility  study  together  (cost/benefit  analysis)  on  the  extension  of  the  aid 

implementation dashboard towards areas of external cooperation; 

  seek  pragmatic  solutions  for  the  inclusion  of  funding  from  line  directorates-general  and/or  other 

institutions such as the European Investment Bank; 

  make good use of the aid implementation dashboard by: 

  making EU delegations fully aware of the existence of the dashboard, its usage and related process 

requirements; 

  setting  a  process  through  which  line  directorates-general  have  to  share  the  information  on  their 

funded projects in third countries with EU delegations and/or headquarters. 

Additional  information  provided  by  Directorates-General  DEVCO  and  NEAR  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

Following the audit in the Directorate-General for International Cooperation and Development, the final audit 
report was published on 31 January 2019 and an action plan to address the recommendations was accepted 
by the Internal Audit Service. To improve country-level coordination with the European External Action Service, 
the  directorate-general  has  undertaken  a  study  to  identify  external  cooperation  financial  flows  beyond  the 
Heading IV of the  General Budget and to assess the  feasibility of integrating them in the dashboard. If the 
conclusion  of  the  study  is  positive,  necessary  processes  for  collecting  information  on  funding  from  line 
directorates-general and European Investment Bank will be put in place. These flows will be integrated in the 
aid  implementation  dashboard.  In  parallel,  a  communication  and  awareness  plan  will  be  designed  and 
implemented  to  maximise  awareness  and  use  of  the  Aid  Implementation  dashboard  by  the  staff  in  EU 
delegations by the end of 2019. 

The  Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  is  working  together  with  the 
Directorate-General for International Cooperation and Development and the European External Action Service 
on the implementation of the very important  recommendation related to the country level coordination and 
improving aid implementation dashboards. Once the feasibility study is finalised, a new version of dashboard 
will be developed and the Directorate-General for Neighbourhood and Enlargement Negotiations will issue a 
note informing EU delegations about its existence, usage and related process requirements.  The Directorate-
General  for  Neighbourhood  and  Enlargement  Negotiations  will  align  with  the  process  set  up  by  the 
Directorate-General for International Cooperation and Development to identify line directorates-general who 
need to share information on their funded projects in third countries with EU delegations and/or headquarters. 

8 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

4.

  Audit on business continuity in DG COMM (DGs COMM and DIGIT) 

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of 
the  management  and  control  systems  put  in  place  by  the  Directorate-General  for  Communication  for  its 
business  continuity  management.  The  aim  of  the  audit  was  to  help  identify  any  possible  weaknesses  in 
Directorate-General  for  Communication  business  continuity  processes  and  to  recommend  improvements 
where needed. 

There  are  no  reservations  in  the  2016  annual  activity  report  of  the  Directorate-General  for  Communication  
that relate to the area audited. According to this  annual activity report, during 2016 the directorate-general 
gave  particular  priority  to  addressing  former  Internal  Control  Standard  no.  10  (business  continuity).  The 
fieldwork was finalised on 11 December 2017. All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  recognises  the  efforts  made  by  the  Directorate-General  for  Communication  to 
prepare for major disruptions and to mitigate the main inherent risks identified. In particular, the directorate-
general put in place a number of key controls to improve its business continuity capability. 

  ex  post  controls:  as  mentioned  in  the  2016  annual  activity  report,  the  Directorate-General  for 
Communication  performed  ex  post-controls  on  former  internal  control  standard  no.  10  (business 
continuity) in nine Representations and three Brussels-based units; 

  knowledge  of  processes:  the  staff  in  the  Directorate-General  for  Communication  responsible  for 

critical functions are very knowledgeable and experienced in its processes; 

  useful leaflets with business continuity information: the Directorate-General for Communication has 
developed very useful information leaflets aimed at raising staff awareness of business continuity 
issues; 

 

training: the Directorate-General for Communication gave training on business continuity to critical 
staff in Representations and Headquarters; 

  hand-over documentation: when a staff member changes post, it is mandatory for the colleague on 
mobility  to  draft  hand-over  documentation  for  the  successor.  The  Internal  Audit  Service  assessed 
two hand-over files and considered them adequate to facilitate a swift take-over of new tasks by a 
new staff member. 

Moreover,  the  Internal  Audit  Service  notes  that  during  the  course  of  the  audit  the  Directorate-General  for 
Communication reacted very promptly and constructively to the emerging issues identified and in a number of 
cases began to take corrective action either before the audit was finalised or very soon after. 

The  Internal  Audit  Service  identified  one  issue  concerning  Business  Impact  Analysis  and  formulated  the 
following very important recommendation: 

The Directorate-General for Communication should finalise its update of the Business Impact Analysis, paying 
particular attention to ensuring that dependencies and resources for running critical  and essential functions 
have been taken into account. The Directorate-General for Communication management should approve the 
Business Impact Analysis and ensure that it is kept up-to-date. The current overall Business Continuity Plan, 
tactical Business Continuity Plans and the relocation plans should be reviewed and aligned as necessary with 
the updated Business Impact Analysis. 

Additional  information  provided  by  Directorate-General  COMM  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The very important Internal Audit Service recommendation related to business impact analysis was closed in 
2018.  A  process  for  keeping  the  Business  Impact  Analysis  up-to-date  has  been  established.  The  Business 
Impact Analysis is presented for review and update to the ‘risk management group’ of the Directorate-General 
for Communication twice a year. In addition, updates are done on a systematic basis whenever new elements 
emerge,  for  instance,  re-organisation  of  the  directorate-general.  The  Business  Continuity  Plan  has  been 
revised following the establishment of the Business Impact Analysis. 

9 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

5.

  Audit  on  ‘synergies  and  efficiencies  review’  in  DGs  BUDG,  COMM,  DIGIT,  HR, 

JRC, OIB, SCIC and SG 

The main objective of the audit was to assess whether the Commission has put in place a clear framework 
and methodology, as well as sound processes and controls to ensure that the objectives of the Synergies and 
Efficiencies Review Communication are met and to assess the state of play of the Synergies and Efficiencies 
Review  Communication  approximately  2  years  after  its  adoption.  The  first  target  dates  are  set  for  2019. 
Therefore  it  is  key  for  such  a  wide  ranging  initiative,  with  high  levels  of  expectation,  to  take  stock  of  the 
progress made so far, confirm or otherwise that it is on track and highlight as early as possible any areas for 
possible improvement/corrective action.  

There  are  no  observations/reservations  in  the  2017  annual  activity  reports  of  the  Directorates-General  for 
Budget, for Communication, for Informatics, for Human Resources and Security, the Joint Research Centre, the 
Office  for  Infrastructure  and  Logistics  in  Brussels,  the  Directorate-General  for  Interpretation  and  the 
Secretariat-General that relate to the area/process audited. The fieldwork was finalised in mid-June 2018. All 
recommendations relate to the situation as of that date. However, the situation was continuously evolving (as 
presented under key developments below) and various factors and new information have come to light since 
then. Where possible, these have been taken into account in finalising the audit engagement (the report was 
issued  in  January 2019)  and  include,  for  example,  the  impact  of  significant  changes  to  the  Commission 
corporate governance framework and the latest meetings of key corporate bodies (4).  

The audit highlighted the following key developments and strengths: 

  Coordination amongst actors and transparent reporting: under the lead of the Directorate-General 
for Human Resources and Security, domain leaders (DLs) meet regularly at operational and senior 
management  levels  to  discuss  issues  related  to  the  implementation  of  the  synergies  and 
efficiencies  review  and  to  help  coordinate  the  work  across  the  different  domains  through  the 
domain  leaders  working  group.  The  Directorate-General  for  Human  Resources  and  Security,  with 
help  from  the  Directorates-General  for  Budget  and  the  Secretariat-General,  included  a  new 
synergies and efficiencies review annex to three Staff Allocation decisions published in 2017 and 
2018 (5). The annexes, prepared based on input and discussions with the domain leaders presented 
the progress made in each domain. Additionally, significant efforts have been made to improve the 
way  in  which  synergies  and  efficiencies  review  related  information  is  reported.  The  Corporate 
Management  Board  proposed  to  seize  the  College  in  February 2019  on  the  state  of  play  of  the 
implementation  of  the  Synergies  and  Efficiencies  Review  Communication,  including  proposals  on 
how to continue to deliver synergies and efficiencies with high quality services, minimal disruptions 
and  taking  account  of  the  evolving  context.  While  the  Internal  Audit  Service  considers  that  this 
process  could  be  even  further  improved,  it  nevertheless  represents  a  significant  development  in 
monitoring  and  reporting  arrangements.  Moreover,  the  recently  enhanced  oversight  role  of  the 
Corporate  Management  Board  as  regards  the  implementation  of  the  synergies  and  efficiencies 
review suggests that it could be best placed to further oversee the continuous modernisation of the 
Commission’s organisation and that a number of the components of the synergies and efficiencies 
review initiative could provide the key building blocks for this. The Internal Audit Service also notes 
the  efforts  to  improve  communication  between  the  domain  leaders  and  the  individual/client 
directorates-general  on  the  service  provided.  This  is  done  through  dedicated  steering  boards  per 
project/domain (6) and networks (7) created and other tools adapted to each domain leader.  

  Specific domain leaders developments: the Internal Audit Service acknowledged the progress made 
and  achievements  in  each  domain  as  regards  the  main  actions  listed  in  the  Synergies  and 
Efficiencies  Review  Communication (8).  The  Internal  Audit  Service  noted  during  the  audit  that 
domain  leaders  and  central  services  are  continuously  taking  measures  in  order  to  improve  the 

4  

5  
6  

7  
8  

In  particular  the  Group  of  Resource  Directors  meeting  on  16 October 2018  and  the  Corporate  Management  Board  meetings  on 
27 November 2018 and 18 December 2018.  
SEC(2017) 230 Annex 3, SEC(2017)528 Annex 2 and SEC(2018)520 Annex 2. 
For  example  DGx  Steering  Group  for  Human  Resource  Modernisation,  Corporate  Communication  Steering  Committee,  Steering 
Board on Conference and Meeting Room Management, eGrants and eProcurement Steering Board. 
Such as the Business Correspondent network, the Communication network and the Conference Correspondent network.  
Paragraph  3  "Actions  to  boost  efficiency  and  effectiveness  of  support  communities"  of  the  Synergies  and  Efficiencies  Review 
Communication. 

10 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

processes,  with  lessons  learnt  taken  on  board  in  order  to  deliver,  as  much  as  possible,  the 
objectives of the Synergies and Efficiencies Review Communication.  

The new human resources model has been rolled-out to all directorates-general in July 2017. This 
involved  the  transfer  of  around  400  human  resource  staff  from  directorates-general  to  Account 
Management  Centres  and  the  creation  of  a  new  Account  Management  Centres  directorate  in  the 
Directorate-General for Human Resources and Security.  

The  three  information  and  communications  technology  projects  selected  in  the  Internal  Audit 
Service audit are at different levels of maturity. In order to optimise the synergies between eGrants 
and eProcurement project, a new governance structure has been created in May 2017 (9), involving 
a change in eProcurement’s system architecture and business owner (10). As regards the local data 
centre centralisation (LDCC), as at July 2018, the Internal Audit Service notes that four directorates-
general have been centralised (11).  

The  Corporate  Communication  Steering  Committee  was  established  on  4 April 2016  and  the 
Communication  Network,  merging  the  work  of  the  former  External  and  Internal  Communication 
Networks was created in July 2016. A Corporate Communication Contracts Team, has  been set up 
early  2018  in  the  Directorate-General  for  Communication.  The  right  of  consent  mechanism 
(whereby  directorates-general  should  seek  consent  of  the  Directorate-General  for  Communication 
for external communication actions with a budget of EUR 1 million and above) was approved by the 
Corporate  Communication  Steering  Committee  in  July 2016.  By  the  end  of  2018,  27  framework 
contracts were expected to be phased-out. The Commission's new external websites were launched 
in 2016 and are being gradually built up and custom information technology development has been 
further de-incentivised.  

The  new  logistics  delivery  model  was  rolled-out  to  all  directorates-general  in  April  2017.  18 
proximity teams, managed by the Office for Infrastructure and Logistics in  Brussels and delivering 
logistics services to all Commission buildings (except for the Berlaymont building) were created in 
April 2017.  

The Directorate-General for Interpretation launched the steering board on events and meeting room 
management  in  September 2016.  In  2017,  the  Directorate-General  for  Interpretation  signed  an 
inter-institutional  framework  contract  on  purchase,  rent  and  maintenance  of  audio-visual 
equipment and services. In  2018 it  finalised, with the  cooperation of the Office  for Infrastructure 
and Logistics in Brussels, the inventory of all meetings rooms in the Commission and presented its 
roll-out  model  for  meeting  room  management  to  the  Corporate  Management  Board  in 
November 2018. 

Regarding  conference  organisation,  the  Directorate-General  for  Interpretation  set  up  an  event 
register  at  Commission  level  in  January 2017  and  launched  the  Conference  Correspondents 
network, which acts as a forum for information, discussion and dissemination of best practice for 
the  professionalization  of  the  community.  The  call  for  tendering  a  framework  contract  on  Event 
Management Services was published in December 2018 (its signature is expected for 2019).  

The  Internal  Audit  Service  identified  two  issues  on  improving  monitoring  arrangements  and  reliability  of 
savings  estimates  and  on  embedding  the  Synergies  and  Efficiencies  Review  culture  Commission-wide  and 
issued the following two very important recommendations: 

Improving monitoring arrangements and reliability of savings estimates 

At the corporate level, the central services should define clear criteria for determining ‘savings’ and monitor 
closely  the  progress  made  towards  achieving  the  target.  Any  significant  change  to  the  target  should  be 

9   
10  

11  

eGrants and eProcurement Steering Board. 
On 3 March 2017, the board endorsed the proposal of the Directorate-General for Informatics to entrust Joint Research Centre as 
Business Owner of the project instead of the Publications Office of the European Union (Corporate Management Board minutes).  
Out of which two had been already centralised before the synergies and efficiencies review. 15 other directorates-general (out of 
35) have started the process. According to the current planning, all directorates-general should have started migrating their local 
data centers to the corporate data centers by 2020. 

11 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

presented  quickly  to  the  Corporate  Management  Board.  Reported  savings  should  be  accompanied  by  the 
baseline figures and the date at which these were established. In addition, for certain domains for which the 
expected savings are highest, notably human resources and information and communications technology, the 
responsible domain leaders need respectively to demonstrate more clearly how those savings will be made to 
fill the gap between originally estimated targets in the synergies and efficiencies review and current revised 
ones.  

Monitoring  mechanisms  should  be  put  in  place  to  ensure  that  the  ‘saved’  resources  are  actually  saved  in 
practice, as resources which are declared as saved, but simply used in the same role outside the control of the 
domain  leader  concerned,  are  not  really  saved  at  all.  The  mechanisms  for  collecting  posts  and  using 
research/operational budget lines should be clarified. Domain leaders should be invited to provide information 
on other (quantifiable) savings or (qualitative) benefits expected to be made when implementing the projects.  

Embedding the Synergies and Efficiencies Review culture Commission-wide  

a) Improving communication 

The  Directorate-General  for  Human  Resources and Security, with  the  support  of  the  domain  leaders, should 
develop  a  communication  campaign  to  explain  the  synergies and  efficiencies review  objectives,  the  domain 
leadership  culture  and  potential  added-value  for  the  Commission  as  a  whole.  The  Directorates-General  for 
Human  Resources  and  Security  and  for  Budget  should  communicate  the  link  between  the  resources 
directorates-general contribute as part of the synergies and efficiencies review and the resources they receive 
for  their  own  priorities.  Furthermore,  they  should  communicate  the  incentives  that  new/alternative  ways  of 
working  can  bring  over  and  above  the  formal  staff  allocation  process.  Domain  leaders  should  continue  the 
feedback exercise, which can feed into the appraisal exercise. 

b) Providing assurances on quality of service/client satisfaction 

The domain leaders should set up appropriate quality mechanisms to demonstrate the level of quality of their 
services to the client directorates-general (which should include publication of service catalogues, agreeing on 
the minimum service levels, effective monitoring based on SMART key performance indicators, feedback and 
provision for corrective/remedial actions) and take remedial actions when necessary.  

Additional  information  provided  by  Directorates-General  BUDG,  COMM,  DIGIT,  HR,  JRC  OIB  SCIC 
and SG on the measures defined and/or implemented following the Internal Audit Service audit 

Building on the audit and on request of the Corporate Management Board, the Directorate-General for Human 
Resources and Security and the Secretariat-General – with contributions from all other Domain Leaders and 
the Directorate-General for Budget – drafted a  new Communication on ‘Synergies and Efficiencies initiative: 
stocktaking and way forward’, which was adopted on 26 March 2019. The Communication takes stock of what 
has been achieved so far in the synergies and efficiencies initiative, assesses the challenges encountered and 
proposes  a  way  forward  to  further  modernise  the  Commission’s  organisational  performance.  In  April  2019, 
the Internal  Audit Service considered that the action  plan implementing the three audit  recommendations – 
coordinated  by  the  Directorate-General  for  Human  Resources  and  Security,  with  contributions  from  the 
Secretariat-General,  the  Directorate-General  for  Budget  and  the  other  Domain  Leaders,  was  satisfactory  to 
mitigate the identified risks. 

The  Directorate-General  for  Human  Resources  and  Security  is  coordinating,  in  close  cooperation  with  the 
Secretariat-General and the Directorate-General for Budget, the implementation of the actions defined in the 
above mentioned Communication and action plan. A number of actions have already been implemented. The 
phased  savings  and  investments  per  domain,  per  directorate-general  and  per  year,  following  consultations 
with  the  directorates-general,  have  been  agreed  by  the  Corporate  Management  Board.  Arrangements  are 
being put in place – in close cooperation with the other concerned services – for objectives, key performance 
indicators  and  savings  implementation.  A  user-centric  communication  campaign  around  all  modernisation 
measures flowing from synergies and efficiencies is now in development. 

12 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The Secretariat-General is working with the Directorates-General for Human Resources and Security and with 
the  Directorate-General  for  Budget  to  define  the  mechanism  for  and  scope  of  the  annual  monitoring  and 
reporting  to  the  Corporate  Management  Board  and  the  Group  of  Resource  Directors  on  overall  project 
progress. 

The  Directorate-General  for  Communication  is  involved  in  the  use  of  the  new  ATLAS  tool  to  help  services 
across the Commission identify jobs or activities that belong to the external communication domain. Further, 
the  Directorate-General  for  Communication  is  also  working  on  internal  communication  aspects  of  the 
initiative,  both  as  contributor  to  the  central  campaign  led  by  the  Directorate-General  for  Human  Resources 
and Security and within the communication domain itself, with the development of a new information portal 
to present its corporate services (ongoing). 

The Directorate-General for Informatics provided inputs for the action plan, mostly as a contributor under the 
lead  of  the  Directorate-General  for  Human  Resources  and  security,  or  for  a  few  points  as  a  leader  for  the 
information  technology  domain.  Some  actions,  included  in  the  Synergies  and  Efficiencies  Review 
Communication  and  falling  in  the  remit  of  the  Directorate-General  for  Informatics,  are  already  advanced 
(local date centre consolidation, e-procurement, building blocks), reducing the risks accordingly. 

Although  the  audit  on  ‘synergies  and  efficiencies  review’  did  not  address  the  Joint  Research  Centre  in  its 
findings or recommendations, it was included in this review because it manages eProcurement, which is part 
of the Commission’s synergies and efficiencies’ processes. 

In the Office for Infrastructure and Logistics in Brussels, the audit scope was limited to the centralisation of 
local  proximity  teams.  The  audit  on  'synergies  and  efficiencies  review'  did  not  address  the  Joint  Research 
Centre in its findings or recommendations. The Joint Research Centre was included in this review because it 
manages eProcurement which is part of the Commission's synergies and efficiencies' processes. 

In  the  Directorate-General  for  Interpretation,  there  is  a  steering  board  on  events  and  meeting  room 
management since September 2016. In 2018 it finalised, with the cooperation of the Office for Infrastructure 
and Logistics in  Brussels,  the  inventory  of  all  meetings rooms  in  the  Commission  and presented  its  roll-out 
model  for  meeting  room  management  to  the  Corporate  Management  Board  in  November 2018.  The 
Directorate-General for Interpretation has renovated to-date over 50 meeting rooms in the Commission. The 
internal web-streaming capacity to provide life transmission from important events such as the State of the 
Union Speech has been significantly strengthened. 

Regarding  conference  organisation  in  the  Directorate-General  for  Interpretation,  an  event  register  at 
Commission level is available since January 2017, which gives an overview of the conferences organised by 
the  Commission  services  throughout  the  year  as  well  as  the  volume  of  budgets  involved.  The  Conference 
Correspondents  network  acts  as  a  forum  for  information,  discussion  and  dissemination  of  best  practice  for 
the professionalisation of the community. As part of its efforts to professionalise the conference organisers’ 
community  in  the  Commission,  the  Directorate-General  for  Interpretation  made  available  a  range  of  web-
based  tools on  conference  organisation.  An  online  participants’  registration  software  was  developed  for  the 
corporate use. The call for tendering a framework contract on Event Management Services was published in 
December 2018  (its  signature  is  expected  for  2019).  The  Directorate-General  for  Interpretation,  in 
collaboration with the Directorate-General for Human Resources and Security and the other domain leaders 
will continue actively working to implement the actions under its responsibility. 

13 

 
 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

6.

  Audit  on  dissemination  and  exploitation  of  Horizon  2020  results  in  

DGs CNECT, RTD and CSC,  REA and ERCEA 

The objective of the audit was to assess the design  of the dissemination and exploitation framework by the 
Common Support Centre and its effective implementation by a sample of Horizon 2020 implementing bodies 
(12).  

There are no observations/reservations in the 2017 annual activity reports of the directorates-general in the 
audit  scope  that  relate  to  the  area/process  audited.  The  fieldwork  was  finalised  on  7 December 2018.  All 
recommendations relate to the situation as of that date. 

The audit highlighted the following strengths: 

 

 

the  processes  for  the  evaluation  of  proposals  and  the  monitoring  of  the  dissemination  and 
exploitation  aspects  in  Horizon  2020  projects  are  supported  by  common  information-technology 
tools designed by the Common Support Centre;  

the Common Support Centre set up the dissemination and exploitation practitioner’s platform  for 
the  first  dissemination  and  exploitation  strategy  (2015-2017)  to  collect    dissemination  and 
exploitation  specific  guidance  and  good  practices  and  the  Dissemination  and  Exploitation  Net  to 
coordinate  and  execute  the  revised  dissemination  and  exploitation  strategy  (2018-2020)  and  its 
action plan; 

  central reporting on the mandatory key performance indicators for dissemination and exploitation 

via the Horizon 2020 dashboard. 

The  Internal  Audit  Service  identified  one  issue  on  monitoring  compliance  with  the  dissemination  and 
exploitation contractual obligations and reporting requirements and formulated the following very important 
recommendation: 

The Common Support Centre should: 

  enhance  and  adopt  the  vademecum  on  data  and  results  for  the  dissemination  and  exploitation 

activities during and after project implementation; 

  collaborate  with  the  Horizon  2020  implementing  bodies  to  raise  awareness  amongst  the  project 
officers (POs) on their responsibility to monitor the dissemination and exploitation obligations and 
reporting requirements; 

  define an approach to follow-up the exploitation activities after the end of the project and include 
measures to  encourage  the  beneficiaries to  continue  reporting  on  peer-reviewed  publications  and 
patents to the Commission after the end of the projects; 

  clarify  the  possible  actions  available  for  breaches  of  dissemination  and  exploitation  contractual 
obligations, including practical examples of those that could justify the use of one of the dissuasive 
measures (e.g. grant reduction). 

Additional  information  provided  by  Directorate-General  of  RTD  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The  action  plan  has  been  submitted  to  the  Internal  Audit  Service.  The  section  of  the  Horizon  2020 
Vademecum  on  Dissemination  and Exploitation  will  be  updated, together with  the  ‘Research  and  Innovation 
family’,  to  reflect  the  recommendations  of  the  Internal  Audit  Service  audit  report.  The  guidance  documents 
will also be updated 

12     Directorate-General for Research and Innovation, Directorate-General for Communications Networks, Content and Technology, the 

Research Executive Agency and European Research Council Executive Agency. 

14 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

to reflect the updated section of the vademecum. An approach for following up the exploitation activities after 
the end of the project will be defined and included in the updated vademecum and guidance documents.  

Dedicated  communication  will  be  conducted  for  the  project  officers,  clarifying  the  legal  consequences  and 
possible  actions  concerning  the  breaches  of  ‘Dissemination  and  Exploitation’  contractual  obligations.  The 
communication will describe the approach for following up exploitation activities after the end of the project 
and will refer to the updated vademecum and the guidance documents.  

Beneficiaries  are  legally  obliged  to  report  on  their  publications  and  patents.  The  Common  Implementation 
Centre  will  do  targeted  communication  to  beneficiaries  for  promoting  the  use  of  the  continuous  reporting 
after  the  end  of  their  projects  and  remind  them  on  the  residual  obligations  of  their  grant  agreement  as 
described in the online Horizon 2020 manual. 

The  services will  be  supported  by  the  updated  sections  of  the  Horizon  2020  vademecum on  ‘Dissemination 
and  Exploitation’  and  the  open  access/visibility  of  EU  funding.  The  obligations  for  open  access,  EU  funding 
visibility, etc. will also be emphasised in the training and communication on ‘Dissemination and Exploitation’. 

7.

  Consolidated  report  on  Horizon  2020  project  management  and  ex  ante 

control audits in DGs RTD, DG CNECT, REA, ERCEA, INEA and EASME 

The objective of the series of audits on Horizon 2020 project management and ex ante controls was to assess 
whether  the  Commission  (i.e.  the  Common  Support  Centre  and  the  selected  Horizon  2020  implementing 
bodies)  has  designed  and  implemented  (i)  an  effective  project  management  process  (ensuring  that  projects 
are effectively implemented by the beneficiaries in line with the grant agreement) and (ii) effective  ex ante 
controls  on  Horizon  2020  grant  payments  (contributing  to  the  assurance  concerning  the  legality,  regularity 
and sound financial management of expenditure). 

The Internal Audit Service auditors identified the following good practices and strengths, some of which could 
serve as a basis for strengthening the grant management and ex ante controls processes across the Horizon 
2020 implementing bodies: 

  Common Support Centre: the Common Support Centre has provided central information-technology 
systems  to  support  various  processes,  including  project  monitoring,  ex  ante  controls  and 
amendments  for  the  whole  research  family.  This  facilitates  the  exchange  of  key  documents  (e.g. 
deliverables,  periodic  reports,  amendment  requests)  between  the  Commission  and  the  grant 
beneficiaries  and  the  tracking  of  deadlines,  which  contributes  to  the  overall  efficiency  of  the 
process; 

  Directorate-General  for  Communications  Networks,  Content  and  Technology,  Executive  Agency  for 
Small  and  Medium-sized  Enterprises:  the  responsible  officers  record  in  the  common  information 
technology system COMPASS detailed comments, justifications and additional checks related to the 
approval process for project amendments; 

  Directorate-General  for  Communications  Networks,  Content  and  Technology,  Research  Executive 
Agency:  the  Directorate-General  for  Communications  Networks,  Content  and  Technology  and  the 
Research  Executive  Agency  have  established  internal  networks  of  project  officers  to  ensure  a 
coherent  approach  and  overall  coordination  of  the  grant  management  process.  In  addition,  the 
Directorate-General for Communications Networks, Content and Technology has appointed a single 
point of contact to actively collect good practices and know-how from the project officers and also 
to  discuss  with  the  Common  Support  Centre  issues  relating  in  particular  to  guidance  and  IT 
functionalities; 

 

Innovation  and  Networks  Executive  Agency:  The  Innovation  and  Networks  Executive  Agency  has 
developed a Risk Assessment Document to support the project management process. It is filled in 
for  each  project  following  the  grant  agreement  preparation  phase.  It  includes  a  description  of 
several  risk  factors  (e.g.  the  number  of  partners,  different  funding  ratios  used).  Based  on  this 
document,  the  Innovation  and  Networks  Executive  Agency  decides  on  the  type  and  intensity  of 
monitoring activities proportionate to the project risk level/complexity. The document is updated at 
key  milestones  (e.g.  end  of  the  reporting  periods,  at  handovers  to  other  project  officers).  This 

15 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

enables the Agency to revise the initial risk level of the project and to adapt the monitoring strategy 
for the project accordingly. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

8.

  Audit on Connecting Europe Facility telecom governance in DGs CNECT, DGT, 

DIGIT, EMPL, GROW, JUST and SANTE 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effectiveness  of  the 
implementation of the Commission's Connecting Europe Facility telecom governance arrangements within the 
Commission.  

There are no observations/reservations in the 2017 annual activity reports of the directorates-general in the 
audit  scope  that  relate  to  the  area/process  audited.  The  fieldwork  was  finalised  on  20 December 2018.  All 
recommendations relate to the situation as of that date. 

The audit highlighted the following strengths: 

  with  an  unchanged  level  of  resources,  and  in  an  increasingly  complex  context  given  the  growing 
number  of  Digital  Service  Infrastructures  and  implementing  directorates-general,  Unit  CNECT.D1 
has satisfactorily managed the annual Work Programmes preparation process; 

 

 

 

the  governance  arrangements  between  the  Directorate-General  for  Communications  Networks, 
Content  and  Technology  and  the  Innovation  and  Networks  Executive  Agency,  mandated  with  the 
implementation  of  Connecting  Europe  Facility  telecom  grants,  are  well  established.  The  current 
written agreements between both provide a sound framework for the supervision of the Innovation 
and Networks Executive Agency by the Directorate-General for Communications Networks, Content 
and Technology; 

in  2015,  the  Directorate-General  for  Communications  Networks,  Content  and  Technology 
commissioned  a  study  that  provided  an  extensive  and  comprehensive  analysis  of  the  long-term 
sustainability of the Digital Service Infrastructures (which is an important element in the Connecting 
Europe Facility regulation); 

in  2017,  the  Connecting  Europe  Facility  telecom  communication  strategy  was  harmonised  at 
programme level, defining a communication action plan with targets and milestones. 

The Internal Audit Service identified one issue concerning the Connecting Europe Facility telecom performance 
framework and formulated the following very important recommendation: 

The Directorate-General for Communications Networks, Content and Technology, in cooperation with the other 
directorates-general  implementing  the  Connecting  Europe  Facility  telecom  programme,  should  improve  the 
current performance framework of the programme and duly monitor its progress and the results. In addition, 
the Directorate-General for Communications Networks, Content and Technology should exercise an oversight 
role and coordinate with the other Connecting Europe Facility telecom implementing directorates-general, so 
that  each  Digital  Service  Infrastructures  has  (as  much  as  possible)  SMART (13)  objectives  and  associated 
RACER (14) indicators for results as well as for annual outcomes. 

Additional  information  provided  by  Directorate-General  CNECT  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

To  address  the  recommendations,  the  Directorate-General  for  Communications  Networks,  Content  and 
Technology  together  with  the  Directorate-General  for  Justice  and  Consumers,  the  Directorate-General  for 
Internal Market, Industry, Entrepreneurship and SMEs, the Directorate-General for Health and Food Safety, the 

13  
14  

SMART: specific, measurable, achievable, realistic and timely 
RACER: relevant, accepted, credible, easy and robust 

16 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Directorate-General for Employment, Social Affairs and Inclusion, the Directorate-General for Informatics and 
the Directorate-General for Translation, envisages several actions including for example the preparation of a 
monitoring  guidebook  aimed  to  revise  and  improve  the  overall  performance  framework  both  at  topic  and 
programme  level,  the  strengthening  of  the  current  internal  governance  arrangements  by  clarifying  the 
distribution  of  roles  and  responsibilities  between  the  different  actors  and  existing  structures,  and 
implementation  of  a  financial  monitoring  tool  of  the  budget  flexibility.  The  Directorate-General  for 
Communications  Networks,  Content  and  Technology  plans  to  implement  all  the  actions  needed  for  the 
implementation of all recommendations of the Connecting Europe Facility audit by Q4 2020. 

The Directorate-General for Employment, Social Affairs and Inclusion updated the mission statement and Unit 
Management Plan of Unit EMPL.F.5 and published it on the intranet; the job description of the Head of Unit 
EMPL.F.5 has also been updated. Finally, the Directorate-General for Employment, Social Affairs and Inclusion 
is in the process of defining Key Performance Indicators and related targets concerning Electronic Exchange of 
Social  Security  Information  part  funded  by  Connecting  Europe  Facility  Telecom.  The  Memorandum  of 
Understanding with the Directorate-General for Communications Networks, Content and Technology is under 
finalisation. 

9.

  Audit  on  the  effectiveness  and  efficiency  of  the  new  Early  Detection  and 
Exclusion  System  in  protecting  the  EU  financial  interests  in  DGs  BUDG, 
DEVCO, REGIO and RTD 

The objective of the audit was to assess whether the Commission has designed and implemented an effective 
and efficient control system for the management of the Early Detection and Exclusion System (EDES) aimed 
at protecting the EU budget, in line with the legal provisions. 

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorates-General  for 
Budget, for International Cooperation and Development, for Regional and Urban Policy and for Research and 
Innovation  and that relate to the area/process audited. The fieldwork was finalised on 10 October 2018. All 
recommendations relate to the situation as of that date. 

The audit highlighted the following strengths: 

  using good practice from the World Bank suspension and debarment system: before designing and 
implementing  the  Early  Detection  and  Exclusion  System  for  the  European  Institutions,  the 
Directorate-General for Budget performed an analysis of the suspension and debarment system in 
place  at  the  World  Bank  Group.  This  enabled  the  Directorate-General  for  Budget  to  factor  in  the 
lessons learnt when setting up the Early Detection and Exclusion System. The system’s Panel is, to 
a certain extent, similar to the Office of Suspension and Debarment within the World Bank Group. 
Both  bodies  assess  the  evidence  underpinning  specific  cases  and  issue  recommendations 
concerning the sanctioning of the economic operator breaching the rules; 

  composition of the Early Detection and Exclusion System Panel: a key component of the system is 
its  Panel (15),  which  is  composed  of  an  independent  Chair,  a  Vice-Chair,  two  permanent  members 
who are senior Commission officials, and the Authorising Officer responsible (AOR) representing the 
directorate-general bringing the case to the Panel. Subject to the approval of the Chair, observers 
may  be  present  as  well.  The  Commission  was  able  to  attract  high-level  individuals  as  Chair  and 
Vice-Chair.  Together  with  the  internal  standing  members,  this  ensures  that  the  Panel  has  the 
necessary expertise and experience to carry out its tasks effectively; 

 

integration of automatic Early Detection and Exclusion System checks into the Directorate-General 
for  Research  and  Innovation  IT  system  for  grant  management:  the  Directorate-General  for 
Research  and  Innovation  has  integrated  controls  into  the  electronic  workflow  and  grant 
management  system  COMPASS/SYGMA  to  check  whether  an  economic  operator  receiving  funds 
from Horizon 2020 programmes is registered for early detection or exclusion in the Early Detection 
and Exclusion System. The Directorate-General for Research and Innovation system automatically 

15  

The  Panel  assesses  requests  and  issues  recommendations  for  exclusion  and  financial  penalty  for  cases  referred  to  it  by  the 
Commission or other Institutions and bodies. 

17 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

consults  the  Early  Detection  and  Exclusion  System  database  at  several  stages  of  the  grant 
management  process and therefore  helps to  provide  an  efficient  and effective  control  during  the 
workflow, mitigating the risk that an economic operator that represents a threat to the EU Budget 
may receive financial support from EU programmes. 

The Internal Audit Service identified two issues concerning  guidelines and awareness raising and concerning 
applying EDES in practice and formulated the following very important recommendations: 

The absence of corporate guidelines and lack of awareness at operational level  

At  the  corporate  level,  the  Directorate-General  for  Budget  should  issue  corporate  guidelines,  in  addition  to 
running training sessions, for the Early Detection and Exclusion System process to ensure a more harmonised 
process  and  to  ensure  that  it  is  used  as  widely  and  frequently  as  possible  across  the  Commission.  These 
guidelines  and  training  sessions  should  be  regularly  revised  to  reflect  the  development  of  the  process.  The 
guidance and awareness raising should also focus on the particularities of the  Early Detection and Exclusion 
System process in indirect and shared management, both from the Commission’s and external stakeholders’ 
point of view. 

At the local level, operational directorates-general should continue their effort to raise awareness about the 
Early  Detection  and  Exclusion  System  process  in  general,  including  the  specific  requirements  that  apply  to 
indirect  and  shared  management,  and  remind  staff  of  their  obligation  to  use  it.  Furthermore,  directorates-
general  should  integrate  Early  Detection  and  Exclusion  System  related  activities (such  as awareness  raising 
and training) into their Anti-Fraud Strategy.  

The application of EDES in practice  

The  directorates-general  should  consider including  steps in  their internal  control  systems  to  cover the  Early 
Detection and Exclusion System registration procedure (both exclusion and early detection). The directorates-
general should finalise on a timely basis the assessment of their pending  European Anti-Fraud Office cases 
and decide on the need to launch an Early Detection and Exclusion System exclusion procedure. In turn, the 
Directorate-General  for  Budget  should,  in  cooperation  with  other  central  services  (the  Legal  Service,  the 
Secretariat-General  and the European  Anti-Fraud  Office), actively  monitor that  directorates-general  perform 
an  adequate  follow-up  of  the  European  Anti-Fraud  Office  cases  and,  where  necessary,  remind directorates-
general of their responsibility to take prompt action.  

To assess the benefit of consulting the Irregularities Management System (IMS), the Directorate-General for 
Budget should clarify, following consultation with concerned directorates-general, the practical design of the 
checks  in  the  Irregularities  Management  System  and  how  and  to  what  extent  they  should  be  performed, 
bearing in mind the cost-effectiveness and efficiency of using the information contained in the Irregularities 
Management System. 

The  Directorate-General  for  Budget,  together  with  the  European  Structural  and  Investment  Funds 
directorates-general,  should  assess  the  cost  and  benefits  of  opening  up  ARACHNE  for  use  in  direct 
management  and  of  implementing  an  exchange  of  information  from  the  Early  Detection  and  Exclusion 
System to ARACHNE on the publicly listed excluded entities. Finally, the Directorate-General for Budget should 
analyse  the  access  logs  of  the  Early  Detection  and  Exclusion  System  database  of  the  Member  States’ 
authorities  and  share  the  results  with  the  directorates-general  in  shared  management  in  order  to  better 
target awareness raising efforts. 

Additional  information  provided  by  Directorates-General  BUDG,  DEVCO,  REGIO  and  RTD  on  the 
measures defined and/or implemented following the Internal Audit Service audit 

The  final  audit  report  was  published  on  25 January 2019.  In February 2019,  the  Directorate-General  for 
Budget has agreed with the Internal Audit Service an action plan to implement the related recommendations. 
In  particular,  the  Directorate-General  for  Budget  has  finalised  the  corporate  guide  based  on  the  Early 
Detection  and  Exclusion  System  and  updated  it  to  the  new  Financial  Regulation.  A  Communication  Plan 
endorsed by the Corporate Management Board in March 2019 is implemented by the Directorate-General for 
Budget  in  order  to  increase  awareness.  Moreover,  the  possible  use  of  ARACHNE  will  be  considered  but  is 
conditioned  by a  cost/benefit analysis, the  availability  of  related  budget  appropriations, and  the  need  to 

18 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

respect  fundamental  rights.  Increasing  cooperation  with  the  European  Anti-Fraud  Office  is  under  way  at 
directors’  level  and  the  follow-up  of  its  reports  is  already  addressed  at  the  Corporate  Management  Board 
level, while particular attention is devoted to the follow-up of the Office’s financial recommendations. Finally, 
the length of the Panel procedure is monitored under its new Rules of Procedure. 

The Directorate-General for International Cooperation and Development  services proposed an action plan to 
address the recommendations, which has been accepted by the Internal Audit Service. To improve guidelines 
on  the  Early  Detection  and  Exclusion  System,  the  Directorate-General  for  International  Cooperation  and 
Development  Companion  has  updated  chapter  13  on  28 May 2019  and  will  include  guidance  on  the 
requirements of the system in indirect management in the future manual for the Contribution Agreement by 
the  end  of  2019.  The  Directorate-General  for  International  Cooperation  and  Development  will  develop  an 
awareness  raising  campaign  in  coordination  with  the  Directorate-General  for  Budget,  revise  its  existing 
training  materials  which  provide  information  on  the  Early  Detection  and  Exclusion  System  and  conduct 
trainings  for  relevant  staff.  The  Directorate-General  for  International  Cooperation  and  Development  will 
update  its  Anti-Fraud  Strategy  on  the  basis  of  the  Commission’s  Anti-Fraud  Strategy  revision  in  2019.  In 
parallel with the strategy revision, the Directorate-General for International Cooperation and Development will 
update  its  internal  procedures  related  to  fraud  and  relations  with  the  European  Anti-Fraud  Office.  The 
Directorate-General  for  International  Cooperation  and  Development  will  also  review  its  internal  control 
systems and include steps to cover the Early Detection and Exclusion System registration procedure (covering 
both, exclusion and early detection). 

The  recommendation  has  been  accepted  by  the  Directorate-General  for  Regional  and  Urban  Policy  and 
consequently  an  action  plan  has  been  submitted  in  February 2019  to  the  Internal  Audit  Service,  without 
prejudice  to  the  fact  that  in  shared  management  transmission  of  information  by  Member  States  would 
require sector-specific rules. The Internal Audit Service has concluded that the action plan of the Directorate-
General for Regional and Urban Policy is deemed to be satisfactory to mitigate the risks identified. 

Concerning  the  Directorate-General  for  Research  and  Innovation,  the  final  audit  report  was  issued  on 
25 January 2019.  The  action  plan  has  been  prepared  and  takes  into  account  all  the  points  of  the 
recommendations. 

10.

  Audit  on  Intellectual  Property  Rights  supporting  activities  in  DGs  COMM, 
DIGIT, GROW, JRC and OP 

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of 
the  governance,  risk  management  and  control  processes  put  in  place  by  the  Commission  to  manage 
intellectual property rights (IPR). 

There are no observations/reservations in the 2017 annual activity reports of the audited directorates-general 
that relate to the area/process audited. The fieldwork was finalised in November 2018. All recommendations 
relate to the situation as of that date.  

The audit highlighted the following strengths: 

 

 

 

 

the  Central  IP  Service  of  the  Commission  (created  in  Joint  Research  Centre)  is  staffed  with  a 
competent team composed of specialists in the field of Intellectual Property Rights; 

the  enhanced  coordination  between  certain  IP-intensive  directorates-general  (such  as  the 
Directorate-General  for  Communication  and  the  Directorate-General  for  Internal  Market,  Industry, 
Entrepreneurship and SMEs) with the Central IP Service; 

the  creation  of  an  informative  and updated  webpage  on  the  intranet  site  of  the  Commission  (My 
Intracomm) where staff members of the Commission can obtain relevant information related to IP 
management; 

the Central IP Service offers  numerous Intellectual Property Rights related training courses, which 
are  open  to  all  staff  of  the  Commission.  The  courses  are  provided  by  specialised  personnel  and 
focus on specific issues such as procurement or social media.  

19 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The Internal Audit Service identified two issues concerning corporate IPR management at the Commission and 
the corporate software policy and formulated the following very important recommendations: 

Corporate IPR management at the Commission  

Joint Research Centre should: a) finalise the development of the dynamic IP inventory (to ensure that all the 
Commission directorates-general are able to continuously identify, classify and monitor Intellectual Property 
Rights protected intangible assets), b) follow-up with directorates-general and services on their obligation to 
identify and communicate the IP assets acquired/developed and c) develop clear guidelines to include initial 
assessment criteria to enable a consistent evaluation of IP assets to be made by the Central IP Service and 
the Intellectual Property Rights Correspondents.  

Moreover,  the  Joint  Research  Centre  should  develop  corporate  risk  management  guidance  for  Intellectual 
Property  Rights  protected  assets  and  ensure  its  dissemination  and  application  by  the  Intellectual  Property 
Rights Correspondents of the various directorates-general/services.  

Finally, in the process of updating Communication SEC(2001)1397 (16), Joint Research Centre should discuss 
with  the  Secretariat-General  and  the  Legal  Service  the  cost-effectiveness  of  the  existing  decision  making 
process  when  licensing  or  registering  IP  assets  with  a  view  to  simplifying  it.  The  IP  delegation  should  be 
amended based on the outcome of this discussion.  

Software and IT solutions  

The  Directorate-General  for  Informatics  should  update  the  ‘General  Terms  and  Conditions  for  Information 
Technology  Contracts’.  In  addition,  The  Directorate-General  for  Informatics  and  the  Joint  Research  Centre 
should jointly develop a software policy for the Commission to regulate the dissemination of software owned 
by the Commission.  

Additional information provided by Directorates-General DIGIT and  JRC on the measures defined 
and/or implemented following the Internal Audit Service audit 

On  the  intellectual  property  rights  management,  the  Internal  Audit  Service  recommended  to  the  Joint 
Research Centre the completion of a dynamic Intellectual Property inventory which now stands at more than 
50%  completion  (EURECA).  The  existing  vademecum  on  intellectual  property  rights  provides  a  scheme  for 
intellectual  property  rights  management,  it  will  be  replaced  by  a  more  dynamic  tool,  to  incorporate  various 
aspects of intellectual property rights assets. The Internal Audit Service also requested that the Joint Research 
Centre  seek  simplification  of  the  decision-making  process  when  licencing  out  or  registering  the  intellectual 
property  rights  assets;  during  2018  the  Joint  Research  Centre  already  initiated  the  appropriate  discussions 
with  other  directorates-general  in  this  respect.  On  the  intellectual  property  rights  software  and  information 
technology  solutions,  the  Joint  Research  Centre  together  with  the  Directorate-General  for  Informatics  will 
elaborate appropriate guidelines for establishing a Commission policy for regulating the dissemination of EU-
owned software. A complete action plan has been submitted and accepted by the Audit Service. 

As  the  Directorate-General  for  Informatics  actions  are  closely  related,  the  action  plan  submitted  to  the 
Internal  Audit  Service  takes  full  account  of  the  actions  and  implementation  dates  foreseen  by  the  Joint 
Research Centre. As the first steps of implementation being planned for mid/end 2019, related risks are thus 
expected to decrease accordingly. 

16  

Octroi de Pouvoirs Délégués dans le Domaine de la Propriété Intellectuelle, SEC(2001)1397. 

20 

 
 
 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Agriculture, natural resources and health  

1.

 Limited review of the adjustment of the reported error rate by DG AGRI and 
the calculation of the amounts at risk at payment 

The  objective  of  this  limited  review  was  to  assess  the  adjustment  made  by  the  Directorate-General  for 
Agriculture  and  Rural  Development  to  the  error  rates  reported  by  Member  States,  the  calculation  of  the 
amounts at risk at payment and the adequacy of the directorates-general own guidance.  

In  his 2016  annual  activity  report, the  Director General  of  the  Directorate-General  for  Agriculture  and Rural 
Development qualified his declaration of assurance on the use of resources (implementation of the Common 
Agricultural  Policy  expenditure)  by  formulating  three  reservations:  (1)  for  expenditure  related  to  Market 
Measures,  (2)  for  Direct  Payments  and  (3)  for  Rural  Development.  The  fieldwork  was  finalised  on 
2 February 2018. All recommendations relate to the situation as of that date. 

The audit highlighted the following strengths: 

  following  previous  recommendations  from  the  Internal  Audit  Service (17),  the  Directorate-General 
for Agriculture and Rural  Development developed methodological guidance for adjusting the error 
rates  in  line  with  the  requirements  of  the  central  services.  The  Internal  Audit  Service  also 
acknowledges that starting with financial year 2016, the majority (18) of the control statistics/data 
are  exclusively  transmitted  by  the  Member  States  to  the  Directorate-General  for  Agriculture  and 
Rural Development via ‘Statel/eDamis’ (19). This has improved the Directorate-General’s efficiency in 
analysing and treating the data; 

 

 

the  Internal  Audit  Service  notes  that  the  Certification  Bodies  reports  on  year  N  become  available 
only  as  of  mid-February  of  year  N+1  and  their  assessment  is  finalised  in  late  March,  while  the 
annual activity report has to be finalised by 25 April (20). Given these time constraints, the Internal 
Audit  Service  recognises  the  efforts  and  commitment  shown  by  the  Directorate-General  for 
Agriculture and Rural Development staff to assess all the information available which might require 
adjustments to be made to the error rates; 

the  Directorate-General  for  Agriculture  and  Rural  Development  has  well-established  planning  and 
coordination arrangements in place to support the adjustment process. For the 2016 annual activity 
report  exercise,  directorate  AGRI-H  ‘Assurance  and  Audit’  (H.1)  set  out  internal  milestones  for  the 
different  steps  and  deliverables,  which  helped  to  ensure  the  timely  completion  of  both  the  error 
rate  adjustment  process  and  the  drafting  of  the  relevant  parts  of  the  annual  activity  report.  The 
Internal  Audit  Service  also  acknowledges  that  the  operational  units  were  actively  involved  in  this 
process and, where relevant, contributed to the assessment by providing updates on the latest state 
of play as regards Partnership Agreements (PAs) action plans; 

  a good practice was noted as regards the comprehensive way Unit AGRI.H.4 ‘Assurance and audit  - 

Rural Development’ documented its assessment of the applied adjustments. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

17  

Final Report on the Limited Review of the Calculation and the Underlying Methodology of  the Directorate-General for Agriculture 
and Rural Development Residual Error Rates for the 2012 Reporting Year of 26 March 2013. 

18     Since  2014,  first  the  direct  payments  and  then  gradually  most  of  the  remaining  schemes’  statistics  were  transmitted  via 
‘Statel/eDamis’.  As  of  2016,  ‘Statel/eDamis’  is  used  for  ABB03  -  European  Agricultural  and  Guarantee  Fund  –  direct  payments 
(except  cross-compliance)  and  ABB04  –  EAFRD  (except  ex  post  controls).  Market  measures  statistics  are  still  transmitted  via 
ISAMM. 

19     Electronic channel for automated transmission of control data/statistics. 
20    
Instructions for the 2016 annual activity reports of 21 November 2016. 

21 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

2.

 Audit on the implementation of payments and corrections in DG AGRI (shared 
management) 

The  objective  of  the  audit  was  to  assess  whether  the  Directorate-General  for  Agriculture  and  Rural 
Development  internal  controls  and  procedures  are  effective  in  ensuring  the  correct  execution  of  European 
Agricultural  and  Guarantee  Fund  (EAGF)  payments  to  Member  States,  notably  in  respect  of  applicable 
regulatory  ceilings  and  payments  deadlines  and  the  correct  implementation  of  reductions  and  suspensions 
and financial corrections, including instalments and deferrals.  

The fieldwork was finalised on 24 October 2018. All recommendations relate to the situation as of that date. 

The Internal Audit Service recognises the Directorate-General for Agriculture and Rural Development efforts to 
design, set up and operate a comprehensive system to control and manage the implementation of European 
Agricultural  and  Guarantee  Fund  payments  and  corrections,  in  particular  in  view  of  the  complex  legal 
framework  governing  this  element  of  the  Common  Agricultural  Policy.  The  auditors  also  acknowledge  the 
efforts of the directorate-general to maintain relevant job descriptions and up-to-date back-up arrangements. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

3.

 Audit  on  the  management  of  Instrument  of  Pre-Accession  for  Rural 
Development II in DG AGRI 

The  objective  of  this  audit  was  to  assess  whether  the  Directorate-General  for  Agriculture  and  Rural 
Development  has  put  in  place  efficient  and  effective  governance,  risk  management  and  internal  control 
processes for implementing the Instrument of Pre-Accession for Rural Development II budget. 

The  aim  of  these  controls  is  to  ensure  that  financial  assistance  to  beneficiary  countries  is  implemented  on 
time,  in  a  legal  and  regular  way  and  delivers  on  the  objectives  stipulated  in  the  programmes  and  in  the 
Instrument of Pre-Accession for Rural Development II legal bases. 

No reservations regarding the management of Pre-Accession for Rural Development II were made in the 2017 
annual  activity  report  of  the  Directorate-General  for  Agriculture  and  Rural  Development.  The  fieldwork  was 
finalised on 23 November 2018. All recommendations relate to the situation as of that date. 

The  auditors  found  that  the  Directorate-General  for  Agriculture  and  Rural  Development  has  established 
knowledgeable  and  committed  teams  to  work  on  Pre-Accession  for  Rural  Development  II  in  both  the 
operational unit (pre-accession assistance unit) and in the pre-accession team (assurance and financial audit 
unit). 

The Internal Audit Service did not formulate any critical or very important recommendations. 

4.

 Audit on the evaluation process in DG AGRI 

The objective of the engagement was to assess the design and implementation of the controls put in place by 
the  Directorate-General  for  Agriculture  and  Rural  Development  to  ensure  an  effective  management  of  the 
evaluation process. 

The Internal Audit Service noted that the controls put in place by  the Directorate-General for Agriculture and 
Rural Development for the evaluation process were effectively designed and implemented at the time of the 
audit. 

The  Internal  Audit  Service  did  not  formulate  any  critical  or  very  important  recommendations.  Given  the 
positive  outcome  of  the  audit,  no  formal  audit  report,  as  envisaged  in  the  Mutual  Expectations  Paper,  was 
issued, but the results of the audit were communicated to the auditee in a closing note. 

22 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

5.

 Audit  on  closure  of  the  2007-2013  European  Fisheries  Fund  Operational 
Programmes in DG MARE 

The objective of the audit was to assess the design and implementation of the controls put in place by the 
Directorate-General  for  Maritime  Affairs  and  Fisheries  to  ensure  the  effective  closure  of  the  2007-2013 
European Fisheries Fund Operational Programmes. 

The Internal Audit Service noted that the Directorate-General for Maritime Affairs and Fisheries’ strategy for 
the  closure  of  the  2007-2013  European  Fisheries  Fund  Operational  Programmes  was  effectively  designed 
and implemented. 

The  Internal  Audit  Service  did  not  formulate  any  critical  or  very  important  recommendations.  Given  the 
positive  outcome  of  the  audit,  no  formal  audit  report,  as  envisaged  in  the  Mutual  Expectations  Paper,  was 
issued but the results of the audit were communicated to the auditee in a closing note. 

6.

 Audit on TRACES in DG SANTE 

The  objective  of  the  audit  was  to  assess  whether  the  TRAde  Control  and  Expert  System  (TRACES)  is 
adequately  managed  to  provide  and  maintain  over  time,  a  reliable  and  efficient  service  supporting  official 
controls and trade operations.  

There  were  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Health  and  Food  Safety  that  relate  to  the  area  audited.  The  fieldwork  was  finalised  at  the  beginning  of 
January 2018. All recommendations relate to the situation as of that date.   

The  auditors  recognise  the  ongoing  efforts made  by  the  Directorate-General  for  Health  and  Food  Safety  to 
provide  through  TRACES  a  reliable  and  efficient  service  to  support  official  controls  and  trade  operations.  In 
particular, the audit highlighted the following strengths: 

 

 

 

 

the  information  technology  activities  in  the  Directorate-General  for  Health  and  Food  Safety  are 
supported by a quality assurance and security team staffed by experts in the field, responsible for 
security assurance and  performance test activities of new versions of software, risk  assessments 
and security plans of IT systems. The team was reinforced with a team leader in September 2017; 

the Directorate-General for Health and Food Safety has launched the digitisation of the certificates 
workflow in the border clearance process for TRACES. The objective is for the digital document to 
become the original document and for there to be full paperless workflow. This Directorate-General 
has started pilot projects with non-EU countries for the use of an electronic signature in TRACES; 

the  development  team  for  TRACES  projects  works  under  Agile@EC,  a  set  of  project  methods  for 
incremental and iterative software development, adapted for business environments with changing 
priorities.  For  each  development  iteration  since  March 2016,  Directorate-General  for  Health  and 
Food  Safety  has  produced  a  progress  report  before  and  after  each  software  integration.  It  also 
formalised  an  iteration  plan  in  March 2017,  which  describes  how  to  plan,  manage  and  execute 
TRACES iterative developments; 

the  team  of  Directorate-General  for  Health  and  Food  Safety  working  on  TRACES  comprises 
competent and committed colleagues with experience of managing situations of extreme pressure 
and which require extensive coordination with other stakeholders. 

The Internal Audit Service identified two issues concerning IT governance and TRACES security and formulated 
the following very important recommendations: 

IT governance  

To strengthen the information-technology governance structure, the Directorate-General for Health and Food 
Safety should: 

23 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

 

 

 

 

for each area of responsibility of the Directorate-General for Health and Food Safety  - the ‘Health’ 
and the ‘Food safety’ pillars - organise regular meetings chaired by the respective competent Deputy 
Director-General or the Director-General on the definition, execution and prioritisation of information-
technology activities; 
set  up  an  ‘information  system  steering  committee  (TRACES  steering  committee)’  chaired  by  the 
Directorate-General for Health and Food Safety and involving all directorates-general using TRACES, 
as  well  as  ‘information-technology  project  steering  committees’  for  each  of  the  various  TRACES 
projects per business domain; 
update  and  align  the  working  arrangements  with  the  participating  directorates-general  in  TRACES 
and,  in  conjunction  with  these  directorates-general,  consider  developing  a  model  for  TRACES  cost 
sharing 
together  with  the  participating  directorates-general,  the  Directorate-General  for  Health  and  Food 
Safety  should  ensure  that  GovIS2  accurately  reflects  the  ownership,  modules,  operations,  projects 
and budget related to TRACES. 

TRACES security  

In order to strengthen TRACES security, the Directorate-General for Health and Food Safety should: 

 

 
 

 

 

perform an information security risk assessment and, in the event of high security risks, implement 
cost-effective mitigating measures; 
assess the feasibility of secure hosting for TRACES;  
improve controls related to the confidentiality and integrity of the information, such as access control 
and authentication, data masking and manual changes in the production environment; 
finalise  and  implement  those  procedures  required  to  conform  with  the  Commission’s  security 
standards,  notably  in  relation  to  the  information-technology  security  plan,  to  the  development  of  a 
policy  for  logging  and  monitoring  for  TRACES  based  on  business  needs,  as  well  as  to  vulnerability 
assessment and performance testing; 
ensure  that  the  Local  Information  Security  Officer  reports  periodically  on  information-technology 
security  matters  to  the  Directorate-General  for  Health  and  Food  Safety’s  senior  management  and 
that  he  is  involved  on  TRACES  information-technology  security-related  advisory  and  monitoring 
activities. 

Additional  information  provided  by  Directorate-General  SANTE  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The  Directorate-General  for  Health  and Food  Safety  accepted  all  recommendations  and produced  an  action 
plan. Several actions are already on-going with deadlines in late 2019 or 2020 (21). 

Concerning recommendation 1 on information technology governance, the Directorate-General for Health and 
Food  Safety  started  implementing  this  recommendation  on  TRAde  Control  and  Expert  System  governance; 
work  is  on-going  as  regards  TRAde  Control  and  Expert  System    steering  committee  and  project  steering 
committees. In addition, as regards food and feed safety, the Directorate-General for Health and Food Safety 
has set up a Working Group with the Member States to work on an implementing act on the functioning of the 
information  management  system  for  official  controls (22);  this  Working  Group  is  actually  the  primary 
governance  body  for  the  certification  implementation  in  TRAde  Control  and  Expert  System.  With  regard  to 
information  technology  governance  in  general,  the  Directorate-General  for  Health  and  Food  Safety’s  policy 
pillar  meetings,  chaired  by  the  Director-General,  started  to  include  more  general  and  specific  steer  on 
information technology matters. 

21  

22  

Full implementation of the action plan of the Directorate-General for Health and Food Safety depends on the application of the 
new control regulation (Regulation (EU) 2017/625) on 14 December 2019. By this date the use of TRACES will be officially covered 
by an active legal base and its usage will be mandatory for the business process supported by the Directorate-General for Health 
and Food Safety.   

IMSOC: information management system for official controls; Article 134 of Regulation (EU) 2017/625 on official controls   

24 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The Directorate-General for Health and Food Safety has taken actions without delay also on recommendation 
2 on information technology security: the weaknesses identified by the Internal Audit Service are addressed 
mainly by developing an ‘Access Control and Authentication Management Plan’ and a ‘logging and monitoring 
policy document’; it is also reinforcing its code review procedure and seeing to the full implementation of the 
existing  information  technology  security  plan.  The  procedure  of  vulnerability  assessment  and  performance 
testing, as applied since a few years, was formalised in late 2018. 

7.

 Audit on monitoring and enforcement of EU health law in DG SANTE 

The objective of the audit was to assess whether the Directorate-General for Health and Food Safety has put 
in  place  internal  control  systems  that  ensure  the  effective  and efficient  monitoring  and enforcement  of  EU 
health law.  

There  are  no  reservations  in  the  2017  annual  activity  report  of  this  Directorate-General  that  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  2 October 2018.  All  recommendations  relate  to  the 
situation as of that date. 

The auditors recognise the ongoing efforts made by this Directorate-General regarding the enforcement of EU 
health law and identified the following strength in particular: 

The Directorate-General for Health and Food Safety performs a six-monthly internal ‘coherence’ exercise. This 
consists  of  an  internal  review  covering  infringements  registered  in  NIF (23),  EU  Pilot  cases  and  complaints 
registered  in  CHAP (24).  This  exercise  is  used  to  prepare  its  six-monthly  prioritisation  of  the  cases  and 
facilitates supervision by senior management as well as political oversight on alleged breaches of EU law.  

The Internal Audit Service did not formulate any critical or very important recommendations. 

23  
24  

NIF is the corporate EU law infringements database. 
CHAP is the corporate database for ‘Complaints Handling – Accueil des Plaignants’. 

25 

 
 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Cohesion  

1.

 Audit on the evaluation process in DG EMPL and DG REGIO  

The objective of the audit was to assess if Directorates-General for Employment, Social Affairs and Inclusion 
and  for  Regional  and  Urban  Policy  effectively  plan,  design,  conduct,  report  and  follow-up  on  evaluations  in 
accordance  with  the  legal  framework  and  Better  Regulation  requirements,  and  if  they  provide  adequate 
methodological  support  to  the  evaluation  activities  by  the  Member  States  and  make  proper  use  of  their 
results. 

There  are  no  observations/reservations  in  the  2017  annual  activity  reports  of  Directorates-General  for 
Employment,  Social  Affairs  and  Inclusion  and  for  Regional  and  Urban  Policy  that  relate  to  the  area/process 
audited.  The  fieldwork  was  finalised  on  4 July 2018.  All  recommendations  relate  to  the  situation  as of  that 
date. 

The auditors recognised the ongoing efforts made by the Directorates-General for Employment, Social Affairs 
and  Inclusion  and  for  Regional  and  Urban  Policy  to  continuously  improve  the  evaluation  process  and 
strengthen the evaluation capacity in the Member States. More specifically, the audit highlighted the following 
strengths: 

 

 

 

 

 

the  directorates-general  provide  regular  methodological  guidance  and  support  to  the  Member 
States on monitoring and evaluation; 

in order to strengthen capacity building in the Member States, the directorates-general jointly set-
up  an  Evaluation  Helpdesk,  which  provides  methodological  support,  training  and  advice  to  the 
Member States in the areas of monitoring and evaluation. In addition, it supports the  directorates-
general  in  summarising  the  findings  of  the  evaluations  carried  out  by  the  Member  States,  which 
underpin  the  their  various  reports  (e.g.  Summary  Report,  Strategic  Report,  Annual  Activity  Report, 
Annual  Management  and  Performance  Report, and  Cohesion  Report).  Furthermore,  it  supports  the 
directorates-general in performing an in-depth review of the Member States’ evaluation plans and 
carries out evaluation peer reviews; 

the  directorates-general  closely  cooperate  and  coordinate  their  approaches  regarding  monitoring 
and evaluation systems (e.g. common guidance, consultation on each other’s evaluation strategies, 
joint analysis of the evaluation results for the multi-fund Operational Programmes, collaboration on 
the directorates-general ex post evaluations).  

the  Directorate-General  for  Regional  and  Urban  Policy  has  followed  up  on  the  ex  post  evaluation 
2007-2013 by creating a comprehensive action plan including outstanding actions to be completed 
which was approved by the Board of Directors; 

the  Joint  Research  Centre  in  collaboration  with  the  directorates-general  provides  -  through  its 
Centre for Research and Impact Evaluations (CRIE) - methodological support to the Member States 
in carrying out counterfactual impact evaluations; 

  communication of ex post evaluation results (e.g. dedicated communication package covering visual 
communication methods on ex post evaluation results, public consultation, evaluation conference); 

 

the  directorates-general  are  strongly  engaged  with  all  stakeholders  including  beneficiaries  and 
scientific experts. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

2.

  Review of the annual assurance packages by DGs EMPL, MARE and REGIO 

The  objective  of  the  audit  was  to  assess  whether  the  review  of  the  annual  assurance  packages  (APs)  by 
Directorates-General for Employment, Social Affairs and Inclusion and, for Maritime Affairs and Fisheries and 
for Regional and Urban Policy is effective in supporting the declaration of assurance by the Directors-General 
in their annual activity reports and is performed in a timely manner. 

26 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The  Directorate-General  for  Regional  and  Urban  Policy  and  the  Directorate-General  for  Employment,  Social 
Affairs and Inclusion and made the following reservations in their 2017 annual activity reports concerning the 
area/process under the scope of this audit engagement:  

The  Directorate-General  for  Regional  and  Urban  Policy:  concerning  deficiencies  in  the  management  and 
control  systems  for  the  2014-2020  programming  period  (PP)  in  nine  Member  States  and  one  European 
territorial cooperation programme;  

The  Directorate-General  for  Employment,  Social  Affairs  and  Inclusion:  concerning  deficiencies  in  the 
management and control systems for the 2014-2020 programming period in six Member States. 

The Directorate-General for Maritime Affairs and Fisheries did not include any reservation in its 2017 annual 
activity report regarding the 2014-2020 programming period (PP) or the area/process audited. The fieldwork 
of this audit was finalised on 27 July 2018, except for the follow-up work on the compliance audit missions, 
which was finalised on 18 September 2018. All recommendations relate to the situation as of those dates. 

The  Internal  Audit  Service  acknowledges  the  efforts  made  by  Directorates-General  or  Employment,  Social 
Affairs  and  Inclusion,  for  Maritime  Affairs  and  Fisheries  and  for  Regional  and  Urban  Policy  to  improve  and 
further  develop  the  process  for  the  review  of  the  assurance  packages.  The  audit  highlighted  the  following 
strengths: 

  Reinforced  accountability,  control  and  assurance  framework  for  the  2014-2020  programming 
period:  the  2014-2020  programming  period  introduces  the  following  major  changes  to  the 
accountability  provisions  and  the  management  and  control  systems  (at  Member  State  - 
Commission  levels)  compared  to  the  previous programming  period, which, from a  design  point  of 
view, strengthen the accountability, control and assurance framework: 

  a twelve-month (i.e. annual) accounting period running from 1 July to 30 June; 

  a  retention  of  10%  from  each  EU  interim  payment  to  protect  the  EU  budget  from 
legality  and regularity  issues, with  reimbursement/recovery  of  the  annual  balance  only 
due following the acceptance of the accounts by the Commission; 

  The  Member  States  submitting  to  the  Commission  an  annual  assurance  package 
containing  five  documents.  Three  of  these  documents  are  key  elements  for  the 
Commission’s assurance building process: (1) certified accounts for expenditure declared 
to  the  Commission  in  relation  to  the  accounting  period,  (2)  an  annual  control  report 
prepared  by  the  Audit  Authority  which  discloses  a  residual  error  rate  after  the  Audit 
Authority’s verification of the financial corrections implemented by the Member States in 
the  certified  accounts,  and  (3)  an  audit  opinion  prepared  by  the  authority  on  the 
accuracy  of  the  accounts,  the  effective  functioning  of  the  system and the  legality  and 
regularity of the underlying transactions;  

  the  obligatory  application  of  net  financial  corrections  where  the  Commission  or  the 
European  Court  of  Auditors  detect 
irregularities  demonstrating  serious  system 
deficiencies,  unless  the  Member  States  already  identified  these  irregularities  in  the 
assurance  documents  or  other  national  audit  reports  submitted  to  the  Commission  or 
has taken remedial corrective measures by the time of detection by EU audits. 

  Common/consistent  approach  for  the  review  of  the  assurance  packages:  as  stated  in  a  previous 
Internal  Audit  Service  audit  report,  the  directorates-general  have  set  up  several  mechanisms  to 
improve  consistency,  increase  synergies  and  use  their  available  competences  and  expertise  in  an 
efficient  manner.  These  mechanisms  include,  amongst  others,  the  initiative  of  the  Directorates-
General for Employment, Social Affairs and Inclusion and for or Regional and Urban Policy to share 
and  pool  audit  resources  and  activities  for  the  2014-2020  programming  period  and  increased 
coordination between the three directorates-general through a network of auditors (i.e. ‘auditNET’). 
In  particular,  concerning  the  review  of  the  directorates-general  assurance  packages,  the  three 
directorates-general have jointly developed: 

27 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

  In May 2016, a common outline of the internal processes (including template letters and 
checklists)  for  the  desk  review  of  the  assurance  packages  for  the  acceptance  of 
accounts and the examination of legality and regularity aspects; 

  In  May 2017,  a  common  methodology  (i.e.  Enquiry  Planning  Memorandum  –  EPM)  for 
carrying  out  on  the  spot  work  on  the  assurance  packages  with  two  major  risk  based 
audit activities: (1) fact-finding missions and (2) compliance audits.  

While  there  are  certain  differences  between  the  three  directorates-general  in  the  practical 
implementation of the desk review process of the assurance packages (e.g. timing of the review), 
they are taking a consistent overall approach for both control activities (i.e. desk review and on the 
spot audit work) that support their review of the assurance packages.  

  Continuous  support  to  the  Audit  Authorities  as  acknowledged  by  the  Internal  Audit  Service  in  a 
previous  audit  report,  the  directorates-general  have  put  in  place  mature  arrangements  with  the 
Audit Authorities to help them be better prepared to exercise their reinforced role in the 2014-2020 
programming period. These include two main mechanisms, namely: (1) guidance documents and (2) 
regular  meetings  including  at  least  two  technical  group  meetings  per  year,  bilateral  annual 
coordination  meetings  with  the  Audit  Authority  of  each  Member  States  and  the  annual 
‘Homologues’  Group  meeting.  In  the  early  stages  of  the  2014-2020  programming  period,  the 
directorates-general focussed their support to the Member States on setting up their management 
and  control  systems  and  the  designation  process,  while  now  the  focus  has  naturally  shifted  to 
supporting the Member States to prepare the assurance packages adequately. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

28 

 
 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Research, energy and transport  

1.

 Audit on ex ante controls on Horizon 2020 grant payments in DG CNECT 

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  ex  ante  controls  on  Horizon  2020  grant 
payments  in  the  Directorate-General  for  Communications  Networks,  Content  and  Technology  and  their 
contribution  to  the  overall  assurance  on  the  legality,  regularity  and  sound  financial  management  of  the 
expenditure.  

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Communications Networks, Content and Technology that relate to the area/process audited. The fieldwork was 
finalised on 18 April 2018. All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  acknowledges  the  ongoing  efforts  made  by  the  Directorate-General  for 
Communications  Networks,  Content  and  Technology  to  ensure  the  effective  implementation  of  ex  ante 
controls  on  Horizon  2020  grant  payments.  In  particular,  the  Internal  Audit  Service  highlights  the  following 
strengths: 

  strong  control  environment:  the  strong  control  environment  in  the  Directorate-General  for 
Communications  Networks,  Content  and  Technology,  including  systematic  reviews  of  the  periodic 
reports  by independent experts, is a solid basis on  which  the effective implementation of  ex ante 
controls on Horizon 2020 grant payments is based; 

  Operational  Sector  and  Administrative  and  Financial  Units  (OS-AFU)  Network:  the  agenda  of  the 
bimonthly meetings of the network systematically includes a point on Horizon 2020, to discuss in 
particular the grant payments process and to ensure that there is a coherent approach and overall 
coordination of the process. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

2.

 Audit on legacy programmes in DG ENER - management of final payments and 
closure 

The objective of the audit was to assess the compliance of the Directorate-General for Energy final payment 
(including  implementation  of  ex  post  audit  results)  and  closure  processes  for  legacy  programmes  with  the 
relevant rules and procedures.  

The 2016 annual activity report  of the  Directorate-General for Energy included a reservation specifically on 
the  area/process  under  the  scope  of  this  audit  engagement.  In  particular,  for  the  Seventh  Framework 
Programme  (FP7),  the  Directorate-General  for  Energy  estimated  a  ‘residual  error  rate’  of  3.68%,  which 
remains persistently above the 2% materiality threshold, and therefore maintained a reservation in line with 
similar  reservations  expressed  by  the  other  directorates-general  of  the  research  family.  The  fieldwork  was 
finalised on 18 July 2018. All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  recognises  the  ongoing  efforts  made  by  the  Directorate-General  for  Energy  in 
ensuring  the  effective  and  timely  processing  of  final  payments  and  the  closure  of  the  legacy  programmes 
with reduced staff numbers. The audit highlighted the following strengths: 

 

 

the  Directorate-General  for  Energy  has  an  effective  ex  post  control  function  for  the  European 
Energy  Programme  for  Recovery  and  Trans-European  Networks  for  Energy  programmes  which 
ensures coverage of 100% of projects and beneficiaries; 

the Directorate-General for Energy has a well-established system for monitoring and reporting on 
the  financial  aspects  of  the  implementation  of  the  legacy  programmes,  which  covers  the  most 
important  areas  such  as  invoice  ageing,  de-commitments,  closed  and  terminated  projects  with 
‘reste à liquider’/outstanding commitments. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

29 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

3.

 Audit on H2020 grant management (phase II) in ERCEA 

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  internal  control  system  in  place  in  the 
European  Research  Council  Executive  Agency  to  ensure  the  legality,  regularity  and  sound  financial 
management of Horizon 2020 grant payments and amendments. 

There are no observations/reservations in the 2017 annual activity report of the European Research Council 
Executive Agency relating to the area/process audited. The fieldwork was finalised on 25 September 2018. All 
recommendations relate to the situation as of that date. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

4.

 Audit on grants management phase II: project management and payments for 
H2020 in INEA 

The objective of the audit was to assess whether the Innovation and Networks Executive Agency  has put in 
place: 

a) an effective project management process to ensure that beneficiaries implement the Horizon 2020 projects 
that have been funded in line with the grant agreement; and  

b)  effective  ex  ante  controls  on  Horizon  2020    grant  payments  (including  Anti-Fraud  checks  and  corrective 
mechanisms)  to  provide  its  Authorising  Officer  by  Delegation  with  reasonable  assurance  on  the  sound 
financial management of Horizon 2020  and the legality and regularity of the underlying transactions.  

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Innovation  and  Networks 
Executive Agency that relate to the area/process audited. The fieldwork was finalised on 22 October 2018. All 
recommendations relate to the situation as of that date. 

The audit highlighted the following strengths: 

 

 

to  aid  the  project  management  process,  the  Innovation  and  Networks  Executive  Agency  has 
developed  a  risk  assessment  document  which  is  filled  in  per  project  after  the  grant  agreement 
preparation  phase  that  includes a  description  of  several  risk factors  (e.g.  the  number  of  partners, 
different  funding  ratios  used).  Based  on  this  document,  the  Innovation  and  Networks  Executive 
Agency decides on the type  and intensity of monitoring  activities proportionate to the project risk 
level/complexity. The document is updated at the key milestones (e.g. end of the reporting periods, 
at handovers to other Project Officers). This enables the Agency to revise the initial risk level of the 
project and to adapt the monitoring strategy for the project accordingly; 

the  Innovation  and  Networks  Executive  Agency  has  developed  a  detailed  checklist  for  ex  ante 
controls that includes the main aspects not covered by the information-technology tools (Compass, 
Sygma) but which need to be verified by the Project Manager and the Financial Officer. It includes 
specific  checks  on  the  Certificate  of  Financial  Statement,  costs  related  to  subcontracting  or  third 
parties, other direct costs, etc. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

5.

 Audit  on  nuclear  decommissioning  and  waste  management  programme 
implementation in JRC 

The  objective  of  the  audit  was  to  assess  whether Joint  Research  Centre  has set  up  adequate  and effective 
management  and  control  systems  to  implement  the  nuclear  decommissioning  and  waste  management 
programme. 

There are no observations/reservations in the 2017 annual activity report of Joint Research Centre that relate 
to the area/process audited. The fieldwork was finalised on 13 November 2018. All recommendations relate to 
the situation as of that date. 

30 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The audit highlighted the following strengths: 

 

 

 

 

 

the creation of a special Nuclear Decommissioning Department (G.III) and the centralisation of all 
Joint  Research  Centre    nuclear  Units  in  Directorate  G  (as  part  of  the  Joint  Research  Centre  
reorganisation in 2016); 

the  involvement  of  Joint  Research  Centre  senior  management  to  manage  long-pending  strategic 
issues.  Furthermore,  discussions  at  directorate-general  level  and  in  the  High  Level  Steering 
Committee helped to better cope with licensing and stakeholder management issues and to get a 
better insight, on the future development of the programme; 

the recent positive results in managing the Italian liabilities; 

the  high  level  of  professionalism  and dedication  of  decommissioning  staff  and the  demonstrated 
ability  to  cope  with  the  short-term  impact  of  long-term  limitations  on  the  implementation  of  the 
programme; 

the  participation  of  the  nuclear  decommissioning  Unit  in  the  technical  advisory  group  of  the 
Organisation  for  Economic  Co-operation  and  Development  operative  programme  in  nuclear 
decommissioning. This enables establishing contacts, sharing practical experiences and exchanging 
costs/failures  that  can  help  in  managing  difficulties  encountered  with  the  decommissioning  and 
waste management programme. 

Concerning the public procurement process: 

 

 

 

the  increasing  use  of  direct  contracts  with  specific  deliverables  rather  than  quoted  times  and 
means contracts under a framework contract;  

the attempt to limit using expensive intra muros contractors permanently; 

the training of decommissioning staff on how to use correctly framework contracts. 

The Internal Audit Service identified one issue concerning HR management and formulated the following very 
important recommendation: 

Joint  Research  Centre  should  adequately  staff  the  sites  where  decommissioning  and  waste  management 
programme  related  activities are  performed.  Staff  should  have  the  relevant  expertise  and operational  staff 
managing  decommissioning  procurement  procedures  and  contracts  should  get  adequate  support  from 
specialists. 

Additional  information  provided  by  Joint  Research  Centre  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The  Joint  Research  Centre is reviewing  existing  competences  and will  elaborate  a  Human  Resources plan  in 
the  field  of  decommissioning  and  waste  management,  for  addressing  the  Internal  Audit  Service 
recommendations.  The  Joint  Research  Centre  action  plan  was  approved  by  the  Internal  Audit  Service.  More 
specifically, the Joint Research Centre sets out mitigating measures in the short and long run. In the short run, 
a thorough analysis-assessment of scenarios for all four relevant Joint Research Centre’s sites is scheduled 
for  end  2019,  in  the  long  term  the  appropriate  timetable  and  strategy  for  the  acquisition  of  missing 
staff/competences  will  be  defined.  Functions  and  competences  of  existing  staff  will  be  complemented  by 
adequate training. 

6.

 Audit on HR management - recruitment of temporary scientific staff in Joint 
Research Centre 

The  objective  of  the  audit  was  to  assess  whether  the  management  and  control  system  set  up  by  Joint 
Research  Centre  for  the  timely  identification  of  the  competences  needed  to  achieve  the  objectives  of  the 

31 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

directorate-general  and  the  recruitment  of  temporary  scientific  staff  that  match  those  needs  is  adequately 
designed, compliant with the applicable rules and effectively implemented. 

There are no observations/reservations in the 2017 annual activity report of Joint Research Centre that relate 
to the area/process audited. The fieldwork was finalised on 29 November 2018. All recommendations relate to 
the situation analysed as of that date. 

Joint Research Centre has shown the strong will to invest into the development of its staff (including scientific 
staff)  as  a  means  to  fulfil  its  future  policy  objectives.  In  its  Strategy  2030,  Joint  Research  Centre  clearly 
states  how  recruitment,  development  and  care  of  staff  are  central  for  the  achievement  of  its  strategic 
objectives. 

The Internal Audit Service identified two issues concerning the recruitment strategy and the monitoring of the 
recruitment process and formulated the following very important recommendations: 

Recruitment strategy 

Joint  Research  Centre  should  complete  the  ongoing  competency  mapping  at  individual  staff  member  level, 
carry  out  the  subsequent  gap  analysis  and  develop  subsequent  consolidated  human-resource  recruitment 
plans. 

Monitoring the recruitment process 

Joint Research Centre should revise the existing indicators used for monitoring recruitment by setting specific 
targets  for  each  indicator,  periodically  re-assessing  those  targets  and  ensuring  that  indicators  provide 
meaningful information on the entire process. Joint Research Centre should also define indicators to measure 
the effectiveness of its actions to attract staff. Periodical updates on the evolution of the indicators should be 
provided to senior management. 

Additional  information  provided  by  Joint  Research  Centre  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The Joint Research Centre has adopted a tool for competency mapping after a pilot phase, and has analysed 
competency requirements per policy area allowing it to identify existing competences as well as recruitment 
needs. The staff competence mapping is ongoing and scheduled to be finalised by end 2019. An inventory of 
recruitment needs will be established per Directorate, covering a 2-yearly timespan as of beginning of 2020. 
A consolidated recruitment plan will be updated regularly as of 2020. Related indicators are currently under 
revision  and  their  calculation  methods  will  be  defined  for  measuring  the  effectiveness  for  attracting  new 
staff.  In  the  meantime,  the  existing  core  indicators  provide  a  control  instrument  for  the  overall  recruitment 
process. The Joint Research Centre action plan was approved by the Internal Audit Service. 

7.

 Audit on REA’s preparedness to deliver SEDIA-related services  

Since  the  Single  Electronic  Data  Interchange  Area  project  is  still  being  rolled  out,  the  Internal  Audit  Service 
decided to assess the current state of preparedness of the Agency to effectively deliver Single Electronic Data 
Interchange  Area-related  services,  in  order  to  highlight  at  an  early  stage  any  weaknesses  that  could  later 
jeopardise the full achievement of the project’s goals. The audit was due to examine the establishment of the 
necessary operational processes for the effective and efficient delivery of the services for which the Research 
Executive Agency is responsible. 

In  the  period  July  to  September 2018,  the  audit  team  performed  the  preliminary  survey  focusing  their 
analysis on the following main areas:  

  project  governance  arrangements  and  the  Research  Executive  Agency  organisational  structure  for 

providing Single Electronic Data Interchange Area-related services; 

  processes and procedures; 

  human resources; 

32 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

  monitoring and supervision. 

The Internal Audit Service noted that: 

 

 

the  project  governance  arrangements  introduced  by  the  Research  Executive  Agency  for  the 
provision of the legal validation and financial verification services under the Single Electronic Data 
Interchange  Area  framework  are  adequate,  and  the  Research  Executive  Agency’s  organisational 
structure supports the delivery of new services. 

the Agency has, together with stakeholders, put in place adequate processes and procedures for the 
provision of the validation services to clients. 

 

there are adequate business continuity arrangement in place. 

  human-resource related aspects are adequately managed in terms of quantity and quality of staff 
necessary  to  deliver  the  services.  The  main  challenges  are  well  known  and  are  being  closely 
monitored. 

 

the Agency has designed an adequate monitoring and reporting system on the provision of Single 
Electronic Data Interchange Area-related services. 

In  view  of  these  positive  observations,  the  Internal  Audit  Service  decided  to  close  the  audit  after  the 
preliminary survey. No formal audit report, as envisaged in the Mutual Expectations Paper, was issued, but the 
results of the Internal Audit Service preliminary survey were communicated to the Agency in a closing note. 

8.

 Audit on H2020 grant management (phase II - project monitoring and ex ante 
controls) in REA 

The  objective  of  the  audit  was  to  assess  whether  the  Research  Executive  Agency  has  put  in  place  (1)  an 
effective  project  management  process  (ensuring  that  projects  are  effectively  implemented  by  the 
beneficiaries  in  line  with  the  grant  agreement),  and  (2)  effective  ex  ante  controls  on  Horizon  2020  grant 
payments (contributing to the assurance concerning the legality, regularity and sound financial management 
of the expenditure).  

There are no observations/reservations in the 2017  annual activity report of the Research Executive Agency 
that  relate  to  the  area/process  audited.  The  fieldwork  was  finalised  on  24 September 2018.  All 
recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  acknowledges  the  ongoing  efforts  made  by  the  Research  Executive  Agency  in 
ensuring  effective  project  monitoring  and  the  implementation  of  ex  ante  controls  on  Horizon  2020  grant 
payments  in  the  context  of  an  increasing  workload.  In  particular,  the  Internal  Audit  Service  highlights  the 
strong control environment implemented in  the Research Executive Agency, including reviews of the periodic 
reports  by  independent  experts  and  the  internal  networks  of  Project  Officers,  Financial  Officers,  Ethics 
Correspondents  and  Legal  Officers,  which  is  a  solid  basis  for  the  effective  implementation  of  the  project 
management and ex ante controls on Horizon 2020 grant payments. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

9.

 Audit on ex ante controls on H2020 grant payments in DG RTD 

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  ex  ante  controls  on  Horizon  2020  grant 
payments  in  the  Directorate-General  for  Research  and  Innovation  and  their  contribution  to  the  overall 
assurance on the legality, regularity and sound financial management of the expenditure.  

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Research and Innovation that relate to the area/process audited. The annual activity report concludes that the 
overall control system including  ex ante controls and  ex post controls,  has achieved its objective of keeping 

33 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

the  error  rate  within  the  target  range  of  2  to  5%.  The  fieldwork  was  finalised  on  12 June 2018.  All 
recommendations relate to the situation as of that date. 

The Internal Audit Service did not formulate any critical or very important recommendations.  

34 

 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

External action 

1.

 Audit on the Partnership Instrument in FPI 

The objective of the audit was to assess the effectiveness and efficiency of the governance, risk management 
and  control  processes  put  in  place  by  the  Service  for  Foreign  Policy  Instruments  for  the  selection  and 
implementation  of  the  Partnership  Instrument  (PI) operations,  including  the  coordination  of  these  processes 
with other directorates-general/services involved and the EU delegations (EU delegations).  

The 2017 annual activity report of the Service for Foreign Policy Instruments included a reservation linked to 
the material multi-annual error rate for the former programme Cooperation with Industrialised Countries (ICI) 
which ended in 2013 but whose completion budget line is in the same budget chapter/activity as the PI. The 
fieldwork  was  finalised  on  10 September 2018.  All  recommendations  relate  to  the  situation  analysed  as  of 
that date. 

The  Internal  Audit  Service  identified  one  issue  concerning  the  Implementation  of  PI  projects:  Control 
environment and HQ supervision and formulated the following very important recommendation: 

The Service for Foreign Policy Instruments should update the manual for supervision missions and ensure the 
independence of the function responsible for designing and implementing the control on the implementation 
of  the  financial  circuits.  Moreover,  the  Service  for  Foreign  Policy  Instruments  should  take  measures  to 
strengthen the control environment in the EU delegation US and ensure that the shortcomings found during 
the audit are addressed and do not reoccur in the future. 

Additional  information  provided  by  the  Service  for  Foreign  Policy  Instruments  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

The  second  recommendation  (classified  as  very  important)  requested  FPI:  a)  to  remedy  the  weaknesses 
identified  in  the  set-up  of  the  control  environment  at  HQ  and  EU  Delegation  US  level;  b)  to  ensure  the 
independence between the design and the control functions of financial circuits, and c) to update the process 
manual for supervision missions and ensure appropriate reporting to the FPI Authorising Officer by Delegation  
on the outcome of supervision mission findings and the actions taken with regard to recommendations issued.  

The Service for Foreign Policy Instruments accepted both recommendations and established an action plan to 
address them.  

Concerning  recommendation  2  a)  the  Service  for  Foreign  Policy  Instruments  has  already  implemented  the 
mitigating  measures  by  ensuring  that  financial  verification  is  undertaken  by  the  Regional  Team  Americas 
within  the  financial  circuit.  In  addition,  Service  for  Foreign  Policy  Instruments  has  recruited  an  additional 
contractual agent for operational verification in the US delegation in line with the action plan.  

The action addressing recommendation 2 b) ‘in order to ensure the independence between the design and the 
control functions of financial circuits,  the responsibility for each individual supervision mission is henceforth 
entrusted to a Service for Foreign Policy Instruments Head of Unit outside the contract and finance unit that is 
not directly concerned by the specific mission’, has already been implemented as of October 2018.  

The  remaining  recommendations  will  be  implemented  by  the  deadlines  foreseen  in  the  action  plan  (see 
immediately above) or latest end Q3 2019. 

2.

 Audit  on  the  Neighbourhood  Investment  Facility  and  the  Western  Balkans 
Investment Framework in DG NEAR 

The  objective  of  the  audit  was  to  assess  the  adequacy  and  effectiveness  of  the  management  and 
coordination  activities  of  the  Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  for  the 
implementation  of  the  Neighbourhood  Investment  Facility  (NIF)  and  the  Western  Balkans  Investment 
Framework (WBIF). 

35 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

There  are  no  observations/reservations  in  the  2017  annual  activity  report  that  relate  to  the  area/process 
audited. The fieldwork was finalised on 6 September 2018. All recommendations relate to the situation as of 
that date. 

The  auditors  recognise  the  ongoing  efforts  made  by  the  Directorate-General  for  Neighbourhood  and 
Enlargement  Negotiations  to  improve  the  design  and  implementation  of  the  Neighbourhood  Investment 
Facility  and  the  Western  Balkans  Investment  Framework.  For  example,  in  2017  the  Directorate-General  for 
Neighbourhood  and  Enlargement  Negotiations  produced  a  vademecum  that  encompasses  and  clarifies  all 
rules and guidance related to the Western Balkans Investment Framework. The Manual of procedures for the 
Directorate-General  for  Neighbourhood  and Enlargement  Negotiations  also  provides a  useful  explanation  of 
the processes and key information sources regarding the Neighbourhood Investment Facility and the Western 
Balkans Investment Framework as well as the applicable rules and agreements with all International Financial 
Institutions involved. 

The Internal Audit Service also identified some good practices during the audit fieldwork among which is the 
reporting  on  the  financial  leverage  and  the  status  of  the  loans  associated  with  the  Western  Balkans 
Investment  Framework  grants  and  the  guidelines  for  EU  visibility  that  the  EU  delegation  to  Georgia  shares 
with its implementing partners.  

The Internal Audit Service identified four issues on Neighbourhood Investment Facility: financial management, 
Neighbourhood Investment Facility: Commission monitoring and reporting at facility level, WBIF: monitoring at 
the facility level and Western Balkans Investment Framework: financial management and financial reporting 
and formulated the following very important recommendations: 

Neighbourhood Investment Facility: financial management  

The  Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  should  clarify  the  rules  for  the 
calculation of the  International Financial Institutions’ remuneration for hybrid  projects and provide  guidance 
on the establishment of the final amount of the remuneration for those projects. 

Neighbourhood Investment Facility: Commission monitoring and reporting at facility level  

The  Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  should  establish  a  reporting 
mechanism and  consolidate  the  information  on  the  status and actual  amount  of  the  loans  provided  by  the 
International  Financial  Institutions  in  order  to  calculate  the  actual  leverage  and  ensure  that  the 
Neighbourhood Investment Facility annual report contains information on the ongoing and completed projects 
in  terms  of  achievements  and  performance.  The  Directorate-General  for  Neighbourhood  and  Enlargement 
Negotiations  should  also  revise  the  methodology  for  the  calculation  and  reporting  of  the  expected  and 
achieved  leverage  on  the  basis  of  the  signed  contracts,  signed  loan  agreements  and  the  implementation 
reports of the International Financial Institutions. 

Western Balkans Investment Framework: monitoring at the facility level  

The  Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  should  ensure  that  the  authority 
and responsibility of all the actors involved in the Western Balkans Investment Framework reporting process 
are  clearly  defined  and  reassess  the  scope  of  the  monitoring  responsibilities  of  the  Western  Balkans 
Investment Framework Secretariat. The Directorate-General for Neighbourhood and Enlargement Negotiations 
should clarify within the annual activity report the scope of the management declaration and ensure that the 
declarations provided by the partner International Financial Institutions are in compliance with the contractual 
arrangement i.e. adequately cover the Western Balkans Investment Framework contributions to the European 
Western Balkans Joint Fund and all ongoing individual European Western Balkans Joint Fund grants. 

WBIF: financial management and financial reporting 

The Directorate-General for Neighbourhood and Enlargement Negotiations should revise the guidelines on the 
preparation of the project  forms to  clarify when the payment schedules for the grants to be funded  by the 
European  Western  Balkans  Joint  Fund  should  be  prepared.  In  addition,  The  Directorate-General  for 
Neighbourhood and Enlargement Negotiations should ensure that in the future the payments under WB-EDIF 

36 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

(25) equity funds are based on adequate disbursement forecasts to avoid excessive amounts of unused funds. 
The rules for the calculation of the fees due for cancelled or partially implemented grants should be clearly 
defined. The  Directorate-General for Neighbourhood and  Enlargement  Negotiations should  request from the 
EBRD (26) regular financial information on the commitments and disbursements at project level, the fees due 
and paid and perform the clearing of the open pre-financing as appropriate. 

Additional  information  provided  by  Directorate-General  NEAR  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

Following  the  Internal  Audit  Service  recommendations,  the  Directorate-General  for  Neighbourhood  and 
Enlargement Negotiations will reinforce its financial monitoring and reporting, update guidelines and rules of 
procedures of the two investment facilities. 

The Directorate-General for Neighbourhood and Enlargement Negotiations clarified minimum thresholds and 
provided  guidance  on  the  establishment  of  the  final  amount  of  remuneration  for  hybrid  projects  by  the 
December 2018 fees agreement. The Directorate-General for Neighbourhood and Enlargement Negotiations 
will clarify the rules for the inclusion of the communication and visibility and audit costs in the basis of the 
calculation. 

The  Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  will  propose  a  revision  of  the 
Western  Balkans  Investment  Framework  Rules  of  Procedure  within  the  review  of  its  architecture.  The 
Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations  will  clarify  within  the  annual  activity 
report  the  scope  of  the  management  declaration  and  ensure  that  the  declarations  provided  by  the  partner 
International  Financial  Institutions  are  in  compliance  with  the  contractual  arrangement.  Some  of  the  issues 
were already addressed in the meeting between the Directorate-General for Neighbourhood and Enlargement 
Negotiations and the European Bank for Reconstruction and Development as Joint Fund Manager and will be 
further followed up. 

3.

 Audit  on  grant  and  procurement  award  process  under  European 
Neighbourhood Instrument direct management in DG NEAR 

The objective of the audit was to assess whether the Directorate-General for Neighbourhood and Enlargement 
Negotiations  Headquarter  and  the  EU  delegations  manage  grant  and  procurement  award  procedures  under 
the European Neighbourhood Instrument in direct management effectively, efficiently and in accordance with 
the applicable procedures and guidelines to ensure legality and regularity of the underlying transactions. 

The  following  observations/reservations  were  made  in  the  2017  annual  activity  report  of  the  Directorate-
General for Neighbourhood and Enlargement Negotiations concerning the area under the scope of this audit 
engagement: 

Reservation 1: difficulties in monitoring adequately all projects (including grant and procurement under direct 
management) in Libya and Syria. The Directorate-General for Neighbourhood and Enlargement Negotiations is 
not in a position to perform all the checks it needs to do due to the instability in the countries and the lack of 
access to supporting documents. 

Reservation  2:  error  rate  above  2%  in  direct  management  grants  covering  the  European  Neighbourhood 
Instrument and other instruments managed by the Directorate-General for Neighbourhood and Enlargement 
Negotiations. 

The  fieldwork  was  finalised  on  10 December 2018.  All  recommendations  relate  to  the  situation  as  of  that 
date. 

The audit highlighted the following strengths: 

25   Western Balkans Enterprise Development Innovation Facility. 
26  
European Bank for Reconstruction and Development. 

37 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

 

the  guidance  documents  (Practical  guide  –  PRAG,  Manual  of  procedures  -  MAP)  are  quite 
comprehensive and detailed;  

  staff are knowledgeable overall; 

 

the paper files are in general well maintained, procurement/grant award procedures are in general 
well documented, and the audit trail is ensured. 

The Internal Audit Service identified one issue concerning  supervision missions and formulated the following 
very important recommendation: 

The Directorate-General for Neighbourhood and Enlargement Negotiations should revise the  Process Manual 
for Supervision Missions to Delegations to improve the effectiveness of the supervision missions, in particular 
by: a) introducing risk-based planning of supervision missions; b) revising missions frequency; c) adapting the 
length of the on-the-spot visits to the requirements of the manual; d) issuing instructions on the finalisation 
phase  of  the  mission  (validation  of  issues,  acceptance  of  recommendations,  preparation  of  an  action  plan, 
follow-up),  and  e)  establishing  a  procedure  to  disseminate  the  best  practices  identified  and  to  anticipate 
potential  problems  in  other  EU  delegations.  the  Directorate-General  for  Neighbourhood  and  Enlargement 
Negotiations should also ensure that the provisions of the Process Manual are adequately followed. 

Additional  information  provided  by  Directorate-General  NEAR  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The Directorate-General for Neighbourhood and Enlargement Negotiations will update the Process Manual to 
improve  the  effectiveness  of  its  supervisory  missions  to  delegations.  The  Directorate-General  for 
Neighbourhood  and  Enlargement  Negotiations  will  also  coordinate  the  annual  and  multiannual  indicative 
planning  of  missions,  in  collaboration  with  contracts  and  finance  units  and the  relevant  operational  units  in 
order  to  adhere  to  the  provisions  of  the  process  manual  (including  frequency,  performance  and  follow-up). 
The  Annual  and  Multiannual  indicative  plan  will  be  submitted  for  the  approval  of  the  Financial  Assistance 
Steering Committee at the beginning of each year. 

4.

 Audit on the assurance building process in headquarters in DG DEVCO 

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of 
the  governance,  risk  management  and  internal  control  processes  put  in  place  for  the  assurance  building 
process in the Directorate-General for International Cooperation and Development headquarters (HQ). 

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
International Cooperation and Development that relate to the process audited. The fieldwork was finalised on 
5 December 2018. All recommendations relate to the situation as of that date. 

The audit work highlighted the following strengths: 

 

 

 

the  overall  efficiency  of  the  process to  prepare  the  annual  activity  report  taking  into  account  the 
need  to  consolidate  information  from  a  high  number  of  EU  delegations  and  the  tight  deadlines 
(External Action  Management Reports  - EAMRs - of 86 EU delegations to be  submitted by end of 
January,  External  Action  Management  Reports  of  headquarters  and  Trust  Funds  (TF)  managers’ 
activity reports to be submitted by 15 to 20 February at the latest, draft annual activity report to be 
submitted to central services by end of February); 

the  level  of  process  automation  reached  in  the  External  Management  Reports  of  headquarters, 
since data are automatically uploaded into the application from the EU delegations’ External Action 
Management Reports, the Key Performance Information dashboard and the audit module; 

the  knowledgebase  website  of  the  Directorate-General  for  International  Cooperation  and 
Development includes all available guidance and instructions on the assurance-building process; 

38 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

 

 

the  support  provided  by  Directorate  DEVCO.R  staff  to  EU  delegations  and  Directorates  during  the 
External  Action  Management  Reports  and  External  Action  Management  Reports  of  headquarters 
exercise; 

the overall periodic Key Performance Indicators monitoring process, involving Directorate DEVCO.R 
staff, finance and contract Units in each Directorate, geographic desks and EU delegations. 

The  Internal  Audit  Service  identified  one  issue  concerning  guidance,  instructions  and  management 
declarations and formulated the following very important recommendation: 

The Directorate-General for International Cooperation and Development should establish specific guidance on 
the  information  to  be  summarised  or  reported  for  the  status  of  management  declarations  in  the  External 
Action Management Reports of headquarters and monitor and report on it. It should also provide information 
in the annual activity report on the definition and content of this control element as well as on the status of 
management declarations and on their contribution to the assurance building process. 

Additional  information  provided  by  Directorate-General  DEVCO  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The  final  audit  report  was  published  on  21 January 2019.  The  Directorate-General  for  International 
Cooperation  and Development  services  proposed  an  action  plan  to  address the  recommendation,  which  has 
been  accepted  by  the  Internal  Audit  Service.  The  Directorate-General  for  International  Cooperation  and 
Development  has  implemented  the  actions  defined  in  the  action  plan.  Changes  were  made  to  the  External 
Action  Management Reports  of headquarters for the  reporting on  2018, which now include instructions and 
guidance on the definition of materiality at Directorate level. These reports were adapted to include specific 
guidance  for  the  annual  management  declarations  (specifying  which  information  needs  to  be  provided  and 
what  type  of  monitoring  to  be  conducted).  The  2018  annual  activity  report  included  information  on  the 
definition and content of this control element as well as on the status of management declarations and on 
their contribution to the assurance building process.  

The  Directorate-General  for  International  Cooperation  and Development  considers  that  the  recommendation 
has been fully implemented  with the  2018 annual activity reporting  process and is ready for  review by the 
Internal Audit Service. 

39 

 
 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Education and citizenship

1.

 Audit on DG EAC’s ex post financial audits, independent audit bodies’ opinions 
and controls on grant proposal evaluation for Erasmus+ actions implemented 
by national agencies 

The objective of the audit was to assess whether the audited key building blocks of  control strategy of the 
Directorate-General  for  Education,  Youth,  Sport  and  Culture,  for  the  Erasmus+  programme  actions 
implemented  by  the  National  Agencies  are  adequate  and  effectively  implemented  to  provide  reasonable 
assurance on the legality and regularity of the underlying transactions executed by the National Agencies. 

There  are  no  observations  or  reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Education, Youth, Sport and Culture that relate to the areas/processes audited. The fieldwork was finalised on 
4 December 2018. All recommendations relate to the situation as of that date. 

The Internal Audit Service recognises the Directorate-General for Education, Youth, Sport and Culture's efforts 
to  manage  the  implementation  of  the  Erasmus+  programme  in  a  complex  environment  involving  a  large 
number  of  implementing  bodies  (National  Agencies,  national  authorities  and  Internal  Audit  Bodies).  In 
particular, the Directorate-General for Education, Youth, Sport and Culture: 

 

regularly updates its control strategy based on lessons learnt by making changes to the procedures 
and revising guidance for the implementing bodies; 

  ensures that its approach to various controls in the National Agencies is balanced by coordinating 
the  audits  and  control  visits,  while  applying  the  single  audit  principle  to  minimise  the  burden  for 
beneficiaries and the National Agencies; 

  staff implementing the control strategy are knowledgeable and motivated and  have accumulated 

valuable experience in supervising the programme implementing bodies. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

2.

 Audit  on  Erasmus+  and  Creative  Europe  grant  management  Phase  II  (from 
project monitoring to payment) in EACEA 

The  objective  of  the  audit  was  to  assess  if  the  Education,  Audiovisual  and  Culture  Executive  Agency  put  in 
place  an  effective  project  management  process  to  ensure  that  (1)  beneficiaries  implement  the  E+  and 
Creative  Europe  projects  in  line  with  the  grant  agreement,  and  (2)  the  underlying  transactions  (including 
payments)  are  legal  and  regular  in  order  to  provide  the  Authorising  Officer  by  Delegation  (AOD)  with 
reasonable assurance regarding the sound financial management of the E+ and CE programmes. 

The  fieldwork  was  finalised  on  17 December 2018.  All  recommendations  relate  to  the  situation  as  of  that 
date.  

In its 2017 annual activity report the Agency made a reservation related to “Internal control system partially 
functioning due to Internal Control Component III ‘Control Activities’ and IV ‘Information and Communication’ 
needs  major  improvements  in  terms  of  documentation  of  the  Education,  Audiovisual  and  Culture  Executive 
Agency procedures, guidelines and controls over their implementation.” This reservation also concerns the area 
under the scope of this audit engagement. 

40 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The  Internal  Audit  Service  recognises  the  Education,  Audiovisual  and  Culture  Executive  Agency’s  ongoing 
efforts to: 

 

implement the recommendations of the Internal Audit Service audit on grant management phase I 
(from the call to the signature of contracts) in order to improve its internal control environment (27). 
In  particular,  in  terms  of  guidelines,  the  Agency  launched  a  cleaning  up  exercise  and  created  a 
single entry point, i.e. a dedicated section ‘Procedures’ of its intranet which contains the procedures, 
instructions  and  checklists  developed  at  Agency  level.  Moreover,  the  Agency  has  re-assessed  its 
financial circuits taking into consideration the risks and the cost-effectiveness of controls and has 
identified the necessary changes that will be submitted to the attention of the incoming Director; 

 

improve the functionalities of PEGASUS (the local IT application for grant management) to make it 
more fit-for-purpose;  

 

train its staff to perform better their tasks; 

  provide  systematic  statistical  reports  to  support  the  monitoring  of  the  main  steps  of  the  grant 

management process (i.e. payment execution, ex post audits, appeals, litigation cases). 

The  Internal  Audit  Service  identified  three  issues  concerning  the  internal  control  system  related  to  project 
management  and  payments,  project  monitoring  and  assurance  on  the  functioning  of  the  internal  control 
system and formulated one critical and two very important recommendations: 

Internal control system related to project management and payments (very important) 

The Education, Audiovisual and Culture Executive Agency should monitor centrally the correct implementation 
of the Agency’s central guidance, including the alignment of the units’ specific working arrangements with the 
central  guidance.  Attendance  at  mandatory  training  courses  by  the  relevant  staff  members  should  also  be 
monitored. 

Project monitoring (very important) 

The Education, Audiovisual and Culture Executive Agency should complete the central guidance on devising a 
monitoring  strategy  at  unit  level  and  on  assessing  risks  at  project  level,  and  verify  centrally  the  units’ 
monitoring  strategies  to  assess  their  compliance  with  the  central  guidance  and  to  enable  achieving  their 
objectives.  Projects’  risk  profiles  should  be  systematically  recorded  in  PEGASUS  throughout  the  projects’ 
lifecycle, and this information should be used to steer the monitoring activities. 

Assurance on the functioning of the internal control system (critical) 

The Education, Audiovisual and Culture Executive Agency should ensure that the Authorising Officers by Sub 
Delegation  provide  coherent  information  on  the  state  and effectiveness  of  the  internal  controls in  the  units 
under their responsibility and the related results.  

Moreover  it  should  better  manage  the  exception  and  non-compliance  events  by  a)  providing  support  and 
advice  to  the  operational  units  in  the  identification  phase  of  exceptions  and  non-compliance  events, 
b) ensuring that these cases are adequately assessed and justified and exhaustive information is provided to 
the Director when taking decisions (including on the mitigating actions proposed), c) monitoring the effective 
implementation  of  the  mitigating  actions  to  avoid  the  recurrence  of  exceptions  and  non-compliance  events 
and periodically report on it to the Authorising Officer by Delegation. Finally, the central register for exceptions 
and non-compliance event should be maintained and monitored regularly and the Director should receive a bi-
annual report summarising, via a management tool or dashboard, all exceptions and non-compliance events, 
the  control  deficiencies  identified,  their  severity  and  the  affected  internal  control  principles,  the  mitigating 
actions taken and their state of implementation. 

27  

In 2018, the Internal Audit Service carried out two follow-up audit engagements which enabled to close three recommendations, 
including the critical one on the Role of the Evaluation Committee. At the date of the present report, all the remaining 
recommendations stemming from the audit phase I were reported as ready for review by the Agency. They will be followed-up in 
Q1 2019.  

41 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Additional  information  provided  by  the  Director  of  EACEA  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The  Education,  Audiovisual  and  Culture  Executive  Agency  proactively  took  mitigating  measures  as  far  as 
possible between the end of the fieldwork and the issuing of the final report on 31 January 2019. 

In  addition,  the  Agency  has  provided  the  Internal  Audit  Service  with  an  action  plan  mitigating  the  identified 
risks,  which  has  been  accepted.  The  action  plan  is  to  be  implemented  during  2019  in  response  to  the  final 
audit report. 

Based  on  a  limited  follow-up  audit  of  the  actions  that  have  been  implemented  since  the  end  of  the  audit 
fieldwork  phase  and  up  to  7 March 2019,  the  Agency  was  informed  on  14 March  that  the  Internal  Audit 
Service  considers  ‘that  the  underlying  risks  have  been  partially  mitigated  and  will  therefore  downgrade  the 
rating of the recommendation from ‘critical’ to ‘very important’. 

The  Directorate-General  for  Communications  Networks,  Content  and  Technology  closely  monitors  the 
implementation of the action plan by the Education, Audiovisual and Culture Executive Agency. 

3.

 Audit  on  monitoring  the  implementation  and  performance  of  2014-2020 
national programmes by DG HOME  

The  objective  of  this  audit  was  to  assess  whether  the  Directorate-General  for  Migration  and  Home  Affairs 
effectively monitors the implementation and performance of the Asylum, Migration and Integration Fund and 
Internal Security Fund national programmes (NPs) for the 2014-2020 programming period. 

The fieldwork was finalised on 30 June 2018. All recommendations relate to the situation as of that date. 

The audit highlighted the following strengths: 

 

 

 

 

 

 

the  Directorate-General  provides  regular  methodological  guidance  and  support  to  the  Member 
States  on  monitoring  and  evaluation.  Member  States  are  able  to  submit  questions  to  this 
Directorate-General  and  obtain  answers  to  these  queries  via  the  'Frequently  asked  questions' 
mechanism as well as via direct contact with the responsible Desk Officers; 

the Directorate-General for Migration and Home Affairs maintains a constructive dialogue with the 
Member  States  by  establishing  Asylum,  Migration  and  Integration  Fund/Internal  Security  Fund  
Committees and organising dedicated workshops/seminars on a regular basis; 

the  Directorate-General  carried  out  intensive  monitoring activity  of  the  Member States during  the 
period 2015-2017 in order to assess progress on EU co-financed actions in the Member States; 

the  Directorate-General  for  Migration  and  Home  Affairs  representatives  were  present  in  at  least 
one Monitoring Committee meeting held per Member State/Fund during the period 2016-2017 (for 
the sample of Member States reviewed by the Internal Audit Service); 

the Directorate-General has created an SFC (28) support portal bringing together information on the 
legal  bases  as  well  as  the  conclusions  that  were  reached  during  the  Asylum,  Migration  and 
Integration Fund and Internal Security Fund  Committee meetings, workshops and meetings held by 
the Asylum, Migration and Integration Fund and Internal Security Fund  Evaluation networks; 

in  accordance  with  Article  1  of  the  Commission  Delegated  Regulation  (EU)  2017/207  the 
directorate-general  has  put  in  place  a  European  Evaluation  and  Monitoring  Network  for  Asylum, 
Migration  and  Integration  Fund/Internal  Security  Fund    composed  of  the  national  evaluation 
coordinators that were appointed by the Member States. This network is tasked with, among other 

28  

Shared Fund Management Common System. 

42 

 
 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

duties,  providing  contributions  to  the  implementation  of  the  common  monitoring  and  evaluation 
framework that forms the basis for the monitoring and evaluation performed for both Funds. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

4.

 Audit on risk management in DG HOME  

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  risk  management  process  in  Directorate-
General for Migration and Home Affairs in identifying, assessing, and managing critical and significant risks. 

There are no observations/reservations in the 2017 annual activity report of Directorate-General for Migration 
and Home  Affairs  that  relate  to  the  area/process  audited.  The  fieldwork was finalised  on  21 June 2018.  All 
recommendations relate to the situation as of that date. 

The  auditors  recognise  the  ongoing  efforts made  by  Directorate-General  for  Migration  and  Home  Affairs  to 
further develop their risk management process. The audit highlighted the following strengths: 

  Unit  HOME.E4  organised  a  workshop  for the  staff  involved  in  the  2018  risk  assessment  exercise. 
The objective was to bridge the knowledge gap by providing basic training on risk assessment and 
risk management principles. It was very well received by staff; 

 

 

the  Directorate-General  for  Migration  and  Home  Affairs’  risk  management  guide  for  2018  was 
deemed  to  be  appropriate  and  clear  by  the  staff  involved  in  the  risk  assessment  exercise.  The 
Internal Audit Service noted  that the  2018  guide was  more comprehensive than the guidance for 
previous years (2017 and 2016); 

the  successive  validation  of  risks:  first  by  the  Heads  of  Unit  of  each  directorate,  then  by  the 
Director.  The  risks  are  reviewed  and  validated  before  they  are  sent  to  Unit  HOME.E4  for 
consolidation in the Directorate-General’s risk register. 

The Internal Audit Service identified two issues concerning the integration of the risk management process in 
the  organisation’s  culture  and  systems  and  the  risk  identification,  assessment  and  risk  response  and 
formulated the following very important recommendations: 

Integration of the risk management process in the organisation’s culture and systems  

The Directorate-General for Migration and Home Affairs should develop risk management so that it becomes 
a  continuous,  proactive  and  systematic  process  that  is  fully  embedded  in  the  Directorate-General’s  core 
business activities, is integrated into all steps of the Strategic Planning and Programming cycle, and is subject 
to  regular  senior  management  steer  and  involvement.  It  needs  to  clearly  describe  the  roles,  responsibilities 
and tasks of the key actors in the risk management process and ensure that they have sufficient knowledge 
by  identifying  and  addressing  any  training  needs.  Finally,  the  directorate-general  should  properly  document 
the  identification  and  assessment  of  risks  related  to  decentralised  Agencies  and  take  into  account  risks 
concerning  information  technology  support  services  provided  by  the  Directorate-General  for  Justice  and 
Consumers and report on these to the coordinating Units HOME.E4 and A1. 

Risk identification, assessment and risk response  

The  Directorate-General  for  Migration  and  Home  Affairs  should  strengthen  its  guidance  and  methodology 
used for identifying and assessing risks (including lost opportunities), by considering  other risk identification 
methodologies  which  may  be  better  matched  to  its  specific  circumstances.  The  Directorate-General  should 
duly  take  into  account  the  criteria  defined  in  the  corporate  risk  management  guidance  for  assessing  and 
identifying  critical  risks,  clarify  how  to  deal  with  crosscutting  risks  at  corporate  level  and  at  directorate-
general level, and ensure that risks not deemed significant enough to be included in the Directorate-General’s 
central  risk  register  are  regularly  identified,  assessed,  documented  and  monitored  in  risk  registers  at 
Directorate and Unit level. The Directorate-General should review its definition of acceptable risk level, update 
its  guidance  accordingly  and  ensure  its  consistent  implementation  across  the  Directorate-General.  In  the 
Directorate-General’s  central  risk  register  the  risk  response  should  be  clearly  indicated  for  all  the  identified 

43 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

significant  and  critical  risks.  Finally,  action  plans  should  include  clearly  formulated  and  effective  mitigating 
actions with clearly assigned process owners, milestones and deadlines. 

Additional  information  provided  by  Directorate-General  HOME  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The recommendation ‘Integration of the risk management process in the organisation’s culture and systems’ 
is scheduled to be implemented in July 2019. The Directorate-General for Migration and Home Affairs is well 
on  track  with  the  implementation;  some  of  the  actions  had  already  been  proactively  implemented  by  the 
Directorate-General for Migration and Home Affairs, even before the final audit report was issued; e.g. before 
the  official  launch  of  the  annual  risk  exercise  for  2019,  top  management  of  the  Directorate-General  for 
Migration  and  Home  Affairs  defined  the  scope  of  the  exercise,  taking  into  account  the  nature  of  the 
operations  of  the  Directorate-General  for  Migration  and  Home  Affairs  and  the  environment  in  which  it 
operates,  and  the  exercise  was  regularly  discussed  in  the  senior  management  meetings  of  the  directorate-
general. 

The  recommendation  ‘Risk  identification,  assessment  and  risk  response’  is  scheduled  to  be  implemented  in 
July 2019. The Directorate-General for Migration and Home Affairs is well on track with the implementation; 
some of the actions had already been pro-actively implemented by the Directorate-General for Migration and 
Home Affairs, even before the final audit report was issued, e.g. before the official launch of the annual risk 
exercise  for  2019,  top  management  of  the  Directorate-General  for  Migration  and  Home  Affairs  determined 
which risks are to be included its risk register, considering the specificities of this Directorate-General. 

5.

 Audit on risk management in DG JUST 

The objective of the audit was to assess the effectiveness of the risk management process in the Directorate-
General for Justice and Consumers in identifying, assessing, and managing critical and significant risks. 

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Justice and Consumers that relate to the area/process audited. The fieldwork was finalised on 19 June 2018. 
All recommendations relate to the situation as of that date. 

The  auditors  recognise  the  ongoing  efforts  made  by  the  Directorate-General  for  Justice  and  Consumers  to 
further develop its risk management process. The following strengths were identified during the audit: 

  senior management’s involvement in the risk management process;  

 

in its meetings, senior management discussed the 2018 risk assessment exercise, and 2017 mid-
term review of risks before they were officially launched by Unit JUST.01; 

  senior  management  reviewed  the  2018  risk  register  before  it  was  endorsed  by  the  Director-

General; 

 

risk management is a regular agenda point at senior management meetings; 

  Unit JUST.01 organised a workshop with a presentation on risk management, which was addressed 
to  the  risk  management  task  force  members.  The  purpose  of  the  workshop  was  to  bridge  the 
knowledge  gap  through  the  provision  of  basic  training  on  risk  assessment  and  risk  management 
principles. The presentation was very well received by the TF members; 

  at  the  time  of  the  audit,  the  directorate-general  was  in  the  process  of  updating  its  directorate-
general-wide  manual  of  procedures.  An  updated  version  of  the  guide  on  procedures  of  the 
directorate-general was published on the intranet on 4 June 2018 and communicated to staff. This 
includes a dedicated part on risk management, which has also been updated; 

 

Intranet page of the Directorate-General for Justice and Consumers has a dedicated section on risk 
management which contains guidance and other information on risk management, as well as the 
current risk register; 

44 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

 

the  directorate-general  regularly  reports  to  the  Cabinet  on  the  development  of  actions  for 
mitigating politically important significant risks. 

The Internal Audit Service identified one issue concerning the risk identification, assessment and risk response 
and formulated the following very important recommendation: 

The  Directorate-General  for  Justice  and  Consumers  should  strengthen  its  guidance  and  methodology  for 
identifying  and  assessing  risks  to  include  the  consideration  of  lost  opportunities,  external  dimensions  and 
crosscutting  risks  and  the  possibility  of  using  different  risk  identification  methodologies  which  are  better 
matched to its specific circumstances. The  directorate-general should apply the criteria defined in corporate 
risk  management  guidance  for  assessing  and  identifying  critical  risks  and  ensure  that  risks  not  deemed 
significant  enough  to  be  included  in  the  Directorate-General’s  central  risk  register  are  regularly  identified, 
assessed,  documented  and  monitored  in  risk  registers  at  Directorate  or  Unit  level.  The  directorate-general 
should  review  its  definition  of  acceptable  risk  level,  update  its  guidance  accordingly  and  ensure  consistent 
implementation across the directorate-general. In the central risk register of the directorate-general, the risk 
response should be indicated for all the significant and critical risks identified and action plans should include 
clearly  formulated  and effective  mitigating  measures  with  clearly  assigned  process owners, milestones and 
deadlines. 

Additional  information  provided  by  Directorate-General  JUST  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

All  recommendations  stemming  from  this  audit  were  accepted  by  the  Directorate-General  for  Justice  and 
Consumers, and the action plan was partially implemented in 2018. The risk management guide was updated 
accordingly.  Two  workshops  have  been  organised  in  the  light  of  the  2019  risk  management  exercise.  At 
Directorate’s  and  Horizontal  Unit’s  levels  a  risk  register  is  kept  and  regularly  monitored.  The  methodology 
used  for  identifying  and assessing  risks  was  revised.  A  mini-session  meeting  with  the  new  members  of  the 
Task Force (representative staff appointed by each Director/Head of Unit to assist in compiling and assessing 
potential risks identified within their Directorate/Horizontal Unit) took place at the beginning of the 2019 risk 
management exercise, followed by two workshops. The risk management exercise was launched at the same 
time  as  the  Management  Plan  and  the  assessment  of  risks  started  from  the  objectives  of  the  directorate-
general. 

6.

 Audit on procurement in DG JUST 

The objective of the audit was to assess the adequacy of the design and the effective implementation of the 
Directorate-General  for  Justice  and  Consumers’  internal  control  systems  for  the  management  of  the 
procurement process and the effectiveness and efficiency of the related financial circuits. 

There are no observations/reservations in the 2017 annual activity report of  Directorate-General for Justice 
and  Consumers  that  relate  to  the  area/process  audited.  The  fieldwork  was  finalised  on  20 July 2018.  All 
recommendations relate to the situation as of that date. 

The audit highlighted the following strengths: 

 

the ongoing efforts and improvements made by Unit JUST.04 after having taken over  the tasks of 
the Shared Resource Directorate in the procurement process; 

  The Directorate-General for Justice and Consumers prepared the ‘Red flags  – information note on 
fraud indicators’ as an annex to its 2012 Anti-Fraud Strategy (AFS). Although the annex needs to be 
slightly updated following the adoption of the new Anti-Fraud Strategy, it sets out fraud indicators 
in a very clear and comprehensive manner; 

 

the  review  of  ABAC  access  rights  for  the  Directorate-General  for  Justice  and  Consumers  is 
performed by the Directorate-General for Migration and Home Affairs. This approach is in line with 
the  Directorate-General  for  Budget  recommendation  that  this  review  should  be  assigned  to  a 
neutral verifier. 

45 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The  Internal  Audit  Service  identified  one  very  important  issue  concerning  the  preparation  of  procurement 
procedures and formulated the following very important recommendation: 

The  Directorate-General  for  Justice  and  Consumers  should  ensure  that  the  needs  analysis  is  properly 
documented and signed off by the responsible Authorising Officer and update the needs analysis before the 
launch of the procurement procedure. The needs analysis should include: 

 

the estimated amount of the contract, properly supported by relevant information as to how it was 
determined; 

  an  explanation  of  what  other  options  were  considered  before  deciding  to  launch  a  new  call  for 

tender; 

 

the  lessons  learnt  during  the  execution  of  the  contract  currently  in  force  and  how  any  identified 
issues  were  addressed  in  the  new  calls  for  tender,  where  relevant;  and  justification  of  the 
outsourcing option, where relevant. 

Additional  information  provided  by  Directorate-General  JUST  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

In order to improve the needs assessment, the Directorate-General for Justice and Consumers has introduced 
in  April 2019  an  ‘Orientation  Document’  containing  the  main  elements  to  launch  a  procurement  file.  This 
document  enables  policy  units  to  confirm  the  need  to  have  a  procurement  activity  implemented,  identified 
earlier, during the preparation of the Annual Work Programmes. The ‘Orientation Document’ accompanies any 
new  request  for  a  procurement  activity  to  be  charged  on  the  Annual  Work  Programme  2019.  This  is 
complemented  by  a  register  of  all  planned  procurement  activities,  to  be  signed-off  by  the  responsible 
Authorising Officers by Delegation. 

All  recommendations  stemming  from  this  audit  were  accepted  by  the  Directorate-General  for  Justice  and 
Consumers and will be implemented in 2019. 

46 

 
 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Economic and financial affairs

1.

 Consulting engagement on document management in DG ECFIN  

The  objective  of  the  consulting  engagement  was to  provide  advice  to  the  Directorate-General  for  Economic 
and  Financial  Affairs  on  its  document  management  system  with  a  view  to  improving  its  effectiveness  and 
efficiency. 

As this was a consulting engagement and not an audit, no audit recommendations were formulated and the 
Internal Audit Service will not undertake follow up work. 

2.

 Audit  on  effectiveness  and  efficiency  of  DG  FISMA’s  performance 
management system 

The  objective  of  the  audit  was  to  assess  whether  the  Directorate-General  for  Financial  Stability,  Financial 
Services and Capital Markets Union’s performance management system is adequate in the areas of planning, 
monitoring and reporting on the delivery of both its key legislative and administrative policy objectives.  

There  were  no  reservations  in  the  2017  annual  activity  report  of  this Directorate-General  that  relate  to the 
process  audited.  The  fieldwork  was  finalised  on  7 December 2018.  All  recommendations  relate  to  the 
situation as of that date. 

The audit highlighted the following strengths: 

 

 

the  Directorate-General  for  Financial  Stability,  Financial  Services  and  Capital  Markets  Union  used 
the  expertise  available  across  all its  Directorates to  undertake  the  preparation  of  the 2016-2020 
Strategic  Plan  and  the  first  Management  Plan  under  the  revised  strategic  planning  and 
programming  reporting  structure.  A  special  project  team (29)  was  created  for  this  purpose  and 
composed of representatives from across the directorate-general; 

the directorate-general has set up and effectively applies a ‘Traffic Light system’ in their mid term 
review  process  to  provide  assurance  on  the  achievement  of  ‘target  dates’.  The  different  colours 
provide immediate information to management on the level of achievement of key objectives. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

3.

 Audit on the adequacy of DG GROW’s preparation and supervision of the parts 
of the COSME work programmes delegated to EASME 

The  objective  of  the  audit  was  to  assess  whether  the  Directorate-General  for  Internal  Market,  Industry, 
Entrepreneurship  and  SMEs  has  put  in  place  adequate  control  processes  for  preparing  and  supervising  the 
parts of the COSME programme delegated to the Executive Agency for Small and Medium-sized Enterprises, 
in order to enable their efficient and effective implementation by the Agency. 

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Internal  Market,  Industry,  Entrepreneurship  and  SMEs  that  relate  to  the  area/process  audited.  The  fieldwork 
was finalised on 12 September 2018. All recommendations relate to the situation as of that date.  

The Internal  Audit Service recognises the  Directorate-General for Internal  Market, Industry, Entrepreneurship 
and SMEs efforts to put in place effective supervisory and monitoring arrangements for the implementation 
of  the  parts  of  the  COSME  programme  delegated  to  the  Executive  Agency  for  Small  and  Medium-sized 
Enterprises. In particular, the audit highlighted the following strengths: 

29  

In 2016, the Directorate-General for Financial Stability, Financial Services and Capital Markets Union established “Project Teams” to 
improve transparency and the efficiency of crosscutting policy work. Each team comprises staff from at least two directorates and 
has clearly defined deliverables and deadlines. Their work is overseen by the Financial Services Policy Group (FSPG).  

47 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

 

 

in  March  2018, the  Directorate  responsible  for  the  COSME  programme  in  the  Directorate-General 
for  Internal  Market, Industry,  Entrepreneurship  and SMEs  and the  Executive  Agency  for Small  and 
Medium-sized Enterprises established a COSME Code of good practices on the coordination of calls 
for  tender  and  calls  for  proposals.  The  document  lists  the  agreed  measures  to  strengthen  the 
coordination  of  their  services  and  to  facilitate  a  timely  and  efficient  implementation  of  the 
corresponding COSME actions; 

in  collaboration  with  the  Agency,  the  Directorate-General  for 
Industry, 
Entrepreneurship and SMEs improved and streamlined the template used to prepare the roadmaps 
of  delegated  actions  and  SMs  in  order  to  better  meet  the  Agency’s  planning  needs  following  the 
adoption of the COSME annual work programme. 

Internal  Market, 

The Internal Audit Service did not formulate any critical or very important recommendations. 

4.

 Audit  on  supervision  of  project  management  and  payment  for  Galileo  in  
DG GROW 

The objective of the audit was to assess the design and effective implementation of the Directorate-General 
for Internal Market, Industry, Entrepreneurship and SMEs internal controls for (1) the supervision of the Galileo 
programme  implemented  by  the  European  Space  Agency  and  the  GNSS  Supervisory  Authority  and  (2)  the 
processing by the Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs of the related 
financial transactions in order to ensure their legality and regularity. 

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Internal  Market,  Industry,  Entrepreneurship  and  SMEs  that  relate  to  the  area/process  audited.  The  fieldwork 
was finalised on 6 December 2018. All recommendations relate to the situation as of that date. 

The Internal  Audit Service recognises the  Directorate-General for Internal  Market, Industry, Entrepreneurship 
and  SMEs  efforts  to  ensure  effective  supervision  of  the  project  management  and  timely  payment  for  the 
Galileo programme. In particular, the Directorate-General for Internal Market, Industry, Entrepreneurship and 
SMEs developed specific checklists to monitor the operational and financial progress of the programme in the 
progress reports submitted by the European Space Agency and the GNSS Supervisory Authority. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

5.

 Audit on the supervision of the implementation of the Copernicus Programme 
in  DG  GROW  -  Phase  II:  management  of  the  cooperation  and  coordination 
between the different implementing entities 

The  objective  of  the  audit  was  to  assess  if  the  Directorate-General  for  Internal  Market,  Industry, 
Entrepreneurship  and  SMEs  effectively  ensures  cooperation  and  coordination  between  the  different 
implementing entities. The audit aimed at assessing the adequacy and effectiveness of the tools available to 
the Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs  to monitor the activities of 
the  implementing  entities,  to  ensure  corrective  actions  when  necessary  and  to  coordinate  the  different 
contributions so that the programme achieves its objectives. 

The Internal Audit Service decided to close the audit after the preliminary survey. No formal audit report, as 
envisaged in the Mutual Expectations Paper, was issued. 

6.

 Audit on DG TAXUD’s preparation of legislative initiatives 

The objective of the audit was to assess the adequacy of the design and the effectiveness of internal control 
system  of  the  Directorate-General  for  Taxation  and  Customs  Union  for  the  preparation  of  its  legislative 
initiatives. 

There are no observations or reservations in its 2017 annual activity report related to the audited processes. 
The  fieldwork  was  finalised  on  21 September 2018.  All  recommendations  relate  to  the  situation  as  of  that 
date. 

48 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

The auditors recognise the ongoing efforts made by the Directorate-General for Taxation and Customs Union 
to continuously improve the process of preparation of legislative initiatives and highlight the  following good 
practices: 

  when  preparing  its  legislative  proposals,  the  Directorate-General  for  Taxation  and  Customs  Union 
organises  the  work  across  Directorates  in  multi-unit  project  teams.  One  recent  example  of  this 
working  method  was  the  preparation  of  the  legislative  initiative  ‘Fair  taxation  in  the  digital 
economy",  for  which  some  25  operational  staff  from  two  directorates  and  three  Units  were 
involved; 

 

the evaluation and impact assessment support function (EIASF) (which assists the operational units 
in  the  legislative  proposals’  preparation)  organised  regular  and  good  quality  internal  training 
sessions on how to prepare an impact assessment. These trainings were highly appreciated by the 
staff of the directorate-general. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

7.

 Audit  on  financial  management  of  procurement  contracts  and  grants  in  
DG TRADE 

The audit objective was to assess in the Directorate-General for Trade (1) the adequacy of the design and the 
effective implementation its internal control system for the management of procurement and grants, and (2) 
the efficiency and effectiveness of the related financial circuits.  

There are no observations/reservations in the 2017 annual activity report of the Directorate-General for Trade 
that relate to the processes audited. The fieldwork was finalised on 3 September 2018. All recommendations 
relate to the situation as of that date. 

In  the  course  of  the  audit,  the  Internal  Audit  Service  noted  the  following  strengths  in  the  financial 
management of procurement and grants by the Directorate-General for Trade: 

  This  Directorate-General  has  developed  a  webpage  which  includes  the  key  information  on 
framework  contracts    such  as terms of  references, internal  procedures  and  templates used  when 
procuring services under these contracts; 

  Unit TRADE.A.1 (‘Finance and Strategic Planning team’) effectively supports operational units in the 
management  of  procurement  and  grant  contracts  (in  particular  on  the  framework  contracts  on 
evaluation  services)  and  has  established  a  good  communication  network  within  the  Directorate-
General.  The  Unit  is  also  regularly  in  contact  with  the  Directorate-General  for  Budget  on 
implementing  its  updates  in  the  financial  regulation  at  local  level  or  consulting  on  procedural 
issues. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

49 

 
 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

General services 

1.

 Audit on financial management of grants in DG ESTAT 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective  implementation  of 
Eurostat’s  internal  control  systems  for  the  management  of  the  grant  process,  and  the  effectiveness  and 
efficiency of the related financial circuits. 

There were no reservations in the 2017 annual activity report of Eurostat that relate to the process audited. 
The fieldwork was finalised on 23 May 2018. All recommendations relate to the situation as of that date. 

In  the  course  of  the  audit,  the  Internal  Audit  Service  noted  the  following  strengths  in  the  financial 
management of grants by Eurostat: 

  over  the  last  few  years,  the  directorate-general  has  developed  a  set  of  standardised  procedures 
and  related  checklists  for  the  management  of  grants,  which  are  available  on  the  intranet  of  the 
directorate-general; 

  Eurostat has simplified its grant management procedures by introducing a unit cost system for the 

staff costs of beneficiaries in 2015, and the e-grants system in 2018; 

  Unit  A.4  (‘Budget,  financial  management  and  internal  control")  plays  a  key  supportive  role  for  all 

units in charge of the operational management of grants.  

The Internal Audit Service did not formulate any critical or very important recommendations. 

2.

 Audit on effectiveness of DG ESTAT’s cooperation with external stakeholders 

The objective of the audit was to assess whether Eurostat’s management and control systems ensure that it 
effectively cooperates with its external stakeholders.  

There are no observations/reservations in the 2017 annual activity report of Eurostat that relate to the area 
audited. The fieldwork was finalised on 2 October 2018. All recommendations relate to the situation as of that 
date.  

The  Internal  Audit  Service  recognises  the  ongoing  efforts  made  by  Eurostat  to  establish  and  maintain 
effective  cooperation  with  its  external  stakeholders.  The  Internal  Audit  Service  identified  the  following  good 
practices:  

  a  clear  division  of  responsibilities  and  well-established  cooperation  arrangements  have  been 
formally agreed between Eurostat and the European Central Bank aimed at achieving an efficient 
exchange of data and preventing conflicting requests being sent to Member States from Eurostat 
and European Central Bank;  

  a  system  for  joint  data  collection  with  the  Organisation  for  Economic  Co-operation  and 
Development, World Health Organisation and the United Nations Educational, Scientific and Cultural 
Organisation  exists  for  statistical  indicators  in  the  areas  of  education  and  health  statistics.  This 
enables  Eurostat  to  optimise  the  collection  of  data  from  the  Member  States,  apply  common 
concepts and definitions, and avoid duplication of efforts. 

The  Internal  Audit  Service  identified  one  issue  concerning  the  cooperation  arrangements  with  Eurostat’s 
external stakeholders and formulated the following very important recommendation: 

Eurostat  should  further  develop  and  formally  adopt  a  policy  for  cooperation  with  its  external  stakeholders. 
The  directorate-general  should  also  complete  and  update  the  list  of  the  organisations  with  which  it 
cooperates,  set  up  criteria  for  establishing  formal  cooperation  arrangements  and  define  a  procedure  for 
regularly reviewing and updating them. 

50 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Additional  information  provided  by  Directorate-General  ESTAT  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

An action plan to implement this recommendation has been established and agreed to by the Internal Audit 
Service. Eurostat started to develop a strategy for international cooperation and to define the criteria for the 
establishment of formal cooperation arrangements as well as its key partners. Furthermore, Eurostat started 
to  establish  a  list  of  the  organisations  with  which  the  directorate-general  cooperates,  including  the  type  of 
working arrangements and the cooperation activities in place.  Existing cooperation agreements with external 
stakeholders  are  currently  reviewed  and  will  be  revised  if  necessary.  A  procedure  will  be  implemented  to 
request from the responsible directors to signal once a year to the responsible unit possible need for changes 
in the cooperation agreements under their responsibility. 

3.

 Consulting engagement on accounting for JSIS direct billing in PMO 

The objective of the engagement was to review and provide advice on the effectiveness and efficiency of the 
workflow for the direct billing process both from the business and information technology perspective. It also 
covered management reporting to the Joint Sickness and Insurance Scheme’s Comité de Gestion d’Assurance 
Maladie. Finally, the Internal Audit Service reviewed the  compliance of the Office for the Administration and 
Payment  of  Individual  Entitlements  (PMO)  proposals  for  improving  the  accounting  treatment  against  the 
applicable accounting rules and standards.  

As this was a consulting engagement and not an audit, no audit recommendations were formulated and the 
Internal Audit Service will not undertake follow-up work. 

4.

 Audit  on  control  strategy  for  the  Joint  Sickness  and  Insurance  Scheme, 
including accidents insurance (design and implementation) in PMO 

The  objective  of  the  audit  was  to  assess  whether  the  design  and  implementation  of  the  Office  for  the 
Administration and Payment of Individual Entitlements’ control strategy for the Joint Sickness and Insurance 
Scheme  (JSIS)  and  accidents  insurance  is  effective  and  efficient  in  ensuring  that  the  Office  for  the 
Administration  and  Payment  of  Individual  Entitlements  has  reasonable  assurance  on  the  legality  and 
regularity  of  the  underlying  transactions.  This  included  assessing  whether  the  control  strategy  effectively 
addresses  the  risks  related  to  legality,  regularity  and  fraud  and  whether  the  results  are  systematically 
monitored and adequately reported in the annual activity report. The audit also examined whether the control 
strategy ensures that corrective measures are taken promptly and proportionately. 

There are no observations/reservations in the 2017 annual activity report of the Office for the Administration 
and Payment of Individual Entitlements that relate to the area/process audited. The fieldwork was finalised on 
26 November 2018. All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  recognises  the  ongoing  efforts  made  by  the  Office  for  the  Administration  and 
Payment of Individual Entitlements to streamline and adapt the Joint Sickness and Insurance Scheme internal 
processes  and  to  accommodate  the  recent  developments  in  the  medical  sector.  The  audit  highlighted  the 
following strengths: 

  harmonisation  efforts:  the  Office  for  the  Administration  and  Payment  of  Individual  Entitlements 
handles  the  reimbursement  of  medical  claims  from  a  large  number  of  countries  (e.g.  for  2017 
around 170 countries). In this context, weekly coordination meetings between the three Settlements 
Offices (SO) take place in order to improve the harmonisation of the practices and processes. The 
Office  for  the  Administration  and  Payment  of  Individual  Entitlements  set  up  in  2017  Centres  of 
Excellence to build expertise in specific areas. This process aims to align the application of the Joint 
Sickness  and  Insurance  Scheme  rules,  regardless  the  country  where  the  medical  services  were 
provided. Ispra Settlements  Office has already  prepared  an action plan for its ‘Overseas and CHC 
Centre  of  Excellence’,  which  provides  a  brief  overview  of  the  scope,  objectives,  organisational 
structure,  workflows  and  human  resources  necessary  for  the  implementation  of  the  actions.  This 
constitutes  a  good  practice  which  could  be  extended  further  in  the  Joint  Sickness  and  Insurance 
Scheme; 

51 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

  newly  introduced  Vade-mecums  for  the  Office  for  the  Administration  and  Payment  of  Individual 
Entitlements’:  the  vade-mecums  on  tarification  of  hospital  invoices,  accidents  and  subrogation  of 
rights represent a good practice as regards guidelines and instructions to its staff. Going forward, 
these can help with a more harmonised application of Joint Sickness and Insurance Scheme rules 
by  the  Settlements  Offices,  particularly  if  updated  on  a  regular  basis  to  take  account  of  lessons 
learned; 

  customisation  of  Assmal  2  tool  for  business  needs:  the  development  of  the  Joint  Sickness  and 
Insurance  Scheme  online  tool (30)  facilitates  the  interaction  between  the  Joint  Sickness  and 
Insurance Scheme and affiliates as it enables the latter to submit electronic claims and supporting 
documents.  In  addition,  all  documents  issued  by  the  Joint  Sickness  and  Insurance  Scheme  
(decisions, letters, account sheets, certificates) are sent to affiliates via this tool. In 2017, the tool 
was  enhanced  with  new  features  that  better  respond  to  the  needs  of  the  service,  for  example 
allowing accident files to be recorded in Assmal 2 and a facility to search for double payments; 

  handling  time  of  requests:  in  recent  years,  the  Office  for  the  Administration  and  Payment  of 
Individual  Entitlements  has  made  significant  improvements  in  the  time  taken  to  process 
reimbursement  claims  and  the  payment  of  hospital  invoices,  which  has  helped  to  improve  client 
satisfaction.  This  is  particularly  challenging  given,  as  noted  above,  that  the  medical  domain  is 
evolving  at  a  rapid  pace  and  consequently  the  Office  for  the  Administration  and  Payment  of 
Individual Entitlements staff and medical advisers need to keep their knowledge up to date in order 
to take informed decision. 

The  Internal  Audit  Service  identified  two  issues  concerning  the  review  and  documentation  of  JSIS  control 
strategy  and  the  effectiveness  and  efficiency  of  ex  ante  and  ex  post  controls  and  formulated  the  following 
very important recommendations: 

Review and documentation of JSIS control strategy  

The  Internal  Audit  Service  recommended  that  the  Office  for  the  Administration  and  Payment  of  Individual 
Entitlements  review  the  various  components  which  make  up  its  control  strategy  for  Joint  Sickness  and 
Insurance  Scheme  and  accidents  and  bring  these  together  in  a  more  formalised  and  consolidated  control 
strategy  document.  This  should  clearly  describe  the  control  objectives,  the  main  actors  and  their  roles  and 
responsibilities,  the  risk  analysis  and  its  output  (i.e.  Joint  Sickness  Insurance  Scheme  risk  register),  and  the 
intensity  and  frequency  of  the  ex  ante  and  ex  post  controls  for  direct  billing  and  direct  reimbursement 
(including the sampling methods used). It should also include the automated IT controls embedded in Assmal 
2, the Anti-Fraud measures put in place, the reporting on the results of controls together with their evaluation 
and follow-up. This document should be regularly reviewed and updated in case significant changes occur in 
the  functioning  of  the  Joint  Sickness  and  Insurance  Scheme  (e.g.  update  of  the  legal  base  or  rules)  and 
approved by the Authorising Officer by Delegation. 

Effectiveness and efficiency of ex ante and ex post controls  

The  Internal  Audit  Service  recommended  that  the  Office  for  the  Administration  and  Payment  of  Individual 
Entitlements seeks the necessary statistical assurances as to whether its modified sampling approach allows 
it to arrive at a representative error rate and if not then it should ensure the correct application of a statistical 
sampling  method  for  ex  ante  (or  ex  post  controls),  which  allows  results  to  be  extrapolated  for  the  entire 
population.  The  criteria  for  using  derogations  should  be  clarified  in  order  to  ensure  a  harmonised  approach 
and AIPNs should briefly describe in Assmal 2 the underlying reasons when taking a decision. Assmal 2 should 
be used to provide a regular overview report on all derogations to allow an analysis of the root causes. The 
results  of  ex  post  controls  should  be  reported  on  a  more  timely  basis  to  support  the  assurance  building 
process  for  the  reference  period  concerned.  Finally,  the  Office  for  the  Administration  and  Payment  of 
Individual  Entitlements  should  strengthen  its  Anti-Fraud  Strategy  with  regard  to  Joint  Sickness  Insurance 
Scheme,  notably  by  defining  more  precise  Anti-Fraud  actions,  ensuring  for  example  that  transactions  with 
similar characteristics/details are tested as part of ex ante controls. 

30  

Consult  your  membership  rights,  apply  for  medical  authorisations  and  consult  the  reimbursement  history,  submit  claims  for 
reimbursement online and upload the scanned supporting documents.  

52 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Additional  information  provided  by  Director  PMO  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

The Office for the Administration and Payment of Individual Entitlements has agreed on an action plan with 
the  Internal  Audit  Service  on  the  recommendations  put  forward:  organise  a  task  force  to  coordinate  all 
information  on  control  strategy  in  the  Joint  Sickness  Insurance  Scheme.  Publish  the  updated  procedures, as 
well  as  a  formal  document  comprising  all  elements  (February 2020);  prepare  a  specific  Joint  Sickness 
Insurance Scheme risk register for 2019, disclosing high and critical risks (February 2020); organise meetings 
with central services to assess the representativeness of the current monetary unit sampling (MUS) technique 
–  otherwise  determine  the  best  method  for  ex  post  control  (October 2019);  introduce  deadlines  so  that  ex-
post  controls  are  used  for  the  current  reporting  period  (March 2020);  strengthen  anti-fraud  strategy  by 
defining clear measures and by monitoring and reporting on them.  In case of similar transactions, include in 
the ex ante controls (October 2019); define derogations in procedures and regularly review those during the 
coordination meetings (October 2019). 

53 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Information technology audits 

1.

 Audit on information technology project management in DG REGIO 

The objective of the audit was to assess the adequacy of the design and the effectiveness and the efficiency 
of the governance, management and control systems put in place by the Directorate-General for Regional and 
Urban Policy to manage its information technology projects WAVE and SFC, which are the flagship information 
technology projects for the  directorate-general and representative of the overall the Directorate-General for 
Regional and Urban Policy information technology project management practices. 

There  were  no  observations/reservations  in  the  2016  annual  activity  report  of  the  Directorate-General  for 
Regional and Urban Policy that relate to the area/process audited. The fieldwork  was  finalised  on 22 March 
2018. All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  recognises  the  efforts  made  by  the  Directorate-General  for  Regional  and  Urban 
Policy to continuously improve its project management practices, in order to enable the directorate-general to 
respond to their business objectives. A number of important controls are in place to ensure the success of the 
projects. In particular, the WAVE project makes extensive use of Business Process Management practices for 
modelling  and  designing  the  business  processes.  Moreover,  the  Directorate-General  for  Regional  and  Urban 
Policy use the corporate tool ARIS (Architecture of Integrated Information Systems) to model and support the 
different business workflows. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

2.

 Audit on information technology governance at DG DEVCO 

The objective of the audit was to evaluate the current IT governance arrangements in the Directorate-General 
for International Cooperation and Development with a particular focus on the following main areas: 

 

 

the effectiveness of the oversight for information technology-related issues and whether there are 
clear roles and responsibilities in place; 

the  effectiveness  and  efficiency  of  the  processes  which  evaluate,  direct  and  monitor  value 
contribution,  risk  optimisation  and  resource  optimisation  of  information  technology  systems  and 
services  in  the  achievements  of  the  Directorate-General  for  International  Cooperation  and 
Development business objectives. 

There  are  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
International  Cooperation  and  Development  that  relate  to  the  area/process  audited.  The  fieldwork  was 
finalised  on  16 October 2018.  All  recommendations  relate  to  the  situation  as  of  that  date.  However,  the 
Directorate-General for International Cooperation and Development informed us that further to the entry into 
force  of  their  new  organisation  chart  on  1 November 2018,  all  activities  and  staff  relating  to  OPSYS  were 
transferred from Unit 04 to Unit R4. 

The Directorate-General for International Cooperation and Development  management exercises a sound and 
professional  oversight  of  the  information  technology  issues,  in  line  with  the  Commission  principles  for  IT 
governance established in 2004 (31). In particular, the audit highlighted the following strengths: 

 

the  Directorate-General  for  International  Cooperation  and  Development  information  technology 
governance  model  makes  a  clear  distinction  between  business  and  IT  responsibilities,  under  the 
strong coordination role of Unit 04; 

  for  the  OPSYS  programme  there  is  close  cooperation  between  the  Directorate-General  for 
International Cooperation and Development (as representative of the RELEX family) on the business 

31  

Communication to the Commission SEC(2004)1267 on the improvement of information technology governance in the Commission.  

54 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

side  and  the  Directorate-General  for  Informatics  and  the  other  information  technology  solution 
providers on the other side; 

  a  close  and dual  oversight  of  the  OPSYS  programme  is exercised  through  its  management  board 

(OMB) and the specialised project steering committees; 

 

risk management processes are well designed in the areas of project management and information 
security,  and  supported  by  an  information  technology  application  making  it  possible  to  capture, 
analyse and report on risk management related data in an extended and automated manner; 

The  business  processes  of  the  Directorate-General  for  International  Cooperation  and  Development  are 
formally designed, with responsibilities clearly identified to ensure that the business process models remain 
up-to-date and are used for the development of new information technology systems. 

The Internal Audit Service identified two issues concerning the IT governance framework and data governance 
and formulated the following very important recommendations: 

IT governance framework 

The  Directorate-General  for  International  Cooperation  and  Development  should  adapt  its  information 
technology  governance  framework  to  ensure  effective  oversight  of  its  full  portfolio  of  information 
technology-related processes, data and systems. This could take the form of a layered model encompassing 
the following three levels; 

 

 

 

at  the  top  level  a  single  Information  Technology  Steering  Committee  accountable  for  overall 
information technology governance in the directorate-general; 

at a second level, dedicated steering committees chaired by business representative and responsible 
for the oversight of individual or group of information technology systems and components, and; 

at a lower level, dedicated groups responsible for (family of) process(es) and data set(s). Under the 
lead  of  a  central  co-ordination  team  in  the  Directorate-General  for  International  Cooperation  and 
Development, these groups representing the user community should liaise with the system owner(s) 
and IT suppliers. 

As a complementary measure, the Directorate-General for International Cooperation and Development should 
consolidate  the  current  state  and  medium  to  long-term  vision  of  its  information  technology  landscape  in  a 
revised  version  of  its  information  technology  strategy  and  reinforce  its  enterprise  architecture  function. 
Finally, the Directorate-General for International Cooperation and Development should liaise with information 
technology service providers and notably The Directorate-General for Informatics to define regular reporting 
requirements on the service levels achieved, based on Key Performance Indicators.  

Data governance 

The Directorate-General for International Cooperation and Development should strengthen its governance on 
data  architecture  and  ensure  it  retains  ownership  of  the  data  supporting  its  operational  processes.  To 
complement  this,  the  Directorate-General  for  International  Cooperation  and  Development  should  assess, 
decide and clearly communicate its data convergence options in order to properly prepare for the transition 
between  legacy  systems  and  OPSYS.  This  should  also  include  the  reporting  changes  needed  to  integrate 
OPSYS data. 

Additional information provided by Director DEVCO on the measures defined and/or implemented 
following the Internal Audit Service audit 

The  action  plan  of  the  Directorate-General  for  International  Cooperation  and  Development  to  address  the 
recommendations was accepted by the Internal Audit Service on 20 December 2018. The Directorate-General 
for International Cooperation and Development has set up a Relex Family Data Governance Board to ensure 
oversight  of  the  data  architecture  and  its  different  components.  Relex  Family  Data  Governance  Board 
meetings have already taken  place; the Data  Governance Board will  be  reflected  in  the  new  governance  

55 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

 framework  of  the  Directorate-General  for  International  Cooperation  and  Development.  The  directorate-
general  has  drafted  and  started  to  implement  a  strategy  for  data  convergence.  OPSYS,  the  operational 
information  system  under development,  will  be  integrated  into  the  Data  Warehouse  by  the  third  quarter of 
2019. To improve its information technology governance framework, the Directorate-General for International 
Cooperation  and  Development  has  merged  the  different  Project  Steering  Committees  of  the  OPSYS 
programme  into  a  single  Programme  Steering  Committee, which  reports  to  the  IT  Board  of  the  Directorate-
General for International Cooperation and Development and the OPSYS Management Board.  The Directorate-
General for International Cooperation and Development will adopt a revised Governance Policy document and 
draft an IT strategy for 2019-2022 by the end of September. 

3.

 Audit  on  IT  security  management  for  Common  Support  Centre  H2020  grant 
lifecycle systems in DG RTD 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effectiveness  of  the 
implementation of the internal controls put in place by  the Directorate-General for Research and Innovation, 
and more specifically by the Common Support Centre (CSC), for protecting electronic information and assets 
and for grant lifecycle systems supporting the Horizon 2020 programme.  

There  were  no  observations/reservations  in  the  2017  annual  activity  report  of  the  Directorate-General  for 
Research  and  Innovation  that  relate  to  the  area/process  audited.  The  fieldwork  was  finalised  on 
23 November 2018. All recommendations relate to the situation as of that date. 

The  Internal  Audit  Service  noted  a  number  of  good  practices  within  the  Common  information  technology 
Support unit and the Common Support Centre regarding  security management and business management of 
the  processes.  Each  of  these  practices  helps  to  improve  the  effectiveness  and  efficiency  of  the  security 
management process, focusing on prevention and ensuring that identifiable security risks are managed before 
they occur: 

 

tracking  of  the  status  of  security  measures:  the  Common  Support  Centre  tracks  the  defined 
standard  and  specific  security  measures  and  exceptions  in  the  Rational  Team  Concert  security 
measures  tool.  This  enables  a  continuous  and  complete  follow  up  of  the  progress  made  in 
implementing security measures; 

  source  code  reviews:  source  code  reviews  are  performed  both  using  an  automated  tool  (Sonar) 
covering most of the developed source code and by peer/colleague reviews. This ensures increase 
of quality of the code developed and identification of issues or bugs before deploying the code for 
further  testing.  At  the  same  time,  it  enables  the  team  to  identify  common  mistakes  and  builds 
knowledge by sharing their own expertise among each other during the peer reviews; 

  automatic access management: automatic rules are implemented in Secunda+ (user authorisation 
tool)  for  adding/updating/removing  access  rights  based  on  the  nightly  update  with  Common 
Reference  –  staff  reference  database  for  Commission  information  technology  systems (COMREF). 
This  shows  an  efficient  approach  to  access  management  in  cases  when  access  rights  can  be 
automated  and  standardised.  This  approach  also  represents  a  strong  mitigating  control  in  case 
human intervention to remove or change access rights upon changes in an employee status fails; 

  business process view over information technology systems: the establishment of business process 
owner roles supports a transversal view across the Research family and ensures a better coverage 
of business and security requirements increasing harmonisation, simplification and automation; 

  automation of security tests during information technology system development: the automation of 
security tests in place and penetration testing (performed on a pilot) increases the speed of testing 
process.  In  addition,  it  helps  to  identify  vulnerabilities  before  systems  are  deployed  in  the 
production environment and exposed to users. 

The Internal Audit Service did not formulate any critical or very important recommendations. 

56 

 
 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Section 2  
Follow-up engagements (summarised)  

1.

 Follow-up  audit  on  the  management  of  grants  under  the  2014-2020 
consumer and health programmes in CHAFEA 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 1 (very important): internal grant management procedures 

Recommendation N° 2 (important): evaluation committees for the consumer programme 

Recommendation N° 3 (important): evaluation process 

Recommendation N° 4 (important): guidance and interpretation 

The  following  recommendations  were  assessed  as  not  fully  and/or  adequately  implemented  and  were  re-
opened: 

Recommendation  N°  5  (important):  double  funding,  with  original  target  date  for  implementation  of  31 
December 2016, revised to 31 December 2017 after the first follow-up audit 

Chapter 4  of  the  Consumers,  Health,  Agriculture  and Food  Executive  Agency’s new  Handbook  of  Procedures 
reflects the Directorate-General for Budget revised approach to double funding. Under the revised approach, a 
beneficiary receiving an operating grant is now entitled to declare indirect costs under  an action grant if the 
operating grant covers only part of their usual activity if the beneficiary is able to demonstrate clearly that 
the  operating  grant  does  not  cover  any  costs  (including  overheads)  that  may  be  covered  under  the  action 
grant.  It  is  up  to  the  beneficiary  to  demonstrate  this  and  the  Directorate-General  for  Budget  vademecum 
details how this is to be done.  

However, as the Consumers, Health, Agriculture and Food Executive Agency’s financial control strategy is not 
finalised  yet,  the  Internal  Audit  Service  is  not  in  a  position  to  determine  conclusively  the  extent  to  which 
recipients of operating grants are subject to reinforced controls at the time of payment, and if instructions on 
documentation of conclusions and/or further actions to be undertaken following double funding controls are 
adequately defined. 

Recommendation  N°  6  (important):  grant  agreement,  with  original  target  date  for  implementation  of 
31 December 2016, revised to 31 December 2017 after the first follow-up audit 

The Consumers, Health, Agriculture and Food Executive  Agency provided evidence that decisions to award a 
grant retroactively are based on well justified requests by the beneficiaries and are well documented in the 
grant preparation report before the signature of the authorising officer.  

However,  on  the  basis  of  the  evidence  provided,  the  Internal  Audit  Service  has  not  been  able  to  conclude 
satisfactorily  that  the  basis  for  decisions  on  pre-financing  rates  is  adequately  documented.  Moreover,  an 
internal guidance document on issues concerning the financial viability of beneficiaries referenced in chapter 
7  of  the  Consumers,  Health,  Agriculture  and  Food  Executive  Agency’s  Handbook  of  Procedures  is  still  under 
preparation. 

2.

 Follow-up  audit  on  CHAFEA’s  management  and  control  system  for  the 
implementation of the measures for the promotion of agricultural products 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

57 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Recommendation N° 2 (important): grant management  

Recommendation N° 3 (important): selection of experts  

Recommendation N° 4 (important): high-level missions  

The following recommendation was assessed as not fully and/or adequately implemented and was re-opened: 

Recommendation  N°1  (important):  overall  internal  control  framework,  with  original  target  date  for 
implementation of 31 July 2018.  

The Consumers, Health, Agriculture and Food Executive Agency has developed a payments strategy for grants 
which is now being implemented and in addition, complementary checks to address the risk of double-funding 
for certain beneficiaries have been designed in coordination with  the Directorate-General for Agriculture and 
Rural  Development.  However,  although  it  has  started  to  work  on  its  multi-annual  financial  control  strategy, 
this  has  yet  to  be  formally  endorsed  and  registered.  In  addition,  this  still  needs  to  be  complemented,  as 
necessary,  by  any  control  objectives  which  are  identified  as  a  result  of  the  update  of  the  risk  assessment 
scheduled for autumn 2018. Finally, the Consumers, Health, Agriculture and Food Executive Agency still has to 
update annex V ‘Internal Control Template(s) for budget implementation’ to reflect those controls and control 
objectives specific to promotion activities. 

3.

 Follow-up  audit  on  staff  allocation  and  process  management  in  response  to 
staff reduction in DG ENV 

Based on the results of the follow-up audit, the Internal Audit Service concluded that the following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 1 (important): activities and skills mapping 

Recommendation N° 2 (very important): workload assessment 

Recommendation N° 4 (important): efficiency gains 

4.

 Follow-up audit on early implementation of European Structural and 
Investment Funds control strategy 2014-2020 in DG MARE 

Based on the results of the follow-up audit, the Internal Audit Service concluded that the following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 4 (very important): control-related simplification measures 

Recommendation N° 5 (very important): designation process and review 

Recommendation N° 7 (very important): early preventive system audits (EPSA) 

Recommendation N° 8 (very important): review of national audit strategies 

Recommendation N° 9 (very important): audits on ‘Performance data reliability’ 

Recommendation N° 11 (important): coordination arrangements 

5.

 Follow-up  audit  on  amendments  of  2014-2020  operational  programmes  in 
DGs REGIO, EMPL and MARE - DG EMPL 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

58 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Recommendation  N°  1  (very  important):  consistency,  effectiveness  and  timeliness  of  the  OP  amendment 
process  

Recommendation  N°  2  (important):  internal  methodology  and  horizontal  aspects  of  the  OP  amendment 
process 

6.

 Follow-up  audit  on  early  implementation  of  European  Structural  and 
Investment Funds control strategy 2014-2020 in DG EMPL 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 4 (very important): control-related simplification measures 

Recommendation N° 5 (very important): designation process and review 

Recommendation N° 7 (very important): early preventive system audits (EPSA) 

Recommendation N° 8 (very important): review of national audit strategies 

Recommendation N° 9 (very important): audits on ‘Performance data reliability’ 

7.

 Follow-up audit on amendments of 2014-2020 operational programmes in 
DGs REGIO, EMPL and MARE - DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation  N°  1  (very  important):  consistency,  effectiveness  and  timeliness  of  the  OP  amendment 
process  

Recommendation  N°  2  (important):  internal  methodology  and  horizontal  aspects  of  the  OP  amendment 
process 

8.

 Follow-up  audit  on  early  implementation  of  European  Structural  and 
Investment Funds control strategy 2014-2020 in DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 4 (very important): control-related simplification measures 

Recommendation N° 5 (very important): designation process and review 

Recommendation N° 7 (very important): early preventive system audits (EPSA) 

Recommendation N° 8 (very important): review of national audit strategies 

Recommendation N° 9 (very important): audits on ‘Performance data Reliability’ 

9.

 Follow-up audit on major projects in DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 2 (important): planning and reception of major project applications 

59 

 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

10.

  Follow-up audit on the supervision of ITER in DG ENER  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 1 (very important): DG ENER’s supervision strategy for the ITER organisation and project 

The following recommendation was assessed as not fully and/or adequately implemented and was re-opened: 

Recommendation N° 2 (very important): supervision and monitoring of F4E activities with original target date 
31 July 2017 

The Directorate-General for Energy established a supervision strategy for Fusion for Energy (F4E) and, based 
on  assessment  of  the  impact  of  recent  changes,  prepared  a  draft  revised  version  of  the  Administrative 
Arrangement with Fusion for Energy. A dedicated annex outlines the ‘Working relations with Fusion for Energy 
",  which  provide  for  efficient  and  transparent  coordination  between  Fusion  for  Energy  and  the  relevant 
European  Commission  services.  Nevertheless,  the  Administrative  Arrangement  has  not  yet  been  signed  and 
the standard formats for the Fusion for Energy reporting to the Directorate-General for Energy have not been 
finalised yet. 

11.

  Follow-up audit on the supervision of ITER in DG ENER  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 3 (important): supervision objectives at Unit level 

12.

  Follow-up audit on competitive activities in Joint Research Centre 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (important): planning process 

Recommendation N° 3 (important): guidance and supporting IT tools 

Recommendation N° 4 (important): administrative management 

13.

  Follow-up audit on the implementation of the FP7 ex post audit strategy by 
the Common Audit Service in DG RTD 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 1 (very important): delivery of individual audit engagements 

The  following  recommendations  were  assessed  as  not  fully  and/or  adequately  implemented  and  were  re-
opened: 

Recommendation N° 2 (very important): audit planning, monitoring and reporting, with original target date for 
implementation of 01 May 2018 

The  Common  Audit  Service  drafted  a  detailed  audit  plan  for  2019  in  order to  track  the  status of  individual 
audit  files  and  established  budgets  for  in-house  and  outsourced  audits,  which  will  enable  a  comparison 
against actual time spent. The Common Audit Service also established a process to track key audit milestones 
against target dates and to justify delays. It also developed operational objectives for the annual audit plan. 
In addition, the Common Audit Service monitors the inflow of cost statements and revises the annual targets 
for audits accordingly. However, the following elements of the action plan still have to be fully implemented: 
(1) an enhanced tool to manage auditors’ capacity and workload in order to identify resource planning issues 
on  time;  (2)  a  dashboard  with  aggregated  indicators  and  corresponding  targets  on  the  timely  delivery  of 

60 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

audits;  (3)  performance  indicators  and  corresponding  targets  in  order  to  measure  and  to  report  on  the 
strategic  objectives  of  the  Horizon  2020  audit  strategy.    Although  the  recommendation  is  not  fully 
implemented, significant progress has been achieved. Consequently, the Internal Audit Service decided to re-
open the recommendation but downgrade it from ‘very important’ to ‘important’. 

Recommendation N° 3 (important): Anti-Fraud objectives and testing during ex post audits  

The Common Audit Service has established specific and measurable objectives for fraud-risk based audits. It 
has also developed guidance for the auditors on dealing with the risk of fraud and in January 2018, it revised 
the  methodology  in  order  to  improve  the  documentation  of  fraud-risk  based  audits.  However,  the  revised 
methodology  has only  been applied  in  one  on-going  audit  so  far.  Therefore,  it  is premature  for  the  Internal 
Audit Service to conclude on its effective implementation.  

Recommendation N° 4 (important): supervision and quality assurance functions  

The  Common  Audit  Service  implemented  arrangements  for  reciprocal  ‘peer’  assessments  with  the  ex  post 
control directorate in the Directorate-General for Regional and Urban Policy. The Common Audit Service also 
revised the audit methodology in order to clarify which engagement standards the auditors have to comply 
with in the performance of their work. It also established aggregated indicators to measure the performance 
of the external audit firms. If systemic issues are detected during quality control, the Common Audit Service 
now organises training sessions for the auditors. Finally, the audit methodology is revised on a regular basis.  

However,  the  fact  that  improvements  are  still  needed  in  the  documentation  of  in-house  audit  files  (see 
Recommendation No 5 below) indicates that the peer reviews performed by auditors are not yet sufficient. The 
Common Audit Service should therefore revise the supervision and the quality control on the documentation 
of in-house audit files.   

Recommendation N° 5 (important): documentation of in-house audits  

The Common Audit Service performed a cost-benefit analysis and decided to develop an audit management 
tool  internally.  The  current  estimated  target  date  for  implementation  is  September  2019.  In  the  meantime, 
although there are some improvements in the completion of audit programmes and mandatory checklists, the 
audit working papers are not cross-referenced and do not include the audit conclusions. As a result, there are 
no links between the adjustments in the audit report, the audit programmes, and the working papers, which 
may affect the ability of an independent party to review the audit file and arrive at the same conclusions. 

14.

  Follow-up audit on the H2020 project management in DG RTD  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 1.b. (very important): determining the level of monitoring for projects (RTD) 

Recommendation N° 2.b. (important): guidance, support and training (RTD) 

The Internal Audit Service concluded that the following recommendations were not assessed as fully and/or 
adequately implemented and were re-opened: 

Recommendation N° 1.a. (very important): determining the level of monitoring for projects (Common Support 
Centre), with original target date for implementation of 31 July 2017 

The Common Support Centre has fully implemented one of two actions covered by this recommendation. In 
particular, it has reached a consensus at the level of Research and innovation family services on the baseline 
requirements and principles to ensure the implementation of risk based project monitoring (additional checks 
or  reviews  for  highly  risky  projects  and  limited  checks  for  less  risky  projects).  The  guidance  document  was 
adopted by the Common Support Centre Steering Board on 18 December 2018.   

The remaining action (to clarify the use of ‘technical audits’) is yet to be finalised. As reported by the Common 
Support Centre, the revised Vademecum, currently under review by the legal service, explains that the project 
reviews  will  be  used  instead  of  technical  audits.  This  approach  was  already  communicated  to  the 

61 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

implementing bodies via GoFund Wiki noticeboard. However, the Common Support Centre is yet to align the 
corresponding procedures, concepts and terminology in the various guidelines covering the business processes 
and audits.  

Considering the actions already taken, the Internal Audit Service decided to downgrade the recommendation 
from ‘very important’ to  ‘important’ as the Common Support Centre has addressed the risks of inconsistent 
and inefficient project  monitoring, and has partially mitigated the risk of sub-optimal requests for technical 
audits due to unclear guidelines addressed to the responsible officers. 

Recommendation N° 2.a. (important): guidance, support and training (Common Support Centre) 

The  Common  Support  Centre  has implemented  four of  the  five  actions  covered  by  this recommendation.  In 
particular, it completed the guidance on project monitoring by clarifying: (1) the use of project checks versus 
project reviews; (2) the documentation and dissemination of the  project officers’ assessment report; (3) the 
assessment of publishable summaries; (4) the documentation of the justification for the amendments. 

The remaining action to clarify the concept of reinforced monitoring is yet to be finalised. As reported by the 
Common  Support  Centre,  explanations  will  be  available  once  the  revision  of  the  guidance  document  on  ex 
ante controls for interim and final payments is completed.  

15.

  Follow-up  audit  on  the  design  and  set-up  of  the  internal  control  systems 
for Horizon 2020 in DG RTD  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (important): guidance for drafting the work programme/calls 

Recommendation N° 4b (important): evaluation procedures and lessons learned (RTD) 

16.

  Follow-up audit on DG DEVCO payment deadlines  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 1 (very important): encoding of payment requests in DG DEVCO 

Recommendation N° 2 (important): processing of payments in DG DEVCO  

The following recommendation was assessed as not fully and/or adequately implemented and was re-opened: 

Recommendation N° 3 (very important): monitoring of the payment process in DG DEVCO with original target 
date for implementation 31 December 2017 

The  Directorate-General  for  International  Cooperation  and  Development  has  modified  the  Key  Performance 
Indicators on payment delays replacing the internal target of 30 days with the contractual payment deadlines. 
Moreover, it has launched several data quality campaigns on payments with long suspension periods and has 
improved  the  new  guide  on  Programme  Estimates (article  3.1.2)  which  now  clearly  states the  deadlines for 
payment.  

Concerning the monitoring of the payment process (including the suspensions), the directorate-general has so 
far implemented a temporary solution based on the use of PMD. The long-term solution will be based on the 
single integrated corporate system COMPASS/SYGMA which will be implemented as a pilot in January 2019. 
Pending  the  implementation  of  the  long-term  solution,  the  Internal  Audit  Service  considers  that  the 
recommendation  is  not  fully  implemented.  However,  it  considers  the  risk  partially  mitigated  and  decided  to 
downgrade it from ‘very important’ to ‘important’. 

62 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

17.

  Follow-up  audit  on  the  management  of  the  African  Peace  Facility  in  DG 
DEVCO 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (originally very important, downgraded to important during previous follow-ups): design 
and effectiveness of the remedial/mitigating measures at contract level 

Recommendation  N°  3  (originally  very  important,  downgraded  to  important  during  previous  follow-ups): 
governance and coordination between DG DEVCO - EU Delegations – EEAS  

Recommendation N° 5 (important): external audits and follow-up of external audit findings 

The following recommendation was assessed as not fully and/or adequately implemented and was re-opened: 

Recommendation  N°  1  (very  important)  on  institutional  assessment  and  monitoring  by  DG  DEVCO  of  the 
partnership with the AUC 

The Internal Audit Service acknowledges that the updated pillar assessment roadmap/action plan (last update 
February  2018)  and  the  related  Assessment  Report  (April  2018)  provide  assurance  on  the  improvements 
made  by  the  African  Union  Commission  (AUC)  in  each  of  the  pillars.  In  addition,  a  structured  monitoring 
system of the African Peace Facility, based on the new aide-mémoire, has been put in place. However, though 
planned  for  Q4  2018,  the  new  pillar  assessment  recommended  by  Ernst  &  Young  in  their  April  2018  final 
monitoring report has not been launched yet, pending completion by the African Union Commission of assets 
identification and valuation exercise (necessary to comply with IPSAS requirements).  

18.

  Follow-up audit on the performance management system in DG DEVCO 

The following recommendation was assessed as not fully and/or adequately implemented and was re-opened: 

Recommendation N° 2 (very important): monitoring of and reporting on DEVCO’s performance towards 
achieving its objectives 

While sub-recommendations 2.2,  2.3, 2.5 and 2.6 have been adequately and effectively implemented, other 
sub-recommendations remain to be implemented. In particular for sub-recommendation 2.7 it appeared that 
OPSYS Track 1 (results and monitoring) is not yet fully available and was not used for this year’s exercise’ and 
this release is planned for February 2019. Consequently, it is premature to consider sub-recommendation 2.7 
implemented on the basis of the OPSYS release in July 2018. 

19.

  Follow-up audit on procurement under Instrument for Pre-Accession (direct 
management and indirect management with beneficiary countries) – Phase I – 
in DG NEAR  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (important): registration and filing of procurement documentation 

Recommendation N°4 (important): exchange of expertise among the staff of the EU Delegations implementing 
IPA 

20.

  Follow-up audit on procurement under Instrument for Pre-Accession (direct 
management and indirect management with beneficiary countries) – Phase II 
– in DG NEAR 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

63 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Recommendation N° 2 (very important): implementation of control plans by the EU Delegation to Turkey 

21.

  Follow-up audit on past Internal Audit Service audits in DG HOME 

Audit on coordination and working arrangements with EU Decentralised Agencies 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 1 (important): role and responsibility of the partner DG towards its Agencies  

Recommendation  N°  2  (very  important):  overall  strategy  of  the  partner  DG  towards  its  Agencies  – 
Programming  

Recommendation N° 5 (important): organisational structure of the partner DG to interact with its Agencies  

The  following  recommendations  were  assessed  as  not  fully  and/or  adequately  implemented  and  were  re-
opened: 

Recommendation N° 3 (very important): overall strategy of the partner DG towards its Agencies  – Monitoring 
with original target date for implementation of 31 December 2016  

The Directorate-General for Migration and Home Affairs, within its overall responsibility as a member of the 
Agencies’  Management  Board,  has  strengthened  its  monitoring  of  Agencies’  performance (32).  Also,  the 
directorate-general  has  contributed  to  the  implementation  of  the  principles  of  the  Common  approach  and 
Roadmap actions by its Agencies (e.g. support for the establishment of Anti-fraud Strategies and Conflict of 
Interest  Policies  as  well  as  strategies  for  external  communications).  However,  there  is  no  evidence  of 
monitoring by the Directorate-General for Migration and Home Affairs of the implementation of the Roadmap 
actions  by  its  Agencies,  as  envisaged  by  the  Internal  Audit  Service  recommendation  and  the  Directorate-
General’s action plan. The Directorate-General confirmed to the Internal Audit Service that a follow-up table 
will be developed to check whether each individual Agency is on track in implementing the Roadmap actions.  

Therefore, this recommendation cannot be closed at the moment, as one action still needs to be implemented. 
However, taking into consideration the actions already implemented by the Directorate-General for Migration 
and Home Affairs, the Internal Audit Service considered that the residual risk has been partly mitigated and 
decided to downgrade the recommendation from ‘very important’ to ‘important’.  

Recommendation N° 4 (very important): overall strategy of the partner DG towards its Agencies  – Control & 
building-up assurance with original target date for implementation of 30 June 2017 

The Directorate-General for Migration and Home Affairs has strengthened the design of the controls towards 
its  Agencies.  In  particular,  a  control  strategy  for  the  budget  managed  through  decentralised  Agencies  was 
adopted  in  January 2018.  However,  a  separate  control  strategy  for  Agencies  (and  other  bodies)  with 
delegated  budget  implementation  tasks  (i.e.  Delegation  Agreements)  still  has  to  be  established  as 
recommended by the Internal Audit Service.  

On the reinforcement of the building blocks supporting the Authorising Officer by Delegation’s declaration of 
assurance, the following aspects should be noted:  

The  Authorising  Officer  by  Sub  Delegation  (AOSD)  reporting  (template  and  accompanying  instructions)  has 
been strengthened.  However, these  have  not yet been effectively implemented in  practice by all the  AOSDs 
dealing with Agencies (33).  

The Internal Audit Service recommended that the Directorate-General for Migration and Home Affairs use its 
independent sources of assurance more efficiently by: (1) encouraging that evaluation and audit  reports on 

32  

33    

For example, the implementation of the Agencies’ work programme, including reporting on key performance indicators, is regularly 
discussed in the Agencies’ Board meetings.  
In particular, either no or insufficient information is provided in the authorising officer by sub-delegation report on the following 
aspects which are requested in the instructions for the preparation of that report: "present briefly the open audit recommendations 
of the internal auditors of the agency and in case of very important or critical recommendation, detail the action plan proposed by 
the agency and the impact on the assurance".   

64 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

the Agencies are shared with the Directorate-General for Migration and Home Affairs on a timely basis and 
regularly  followed  up;  (2)  establishing  a  mechanism  to  forward,  if  appropriate,  issues  for  Internal  Audit 
Service  consideration;  and  (3)  analysing  the  possibility  to  set  up  Audit  Committees  for  the  Agencies  where 
audit activity is particularly important. However, no evidence has been provided to the Internal Audit Service 
on the effective implementation of these three actions. 

Considering the timing  gap that exists  between the submission of the annual activity report (31/03/N+1) of 
the  directorate-general  and  of  the  agencies’  annual  activity  report  (01/07/N+1),  the  Internal  Audit  Service 
recommended that the Directorate-General for Migration and Home Affairs establish a more systematic way 
of obtaining key information it needs from the Agencies to support its annual activity report. In this context, 
the  Directorate-General  for  Migration  and  Home  Affairs  requested  that  the  Agencies  notify  the  directorate-
general (by 01/02/N+1) of significant events which could have a possible impact on the annual activity report 
of the directorate-general. However, only three of the six agencies provided the information on time. For the 
other three agencies, one did not reply and the other two replied only after the Internal Audit Service issued a 
request  in  the  context  of  this  follow-up.  Therefore,  this  procedure,  although  well-designed,  has  yet  to  be 
effectively  implemented  in  practice.  While  the  Internal  Audit  Service  acknowledges  that  the  Directorate-
General for Migration and Home Affairs is dependent on the agencies for receiving the requested information, 
we  consider  that  the  directorate-general  should  monitor  the  agencies  more  proactively  to  ensure  that  they 
provide this information on time, as it could potentially have a significant impact on the annual activity report 
of the directorate-general and the authorising officer by delegation’s declaration of assurance.  

Finally, the Directorate-General for Migration and Home Affairs encouraged the agencies to prepare adequate 
Anti-Fraud Strategies and conflict of interest policies. Given the key importance of these issues and the level 
of  scrutiny  exercised  by  the  Budgetary  Control  (CONT)  Committee,  we  recommended  that  those 
strategies/policies  are  approved  by  their  respective  Management  Boards.  As  at  the  date  of  this  note,  two 
Agencies had not yet adopted a conflict of interest policy. Therefore, the Internal Audit Service recommends 
that the Directorate-General for Migration and Home Affairs continue its efforts, via its representation in the 
respective  Management Boards, and advocate that the conflict of interest policy in eu-LISA (currently being 
drafted) is finalised and adopted by the Board and that an overarching conflict of interest policy is established 
by  Frontex  (as  recommended  by  the  European  Court  of  Auditors  as  well  in  its  Special  report  12/2016)  and 
adopted by its Board.  

Therefore,  this  recommendation  cannot  be  closed  at  the  moment,  as  several  actions  still  need  to  be 
implemented. However, taking into consideration the actions already implemented by the Directorate-General 
for  Migration  and Home  Affairs, the  Internal  Audit  Service  considered  that  the  residual  risk has  been  partly 
mitigated and decided to downgrade the recommendation from ‘very important’ to ‘important’. 

22.

  Follow-up  audit  on  enforcement  of  the  EU  antitrust  policy  in  DG  COMP: 
cooperation with EU national competition authorities and national courts 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 1 (very important): cooperation with the national courts 

23.

  Follow-up  audit  on  enforcement  of  the  EU  antitrust  policy  in  DG  COMP: 
cooperation with EU national competition authorities and national courts  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (important): cooperation with the national competition Authorities 

Recommendation N° 3 (important): European Competition Network 

65 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

24.

  Follow-up  audit  on  past  Internal  Audit  Service  audits  in  DG  EAC: 
performance  management  systems  in  DG  EAC,  including  the  contributions  of 
executive  Agencies  and  national  Agencies  to  the  achievement  of  policy 
objectives 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N°3 (important): exploitation of best practice between the different policy areas 

25.

  Follow-up  audit  on  Erasmus+  and  Creative  Europe  –  grant  management 
phase I (from the call to the signature of contracts) in EACEA  

Based on the results of the first follow-up work , the Internal Audit Service concluded that sufficient progress 
had  been  made  to  partially  mitigate  the  underlying  risks  and  decided  to  downgrade  the  ratings  of  the 
following recommendations: 

Recommendation  N°  2  (original  rating:  critical,  downgraded  to  very  important):  role  of  the  evaluation 
Committee 

Recommendation N° 9 (original rating: very important, downgraded to important): calculation of time to inform 
and time to contract 

Recommendation N° 10 (original rating: very important, downgraded to important): distribution schemes under 
the MEDIA sub-programme 

26.

  Follow-up  audit  on  Erasmus+  and  Creative  Europe  –  grant  management 
phase I (from the call to the signature of contracts) in EACEA (34) 

Based  on  the  results  of  the  second  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (original rating: critical, downgraded to very important after the 1st follow-up): role of 
the evaluation Committee 

Recommendation N° 6 (important): consolidation of assessment results of the external experts 

Recommendation  N°  10  (original  rating:  very  important,  downgraded  to  important  after  the  1st  follow-up): 
Distribution Schemes under the MEDIA sub-programme 

27.

  Follow-up audit on past Internal Audit Service audits in DG ECFIN 

Audit on evaluation in DG ECFIN 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 3 (important): coverage of the evaluation plan  

34  

Based on the results of the last follow-up audit (results issued on 14 March 2019), the Internal Audit Service concluded that all 
remaining recommendations were adequately and effectively implemented and were closed: 
Recommendation N° 1(very important): Control Environment for Grants; Recommendation N° 3 (very important): Organisation  of 
Evaluation Process; Recommendation N° 4 (very important): External Experts; Recommendation N° 5 (very important): Effectiveness 
of  the  Evaluation  Process;  Recommendation  N°  7  (very important):  Actions  preceding  the award decision; Recommendation  N°  8 
(very important): Non-Retroactivity Principle; Recommendation N° 9 (original rating: very important, downgraded to important after 
the 1st follow-up): Calculation of Time to Inform (TTI) and Time to Contract (TTC). 

66 

 
 
 
 
                                                        
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

28.

  Follow-up  audit  on  the  setting  of  objectives  and  measurement  of 
performances in DG GROW  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 1 (very important): DG GROW performance framework 

Recommendation N° 3 (important): process for preparing the MP/SP  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was not fully and/or adequately implemented and was re-opened: 

Recommendation N° 2 (very important): monitoring of and reporting on performance in the context of the SPP 
cycle  

The  Directorate-General  for  Internal  Market,  Industry,  Entrepreneurship  and  SMEs  ensures  consistency  and 
comparability  of  the  indicators  included  in  the  different  Strategic  Planning  and Programming  documents.  In 
addition, it prepared a ‘Repository of objectives and indicators together with the services responsible for their 
follow-up’. However, the repository does not include exhaustive information about the service responsible for 
the  monitoring  of  the  indicator,  the  data  sources used,  the  methodology  to  calculate  the  indicator and how 
the  reliability  of  data  is  checked.  Moreover,  the  directorate-general  has  not  designed  a  procedure  for  the 
measurement  and  monitoring  of  the  result  indicators  included  in  the  Strategic  Plan  and  in  the  Programme 
Statement.  

However, given the actions taken to date, the Internal Audit Service considers that the related risks have been 
partially mitigated. Therefore, the Internal Audit Service decided to downgrade the recommendation from very 
important to important. 

29.

  Follow-up  audit  on  the  performance  of  DG  GROW’s  supervision  of  ESA’s 
implementation of Galileo  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (important): cooperation between DG GROW and ESA  

Recommendation N° 4 (important): management and coordination of the Galileo programme supervision risks 

Recommendation N° 5 (important): Key Performance Indicators  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was not fully and/or adequately implemented and was re-opened: 

Recommendation N° 1 (important): implementation of the procurement activities 

In  line  with  the  recommendation  and  the  agreed  action  plan,  the  Directorate-General  for  Internal  Market, 
Industry,  Entrepreneurship  and  SMEs  has defined  the  role  of  unit  GROW  02 in  the  review  of  the  Acquisition 
Plan.  The  units  concerned  have  also  prepared  a  procedure  on  the  Acquisition  Plan  process,  describing  the 
different steps in the approval process, the roles and responsibilities of the different units and checklists to be 
used. However, the procedure does not establish clear deadlines for the contributions  of the different  units, 
which  would  help  in  preventing  or  minimising  any  delay  in  processing  the  Acquisition  Plan.  Moreover,  the 
procedure has not yet been formally approved.  

30.

  Follow-up audit on ethics in DG TRADE 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N°2 (important): contacts with interest groups and requests for access to documents 

67 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

31.

  Follow-up  audit  on  performance  of  Anti-Fraud  activities  in  the  own 
resource and taxation areas in DG BUDG 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed.  

Recommendation N°3 (very important): roles and responsibilities in the Traditional Own Resources area 

32.

  Follow-up  audit  on  performance  of  Anti-Fraud  activities  in  the  own 
resource and taxation areas in DG BUDG  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed.  

Recommendation N° 4 (important): performance monitoring and reporting on Anti-Fraud activities in the TOR 
area a) Quality of data in OWNRES 

33.

  Follow-up audit on the procurement process in DG DIGIT 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 4 (important): ex post controls  

34.

  Follow-up audit on performance of EUROSTAT’s support to the Europe 2020 
strategy and the new Commission priorities 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation  N°  2  (important):  operational  planning  and  monitoring  of  the  production  of  Europe  2020 
statistics and other key indicators 

Recommendation N° 4 (important): European statistics quality assurance and data validation checks 

35.

  Follow-up audit on former IAC and Internal Audit Service audits in OIB  

Internal Audit Service Audit on the procurement process in Office for Infrastructure and Logistics in Brussels 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 2 (very important): ex post controls methodology and implementation 

36.

  Follow-up audit on the procurement process in OIL  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 2 (very important): ex post controls  

37.

  Follow-up  audit  on 
implementation of the budget line of the OLAF Supervisory Committee 

the  governance,  planning,  monitoring  and 

The Internal Audit Service conducted two follow-up engagements in 2018 in relation to the audit.  

68 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

During  the  first  follow-up,  the  following  recommendations  were  assessed  as  not  fully  and/or  adequately 
implemented and were re-opened: 

Recommendation N° 1 (very important, downgraded to important): roles and responsibilities, budget planning 
and monitoring. 

Recommendation N° 2 (very important): budget execution  

38.

  Follow-up  audit  on 
implementation of the budget line of the OLAF Supervisory Committee 

the  governance,  planning,  monitoring  and 

Based  on  the  results  of  the  second  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation  N°  1  (rated  important  after  the  first  follow-up):  roles and  responsibilities,  budget planning 
and monitoring 

The following recommendation was not fully and/or adequately implemented and was re-opened: 

Recommendation N° 2 (very important downgraded to important): budget execution, with original target date 
for implementation of 31 January 2018, revised to 30 June 2018 

The  recommendation  consisted  of  five  actions  (2.1  to  2.5)  for  which  the  Office  for  the  Administration  and 
Payment  of  Individual  Entitlements  proposed  an  action  plan,  which  the  Internal  Audit  Service  assessed  as 
satisfactory. The first follow-up audit showed that the Office for the Administration and Payment of Individual 
Entitlements  had  satisfactorily  implemented  two  (2.1  and  2.3)  of  the  five  actions.  Notably,  the  roles  and 
responsibilities  for  the  procedure  to  certify  expenditure  as  ‘correct’  have  been  clarified.  Furthermore,  the  IT 
tool  for  the  management  of  missions  and  of  the  related  expenditure  in  the  Commission  (MIPS)  is  now 
systematically used, which ensures that management of the related expenditure is more timely, regular and 
structured.  

In  the  second  follow-up  audit,  the  Internal  Audit  Service  acknowledged  in  particular  the  specific  context 
related to the creation of the European Public Prosecutor’s Office and its implications on the European Anti-
Fraud Office’s activity, noted that progress still needs to be made in the implementation of two actions (2.2 
and 2.4) and assessed as satisfactory the implementation of one action (2.5).. 

In the light of these results, Internal Audit Service assessed the level of implementation as sufficient overall 
to  reduce  the  level  of  residual  risk,  from  high  to  medium  and  decided  to  downgrade  the  risk  rating  of  this 
recommendation from very important to important. 

39.

  Follow-up  audit  on  performance  and  coordination  of  Anti-Fraud  activities 
in the Traditional Own Resources areas in OLAF 

The Internal Audit Service conducted two follow-up engagements in 2018 in relation to the audit. Based on 
the  results  of  the  first  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 2 (very important): OLAF support 

Recommendation N° 4 (important): performance monitoring and reporting on Anti-Fraud activities in the TOR 
Area b) Quality of reporting on performance 

40.

  Follow-up  audit  on  performance  and  coordination  of  Anti-Fraud  activities 
in the Traditional Own Resources area in OLAF 

Based  on  the  results  of  the  second  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 5 (important): operational cooperation 

69 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

41.

  Follow-up audit on former IAC audits in PMO 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

IAC audit on the reimbursement of experts’ expenses managed by the PMO 

Recommendation N° 3 (very important): compliance with applicable rules and regulations. 

IAC audit on management of accident’s insurance in PMO.3 

Recommendation N° 6 (important): review the control measures. 

IAC audit on contracts related to the management of missions in the PMO 

Recommendation N° 2 (very important): completeness of transactions 

Recommendation N° 3 (very important): ensure a secured access to AMEX data 

Recommendation N° 7 (very important): relevant statistics made available to DGs in the framework of the next 
contract (2014) 

IAC audit on the effectiveness and efficiency of the mission management workflow in the PMO 

Recommendation N° 4 (very important): risk based verifications and controls 

Recommendation N° 6 (very important): redeployment of resources 

Recommendation N° 9 (important): reassessment of services for agencies and bodies. 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was not fully and/or adequately implemented and was re-opened: 

IAC audit on management of accident’s insurance in PMO.3 

Recommendation  N°  5  (very  important):  reliable  monitoring  of  accident  files  with  original  target  date  for 
implementation of 31 December 2012, revised deadline of 31 March 2018 

The Office for the Administration and Payment of Individual Entitlements provided the Internal Audit Service 
with  evidence  that  shows  that  it  now  records  deadlines  for  accident  files  in  ASSMAL2.  This  IT  system  also 
includes automatic checks and controls to ensure correct reimbursements. However, in the current version of 
ASSMAL2,  it  is  not  yet  possible  to  have  an  overview  of  the  deadlines  linked  to  all  accident  files  at  the 
different stages of the process for treating them. Meanwhile, the Office for the Administration and Payment 
of Individual Entitlements is using a set of custom-made reports to monitor the accident files. 

42.

  Follow-up audit on business continuity in DG COMM 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 1 (very important): business impact analysis 

Recommendation N° 3 (important): business continuity documentation 

43.

  Follow-up  audit  on  security  of 
accountancy and inspection processes in DG ENER 

IT  applications  supporting  nuclear 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 4 (important): change management in infrastructure configuration. 

70 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

44.

  Follow-up  audit  on  security  of 
accountancy and inspection processes in DG ENER 

IT  applications  supporting  nuclear 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 3 (important): user access management 

45.

  Follow-up audit on management of local IT in DG ESTAT  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was not fully and/or adequately implemented and was re-opened: 

Recommendation N° 4 (very important): information system security 

The  last  part  of  the  recommendation  –  to  develop  and  implement  security  plans  for  all  active  information 
technology systems and services based on the security requirements identified for each system  – is not yet 
fully  implemented.  Eurostat  has  developed  information  technology  security  plans  by  family  of  standard 
systems,  grouped  along  the  three  main  aspects of  data  exchange,  data  processing  and data  dissemination. 
However, only over half of the operational information technology systems fit into those three categories and 
there is not yet a security plan in place which covers the remaining information technology systems. 

46.

  Follow-up audit on IT governance and portfolio management in DG GROW 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 1 (very important): IT strategy, IT-related risk management, and functioning of the ITSC 

The  recommendation  listed  below  was  assessed  as  not  fully  and/or  adequately  implemented  and  was  re-
opened: 

Recommendation N° 4 (important): IT service documentation and communication, with original target date for 
implementation of 30 June 2018 

The Internal Audit Service considers that although progress has been made, the action plan has not been fully 
implemented  yet.  The  services  documentation  has  only  been  partially  completed  and  therefore  only  partly 
published.  Furthermore,  the  service  catalogue  documentation  is  currently  not  information  system/service 
specific.  Therefore, the  risks  remain  that  relevant  knowledge  may  be  lost  and  that  communication  with  the 
Directorate-General  for 
internal  or  external 
customers/stakeholders  is  inefficient,  both  of  which  can  lead  to  difficulties  in  managing  expectations  and 
ultimately low levels of stakeholder satisfaction. 

Industry,  Entrepreneurship  and  SMEs 

Internal  Market, 

47.

  Follow-up  audit  on  the  former  IAC  audit  on  the  performance  of  the  Anti-
Fraud information system (AFIS) in OLAF  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 9 (important): user account management 

48.

  Follow-up audit on IT logical security controls in OLAF 

The following recommendation was assessed as not fully and/or adequately implemented and was re-opened: 

Recommendation  N°  3  (very  important):  Local  Information  Security  Officer  and  deputy  Local  Information 
Security Officer, with original target date for implementation of 30 March 2018 

71 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

At  the  time  of  the  follow-up,  the  Internal  Audit  Service  noted  that  only  three  out  of  five  parts  of  the 
recommendation  had  been  implemented.  After  the  follow-up  of  the  Internal  Audit  Service,  OLAF  took 
measures to implement the outstanding actions, i.e. organisation of monthly meetings between the Director-
General  and  the  Local  Information  Security  Officer  and  the  establishment  of  a  revamped  2018  Local 
Information Security Officer annual report. Since end of March 2019, OLAF considers the action plan as fully 
implemented.  The  effective  implementation  will  be  assessed  by  the  Internal  Audit  Service  in  due  course  as 
part of a second follow-up audit. 

49.

  Follow-up audit on business continuity management in Publications Office 
of the European Union 

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concludes  that  the  following 
recommendations were adequately and effectively implemented and were closed: 

Recommendation N° 3 (very important): inadequate business impact analysis not delivering intended results 

Recommendation  N°  4  (important):  gaps  in  the  application  level  documentation  and  IT  documentation 
scattered over different media 

50.

  Follow-up audit on business continuity management in Publications Office 
of the European Union 

Based  on  the  results  of  the  follow-up  audit,  the  following  recommendation  was  assessed  as  not  fully 
implemented and was re-opened: 

Recommendation N° 5 (important): testing of business continuity insufficiently co-ordinated and logged, with 
original target date for implementation of 31 October 2017 

The  Publications  Office  of  the  European  Union  is  in  a  transitional  period  as  regards  the  migration  of  its  IT 
activities  to  the  Commission  data  centre  managed  by  the  Directorate-General  for  Informatics.  The  full 
implementation  of  the  service  level  agreement  between  the  Publications  Office  of  the  European  Union  and 
the  Directorate-General  for  Informatics  will  affect  the  measures  on  business  continuity  coordination  and 
logging.  The  full  integration  is  currently  expected  to  be  completed  by  the  end  of  2019.  However,  a  multi-
annual testing programme has yet to be established, covering also the transition period. 

For the  time  being, the  critical  systems  of  the  Office  remain  in  the  former  datacentres.  According  to  the  IT 
infrastructure  consolidation  convention  of  the  Publications  Office  of  the  European  Union,  these  datacentres 
are  considered  to  be  under  the  responsibility  of  the  Directorate-General  for  Informatics  as  from 
1 January 2018. However, the information technology incident exercises, which are performed regularly by the 
Directorate-General for Informatics, do not cover these datacentres. 

The Publications Office of the European Union performs a full switchover of applications from one data centre 
to the other at least twice per year as part of the operational maintenance of the building, when power cut 
exercises are performed. However, these tests are not properly documented for business continuity purposes 
and the results are not reported to senior management. To cover this gap, there needs to be proper failover 
documentation, which aims to prove the system’s ability to move critical operations from the main datacentre 
to back-up systems and vice versa. 

51.

  Follow-up audit on HR IT corporate application – NAP in PMO  

Based  on  the  results  of  the  follow-up  audit,  the  Internal  Audit  Service  concluded  that  the  following 
recommendation was adequately and effectively implemented and was closed: 

Recommendation N° 12 (important): NAP 1st level support 

72 

 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

52.

  Follow-up audit on supervision of outsourced IT operations in DG TAXUD 

Based on the results of the follow-up audit, the following recommendation was assessed as not fully and/or 
adequately implemented and was re-opened: 

Recommendation  N°  3  (important):  audit  arrangements,  with  original  target  date  for  implementation  of 
01 January 2018 

The Internal Audit Service acknowledges that the change of service provider for the QA contract (QA3 to QA4) 
delayed  the  implementation of  this recommendation.  Nevertheless, the  following  actions  have  not  yet  been 
fully  implemented:  (1)  consultation  between  the  Directorate-General  for  Taxation  and  Customs  Union 
resources and governance sector and the QA contractor to improving the audit methodology, and the resulting 
amendment of TEMPO methodology; (2) definition and implementation of rules for ownership, retention, hand 
over  and  deletion  of  audit  records  (test  results,  minutes  of  interviews,  etc.)  and  preparation  of  key 
deliverables  (audit  plan  and  audit  report),  in  line  with  Commission’s  document  management  practices;  (3) 
creation  of  a  post-audit  action  list  with  a  defined  follow-up  process  on  past  audit  recommendations 
stemming  from  QA  audits;  (4)  twice-yearly  presentation  of  the  follow-up  action  list  to  the  Groupe  de 
Coordination Informatique; (5) monthly progress reporting per sector on the audit actions for which they are 
responsible; (6) presentation of the follow-up action list to the Information Technology Steering Committee. 

73 

 
 
 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

List of follow-up audits performed in 2018 for which all recommendations 
have been closed after the follow-up 

Based on the results of the follow-up audits performed in 2018, the Internal Audit Service assessed that the 
following audits listed below could be fully closed as all the recommendations had been adequately 
implemented. 

Audit Title 

53. Follow-up audit on DG AGRI’s management and control system for Voluntary Coupled 
Support  

54. Follow-up audit on the limited review on the reporting on the corrective capacity in DG 
AGRI  

55. Follow-up audit on public procurement in DG CLIMA  

56. Follow-up audit on LIFE+ phasing out in DG ENV  

57. Follow-up audit on monitoring and enforcement of EU environmental law in DG ENV  

58. Follow-up audit on DG SANTE and HOME coordination and working arrangements with 
EU Regulatory Agencies  

59. Follow-up audit on the adequacy and effective implementation of Anti-Fraud Strategy 
in DG SANTE 

60. Follow-up audit on pilot projects and preparatory actions in DG SANTE  

61. Follow-up audit on the former IAC audit on the management of funds in DG SANTE 
Veterinary Programmes 

62. Follow-up audit in DG MARE on amendments of 2014-2020 operational programmes in 
DGs REGIO, EMPL and MARE  

63. Follow-up audit of former IAC audits in DG REGIO: interruptions and suspensions of 
payments, performance framework 

64. Follow-up audit on procurement in DG CNECT  

65. Follow-up audit on project management in DG CNECT  

66. Follow-up audit on the supervision of the implementation of Connecting Europe Facility 
in DG ENER  

67. Follow-up audit on governance and supervision of the Nuclear Decommissioning 
Assistance Programme in DG ENER  

68. Follow-up audit on past Internal Audit Service audits in ERCEA: closure of FP7 projects, 
HR management  

69. Follow-up audit on the former IAC audit on document management in Joint Research 
Centre  

70. Follow-up audit on SPP/ABM in Joint Research Centre  

71. Follow-up audit on the former IAC audit on Nuclear Decommissioning and Waste 

74 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

Management Programme  

72. Follow-up audit on monitoring of the aviation and maritime security policies, including 
related working arrangements with the EMSA Regulatory Agency in DG MOVE  

73. Follow-up audit on the supervision of the implementation of Connecting Europe Facility 
in DG MOVE  

74. Follow-up audit on the Participant Guarantee Fund in DG RTD 

75. Follow-up audit on FP7 control systems in DG RTD  

76. Follow-up audit on the set up of the Common Support Centre for H2020 in DG RTD 

77. Follow-up audit on the limited review on the reporting on the corrective capacity in DG 
RTD 

78. Follow-up audit on design and implementation of EU trust funds in DGs DEVCO, NEAR 
and BUDG –DG DEVCO 

79. Follow-up audit on the limited review on the reporting on the corrective capacity in DG 
DEVCO 

80. Follow-up audit on the former IAC audit on DG DEVCO’s management system of audit 
recommendations 

81. Follow-up audit on DG DEVCO EDF grants 

82 and 83. Follow-up audit on procurement under decentralised management mode in DG 
DEVCO (two follow-up audits performed) 

84. Follow-up audit on objective setting process in the context of preparation of 
Management Plans in DG ECHO 

85. Follow-up audit on FPI control strategy 

86. Follow-up audit on DG NEAR’s residual error rate methodology and calculation 

87. Follow-up audit on design and implementation of EU trust funds in DGs DEVCO, NEAR 
and BUDG – DG NEAR 

(p.m.) (35). Follow-up audit on past Internal Audit Service audits in DG EAC: audit on 
performance of National Agencies in DG EAC, audit on the effectiveness and efficiency of 
the Erasmus+ Control Strategy in the Education, Audiovisual and Culture Executive Agency 
(EACEA) and in National Agencies in DG EAC 

88. Follow-up audit on the objective setting process in the context of preparation of 
Management Plans in DG HOME 

89. Follow-up audit on DG HOME’s management of Emergency Assistance in the context of 
the migration crisis 

(p.m.) Follow-up audit on past Internal Audit Service audits in DG HOME: audit on DG 
HOME’s preparedness for 2014-2020 legislation under shared management 

90 and 91. Follow-up audit on grant management in DG JUST (two follow-up audits 

35  

Pro-memory: Follow-up audit already mentioned before. During this audit recommendations from several audits were followed-up. 
Only for some of these audits this resulted in the closure of all recommendations. 

75 

 
 
 
                                                        
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

performed) 

92. Follow-up audit on past Internal Audit Service audits in EASME: audit on the 
preparedness of the management and control system for the implementation of LIFE 
2014-2020 

93. Follow-up audit on the effectiveness of the management of the COSME programme by 
EASME 

94. Follow-up audit on the limited review on the reporting on the corrective capacity in 
EASME  

(p.m.). Follow-up audit on past Internal Audit Service audits in DG ECFIN: financial 
management and grant process 

95. Follow-up audit on financial management of procurement and grants in DG FISMA  

96 and 97. Follow-up audit on the limited review of the calculation and the underlying 
methodology of the residual error rate for the 2016 reporting year in DG GROW (two 
follow-up audits performed) 

98. Follow-up audit on the former IAC audit on the internal control strategy of the GSA over 
the budget delegated by DG ENTR (current DG GROW) 

99 and 100. Follow-up audit on performance and coordination of Anti-Fraud activities in 
the Traditional Own Resources area in DG TAXUD (two follow-up audits performed) 

101. Follow-up audit on financial and procurement management in DG TRADE 

102. Follow-up audit on design and implementation of EU trust funds in DEVCO, NEAR and 
BUDG – DG BUDG 

103. Follow-up audit on the former IAC audit on external staff management in DG DIGIT 

104. Follow-up audit on management and supervision of contracts for outsourced IT 
services (IT contract management) in DG DIGIT 

105. Follow-up audit on financial management in the Legal Service 

(p.m.) Follow-up audit on former IAC and Internal Audit Service audits in OIB: IAC audit on 
concept and reproduction in OIB 

106. Follow-up audit on the efficiency and effectiveness of the design and implementation 
of the financial circuits in OIB 

107. Follow-up audit on the procurement process in OP 

108. Follow-up audit on the procurement process in DG SCIC 

109. Follow-up audit on effectiveness of measures to handle manual interventions in ABAC 
in DG BUDG 

110. Follow-up audit on management of local IT in DG COMP  

111. Follow-up audit of the former IAC audit on the adequacy of the application CECIS and 
conformity to Commission rules in DG ECHO 

76 

 
 
 
SWD accompanying the Annual report to the Discharge Authority on internal audits carried out in 2018 

112 and 113. Follow-up audit on management of EESSI project in DG EMPL (two follow-up 
audits performed) 

114. Follow-up audit on information security governance in the Commission  

77 

 
 
 
 
Section 3 
Summary of long outstanding recommendations (state of play as at 31 January 2019) 

No. 

DG 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

I 

AGRI 

II 

CLIMA 

III 

CLIMA 

Internal Audit 
Service Audit of the 
processes for 
managing and 
sharing data on agri-
environmental-
climate issues in DG 
AGRI, DG CLIMA 
and DG ENV 

Internal Audit 
Service Audit of the 
processes for 
managing and 
sharing data on agri-
environmental-
climate issues in DG 
AGRI, DG CLIMA 
and DG ENV 

Internal Audit 
Service Audit of the 
processes for 
managing and 
sharing data on agri-
environmental-
climate issues in DG 
AGRI, DG CLIMA 
and DG ENV 

Mapping of information 
needs and available data 
related to agri-
environmental-climate 
issues  

Meetings and presentations between and by AGRI, CLIMA, ENV and Eurostat regarding 
agri-environmental indicators and statistics have been carried out. DG ENV has created 
an  indicator  inventory  which  DG  AGRI  has  contributed  to.  A  set  of  draft  context 
indicators  and  their  methodological  fiches  are  under  development.  The  inventory  of 
‘other statistics’ is currently being updated by Eurostat. During the impact assessment 
for  the  new  CAP,  DG  AGRI  worked  extensively  with  the  Joint  Research  Centre  to 
ensure  that  agri-environmental  interaction  was  taken  into  account  in  the  modelling. 
Further progress is dependent on the revision of the CAP. 

A follow-up audit is currently ongoing. 

Expected delay compared to the original due date of 18 months. 

Mapping of information 
needs and available data 
related to agri-
environmental-climate 
issues  

Meetings and presentations between and by AGRI, CLIMA, ENV and Eurostat regarding 
agri-environmental indicators and statistics have been carried out. DG ENV has created 
an  indicator  inventory  which  DG  AGRI  has  contributed  to.  A  set  of  draft  context 
indicators  and  their  methodological  fiches  are  under  development.  The  inventory  of 
‘other statistics’ is currently being updated by Eurostat. 

A follow-up audit is currently ongoing. 

Expected delay compared to the original due date of 18 months. 

Coordination of Member 
States reporting 
requirements and reuse 
of data  

Substantial progress has been made in its implementation. 

The Legal Service was consulted on the sharing of other IACS data and the other EU 
institutions as well as Member States were consulted on their willingness to share such 
data  through  an  e.survey.  In  addition,  the  three  audited  DGs  had  several  meetings 
between  themselves,  with  other  services  concerned  (ESTAT,  JRC,  GROW),  with 
Member  States  and with  the  EEA.  A  roadmap will  be  established  with  Joint  Research 
Centre and involving other DGs: ENV, CLIMA, ESTAT, JRC, GROW and the EEA.  

To  ensure  an  effective  data  sharing  at  mid-  and  long-term  and  to  provide  legislative 
certainty to the Member States, Article 65 on ‘Data keeping and sharing” is included in 
the  proposal  for  the  regulation  on  the  financing,  management  and  monitoring  of  the 
future CAP post 2020. 

A follow-up audit by the Internal Audit Service is currently ongoing. 

Expected delay compared to the original due date of 13 months. 

12-01-2017 

30-06-2018 

31-12-2019 

12-01-2017 

30-06-2018 

31-12-2019 

12-01-2017 

01-03-2018 

31-03-2019 

78 

 
 
 
 
No. 

DG 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

IV 

EMPL 

V 

ENV 

VI 

MARE 

Internal Audit 
Service audit on 
early implementation 
of European 
Structural and 
Investment Funds 
control strategy 
2014-2020 

Internal Audit 
Service Audit of the 
processes for 
managing and 
sharing data on agri-
environmental-
climate issues in DG 
AGRI, DG CLIMA 
and DG ENV 

Internal Audit 
Service audit on 
early implementation 
of European 
Structural and 
Investment Funds 
control strategy 
2014-2020 

AUDITS ON ‘FINANCIAL 
INSTRUMENTS’  

Mapping of information 
needs and available data 
related to agri-
environmental-climate 
issues  

AUDITS ON ‘FINANCIAL 
INSTRUMENTS’  

The  delay  in  the  implementation  of  this  recommendation  is  due  to  (a)  the  relatively 
low level of  implementation of FI so far which directed  DGs’ audit resources towards 
other priorities and (b) the necessary discussions and coordination arrangements with 
the  Audit  Authorities  on  an  appropriate  methodology  for  auditing  these  instruments. 
While  the  recommendation  is  not  fully  implemented  yet,  important  measures  have 
already been taken. 

A  follow-up  by  the  Internal  Audit  Service  will  take  place  as  soon  as  the 
recommendation is reported as ‘ready for review’ by DG EMPL. 

Expected delay compared to the original due date of 18 months. 

Meetings and presentations between and by AGRI, CLIMA, ENV and Eurostat regarding 
agri-environmental indicators and statistics have been carried out. DG ENV has created 
an  indicator  inventory  which  DG  AGRI  has  contributed  to.  A  set  of  draft  context 
indicators  and  their  methodological  fiches  are  under  development.  The  inventory  of 
‘other statistics’ is currently being updated by Eurostat. During the impact assessment 
for  the  new  CAP,  DG  AGRI  worked  extensively  with  the  JRC  to  ensure  that  agri-
environmental interaction was taken into account in the modelling. Further progress is 
dependent on the revision of the CAP. 

A follow-up audit is currently ongoing. 

Expected delay compared to the original due date of 18 months. 

The  delay  in  the  implementation  of  this  recommendation  is  due  to  (a)  the  relatively 
low level of  implementation of FI so far which directed  DGs’ audit resources towards 
other priorities and (b) the necessary discussions and coordination arrangements with 
the  Audit  Authorities  on  an  appropriate  methodology  for  auditing  these  instruments. 
While  the  recommendation  is  not  fully  implemented  yet,  important  measures  have 
already been taken. 

A  follow-up  by  the  Internal  Audit  Service  will  take  place  as  soon  as  the 
recommendation is reported as ‘ready for review’ by DG MARE. 

Expected delay compared to the original due date of 9 months. 

20-12-2016 

30-06-2018 

31-12-2019 

12-01-2017 

30-06-2018 

31-12-2019 

20-12-2016 

30-06-2018 

31-03-2019 

79 

 
 
No. 

DG 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

VII 

REGIO 

Internal Audit 
Service audit on 
early implementation 
of European 
Structural and 
Investment Funds 
control strategy 
2014-2020 

AUDITS ON ‘FINANCIAL 
INSTRUMENTS’  

VIII 

OLAF 

Internal Audit 
Service audit on IT 
Logical security 
controls in OLAF 

Local Information 
Security Officer and 
deputy Local 
Information Security 
Officer 

IX 

DEVCO 

Internal 
Service 
African 
Facility 
Union 

audit 

Audit 
on 
Peace 
in  African 

INSTITUTIONAL 
AND 
ASSESSMENT 
MONITORING  BY  DG 
THE 
DEVCO 
OF 
PARTNERSHIP 
WITH 
THE AUC  

The  delay  in  the  implementation  of  this  recommendation  is  due  to  (a)  the  relatively 
low level of  implementation of FI so far which directed  DGs’ audit resources towards 
other priorities and (b) the necessary discussions and coordination arrangements with 
the  Audit  Authorities  on  an  appropriate  methodology  for  auditing  these  instruments. 
While  the  recommendation  is  not  fully  implemented  yet,  important  measures  have 
already been taken. 

A  follow-up  by  the  Internal  Audit  Service  will  take  place  as  soon  as  the 
recommendation is reported as ‘ready for review’ by DG REGIO. 

Expected delay compared to the original due date of 18 months. 

OLAF reported this recommendation to the Internal Audit Service as ‘ready for review’ 
on 27 June 2018. Since then, at the time of the follow-up, the Internal Audit Service 
noted that only three out of five parts of the recommendation had been implemented. 
After  the  follow-up  of  the  Internal  Audit  Service,  OLAF  took  measures  to  implement 
the outstanding actions. 

The Internal Audit Service will perform a second follow-up of this recommendation in 
the first half of 2019. 

Expected delay compared to the original due date of 12 months. 

Although  planned  for  Q4  2018,  the  new  pillar  assessment  recommended  by  the 
external  contractor  in  their  April  2018  final  monitoring  report  has  not  been  launched 
yet,  pending  completion  by  the  African  Union  Commission  of  the  identification  and 
valuation of assets exercise (necessary to comply with IPSAS requirements). 

No further mitigating measures can be taken as the closure of the recommendation is 
dependent  on  the  African  Union  Commission’s  readiness  to  launch  the  pillar 
assessment. 

The Internal Audit Service will launch a follow-up once the recommendation is marked 
as ‘ready-for-review’ by management. 

Expected delay compared to the original due date of 32 months. 

X 

ENV 

Internal 
Audit 
Service  Audit  of  the 
for 
processes 
managing 
and 
sharing data on agri-
environmental-
climate  issues  in  DG 
AGRI,  DG  CLIMA 
and DG ENV 

Substantial progress has been made in its implementation. 

Coordination  of  Member 
States 
reporting 
requirements  and  reuse 
of data  

The Legal Service was consulted on the sharing of other IACS data and the other EU 
institutions as well as Member States were consulted on their willingness to share such 
data  through  an  e.survey.  In  addition,  the  three  audited  DGs  had  several  meetings 
among themselves, with other services concerned (ESTAT, JRC, GROW), with Member 
States and with the EEA. 

A follow-up audit is currently ongoing. 

Expected delay compared to the original due date of 13 months. 

20-12-2016 

30-06-2018 

31-12-2019 

02-05-2017 

30-03-2018 

31-03-2019 

21-01-2016 

31-12-2016 

31-08-2019 

12-01-2017 

01-03-2018 

31-03-2019 

80 

 
 
No. 

DG 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

XI 

OLAF 

Internal 
Audit 
Service  audit  on  IT 
security 
Logical 
controls in OLAF 

OVERALL  IT  SECURITY 
ROLES 
AND 
PROCEDURES  

XII 

PMO 

Audit 
Internal 
Service 
on 
charge-back in PMO 

audit 

SERVICE-LEVEL 
AGREEMENTS (SLAS)  

XIII 

PMO 

Audit 
Internal 
Service 
on 
charge-back in PMO 

audit 

COST METHODOLOGY  

XIV 

OIB 

audit 

Audit 
Internal 
Service 
on 
Procurement process 
in  OIB,  OIL  and  DG 
BUDG 

PROCUREMENT 
PROCEDURES  

XV 

OLAF 

Internal 
Audit 
Service  audit  on  IT 
Logical 
security 
controls in OLAF 

KEY  OCM 
PROJECT 
DOCUMENTATION  AND 
LOGGING CONTROLS 

According  to  OLAF,  most  of  the  actions  have  been  implemented,  with  the  remaining 
action (the review of the internal  security framework of Units C2 and D4) planned to 
be completed by the end of March 2019. 

The Internal Audit Service will perform a first follow-up of this recommendation in the 
first half of 2019. 

Expected delay compared to the original due date of 14 months. 

A  new  draft  catalogue  of  services  has  been  prepared  and  communicated  to  all 
interested parties on a dedicated page in MyPMO. PMO has initiated the revision of the 
cost methodology and had consultations with internal and external stakeholders. 

The Internal Audit Service will perform a follow-up during the first half of 2019. 

Expected delay compared to the original due date of 11 months. 

According  to  PMO,  the  revision  of  the  cost  methodology  is  finalised  and  follows  the 
latest corporate guidance of DG BUDG. PMO will no longer apply any discounts to its 
services and a dedicated section on this matter will be available on PMO’s website (or 
information upon request for the potential clients with no access to the website). 

The Internal Audit Service will perform a follow-up during the first half of 2019. 

Expected delay compared to the original due date of 11 months. 

A working document including a proposal for a substantially revised ‘Kallas procedures’ 
has been prepared by OIB and submitted to DG HR members of the working group at 
the  end  of  September  2018.  A  meeting  regarding  the  revision  of  the  procedure 
between OIB and DG HR is scheduled for the end of March 2019. Once an agreement 
is  reached  with  DG  HR,  all  the  relevant  actors  will  be  consulted  through  an  inter-
service consultation. 

The Internal Audit Service will launch a follow-up once the recommendation is marked 
as ‘ready-for-review’ by management. 

Expected delay compared to the original due date of 16 months. 

According  to  OLAF,  most  of  the  actions  have  been  implemented,  including  the 
formalisation  of  the  OCM  and  IT  infrastructure  logging  and  monitoring  policy. 
However, the implementation of the policy within the OCM application and the roles on 
the administration of log files is still missing (expected to be implemented by the end 
of February 2019).  

The Internal Audit Service will perform a first follow-up of this recommendation in the 
first half of 2019. 

Expected delay compared to the original due date of 14 months. 

02-05-2017 

31-01-2018 

31-03-2019 

19-01-2017 

31-03-2018 

28-02-2019 

19-01-2017 

31-03-2018 

28-02-2019 

20-01-2017 

22-12-2017 

30-04-2019 

02-05-2017 

31-12-2017 

28-02-2019 

81 

 
 
No. 

DG 

Audit title 

Recommendation 

Comments 

Final report 
date 

Original 
due date 

Revised 
due date 

XVI 

OLAF 

audit 

Audit 
Internal 
Service 
on 
Performance of Anti-
Fraud  activities 
in 
the  own 
resource 
and taxation areas 

ANTI-
FRAUD   STRATEGIES  IN 
OWN  RESOURCES  AT 
COMMISSION  AND  DG 
LEVEL (OLAF)  

ROLES 
RESPONSIBILITIES 
THE TOR AREA (OLAF)  

AND 
IN 

XVII 

OLAF 

XVIII 

PMO 

audit 

Audit 
Internal 
Service 
on 
Performance of Anti-
in 
Fraud  activities 
the  own 
resource 
and taxation areas 

audit 

Audit 
Internal 
Service 
on 
effectiveness  of  the 
management 
of 
absenteeism  in  the 
Offices 
(OIB,  OIL 
and PMO) 

The Internal Audit Service has not yet been able to conduct a follow up audit due to 
the  continued  extension  in  the  date  of  implementation  of  the  recommendation.  This 
arises  from  the  delay  in  the  finalisation  of  a  revised  Commission  Anti-Fraud  Strategy 
(CAFS).  One  of  the  principal  reasons  for  the  delay  in  the  finalisation  of  the  revised 
CAFS  has  been  the  necessity  to  take  into  account  findings  and  recommendations  of 
the  ECA  in  its  special  report  on  fighting  fraud  in  EU  spending  (issued  on  10  January 
2019). According to the latest information received from OLAF on 11 March 2019, the 
recommendation will be fully implemented in the revised CAFS, the adoption of which 
is scheduled for the end of March 2019. 
The Internal Audit Service will launch a follow-up once the recommendation is marked 
as ‘ready-for-review’ by management. 

Expected delay compared to the original due date of 15 months. 

The Internal Audit Service has not yet been able to conduct a follow up audit due to 
the  continued  extension  in  the  date  of  implementation  of  the  recommendation.  This 
arises  from  the  delay  in  the  finalisation  of  a  revised  Commission  Anti-Fraud  Strategy 
(CAFS).  Several  key  elements  of  the  recommendation  await  the  agreement  on  the 
revised  CAFS.  According  to  the  latest  information  received  from  OLAF  on  11  March 
2019,  the  recommendation  will  be  implemented  in  the  revised  CAFS,  the  adoption  of 
which is scheduled for the end of March 2019. 

The Internal Audit Service will launch a follow-up once the recommendation is marked 
as ‘ready-for-review’ by management. 

Expected delay compared to the original due date of 15 months. 

5-12-2016 

31-12-2017 

31-03-2019 
(36) 

5-12-2016 

31-12-2017 

31-03-2019 
(37) 

PMO_MONITORING AND 
ANALYSIS OF ABSENCES 
AT OFFICE LEVEL  

At the cut-off date of this report this recommendation was still pending, however PMO 
has  updated  the  status  on  11  February  2019  and  considers  the  recommendation  as 
‘ready for review’. 

The Internal Audit Service will perform a follow up in the first quarter of 2019. 

Expected delay compared to the original due date of 18 months. 

6-10-2015 

30-06-2017 

11-02-2019 

36  
37  

Revised on 11 March 2019 from 28 February 2019 to 31 March 2019. 
Revised on 11 March 2019 from 28 February 2019 to 31 March 2019. 

82