COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2020
Date: 2021-06-08
Institutions: European Commission, Secretariat-General
Subjects: activity report, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 8.6.2021  SWD(2021) 132 final  COMMISSION STAFF WORKING DOCUMENT    Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS  Annual report to the Discharge Authority on internal audits carried out in 2020                        {COM(2021) 292 final}  
 
 
Table of Contents 
Content of this staff working document ................................................................................................................................................. 6 

PART 1: Final reports ............................................................................................................................................................................................ 7 

HORIZONTAL AUDITS ............................................................................................................................................................................................... 7 

1.  Audit on pillar assessment in the external action family (DG BUDG, DG ECHO, DG INTPA, DG NEAR, 

FPI) 

7 

2.  Audit on the Commission’s strategy for data, information and knowledge management (DG BUDG, 
DG DIGIT, DG ESTAT, DG HR, JRC, SG) ................................................................................................................................ 11 

3.  Audit on the management of the European fund for strategic investments guarantee fund (DG 

BUDG, DG ECFIN) ............................................................................................................................................................................. 13 

4.  Audit on WIFI4EU (DG CNECT, DG DIGIT, INEA) ............................................................................................................ 13 

5.  Audit on the implementation of anti-fraud actions in research (DG CNECT, EASME, ERCEA, DG RTD, 
INEA, REA) ............................................................................................................................................................................................. 14 

6.  Audit on the management of experts in H2020 grants (DG CNECT, DG RTD, EASME, INEA, REA) 15 

7.  Audit on data protection (DG DIGIT, DG HR, JRC, LS, SG) ....................................................................................... 16 

8.  Audit on indirect management with entrusted entities (DG INTPA, DG NEAR) .......................................... 18 

AGRICULTURE, NATURAL RESOURCES AND HEALTH ...................................................................................................................................... 19 

1.  Limited review of the management of State aid in the field of agriculture in DG AGRI .................... 19 

2.  Audit on the financial management of the 2014-2020 European agriculture fund for rural 

development in DG AGRI ............................................................................................................................................................. 19 

3.  Audit on the design and implementation of CHAFEA control strategy .......................................................... 19 

4.  In-depth risk assessment of the innovation fund (DG CLIMA) ............................................................................ 20 

COHESION ............................................................................................................................................................................................................... 20 

1.  Audit on the process for coordinating technical support to the Member States in DG REFORM 

(including the contribution of DG REGIO and DG EMPL to the coordination mechanism) ................. 20 

2.  Audit on implementation of financial instruments under European Regional Development 

Fund/Cohesion Fund 2014-2020 in DG REGIO ............................................................................................................. 21 

RESEARCH, ENERGY AND TRANSPORT .............................................................................................................................................................. 22 

1.  Audit on the effectiveness of the design and of the implementation of the ex post control strategy 
for Connecting Europe Facility (CEF) by INEA ................................................................................................................ 22 

2.  Audit on the JRC’s support to EU policy and knowledge management (selection of and delivery on 
Commission requests) .................................................................................................................................................................. 23 

3.  Audit on accounting of assets in JRC .................................................................................................................................. 24 

4.  Audit on Horizon 2020 grant management phase 3 in REA ................................................................................ 25 

5.  Audit on the Horizon 2020 ex post audit strategy in DG RTD ............................................................................. 25 

EXTERNAL ACTIONS .............................................................................................................................................................................................. 27 

1.  Audit on performance management in FPI ..................................................................................................................... 27 

2.  Consulting engagement on EU visitors’ programme in FPI ................................................................................... 28 

EDUCATION AND CITIZENSHIP ............................................................................................................................................................................ 28 

1.  Audit on effectiveness of the protection of personal data of beneficiaries of and participants in the 
Erasmus+ and European Solidarity Corps programmes managed by DG EAC ......................................... 28 

2.  Audit on grant management (phase 3) – ex post controls in EACEA .............................................................. 30 

3.  Audit on grant management of the 2014-2020 Justice and Rights, Equality and Citizenship  

programmes – implementation in DG JUST ................................................................................................................... 30 

ECONOMIC AND FINANCIAL AFFAIRS ................................................................................................................................................................ 31 

1.  Limited review on the implementation of the new internal control framework in DG COMP ......... 31 

1 

 
2.  Audit on supervision of the implementation of the 2014-2020 programme for the European 

geostationary navigation overlay service in DG DEFIS ............................................................................................ 32 

3.  Audit on payments and accounting for tangible assets under the Galileo and Copernicus 2014-

2020 programmes in DG DEFIS ............................................................................................................................................. 33 

4.  Limited review on the implementation of the new internal control framework in DG FISMA......... 33 

5.  Audit on evaluation activities in DG TRADE .................................................................................................................... 33 

GENERAL SERVICES .............................................................................................................................................................................................. 34 

1.  Audit on human resources management in DG ESTAT ............................................................................................ 34 

2.  Audit on performance management in OLAF ................................................................................................................ 36 

3.  Limited review on the implementation of the new internal control framework in OP ......................... 37 

INFORMATION TECHNOLOGY AUDITS ................................................................................................................................................................ 37 

1.  Audit on management of public cloud services (DG DIGIT, DG HR, SG) ........................................................ 37 

2.  Audit on information technology security management in DG GROW ........................................................... 39 

3.  Audit on information technology governance and project management in JRC ..................................... 39 

PART 2: Follow-up engagements (summarised) .............................................................................................................................. 41 

1.  Follow-up audit in DG BUDG on the effectiveness and efficiency of the new early detection and 

exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG 
RTD (2 follow-ups performed in 2020) ............................................................................................................................. 41 

2.  Follow-up audit in DG CLIMA on the LIFE financial instrument: effectiveness and efficiency of the 
current framework in DG CLIMA and DG ENV ................................................................................................................ 41 

3.  Follow-up audit in DG EMPL on monitoring the implementation and performance of 2014-2020 
operational programmes in DG EMPL, DG MARE and DG REGIO ....................................................................... 41 

4.  Follow-up audit in DG ENV on the LIFE financial instrument: effectiveness and efficiency of the 

current framework in DG CLIMA and DG ENV ................................................................................................................ 41 

5.  Follow-up audit in DG ESTAT on the production process and the quality of statistics not produced 
by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST) ....................................................... 42 

6.  Follow-up audit in DG GROW on the production process and the quality of statistics not produced 
by Eurostat (DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST) ....................................................... 42 

7.  Follow-up audit in DG HOME on human resources management and staff allocation in DG HOME 
and DG JUST ....................................................................................................................................................................................... 42 

8.  Follow-up audit in DG HR on the effectiveness of the management of absenteeism in OIB, OIL and 

PMO 

 ................................................................................................................................................................................................ 43 

9.  Follow-up audit in DG INTPA on the effectiveness and efficiency of the new early detection and 

exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG 
RTD 

 ................................................................................................................................................................................................ 43 

10. Follow-up audit in DG JUST on the production process and the quality of statistics not produced 
by Eurostat in DG ENER, DG ESTAT, DG FISMA, DG GROW and DG JUST .................................................... 43 

11. Follow-up audit in DG JUST on human resources management and staff allocation in DG HOME 
and DG JUST ....................................................................................................................................................................................... 43 

12. Follow-up audit in JRC on intellectual property rights supporting activities in DG COMM, DG DIGIT, 
DG GROW, JRC and OP ................................................................................................................................................................. 44 

13. Follow-up audit in DG MARE on monitoring the implementation and performance of 2014-2020 
operational programmes in DG EMPL, DG MARE and DG REGIO ....................................................................... 44 

14. Follow-up audit in OIL on the effectiveness of the management of absenteeism in OIB, OIL and 
 ................................................................................................................................................................................................ 44 

PMO 

15. Follow-up audit in OP on intellectual property rights supporting activities in JRC, DG COMM, DG 

GROW, DIGIT and OP ..................................................................................................................................................................... 44 

16. Follow-up audit in PMO on the effectiveness of the management of absenteeism in OIB, OIL and 
 ................................................................................................................................................................................................ 45 

PMO 

2 

 
17. Follow-up audit in DG REGIO on monitoring the implementation and performance of 2014-2020 
operational programmes in DG EMPL, DG MARE and DG REGIO ....................................................................... 45 

18. Follow-up audit in DG REGIO on the effectiveness and efficiency of the new early detection and 

exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and DG 
RTD 

 ................................................................................................................................................................................................ 45 

19. Follow-up audit in DG RTD on the effectiveness and efficiency of the new early detection and 
exclusion system in protecting the EU financial interests in DG BUDG, DG INTPA, DG REGIO and 
RTD 

 ................................................................................................................................................................................................ 45 

20. Follow-up audit on the monitoring and enforcement of EU health law in DG SANTE ......................... 46 

21. Follow-up audit on the management of the employment and social innovation programme (EaSI) 
with special emphasis on PROGRESS axis in DG EMPL (2 follow-up audits performed in 2020) 46 

22. Follow-up audit on ex ante controls on Horizon 2020 grant payments in DG CNECT......................... 46 

23. Follow-up audit on human resources management – recruitment of temporary scientific staff in 
 ................................................................................................................................................................................................ 46 

JRC 

24. Follow-up audit on verification plans in DG INTPA (2 follow-up audits performed in 2020) ......... 46 

25. Follow-up audit on common foreign and security policy in FPI ......................................................................... 47 

26. Follow-up audit on partnership instrument in FPI ...................................................................................................... 47 

27. Follow-up audit on the Neighbourhood Investment Facility (NIF) and the Western Balkans 

investment framework (WBIF) in DG NEAR (2 follow-up audits performed in 2020) .......................... 47 

28. Follow-up audit on DG HOME’s audit activity and clearance of accounts .................................................. 48 

29. Follow-up audit on procurement in DG JUST................................................................................................................. 48 

30. Follow-up audit on anti-fraud information system in OLAF ................................................................................ 49 

31. Follow-up audit on supervision of outsourced IT operations in TAXUD ........................................................ 49 

32. Follow-up audit on the procurement process in DIGIT ............................................................................................ 50 

33. Follow-up audit on Eurostat’s quality management of statistical processes ........................................... 50 

34. Follow-up audit on effectiveness of Eurostat’s cooperation with external stakeholders .................. 50 

35. Follow-up audit on management of information technology security in DG DIGIT ............................... 50 

36. Follow-up audit on information technology governance in DG INTPA ........................................................... 51 

37. Follow-up audit on information technology security management in DG RTD (2 follow-up audits 
performed in 2020) ........................................................................................................................................................................ 51 

List of audits for which all recommendations have been closed in 2020 after a follow-up audit ..... 52 

Part 3: summary of long-outstanding recommendations – state of play as at 31 January 2021 ................ 55 

3 

 
 
 
 
 
List of abbreviations 

CHAFEA: Consumers, Health; Agriculture and Food Executive Agency  
DG AGRI: Directorate-General for Agriculture and Rural Development  
DG BUDG: Directorate-General for Budget  
DG CLIMA: Directorate-General for Climate Action  
DG CNECT: Directorate-General for Communications Networks, Content and Technology  
DG COMM: Directorate-General for Communication  
DG COMP: Directorate-General for Competition  
DG DEFIS: Directorate-General for Defence Industry and Space 
DG DEVCO: Directorate-General for International Cooperation and Development1  
DG DIGIT: Directorate-General for Informatics  
DG EAC: Directorate-General for Education, Youth, Sport and Culture  
DG ECFIN: Directorate-General for Economic and Financial Affairs 
DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations 
DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion  
DG ENER: Directorate-General for Energy 
DG ENV: Directorate-General for Environment  
DG ESTAT: Eurostat  
DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union  
DG GROW: Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs  
DG HOME: Directorate-General for Migration and Home Affairs  
DG HR: Directorate-General for Human Resources and Security  
DG INTPA: Directorate-General for International Partnerships (former DG DEVCO) 
DG JUST: Directorate-General for Justice and Consumers  
DG MARE: Directorate-General for Maritime Affairs and Fisheries  
DG MOVE: Directorate-General for Mobility and Transport  
DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations  
DG REFORM/SRSS: Directorate-General for Reform (former SRSS – Structural Reform Support Service) 
DG REGIO: Directorate-General for Regional and Urban Policy  
DG RTD: Directorate-General for Research and Innovation  
DG SANTE: Directorate-General for Health and Food Safety  
DG SCIC: Directorate-General for Interpretation  
DGT: Directorate-General for Translation  
DG TAXUD: Directorate-General for Taxation and Customs Union  
DG TRADE: Directorate-General for Trade  
EASME: Executive Agency for Small and Medium-sized Enterprises  
EACEA: Education, Audiovisual and Culture Executive Agency  
EPSO: European Personnel Selection Office  
ERCEA: European Research Council Executive Agency  
FPI: Service for Foreign Policy Instruments  
IAS: Internal Audit Service  
IDEA: Inspire, Debate, Engage and Accelerate Action 
INEA: Innovation and Networks Executive Agency  
JRC: Joint Research Centre  
OIB: Office for Infrastructure and Logistics in Brussels  

1  

On 16 January 2021, DG DEVCO became the Directorate-General for International Partnerships (DG INTPA). To facilitate the 
reading, we used the name DG INTPA throughout this report. This should be understood to refer to DG DEVCO for all events, 
documents and figures before the aforementioned transition date. 

4 

 
 
 
 
                                                           
OIL: Office for Infrastructure and Logistics in Luxembourg  
OLAF: European Anti-Fraud Office  
OP: Publications Office of the European Union  
PMO: Office for the Administration and Payment of Individual Entitlements  
REA: Research Executive Agency  
SG: Secretariat-General  
SG.RECOVER: Secretariat-General Recovery & Resilience Task Force 
SJ: Legal Service 
UKTF: Task Force for Relations with the United Kingdom 

5 

 
 
Content of this staff working document 

Part 1 of this document contains: 

 

a summary of the internal audit engagements performed as part of the 2020 Internal Audit Service 
(IAS) audit plan (reports issued between 1 February 2020 and 31 January 2021); and  

 

the principal recommendations (critical and very important2) made.  

The  information  contained  in  this  document  reflects  the  state  of  play  when  the  audit  engagements  were 
finalised.  Each  audit  followed  the  applicable  standard  professional  validation  and  contradictory  procedures 
between  auditor  and  auditee  at  the  time  of  the  finalisation  of  the  engagement.  The  enclosed  summary  of 
each  engagement  aims  to  provide  an  overview  of  the  audits  and  their  main  results.  Additional,  up-to-date 
information is provided in specific sections by the auditees on measures drawn up and already implemented 
after the internal audit engagements were finalised. 

Part  2  of  this  document  contains  a  summary  of  the  results  of  the  Internal  Audit  Service’s  follow-up 
engagements performed between 1 February 2020 and 31 January 20213. 

Part  3  provides  a  summarised  overview  of  the  six  long  overdue  very  important  recommendations  as  at  31 
January 2021. 

2 

3 

Important  recommendations  are  not  reproduced  in  this  annex.  Please  note  that  for  some  audit  engagements  the  number  of 
recommendations may be higher as compared to the number of issues or observations made, as one audit issue/observation may 
result in several, separate recommendations being formulated to different Commission departments. 
The  summary  reflects  the  IAS’s  assessment  of  the  audit  recommendations’  implementation  status  at  the  end  of  the  follow-up 
assignment.  It  does  not  take  into  account  any  further  action  with  possible  impact  on  the  status  of  the  recommendation  that  the 
auditee may have undertaken and reported to the IAS since the release of the IAS follow-up note or report. 

6 

 
 
                                                           
PART 1: Final reports 

Horizontal audits 

1.  Audit on pillar assessment in the external action family (DG BUDG, DG ECHO, 

DG INTPA, DG NEAR, FPI) 

The objective of the audit was to assess the adequacy of the design, and the efficiency and effectiveness of 
the implementation of the pillar assessment process of entities to be entrusted with the implementation of 
Union  funds  in  the  external  action  domain  and  to  assess  if  it  enables the  Commission  to  ensure  a  level  of 
protection of the financial interests of the Union equivalent to the one that is provided when the Commission 
implements the budget directly. 

There  are  no  observations  /  reservations  in  the  2019  Annual  Activity  Reports  of  the  audited  Directorates-
General/Service that relate to the area/process audited. The fieldwork was finalised on 11 December 2020. All 
observations and recommendations relate to the situation as of that date. 

The  IAS  acknowledged  the  coordination  steps  DG  BUDG  has  taken  so  far,  in  particular  the  design  of  the 
planned  central  repository  that,  after improvements,  will  become  a  very  useful  tool  to  enhance  consistency 
and efficiency of the pillar assessment process across the Commission.  

The  IAS  also  acknowledged  the  coordination  efforts  (e.g.  alignment  of  existing  pillar  assessments  with  the 
requirements of the current Financial Regulation) and support to other Commission services by the DG INTPA 
as the lead service for a high number of pillar assessed entities.  

The efficiency and documentation of the pillar assessment process have improved over time. 

The IAS identified two critical issues concerning: (1) pillar assessment of the United Nations Secretariat; and 
(2) agreements signed with  pillar assessed entities. It also identified three very important issues concerning: 
(1)  the  corporate  oversight  role;  (2)  substantive  changes  in  pillar  assessed  entities’  systems,  rules  and 
procedures;  and  (3)  the  Commission  services’  involvement  in  the  pillar  assessment  process.  The  IAS 
formulated four critical and fifteen very important recommendations: 

Pillar assessment of the United Nations Secretariat in DG INTPA (1 critical recommendation addressed to DG 
INTPA) 

DG  INTPA  should  launch  as  soon  as possible, and based  on  the  support  of  all  interested  services, the  pillar 
assessment for the United Nations Secretariat (covering both the procurement and grants pillars) and for the 
entities that cannot rely on it (covering all but the three new pillars introduced in 2019), and apply supervisory 
measures  until  the  pillars  are  positively  assessed.  Furthermore,  based  on  the  outcome  of  the  existing  joint 
working group with the United Nations Secretariat, launch the assessment of the three new pillars introduced 
in  2019  and  finalise  it  within  the  deadline  set  by  the  Interinstitutional  Relations  Group  fiche  of  November 
2020. 

Agreements signed with pillar assessed entities (3 critical recommendations addressed to DG INTPA, DG NEAR 
and DG ECHO respectively and 1 very important recommendation addressed to DG BUDG) 

DG  BUDG  should  inform  the  services  of  the  conditions  for  making  a  presumption  of  conformity,  liaise  with 
them to implement supervisory measures for pillars that are not fully compliant, and cooperate to verify  the 
information regarding the scope of the assessment of the sub-delegation pillar. It  should  correct/record the 
scope and outcome of the pillar assessments in its inventory, when applicable.  

7 

 
 
 
The operational services should follow the instructions of DG BUDG and provide the necessary information. As 
prescribed by the Financial Regulation, prior to signing a contribution agreement, they should verify that the 
agreement allows the entrusted entity to use only the pillars it complies with, or that adequate supervisory 
measures are applied if the entity is not fully compliant. 

Corporate  oversight  role  (3  very  important  recommendations  addressed  to  DG  BUDG,  1  very  important 
recommendations addressed to DG INTPA, 1 very important recommendation addressed to DG NEAR) 

DG BUDG should further develop its corporate oversight role by clearly defining the scope of this role and the 
mandatory  or  advisory  nature  of  its  instructions  and  guidance  to  ensure  coordination  and  coherence  in  the 
pillar  assessment  process  across  the  Commission.  It  should  develop,  in  cooperation  with  the  other  services 
concerned  and  drawing  from  their  experience,  comprehensive  corporate  guidance  including  process 
description, templates and tools for  pillar assessments applicable to all Commission services. It  should also 
adopt a roadmap with milestones towards the establishment of the central repository / automated workflow 
tool and refine and complete the functional and technical requirements of the planned tool. 

Substantive  changes  (5  very  important  recommendations  addressed  to  DG  BUDG,  DG  INTPA,  DG  NEAR, 
DG ECHO and FPI respectively) 

DG BUDG should establish a mechanism enabling the lead services to verify compliance by the pillar assessed 
entities  with  the  obligation  to  report  substantive  changes  to  their  systems,  rules  and  procedures.  It  should 
adopt a procedure and issue guidelines for assessing such changes, and specify which measures to apply if 
substantive changes reported by an entity undermine the positive result of the pillar assessment. 

Commission  services’  involvement  in  the  pillar  assessment  process  (4  very  important  recommendations 
addressed to DG INTPA, DG NEAR, DG ECHO and FPI respectively) 

For ongoing and future pillar assessments, the operational Directorates-General / services should effectively 
use the possibilities at their disposal (e.g. participation in meetings, review of draft reports, their compliance 
with terms of reference, completeness, quality) to ensure that pillar assessments are of a good quality so that 
they can be relied on to take an informed decision on entrusting budget implementation tasks under indirect 
management.  Moreover,  they  should  adequately  document  the  pillar  assessment  review  process  and 
communicate  its  outcome,  including  the  supervisory  measures,  when  applicable,  correctly  and  in  a  timely 
manner;  to  the  pillar  assessed  entity  and  the  other  Commission  services.  Finally,  DG  NEAR  and  DG  ECHO 
should  establish  roadmaps  for  the  implementation  of  recommendations,  monitor  their  implementation  and 
systematically review if the supervisory measures established are relevant and sufficient. 

Additional  information  provided  by  DG  BUDG,  DG  INTPA,  DG  NEAR,  DG  ECHO  and  FPI  on  the 
measures defined and/or implemented following the Internal Audit Service audit 

The  multi-DG  audit  on  pillar  assessment  in  the  external  action  family  resulted  in  five  ‘very  important’ 
recommendations  for  DG  BUDG.  They  concerned  (further)  developing  the  corporate  coordination  and 
the  central 
the 
coherence  of 
repository/automated workflow tool, the mechanism of reporting the substantial changes and the conditions 
for making a presumption of conformity. DG BUDG’s action plan was agreed with the IAS in April 2021. 

the  pillar  assessment  process, 

related  guidance  for 

the  DGs, 

DG BUDG's action plan, agreed by the IAS, includes 22 measures related to these recommendations, some of 
which  have  already  been  delivered  as  planned  (e.g.  first  training  session  held  and  further  sessions  are 
scheduled, general guidance on Indirect Management published, updated repository made available to other 
Services,  model  notes  for  lead  DGs,  updated  FAQs,  Budgweb  pages  on  indirect  management  have  been 
reshaped, DG BUDG expert group on pillar assessments has been established, organisation of the update of 
the repository on a monthly basis). The bulk (50%) of DG BUDG measures is expected to be implemented by 
the end of June 2021.  

8 

 
 
 
 
 
DG BUDG is also liaising, within its remit, with external action DGs with regard to the implementation of their 
respective  action  plans  put  forward  to  address  the  IAS  recommendations  (e.g.  UNS  supervisory  measures, 
sub-delegation, repository of pillar-assessed entities, complementary assessments progress). 

Since  the  reception  of  the  audit  report,  DG  INTPA  has  further  assessed  the  IAS  observations  and,  in 
cooperation with the IAS has put in place an action plan. Its implementation should be completed by end of 
December  2021.  In  particular,  the  following  measures  have  already  been  implemented  to  address  the  two 
critical and three very important recommendations issued to DG INTPA: 

-  On  behalf  of  the  Commission,  DG  INTPA  has  written  to  the  UN  Controller  outlining  the  immediate 
consequences of the IAS report and the measures taken by the Commission and requesting the information 
needed  to  launch  the  missing  pillar assessments  of  the  UN Secretariat  and some  related  entities (UNEP  / 
UNODC).  

- The Director-General of DG INTPA issued an instruction note to all DG INTPA authorising officers and Heads 
of  Delegation  to  suspend  the  signature  of  contribution  agreements  with  the  UN  Secretariat  and  entities 
relying on its pillar assessment until the supervisory measures are put in place. 

-  A  separate  letter with  the  list  of  applicable  supervisory  measures,  pending  the  finalisation  of  the  PA, was 
sent  to  the  UN  on  15  April,  following  agreement  by  DG  BUDG  and  the  Legal  Service.  These  supervisory 
measures are detailed conditions for the entities to award procurement and grants while ensuring a level of 
protection of the EU funds equal to the level of protection assured by the Commission. Cooperation with the 
entities could therefore resume. However, the signature of agreements with supervisory measures is done 
on an exceptional basis and it is limited to actions that need to be urgently concluded before the completion 
of the pillar assessments. 

-  On  behalf  of  the  Commission,  DG  INTPA  has  written  to  the  UN  Controller  providing  clarifications  on  the 
conduct of the complementary assessments of the three  new pillars on exclusion from access to funding, 
publication of information on recipients of funds and protection of personal data and recalled the need for 
completing such assessments by 31 December 2021. 

- On 28 April 2021 DG INTPA signed the contract for the assessment of the grants and procurement pillars of 
the  United  Nations  Secretariat  (UNS).  The  announcement  letter  was  sent  to  the  UN  on  30  April.  The 
assignment starting date is mid May. 

-  DG  INTPA  has  carefully  assessed  all  other  building  blocks  supporting  the  assurance  in  relation  to  the 
operations  affected  by  the  findings  (i.e.  DG  INTPA’s  verification  missions,  RER  study,  ECA  audits, 
management declarations, follow-up of audit results). The conclusion is that there is reasonable assurance 
as regards the accuracy of payments made and the legality and regularity of the underlying transactions. 

- DG INTPA has also analysed the potential impact of the risks reported by the IAS on the operations with the 
identified entities in the report in terms of relevant expenditure in 2020. DG INTPA has also verified whether 
further  payments  to  entrusted  entities  in  2020  that  were  not  identified  in  the  IAS  report  could  also  be 
affected by missing or incomplete pillar assessments. This additional analysis covered operations with the  
20  most  important  (by  paid  amounts)  entrusted  entities4  and  468  transactions  were  assessed.  Relevant 
expenditure  (i.e.  total  payments  made  minus  pre-financing  plus  clearing  of  pre-financing)  relating  to 
contracts affected by the IAS findings amounts to EUR 55.4 million and the amount at risk corresponds to 
EUR 1.7 million. The conclusion is that the risk identified is under control while the financial impact is below 
the de minimis threshold. 

- DG INTPA liaised with and obtained information from relevant services so that complete information on the 

scope of the assessment of the sub-delegation pillar to be included in DG BUDG database. 

- DG INTPA replaced the databases on its Intranet with a link to the inventory compiled by the  Directorate-

General for Budget, after having liaised with DG BUDG on the needed corrections to be made. 

4 468 transactions were assessed that had not been covered by the initial remedial actions. As a result of these additional assessments, 
only 2 transactions with an aggregate relevant expenditure of EUR 1.570.063, 33 were identified as potentially affected by any of the 
weaknesses  reported  by  the  IAS.  In the  cases  in  question, agreements  signed  included sub-delegation  although  the entity  concerned 
(AECID) had not been assessed for that pillar. It is to be noted that there is no indication that any sub-delegation took place. 

9 

 
 
 
 
                                                           
It is also foreseen that the following measures are going to be implemented: 

- DG INTPA already included a reminder in the latest  version of INTPA Companion published in February on 
the  need  for  diligent  verification  prior  to  the  signature  of  agreements  that  in  the  absence  of  full  PA-
compliance  supervisory  measures  are  needed.  INTPA  will  also  bring  formally  this  to  the  attention  of  all 
services and add/update information on supervisory measures. 

-  DG  INTPA  has  already  been  strengthening  the  involvement  of  relevant  services  in  the  PA  process  by 
increasing  participation  in  opening  and  closing  meetings,  encouraging  Entities  to  submit  draft  reports, 
systematically  sharing  the  draft  reports  with  relevant  colleagues  in  BUDG  and  line  DGs  and  providing 
comments  on  the  reports.  Checklist(s)  including  the  issues  to  be  considered  during  the  quality  review 
process of the draft and pre-final PA reports will soon be introduced. 

- Following DG BUDG Instruction Note of 31 March on the discontinuation of the sub-delegation pillar and DG 
BUDG Note on ‘Complementary assessment of pillar 6 – Financial Instruments and Budgetary Guarantees’, 
DG  INTPA  will  shortly  send  communications  clarifying  the  need  for  certain  entities  to  undergo 
complementary  assessments  of  the  grants  pillar  and  relevant  sections  of  the  financial  instruments  pillar. 
For  entities  that  were  only  assessed  for  sub-delegation  -  without  the  grant  pillar  being  assessed  - 
contractual  (supervisory)  measures  will  be  needed  to  cover  the  gap  pending  the  completion  of  the 
assessment of the grants pillar. In addition, if the complementary assessment for relevant sections of pillar 
6  is  still  ongoing  at  the  moment  of  entering  into  contractual  arrangements  for  InvestEU  and/or  EFSD  + 
guarantee  agreements  and  equity,  relevant  contractual  provisions  will  have  to  be  included  in  the 
agreements. DG INTPA has started the drafting of such measures. 

DG  NEAR  adopted  the  action  plan  to  address  the  IAS  recommendations  in  March  2021,  its  implementation 
should be completed by October 2021. The actions to address the critical recommendation have been already 
implemented, more specifically: 

-  DG  NEAR  has  updated  the  relevant  checklist  and  sent  a  note  to  the  staff  at  Headquarters  and  in  EU 
Delegations  with  a  reminder  that  only  those  tasks,  for  which  the  pillars  have  been  assessed,  can  be 
entrusted, and that the supervisory measures should be applied, when they are established. 

The other three very important recommendations have also been mostly implemented. They cover: 

- the update of the Manual of procedures (MAP), including indicating the assignments of responsibilities within 

DG NEAR;  

- a closer monitoring of possible substantive changes in the pillar assessed entities;  

-  better substantiation  of  the  decision  to  directly  contract  auditors,  which  from now  on  will  be  done  with  a 

note to the file signed by the Director-General; 

- the usage of checklists for reviewing draft and pre-final reports and considering participation in the closing 

meetings;  

- setting the deadlines for communicating the results of the pillar assessments in MAP;  

- the quarterly follow-up of the implementation of the recommendations in the roadmaps; 

- bi-annual re-assessment of the the supervisory measures.  

10 

 
 
 
 
 
Some of the above listed points might need to be updated once DG BUDG issues their guidance in mid-2021. 
In addition, DG NEAR has carried out a thorough analysis of the payments made in 2020 to entrusted entities, 
including also entities not specifically identified by the IAS. The comprehensive checks conducted by DG NEAR5 
resulted  in  the  identification  of  errors  equal  to  0.21%  of  the  payments  made  in  2020  to  entrusted  entities 
under indirect management, well below the materiality level (2%). 

DG  ECHO  has  accepted  the  recommendations  and  an  action  plan  has  been  agreed  with  the  IAS.  The 
recommendations should be implemented by 30 June 2021 and include the following actions: 

- An instruction note will be issued by the Director-General. It will set out the responsibilities within DG ECHO 
units  to  ensure  that  the  outcome  of  the  pillar  assessment  and  the  established  supervisory  measures  are 
adequately recorded and applied. The instruction note will also identify the responsible unit in charge of the 
monitoring of the substantive changes communicated by the entities pillar assessed, the analysis of these 
changes and the identification of additional measures that can be needed following these changes. 

- Furthermore, a specific checklist will be developed for the review of the pillar assessment reports to ensure 

that the assessment process is adequately monitored and properly documented.  

-  In  addition,  DG  ECHO  has  included  supervisory  measures  in  its  IT  tool  and  will  ensure  that  compliance  is 

achieved on a permanent basis.  

-  Concerning  the  critical  audit  finding  for  the  pillar  assessment  of  the  UN  Secretariat,  DG  ECHO  noted  that 

supervisory measures are in place and applied as necessary.  

DG ECHO performed similar checks to the ones described by DGs INTPA and NEAR and found that for 2020, 
0.22% of its payments to  pillar assessed entities were at risk. The estimated financial impact amounted to 
EUR  56  000  and  was  well  below  the  de  minimis  threshold  for  raising  a  reservation  in  the  annual  activity 
report. According to DG ECHO, sufficient assurance could be obtained, and this analysis was performed in full 
cooperation with DG BUDG, the IAS and the other partners. 

It is foreseen that the two very important recommendations addressed to the FPI will be implemented by the 
drafting of a detailed internal FPI note due on 30 June 2021. The note will: 

- define the pillar assessment procedures;  

-  clarify  among  others  the  process for  dealing  with  substantive  changes and  FPI’s involvement  in  meetings 
and in drafting assessment report analysis; 

- set standards for the documentation of the pillar assessment review process.  

2.  Audit  on  the  Commission’s  strategy  for  data,  information  and  knowledge 

management (DG BUDG, DG DIGIT, DG ESTAT, DG HR, JRC, SG) 

The objective of the audit was to assess the effectiveness of the Commission’s strategy on data, information 
and knowledge management (DIKM) in addressing the challenges and expectations in this domain. 

There  are  no  observations  /  reservations  in  the  2019  Annual  Activity  Reports  of  the  audited  Directorates-
General  that  relate  to  the  area  audited.  The  fieldwork  was  finalised  in  October  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS recognised a number of strengths as regards the Commission’s framework for data, information and 
knowledge management, in particular:  

  Governance structure: the Commission has set up a multi-layer governance structure for DIKM which 
is  fully  embedded  in  the  overall  Commission’s  governance.  The  Information  Management  Steering 
Board  (IMSB)  reports  to  the  Corporate  Management  Board  and  is  chaired  by  the  Chief  Operating 

5 DG NEAR verified 99.3% of the payments made in 2020 under indirect management with entrusted entities (amounting to EUR 1.531 
million). The cumulative amount affected by the error identified by the IAS (missing or incomplete pillar assessment) is equal to EUR 3.29 
million (0.21% of the payments). 

11 

 
 
 
                                                           
Officer of the Commission. It is supported by an Information Management Team (IMT), composed of 
experts  from  several  Directorates-General.  Its  tasks  are  to  develop  policies  and  action  plans  and 
submit  proposals  to  the  IMSB.  The  IMSB  has  achieved  the  goal  to  set  up  very  ambitious  work 
programmes  and  to  coordinate  and  support  the  efforts  of  many  Commission  services  aiming  to 
address the DIKM challenges in a collaborative and agile way. Its coordination efforts are welcomed 
by the services closely involved in the DIKM. 

The IMSB and the IMT operate in a very transparent and open way. The outcome of the meetings is 
well  documented  and  there  are  dedicated  webpages  where  all  the  relevant  information  is  stored, 
including those related to the data strategy actions and the data ecosystem collaborative space.  

  Communication and visibility actions: the Secretariat-General together with the JRC, DG DIGIT and DG 
HR  have  made  particular  efforts  to  promote  the  DIKM  visibility  activities.  The  knowledge  weeks, 
organised  in  2018  and  2019,  were  successful  and  well  attended  events  and  achieved  to  raise 
awareness  of  the  DIKM  projects  and  support  the  individual  Directorates-General  in  implementing 
them. These events were also key in further supporting the cultural change within the Commission. 

Some of the DIKM actions, such as the one-stop-shop, the new corporate search and the opening of the ARES 
files, have been very successful in improving the information and knowledge sharing in the Commission. 

The IAS identified two very important issues on: (1) the design of the DIKM strategy; and (2) DIKM governance 
issues and formulated four very important recommendations: 

Design of the DIKM strategy (1 very important recommendation addressed to SG) 

The different elements of the DIKM strategy have to be reassessed and revised to strengthen their strategic 
orientation  and  coherence  and  better  demonstrate  how  it  contributes  to  the  Commission’s  priorities  and 
activities.  This  has  to  be  translated  into  SMART  long-term  strategic  objectives  giving  the  different 
departments  involved  in  the  implementation  a  common  understanding  of  the  strategic  direction  when 
designing and implementing the actions. These objectives have to be adequately reflected in the management 
plans of the services implementing the DIKM actions. 

DIKM governance issues (3 very important recommendations addressed to SG) 

The  role  of  the  IMSB  regarding  the  monitoring  of  the  human  and  financial  resources  deployed  for 
implementing  the  DIKM  corporate  actions  has  to  be  clarified.  The  roles  and  tasks  of  the  IMT  have  to  be 
clarified  and monitoring  procedures  have  to  be  adopted.  The  Secretariat-General  should  implement  tools to 
ensure effective coordination and sharing of information among action leaders and improve the exchange of 
information between the IMSB and the Information Technology and Cybersecurity Board. 

Additional information provided by SG on the measures defined and/or implemented following the 
Internal Audit Service audit 

The Secretariat-General coordinated the preparation of an action plan for the IAS audit on DIKM, which was 
accepted  by  the  IAS  on  25  March  2021.  The  action  plan  puts  forward  actions  to  address  the  audit’s 
recommendations,  such  as  aligning  of  DIKM  strategic  documents  and  objectives,  enhancing  the  monitoring 
and  reporting  of  the  strategy’s  implementation,  systematising  the  information  exchange  among  the 
participating governance bodies, and developing operational guidance on data quality. 

12 

 
 
 
 
 
To address the audit’s very important recommendations, the Secretariat-General will coordinate the following 
actions, which will have been completed by January 2022:  

- assess the relevance and coherence of existing DIKM strategic objectives and will formulate a set of specific 
and measurable medium term objectives, aligned with the Commission’s political guidelines and priorities. 
The objectives will guide the IMSB’s next work programme;  

- verify that the DIKM strategic objectives are adequately reflected in the management plans of the services 

involved in their implementation; 

- update the mandate of the IMSB and other policy documents to clarify its responsibilities. The information 
management team’s (IMT) added  value, key role, responsibilities and procedures, including monitoring and 
reporting, will also be reviewed; 

-  improve  further  the  systematic  information  exchange  between  the  IMSB  and  the  Information  Technology 
and Cybersecurity Board, e.g. by sharing meeting minutes regularly and aligning the rolling agendas of the 
two Boards;  

-  enhance  further  the  systematic  knowledge  sharing  among  the  action  leaders,  the  IMT  members  and  the 
local data correspondents, e.g. through the use of a common collaboration space using Microsoft Teams;  

- provide further guidance to the action leaders, including a common approach for referencing the corporate 

actions in their management plans and other planning documents;  

-  continue  providing  progress  information  to  the  IMSB  through  the  biannual  monitoring  reports,  which 
document  in  their milestones  and/or  deliverables the  progress of  all  relevant  activities of  an  IMSB action, 
including IT projects; 

-  clarify  to  the  action  leaders  that  for  the  actions  under  their  responsibility  in  the  IMSB’s  next  work 
programme, they should: define result-orientated performance indicators, and  set baseline values, targets 
and milestones. 

3.  Audit on the management of the European fund for strategic investments 

guarantee fund (DG BUDG, DG ECFIN) 

The audit objective was to assess the adequacy and effectiveness of the internal control systems related to 
the management of the European fund for strategic investments guarantee fund (including management of 
the European fund for strategic investments guarantee fund’s assets and calls on the EU guarantee) by DG 
BUDG and DG ECFIN, ensuring that the Commission is able to honour the calls on the EU guarantee. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  ECFIN  that  relate  to  the 
area/process  audited  (until  the  transfer  of  the  main  part  of  the  audited  activity  to  DG  BUDG  on  1  January 
2020, DG ECFIN was exclusively performing these tasks). The fieldwork was finalised on 27 November 2020. 
All observations and recommendations relate to the situation as of that date. 

The IAS recognised the following strengths/good practices: 

 

 

The  staff  members  managing  the  European  fund  for  strategic  investments  guarantee  fund  and 
conducting the related financial operations have the required expertise. 

There  is  a  strong  collaboration  and  knowledge  sharing  between  the  different  units  in  ECFIN.DDG2 
and BUDG.E. 

The IAS did not formulate any critical or very important recommendations. 

4.  Audit on WIFI4EU (DG CNECT, DG DIGIT, INEA) 

The objective of the audit  was to assess the effectiveness of the management of the WiFi4EU initiative by 

13 

 
 
 
the DG CNECT and INEA, including the IT support provided by the DG DIGIT. 

There are no observations / reservations in the 2019 Annual Activity Reports of the Directorates-General and 
Executive Agency that relate to the area/process audited. The fieldwork was finalised on 16 October 2020. All 
observations and recommendations relate to the situation as of that date. 

The  IAS  acknowledged  the  ongoing  efforts  made  by  DG  CNECT,  DG  DIGIT  and  INEA  to  ensure  the  effective 
implementation of the WiFi4EU initiative and recognised the following strengths: 

 

The  governance  arrangements  between  the  DG  CNECT,  DG  DIGIT  and  INEA  are  overall  well 
established.  The  current  written  agreements  (memoranda  of  understanding  between  the  two 
Directorates-General provide a sound framework for the supervision of the WiFi4EU initiative.  

  WiFi4EU  is  implemented  and  supervised  by  knowledgeable  and  committed  staff  in  DG  CNECT,  DG 

DIGIT and INEA. Furthermore, there is a good collaboration between these entities.  

 

In addition to the functionalities of the WiFi4EU portal, the INEA has set up:  

o 

o 

o 

clear  guidelines  and  procedures  for  staff  (including  supporting  checklists  for  10 
processes/sub-processes);  

an  effective  control  mechanism  for  processing  payments  and  monitoring  the  execution  of 
the initiative; 

a mapping tool to check the geolocation data encoded in the installation reports. 

  DG  DIGIT  provides  effective  support  to  the  management  of  WiFi4EU  with  tools  for  monitoring  the 
execution of the initiative. Moreover, it developed an IT security plan adapted to the specificities of 
the initiative.  

The IAS did not formulate any critical or very important recommendations. 

5.  Audit  on  the  implementation  of  anti-fraud  actions  in  research  (DG  CNECT, 

EASME, ERCEA, DG RTD, INEA, REA) 

The  objective  of  the  audit  was  to  assess  whether  the  anti-fraud  framework  in  the  research  family  is 
adequately designed and effectively implemented to ensure that: potential fraud cases can be prevented and 
timely detected; appropriate follow-up actions are taken when cases of serious suspicions are detected or for 
established fraud cases; anti-fraud activities are compliant with the applicable rules. 

There are no reservations in the 2019 Annual Activity Report of the audited Directorates-General or Executive 
Agencies  that  relate  to  the  area/process  audited.  The  fieldwork  was  finalised  on  26  November  2020.  All 
observations and recommendations relate to the situation as of that date. 

The IAS recognised the following strengths: 

 

 

The  design  and  implementation  of  the  research  anti-fraud  strategy  is centrally  coordinated  via  the 
Fraud and Irregularities in Research Committee, chaired by the Common Audit Service and attended 
by  the  Research  and  Innovation  family.  In  addition,  the  Common  Audit  Service  facilitates  the 
coordination  with  OLAF  for  the  whole  family,  which  ensures  a  coherent  approach  regarding  key 
elements  of  the  anti-fraud  framework  such  as  the  development  of  a  common  fraud  awareness 
training. 

The  ex  ante  controls  in  Horizon  2020  projects  are  supported  by  common  information  technology 
tools  designed  by  the  Common  Implementation  Centre.  At  the  end  of  2019,  the  Common 
Implementation  Centre  reinforced  the  anti-fraud  controls  before  and  after  signature  of  the  grant 

14 

 
 
 
agreements  by  providing  effective  information  technology  support  tools  (ARIS  and  SIMBA)  for  the 
detection  of  double  funding  and  plagiarism,  which  enable  to  check  the  content  of  deliverables 
against other documents already submitted to the Commission.  

The IAS did not formulate any critical or very important recommendations. 

6.  Audit on the management of experts in H2020 grants (DG CNECT, DG RTD, 

EASME, INEA, REA) 

The  objective  of  the  audit  was  to  assess  if  the  internal  control  system  setup  for  the  expert  management 
process in the research family is adequately designed and effectively implemented to ensure that the experts 
selected adhere to the criteria defined for the fulfilment of their evaluation and monitoring tasks and ensures 
compliance with the applicable rules. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  the  Directorates-General  and 
Executive Agencies that relate to the areas/process audited. The fieldwork was finalised on 30 October 2020. 
All observations and recommendations relate to the situation as of that date. 

The IAS recognised the following strengths:  

 

 

 

The  central  role  of  Unit  REA.C4  for  Horizon  2020  evaluators  ensures  overall  coordination  and 
coherence in contracting with experts as well as processing payments in a timely manner.  

The business process owner for expert management organises and coordinates regular meetings of 
the  Expert  Management  Steering  Committee  and  Key  Users  Group  to  discuss  major  issues  and 
developments regarding the expert management process.  

The  operational  units  have  made  sustained  efforts  to  ensure  that  selected  experts  adhere  to  the 
criteria  defined  for  the  fulfilment  of  their  evaluation  and  monitoring  tasks  (experience,  skills, 
knowledge, and independence).  

The  IAS  identified  two  very  important  issues  concerning:  (1)  the  monitoring  of  expert  participation  patterns 
and  respect  of  rotation  rules;  and  (2)  compliance  with  personal  data  protection  and  formulated  two  very 
important recommendations: 

Monitoring of participation patterns of independent experts and respect of the rotation rules 1 very important 
recommendation addressed to DG RTD) 

The  Common  Implementation  Centre  should  revise  its  guidance  on  monitoring  participation  patterns  and 
respect  of  rotation  rules,  clearly  allocate  the  responsibility  for  collecting  the  relevant  data  and  request  the 
Horizon 2020 implementing bodies to respect the guidance. The Common Implementation Centre should also 
determine  for  which  experts  the  rotation  rules  were  not  respected  when  the  pools  from  which  to  select 
experts were created and take the necessary corrective action. 

Processing of experts personal data (1 very important recommendation addressed to DG RTD) 

The  Common  Implementation  Centre  should  develop  a  common  policy  at  research  family  level  on  checking 
experts’ competence from social media and on the internet and processing personal data collected from these 
external  sources  in  line  with  the  applicable  rules.  Furthermore,  the  Common  Implementation  Centre  should 
update  the  expert  management  record  (updated  legacy  notification)  and  privacy  statement  to  include  this 
common policy. 

15 

 
 
 
 
 
Additional  information  provided  by  DG  RTD  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

The  Common  Implementation  Centre,  together  with  the  Directorates-General  and  Executive  Agencies 
concerned, drafted an action plan addressing the two very important recommendations. The action plan was 
presented to the IAS on 26 February 2021 and according to it the Common Implementation Centre will: 

-  update  and align  the  guidance  on  rotation  and monitoring  of  participation  rules for  experts,  in  agreement 

with Horizon Europe and including the template of the call evaluation report; 

-  provide  instructions  (to  be  included  in  the  eExperts  Vademecum)  for  services  to  communicate  to  the 
Business Process Owners, as part of the Steering Committee tasks, on the adequate number/gender balance 
of experts available for their specific needs; 

- develop guidance (to be included in the Vademecum) on the use of social media/internet and the processing 

of personal data of experts retrieved from external sources, including practical implementation aspects; 

-  include in a single call for expression of interest a reference to social media (and a reference in the portal's 

privacy statement if required); 

- further enlarge the extended mandate of the Taskforce on Elimination and Retention Safeguadrs (TFERS) to 

manage the elimination of obsolete personal data of experts on shared drives; 

- create awareness on data protection via different channels such as trainings and the DG’s Intranet. 

The Business Process Owners will ensure that publication of personal data published on  the Portal abides by 
the respective rules. 

7.  Audit on data protection (DG DIGIT, DG HR, JRC, LS, SG) 

The objective of the audit was to assess whether the Commission has put in place an effective and efficient 
control  system  enabling  Directorates-General/services  to  demonstrate  compliance  with  the  provisions  of 
Regulation (EU) 2018/1725.  

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Reports  of  the  Directorates-General  / 
services concerned that relate to the area/process audited. The fieldwork was finalised in mid-July 2020. All 
observations and recommendations relate to the situation as of that date.  

The IAS recognised the following strengths: 

With  the  entry  into  force  of  Regulation  (EU)  2018/1725  (Internal  Data  Protection  Regulation  -  IDPR),  the 
Commission adopted an action plan with ambitious objectives and milestones for the implementation of the 
new  rules  in  the  Commission,  thus  giving  the  right  tone  at  the  top.  The  Data  Protection  Officer  (DPO)  has 
monitored and reported on the implementation of the action plan annually. 

The Commission has put in place a decentralised model aiming at ensuring an adequate level of responsibility 
and accountability across the organisation through key actors at corporate and at Directorate-General/service 
level (DPO and (delegated and operational) controllers), as well as a network of Data Protection Coordinators 
(DPC).  While  the  IAS  has  identified  the  need  to  strengthen  certain  aspects,  this  decentralised  model,  as 
conceived,  provides  a  proportionate  balance  between  steer  at  corporate  level  and  accountability  at 
Directorate-General/service level and helps to ensure a good level of collaboration across the organisation.  

The  DPO  is  appropriately  positioned  in  the  Commission’s  governance  structure.  Although  attached  for 
administrative purposes to the Secretariat-General, he is functionally independent of the Secretariat-General 
and other Commission  Directorates-General/Services.  Hierarchically, the  DPO and his team are placed  under 
the supervision of the Chief Operating Officer (COO) and reports regularly to the Group of Resource Directors, 
a permanent sub-group of the Corporate Management Board (CMB), chaired by the COO. 

16 

 
 
 
 
Overall, in the sampled Directorates-General / services, there is a good level of awareness of data protection 
aspects by the actors involved at the different stages of the process.  

The data protection process is supported by a dedicated IT system, i.e. Data Protection Records Management 
System (DPMS), managed by the DPO (i.e. the system owner). While the IAS has identified the need to develop 
certain  features  in  this  system  to  improve  its  efficiency,  DPMS  provides  overall  a  good  basis  for  the 
management of processing operations in compliance with the IDPR. 

The IAS identified three very important issues related to: (1) the general framework governing personal data 
protection;  (2)  the  DPO  role  and  actions;  and  (3)  compliance  with  key  provisions  of  the  regulation  and 
formulated eight very important recommendations: 

General  framework  governing  personal  data  protection  aspects  in  the  Commission  (3  very  important 
recommendations  addressed  to  SG/DPO,  1  very  important  recommendation  addressed  to  DG  HR,  1  very 
important recommendation addressed to DG DIGIT) 

The IAS recommended that the DPO adopt additional guidance on the DPC function and, jointly with DG DIGIT, 
develop  methodology  and  guidance  for  defining  a  minimum  set  of  IT  related  controls  to  address  the 
requirements  of  the  IDPR  when  designing  new  IT  systems  or significantly  updating  existing  IT  systems.  The 
IAS also recommended: (1) the DPO should provide guidance to ensure that the shared DPC function is based 
on harmonised arrangements that set out the roles and responsibilities of each party; and (2) DG HR should 
assess,  jointly  with  the  delegated  controllers  of  the  four  Offices  of  the  HR  family,  whether  it  is  feasible  to 
maintain  a  common  DPC  function  and if  so,  to  support  the  shared  function  with  appropriate  arrangements, 
including the allocation of the necessary resources and the clarification of key responsibilities. 

Data  Protection  Officer’s  role  and  actions  to  support  the  data  protection  process  across  the  Commission 
services (2 very important recommendations addressed to SG/DPO) 

The  IAS  recommended  that  the  DPO  strengthen  its  draft  annual  work  programme  2020-2021  (including 
clearly defined objectives, timeliness for the planned actions, key performance indicators to monitor actions 
and  the  resources  to  be  allocated)  and  adopt  it  on  a  timely  basis.  As  part  of  this  exercise,  the  DPO  should 
analyse  in  particular  the  resources  needed  to  carry  out  audits  and/or  inspections  to  monitor  the  internal 
application of the IDPR, while considering the work to be carried out by other assurance providers. The work 
programme  should  be  presented  to  the  CMB,  which  considering  its  oversight  and  advisory  role  on  personal 
data protection matters, should decide on the actions to be taken as regards any resourcing issues. The DPO 
should  issue  an  annual  activity  report  on  the  activities  performed,  including  on  the  implementation  of  the 
work programme. 

In addition, the IAS recommended that the DPO, as system owner of DPMS, issue comprehensive guidance as 
regards the existing records types (‘individual’, ‘corporate centralised’ and ‘corporate decentralised’) and revise 
the  ‘DPMS  record  template’  to  reflect  the  roles  as  defined  in  the  implementing  rules  (delegated  controller, 
operational controller). The DPO should also implement a module in DPMS for the management of personal 
data breaches across the Commission and include a feature to facilitate the regular review of the records of 
processing operations. 

Compliance with key provisions of the regulation on data protection across the Commission (1 very important 
recommendation addressed to SG/DPO) 

The IAS recommended that the DPO further raise awareness (in the Group of Resource Directors and the DPC 
Network) on the urgent need to keep a proper record of all the processing activities in line with the provisions 
of the IDPR and report to the CMB the exceptions so that appropriate action may be taken. The DPO should, in 
consultation  with  the  DPC  network,  issue  guidance  on  the  handling  of  data  subjects’  requests, implement  a 
corporate  solution  to  protect  the  data  subjects’  rights  and  develop  a  training  module  aiming  at  building-up 
competencies on performing data protection impact assessments by operational controllers. The  DPO should 
issue  guidance  on  the  internal  arrangements  to  be  concluded  between  Directorates-General  and  services 
where processing operations are carried out jointly. The DPO should, taking account of the EDPS’s recent order 
and  planned  guidance  on  international  transfers  of  data,  as  well  as  the  information  received  from  the 
delegated controllers, analyse how compliance of the Commission’s processing operations with the IDPR can 
17 

 
 
 
be ensured. In this context, the DPO should provide assistance to the delegated  controllers and consult with 
the EDPS, when appropriate. 

Additional  information  provided  by  SG,  DG  DIGIT  and  DG  HR  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit  

The Secretariat-General had five very important recommendations from the Internal Audit Service addressed 
to  the  Data  Protection  Officer  (DPO)  on  guidance  and  methodology.  The  action  plan  was  approved  by  the 
Internal Audit Service and will be implemented in 2021 with the exception of a couple of actions that will be 
implemented in the first quarter of 2022 .  

The  main  actions  for  the  implementation  of  these  very  important  recommendations  include  the  issuing  of 
guidance, the creation in the ‘DPMS record template’ of the necessary fields to reflect the roles defined in the 
Implementing Rules, the implementation of certain changes to the DPMS, the development  – in consultation 
with  the  data  protection  coordinators’  network  –  of  a  training  module  or  workshop  on  performing  a  data 
protection impact assessment by operational controllers, the raising of awareness on the urgent need to keep 
a proper recording of all the processing activities and the issuance of a standalone annual activity report on 
the  activities  performed  by  the  Data  Protection  Officer.  On  international  transfers,  taking  account  of  the 
European Data Protection Supervisor’s recent order and planned guidance on international transfers of data, 
as well  as the  information  received  from the  delegated  controllers, the  Data  Protection  Officer will  analyse 
how  compliance  of  the  Commission’s  processing  operations  with  the  IDPR  can  be  ensured.  This  includes 
coordinating the Services’ completing and updating (where required) the Commission’s inventory of processing 
operations involving international transfers. In addition, the Data Protection Officer will provide assistance to 
the  delegated  controllers  in  order  to  help  implement  any  forthcoming  guidance  on  this  matter  by  the 
European Data Protection Supervisor. 

Only one (very important) recommendation concerned DIGIT as associated  DG, namely that the DPO should 
adopt  jointly  with  DIGIT  and  in  consultation  with  data  controllers  and the  DPC  network, a  methodology  and 
guidance  for  defining  a  minimum  set  of  IT  related  controls  to  address  the  requirements  of  the  IDPR  when 
designing new IT systems or significantly updating existing IT systems. This recommendation is not due until 
the end of 2021.  

The recommendation addressed to DG HR consists in DG HR needing to review its centralised Data Protection 
Coordination  (DPC)  role  for  the  DG  HR  family  (OIB,  OIL,  EPSO  and  PMO).  The  decision  has  been  taken  to 
devolve  the  DPC  role  to  the  Offices.  The  decision  is already  being  formally  communicated  to  the  Offices,  a 
transition period is now entered in which DG HR assures the function for the time the Offices need to organise 
their own Data Protection Coordinator. The recommendation will be deemed implemented once the transition 
period is completed. 

8.  Audit on indirect management with entrusted entities (DG INTPA, DG NEAR) 

The objective of the audit was to assess if indirect management agreements are designed and implemented 
in an efficient and effective manner, in compliance with the regulatory framework.  

There are no observations / reservations in the 2019 Annual Activity Reports of the two Directorates-General 
that relate to the area / process audited. The fieldwork was finalised on 24 November 2020. All observations 
and recommendations relate to the situation as of that date. 

The IAS recognised the following strengths/good practices: 

 

 

The EU Delegation in Turkey documents comprehensively the calls for proposals, related evaluation 
and  negotiation  reports,  in  particular  for  actions  implemented  through  the  Facility  for  Refugees  in 
Turkey. 

There  is  complete  documentation  in  the  Common  Relex  Information  System  of  requests  for 
derogations from contractual clauses (general conditions) and prior approvals. 

18 

 
 
 
 

The  external  assistance  management  reports  reviewed  provide  comprehensive  information  on  the 
funding  (commitments/payments)  channelled  through  indirect  management  with  entrusted  entities 
and related challenges.  

The IAS did not formulate any critical or very important recommendations. 

Agriculture, natural resources and health 

1.  Limited review of the management of State aid in the field of agriculture in 

DG AGRI 

In the context of the transfer of the State aid Unit from DG AGRI to DG COMP as from 1 January 2020, the 
objective of this limited review was to provide assurance on the effectiveness and efficiency of the controls 
implemented by DG AGRI for dealing with State aid in the agricultural sector. 

The 2017 and 2018 Annual Activity Reports contain no reservations concerning State aid. The fieldwork was 
finalised on 20 December 2019. All observations and recommendations relate to the situation as of that date. 

The  IAS  recognised  the  in-depth  knowledge  and  experience  of  staff  managing  State  aid  in  agriculture.  This 
has  been  developed  over  a  number  of  years  and  has  helped  the  unit  to  meet  all  the  required  statutory 
deadlines. 

The IAS did not formulate any critical or very important recommendations. 

2.  Audit on the financial management of the 2014-2020 European agriculture 

fund for rural development in DG AGRI 

The  objective  of  the  audit  was  to  assess  the  design  and  effective  implementation  of  DG  AGRI’s  internal 
control  processes  for  the  financial  management  of  the  2014-2020  European  agricultural  fund  for  rural 
development. 

The following observations/reservations were made in the 2019 Annual Activity Report concerning specifically 
the area/process under the scope of this audit engagement:  

-  The  reservation  concerns  the  payments  made  on  rural  development  in  2019  and  it  covered  the 
amount of EUR 288.35 million, representing 2.03% of the total annual European agricultural fund for 
rural development expenditure of EUR 14  179.98 million. Reservations have  been made concerning 
21 paying agencies, comprising 18 Member States. 

The fieldwork was finalised on 18 June 2020. All observations and recommendations relate to the situation 
as of that date, except for finding one for which additional information was received and assessed following 
DG AGRI's comments to the draft audit report. 

The audit team noted the profound knowledge and extensive experience of the finance team in Unit AGRI.R.4. 
This,  together  with  their  availability  to  support  the  colleagues  in  the  geographical  units,  was  also  clearly 
confirmed through the replies to the IAS survey of the geographical unit colleagues. 

The IAS did not formulate any critical or very important recommendations. 

3.  Audit on the design and implementation of CHAFEA control strategy 

The  objective  of  the  audit  was  to  assess  whether  CHAFEA  has  designed  an  adequate  control  strategy  and 

19 

 
 
 
implements  it  effectively  and  efficiently  to  ensure  the  legality  and regularity  of  the  underlying  transactions 
and sound financial management of its delegated programmes. 

There are no observations/reservations in the 2017 and 2018 Annual Activity Reports of CHAFEA that relate 
to the area audited. The fieldwork was finalised on 7 July 2020. All observations and recommendations relate 
to the situation as of that date. 

The  IAS  recognised  the  commitment  and  expertise  of  key  staff  in  the  ‘Corporate  Support  and  Resources 
Management Unit’ and operational units of CHAFEA. 

The IAS did not formulate any critical or very important recommendations. 

4.  In-depth risk assessment of the innovation fund (DG CLIMA) 

The objective of this engagement was to identify, categorise and assess, in cooperation with DG CLIMA, the 
main  inherent  risks  relating  to  the  set-up  and  start  of  the  innovation  fund,  with  a  view  to  enabling  the 
Directorate-General to manage those risks adequately. 

Originally,  the  IAS  intended  to  undertake  an  audit  in  this  area.  However,  at  the  time  of  engagement,  the 
processes relating to the set-up of the fund were still very much under discussion. Furthermore, subsequent 
to the start of the engagement, the Commission decided to delegate the responsibility for the implementation 
of  the  fund  to  the  Innovation  and  Networks  Executive  Agency.    Consequently,  the  Internal  Audit  Service 
focussed, in cooperation with DG CLIMA, on the identification of the main inherent risks associated with the 
set-up  of  the  fund,  including  the  launch  of  the  first  call  for  proposals,  from  both  the  supervisory  and 
implementation perspectives. 

As the engagement was a risk assessment, the report did not contain an audit opinion or conclusion and no 
formal recommendations were issued. Instead, the report contained issues for consideration for the attention 
of management. Their effective implementation will not be formally followed up by the IAS. 

Cohesion 

1.  Audit  on  the  process  for  coordinating  technical  support  to  the  Member 
States in DG REFORM (including the contribution of DG REGIO and DG EMPL 
to the coordination mechanism) 

The objective of the audit was to assess whether or not DG REFORM’s processes for coordinating the provision 
of  technical  support  to  the  Member  States  and  for  selecting  projects  under  the  Structural  Reform  Support 
Programme are adequately designed and functioning effectively. The audit also assessed whether DG REGIO 
and  DG  EMPL  have  put  in  place  adequate  procedures  for  contributing  to  the  coordination  mechanism  on 
technical support established by DG REFORM and whether these are functioning effectively. 

There are no observations/reservations in the 2019 Annual Activity Report of DG REFORM that relate to the 
area/process  audited.  The  fieldwork  was  finalised  on  30  May  2020.  All  observations  and  recommendations 
relate to the situation as of that date. 

The IAS recognised the following strengths in the practices followed by DG REFORM: 

  Clear  instructions  were  provided  by  DG  REFORM  to  Member  State  authorities  on  how  to  prepare 
requests  of  technical  support  for  submission.  In  order  to  answer  any  additional  questions  the 
Member  State  had  on  the  Structural  Reform  Support  Programme  process,  DG  REFORM  organised 
meetings with the Member States' coordinating authorities in the form of videoconferences.  

20 

 
 
 
 

 

The  instructions  on  the  Structural  Reform  Support  Programme  consultation  for  the  assessment  of 
Member State requests provided by DG REFORM to the participating Directorates-General were clear 
and  adequate  and  have  remained  consistent  during  the  audited  period.  In  case  the  Directorates-
General  needed  any  further  clarifications,  these  were  provided  to  them  through  direct  bilateral 
exchanges  with  DG  REFORM.  Also  the  topic  of  the  Structural  Reform  Support  Programme  request 
consultation process has been included in the topics that are discussed during the technical support 
working group meetings.  

The  tailor-made  dashboards  prepared  by  DG  REFORM  for  each  of  the  participating  Directorates-
General  (showing  the  number  of  requests received  from  the  Member State  and  the  status of  their 
project implementation) elicited a high satisfaction rate from the Directorates-General participating 
in the 2020 satisfaction survey. 

The IAS did not formulate any critical or very important recommendations. 

2.  Audit on implementation of financial instruments under European Regional 

Development Fund/Cohesion Fund 2014-2020 in DG REGIO 

The objective of the audit was to assess whether DG REGIO has put in place adequate controls for supporting 
Member States in the uptake and use of financial instruments under the 2014-2020 programming period for 
the European Regional Development Fund / Cohesion Fund and for monitoring their implementation. 

In its 2019 Annual Activity Report, DG REGIO did not issue a reservation specifically on financial instruments. 
Nevertheless, the Directorate-General made a reservation for the 2014-2020 programming period concerning 
weaknesses in management and control systems in 58 European Regional Development Fund / Cohesion Fund 
programmes in 13  Member  States. The necessary  preventive and corrective actions  have been or are being 
requested  from  the  Member  States  concerned.  The  fieldwork  was  finalised  on  25  November  2020.  All 
observations and recommendations relate to the situation as of that date. 

The IAS recognised the following strengths in the practices followed by DG REGIO in the audited area: 

  Organisation and function of financial instruments matrix meetings: the financial instruments matrix 
enables  sharing  examples  of  good  practices  /  successful  use  of  different  types  of  financial 
instruments among its members. 

  Country responsibilities in Unit B3: a clear allocation of Unit B3 staff per Member States to provide 
support. Expert knowledge and support provided by the coordination unit is very well perceived by the 
implementation  units.  During  the  last  two  years  Unit  B3  made  significant  efforts  to  improve  and 
facilitate the coordination and cooperation in the area of financial instruments implementation. 

  DG  REGIO  developed  a  dedicated  tool  in  SharePoint  for  monitoring  the  uptake  of  the  Coronavirus 
Response  Investment  Initiative  for  each  Member  State,  which  covers  also  measures  related  to 
financial instruments. 

The IAS did not formulate any critical or very important recommendations. 

21 

 
 
 
Research, energy and transport  

1.  Audit on the effectiveness of the design and of the implementation of the 

ex post control strategy for Connecting Europe Facility (CEF) by INEA 

The objective of the audit was to assess the effectiveness of the design and implementation by INEA of the 
ex post control strategy in order to obtain reasonable assurance on the legality and regularity of underlying 
transactions. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  INEA  that  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  9  September  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS recognised the ongoing efforts made by INEA in the design and implementation of the ex post control 
strategy for the CEF programme and identified the following strengths / good practices: 

 

 

 

 

There is a good document archiving system thanks to which all the project information and audit files 
(paper and electronic data) are easily accessible to the INEA staff involved.  

There is a thorough supervision of the audits performed by the external contractor including monitoring 
and detailed  quality  review  of  their main  deliverables.  The  supervision  also  includes  performing  joint 
missions once a year.  

There is an effective internal review process (audit follow-up process) on the implementation of audit 
results  that  is  used  by  the  ex  post  audit  team  to  inform  operational  and  financial  colleagues  of  the 
outcome of an ex post audit and agree the implementation of financial recommendation.  

The ex post audit team succeeded in delivering the annual audit plans while not being fully staffed. 

The IAS identified one very important issue on the assessment of the legality and regularity of amendments 
to implementing contracts and formulated one very important recommendation: 

INEA  should  update  its  ex  post  audit  methodology  for  the  assessment  of  the  legality  and  regularity  of 
amendments  or  exceptions  to  the  procurement  procedures.  Moreover,  the  Agency  should  prepare  clear 
guidelines  and  checklists  to  enable  consistent  assessment  of  the  legality  and  regularity  of  amendments  to 
implementing  contracts  (for  example  the  due  diligence  at  tender  phase)  and  to  document  all  checks 
performed.  Additionally,  the  Agency  should  raise  awareness  with  the  beneficiaries  on  the  restrictive 
interpretation of the use of contract amendments without public tendering. 

Additional  information  provided  by  INEA  on  the  measures  defined  and/or  implemented  following 
the Internal Audit Service audit 

The action plan with the measures to address this very important recommendation was defined and agreed 
with  the  Internal  Audit  Service.  The  measures  included  the  revision  of  the  public  procurement  checklist  to 
provide improved guidance to auditors auditing public procurement procedures for the Agency. This checklist 
was  validated  by  DG  GROW  and  is  applicable  already  as  of  the  2021  Ex-post  Audit  Plan.  In  addition,  the 
Agency has paid particular attention to raising the awareness of its beneficiaries to the interpretation of the 
justifications of contract modifications both in ex-post audits and more widely. The measures addressing this 
very  important  recommendation  were  implemented  by  the  Agency  in  the  first  quarter  of  2021  and  will  be 
subject to a follow-up by the Internal Audit Service before being formally closed. 

22 

 
 
 
2.  Audit  on  the  JRC’s  support  to  EU  policy  and  knowledge  management 

(selection of and delivery on Commission requests) 

The objective of the audit was to assess whether the processes put in place by the JRC to support policy (both 
policy  making  and  policy  implementation)  and  knowledge  management  are  adequately  designed  and 
effectively and efficiently implemented. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  the  JRC,  which  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  10  November  2019.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS recognised the ongoing efforts made by the JRC to further improve the policy support delivered to the 
policy Directorates-General and to develop knowledge management in the Commission. 

The IAS recognised the following strengths: 

 

 

 

 

 

The  preparation  of  the  work  programme  is based  on  well-structured  procedures with  clear roles and 
responsibilities.  

The  JRC  has  in  place  an  effective  change  management  procedure  to  update  the  work  programme 
during its execution in order to address new requests expressed by the client services.  

Following the guidelines of its Strategy 2030 on managing knowledge and competences, the JRC has 
created  six  knowledge  centres  and  seven  competence  centres  which  enable  exploitation  of  the 
knowledge and competences of staff in the JRC and in the partner Directorates-General.  

Several  good  practices  were  identified  in  the  knowledge  and  competence  centres  such  as  the 
organisation  of  knowledge  weeks,  workshops,  trainings  and  exchanges  in  communities  of  practice, 
communication practices and tools, internal organisation of teams and registry of policy Directorates-
General requests.  

To  enhance  the  added  value  of  knowledge  management,  the  JRC  internally  reflected  in  a  senior 
management roundtable held in May 2020 on the experience of knowledge management over the last 
four years and its possible evolution, including its mission, roles, tasks and responsibilities.  

In the survey carried out by the IAS, the policy Directorates-General provided positive feedback on: 

 

 

The quality of the JRC deliverables: 82% of respondents rated it good or very good.  

The cooperation with the JRC for the definition of the specifications of the work: 76% of participants 
rated it as good or very good.  

Moreover, the policy Directorates-General appreciate the possibility to co-design the work delivered by 
the JRC as well as the transparent communication by the JRC on the scientific support it can provide, 
the  clarity  of  roles  and  responsibilities  for  policy  support  within  the  JRC,  and  progress  and  possible 
issues during the execution of the projects. 

The IAS identified one very important issue on the policy support: definition of priorities, identification of needs 
and assessment of the requests and formulated one very important recommendation: 

JRC  should:  (1)  set  up  a  regular  coordination/consultation  forum  at  Director-General  level  to  coordinate 
priorities  and  needs  for  policy  support;  (2)  include  a  formal  consultation  of  the  policy  Directorates-General 
early in the process to prepare the work programme to obtain a reliable and up-to-date view on their needs; 
and  (3)  develop  a  mechanism/system  in  order  to  obtain  a  structured  and  systematic  overview  of  requests 
made through different entry points to enable the JRC to better prioritise requests and track their responses. 

23 

 
 
 
Additional  information  provided  by  JRC  on  the  measures  defined  and/or  implemented  following 
the Internal Audit Service audit 

According  to  the  action  plan  accepted  by  the  IAS  on  22  February  2021,  the  JRC  will  address  the  very 
important recommendation by continuing having meetings at DGs’ level to discuss future priorities. The JRC 
will  revise  the  work  programme  processes  (adoption  of  revision  proposal  and  implementation  are  planned 
respectively by December 2021 and by March 2022). Better prioritisation and consultation of partner DGs on 
their  priorities  and  needs  will  be  addressed  in  the  revision.  A  longer  period  for  the  formal  ISCs  has  been 
already implemented (from 15 to 20 working  days).  Definition of priorities will also be discussed within the 
process  of  ‘Reset,  Re-imagining  and  Re-energising  for  new  challenges’,  where  the  JRC  will  re-assess  its 
priorities,  align,  and  simplify  its  processes.  By  the  end  of  2021,  a  dedicated  system  to  keep  track  of  all 
requests from partner DGs and JRC responses will be set up. 

3.  Audit on accounting of assets in JRC 

The objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of 
the implementation of the fixed assets management accounting controls put in place by the JRC to report and 
present fairly the assets it owns in its accounts. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  JRC  that  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  17  December  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS recognised the ongoing efforts made by the JRC to ensure the completeness of the assets registered 
in the accounts as well as the high level of professionalism and dedication of the staff involved, including the 
JRC asset accountant. In particular, the IAS identified the following positive elements: 

 

 

The  establishment  of  an  asset  coordination  group  through  which  best  practices  and  knowledge  are 
exchanged. Thanks to this network, in 2018 Unit R.9 organised a training for the new asset manager of 
Karlsruhe in Ispra to introduce her to the specificities of the job.  

Unit  R.9  organised  accounting  and  JRC  integrated  processing  system  (JIPSY)  trainings  on  a  regular 
basis during the year and upon request. It also provides support to the JRC users of JIPSY and ABAC 
Assets for accounting and asset related issues.  

The  IAS  identified  one  very  important  issue  concerning  the  asset  accounting  control  related  to  process 
documentation, guidance and methodology and formulated one very important recommendation: 

JRC should complete the existing guidelines and manual with additional documentation describing the assets 
accounting  control  process,  the  methodology  for  performing  the  assets  accounting  controls  and  the 
calculation methods for the key performance indicators concerned. 

Additional  information  provided  by  JRC  on  the  measures  defined  and/or  implemented  following 
the Internal Audit Service audit 

Based  on  the  action  plan  accepted  by  the  IAS  on  4  March  2021,  the  JRC  will  address  the  identified  very 
important  issue  within  the  end  of  2021  as  follows:  the  existing  accounting  guidelines  and  manual  will  be 
completed with additional documentation and instructions for staff in order to better describe the whole asset 
accounting  control  process  (e.g.  types  of  controls,  methodology  used,  roles and  responsibilities,  reporting  of 
information, process for annual closure). Reference will be added to the relevant DG BUDG guideline, where 
applicable. The calculation method for the KPIs concerned will also be described in a detailed document. 

Moreover, the methodology for calculation of the error rate has been reviewed by March 2021, as scheduled, 
in response to an important issue identified by the auditors. The accounting error for year 2020, as included in 
the JRC AAR 2020, has been estimated following the revised approach. 

24 

 
 
 
4.  Audit on Horizon 2020 grant management phase 3 in REA  

The  objective  of  the  audit  was  to  assess:  (1)  the  effectiveness  of  the  ex  ante  controls  on  Horizon  2020 
payments;  (2)  the  compliance  of  the  management  of  projects  with  EU  restricted  information  with  the 
applicable rules; and (3) the effectiveness of the process for the closure of REA’s H2020 projects. 

There are no observations/reservations in the 2019 Annual Activity Report of REA that relate to the processes 
audited.  The  fieldwork  was finalised  on  7  December  2020.  All  observations  and  recommendations  relate  to 
the situation as of that date. 

The  IAS  acknowledged  the  ongoing  efforts  made  by  REA  in  ensuring  effective  implementation  of  ex  ante 
controls  on  Horizon  2020  grant  payments  in  the  context  of  an  increasing  workload  and  recognised  the 
following strengths:  

 

 

REA has a strong control environment, including systematic reviews of periodic reports by independent 
experts  and  financial  verifications  performed  centrally  by  Unit  C.2.  This  provides  a  solid  basis  for  an 
effective implementation of ex ante controls on Horizon 2020 grant payments.  

The  networks  of  project  officers,  financial  officers,  ethics  correspondents  and  legal  officers  have 
regular meetings to discuss in particular the Horizon 2020 grant management process and to ensure a 
coherent approach and overall coordination of the process in REA.  

The  IAS  identified  one  very  important  issue  concerning  the  management  of  projects  with  RESTREINT  UE/EU 
RESTRICTED information and formulated one very important recommendation: 

REA  should  ensure  the  respect  of  the  rules  as  regards  the  briefings  for  monitors  and  the  organisation  and 
documentation  of  the  review  meetings  with  RESTREINT  UE  /  EU  RESTRICTED  deliverables,  and  align  the 
internal REA guide to the provisions of Commission Decision No 2019/1962. Furthermore, the staff involved in 
managing projects with RESTREINT UE / EU RESTRICTED deliverables should attend the training courses on the 
RUE system and formally acknowledge their security obligations. 

Additional  information  provided  by  REA  on  the  measures  defined  and/or  implemented  following 
the Internal Audit Service audit  

REA  accepted  the  IAS  recommendation  and  is  addressing  it  by  a  dedicated  action  plan  which  includes  the 
update  of  REA  internal  guidance,  the  development  of  specific  briefing  material  for  research  consortia  and 
experts, improved handling of review meetings involving EU restricted deliverables, and the increase of staff 
awareness about the security rules and their obligations while managing projects with classified information.  

The action plan should be fully implemented by end of January 2022, with a first set of actions completed by 
end  of  May  2021:  the  updated  REA  internal  guidance  and  various  briefing  materials  will  be  delivered 
according  to  the  agreed  timeline.  The  second  part  of  the  actions,  relating  to  awareness  raising  actions  and 
training of staff will be implemented in a subsequent step. 

Moreover,  as  REA  parent  DGs  and  other  executive  agencies  expressed  their  interest  in  benefitting  from  the 
outcome  of  the  action  plan,  a  complementary  action  is  being  carried  out  so  that  the  good  practice  can  be 
shared in future in an efficient way. 

5.  Audit on the Horizon 2020 ex post audit strategy in DG RTD 

The objective of the audit was to assess the adequacy and effectiveness of the Horizon 2020  ex post audit 
strategy  (‘the  strategy’)  in  contributing  to  the  assurance  about  the  legality  and  regularity  of  the  underlying 
transactions. 

25 

 
 
 
There are no observations/reservations in the 2019 Annual Activity Reports of the Horizon 2020 implementing 
bodies that relate to the process audited. The fieldwork was finalised on 15 December 2020. All observations 
and recommendations relate to the situation as of that date.  

The IAS recognised the ongoing efforts by the Common Audit Service (CAS) to design and implement the  ex 
post  audit  strategy  for  the  Horizon  2020  programme  and  identified  the  following  strengths  and  good 
practices concerning the implementation of the strategy by the CAS, information technologies supporting the 
CAS processes, and the overall level of satisfaction with the services provided by the CAS: 

 

 

 

 

 

The  CAS  has  addressed  the  weaknesses  identified  in  the  previous  IAS  audit  on  the  ex  post  audit 
strategy for the seventh framework programme concerning the audit planning and staff allocation, the 
execution  and  documentation  of  audits,  the  supervision  and  quality  control,  and  the  monitoring  and 
reporting on audit delivery, and has enhanced its internal organisation and procedures effectively. They 
have  also  made  a  significant  effort  to  close  individual  audit  files  that  were  long  overdue,  including 
analysing and addressing the root causes of the delays.  

The audit process is supported by detailed manuals, standard procedures, and checklists.  

The  audit  process  is  supported  by  information  technology  (IT)  systems  COMPASS  (offering  fully 
integrated  workflows  for  the  management  of  internal  and  external  audits)  and  AUDEX  (ensuring 
storage of all information on the status, inputs and results of all audits).  

The recently released CAS dashboard enables the CAS and its stakeholders to easily and continuously 
monitor the various targets and key performance indicators set for the  ex post audits (e.g. number of 
closed audited participations, direct coverage of the paid financial statements provided by the audits).  

Overall level of satisfaction with the services provided by the CAS: 68% of the stakeholders are overall 
satisfied with the services and deliverables provided by the CAS.  

The  IAS  identified  one  very  important  issue  concerning  the  design  of  the  strategy  and  formulated  two  very 
important recommendations:  

The  Common  Implementation  Centre  (CIC)  should  adjust  the  ex  post  audit  strategy  to  allow  the  CAS  to 
optimise to the extent possible the use of its resources by supplementing the common representative sample 
with audit samples covering the high risk areas (e.g. high risk beneficiaries or projects) for all implementing 
bodies,  to  strengthen  the  contribution  of  the  ex  post  controls  to  the  corrective  mechanisms.  It  should  also 
further develop the existing guidance on ad hoc requests for risk-based audits to clarify situations where they 
can be requested and to provide considerations and criteria to be used by the CAS when deciding to approve 
or reject the submitted requests.  

Furthermore, the CIC should define and implement a roadmap to complement the existing control strategy in 
view  of  progressively  reducing  the  error  rate,  taking  into  consideration  cost/benefit  elements  (including  the 
impact on the business) and should ensure that the audit strategy contributes to the revised control strategy. 

Additional  information  provided  by  DG  RTD  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

According  to  the  action  plan,  the  CAS  will  regularly  run  corporate  risk-based  selections.  For  the  future,  the 
Horizon Europe ex-post audit strategy will be a risk based one.  

26 

 
 
 
 
 
The CIC will adapt its outreach campaign to Horizon 2020 beneficiaries to focus the content of the seminars 
on the cost category contributing by far the most to the error rate (personnel cost) and undertake active steps 
to  ensure  the  participation  of  the  categories  of  beneficiaries  most  vulnerable  to  errors  (newcomers,  SMEs, 
third country participants, one-time participants). It will analyse the possibility of enhanced in-depth ex-ante 
checks  on  a  sampling  basis  to  a  number  of  risk-prone  beneficiaries.  The  CAS  will  continue  to  provide 
information  on  the  most  common  errors and feed  the  information  presented  to  the  officers  responsible  for 
ex-ante  controls.  It  will  also  prepare  an  online  training  (webinar)  that  would  be  available  to  all  certifying 
auditors upon taking up the assignment. 

The  CIC  will  timely  implement  all  the  actions  included  in  the  action  plan  agreed  via  the  High  Level  group 
between DG BUDG, RTD, IAS and the SG. 

External actions 

1.  Audit on performance management in FPI 

The objective of the audit was to assess whether FPI has put in place an adequate performance management 
framework to plan, monitor, manage and report on the achievement of its policy objectives. 

There  are  no  observations/reservations  in  the  past  Annual  Activity  Reports  of  FPI  that  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  3  July  2020.  All  observations  and  recommendations 
relate to the situation as of that date. 

The  IAS  recognised  the  ongoing  efforts  made  by  FPI  to  build  its  performance  management  framework  and 
integrate it into its daily operations. In particular, the following strengths were observed: 

 

 

 

The development of an FPI manual has been a major step forward in setting a harmonised FPI-wide 
approach to project management, evaluation and other horizontal functions.  

The  FPI  results  framework, included  in  the  FPI  manual, sets  a  solid  foundation  for  a  future  FPI-wide 
system for monitoring the results of FPI’s instruments.  

The  reporting  in  the  Annual  Activity  Report  and  programme  statements  rigorously  follows  the 
objectives and indicators defined in the 2016-2020 Strategic Plan and the 2019 Management Plan.  

The  IAS  identified  one  very  important  issue  concerning  the  fragmentation  of  the  performance  management 
framework and formulated the following very important recommendation: 

FPI  should  increase  the  central  coordination  of  its  performance  management  framework,  so  that  the 
framework covers all FPI’s activities coherently. 

Additional information provided by FPI on the measures defined and/or implemented following the 
Internal Audit Service audit 

The actions to be taken by FPI, agreed with the IAS, will be implemented progressively and include: 

- the setting up of a central coordination function for performance management; 

- further reinforcement of the coherence and steering of the Service’s performance management framework; 
in this context a revision of the Results Framework in conjunction with a revision of the FPI Manual is foreseen 
during 2021;  

27 

 
 
 
 
 
 
- establishment of the needs for outsourcing contracts from all operational units during N+1 by the end of the 
year  N;  based  on  the  analysis  of  the  needs  communicated,  FPI  will  advocate  the  added  value  in  pooling 
contracts between relevant Units. This coordination exercise will be launched in 2021 (year N); 

-  ensuring  for  the  next  Multiannual  Indicative  Programmes,  that  objectives  and  expected  results  are  as 
specific as possible and indicators are aligned with the FPI Results Framework; 

-  performing  systematic  review  and  annual  assessment  of  objectives  and  indicators  as  proposed  by  FPI 
Operational Units; in this revision, attention will be given to ensure that objectives are SMART and indicators 
RACER; 

-  performing  a  first  results  collection/reporting  exercise  in  OPSYS  by  end  2021  where  increased  quality 
controls on indicators will be carried out; 

- as part of the roll out of OPSYS in 2021, FPI has and will further develop action-level indicators and Logical 
Framework for EOM and CFSP actions; 

- the appointment within each operational unit of a person responsible for quality control of the calculation of 
indicators;  furthermore,  each  Unit  will  formalize  the  calculation  method  and  introduce  a  double  verification 
procedure;  the  central  coordination  function  (FPI.6)  will  assure  the  coordination,  relevant  guidelines  and 
homogeneous approach throughout the Service to the extent possible. 

The recommendation is expected to be fully implemented by the end of 2021. 

2.  Consulting engagement on EU visitors’ programme in FPI 

The  objective  of  the  consulting  engagement  was  to  provide  advice  to  the  FPI  Head  of  Service  on  how  to 
improve  the  cooperation  of  the  Commission  and  the  European  Parliament  on  EU  visitors’  programme.  The 
scope  of  the  engagement  covered  the  functioning  of  the  EU  visitors’  programme, including  governance  and 
decision-making  processes,  the  two  institutions’  respective  contributions  to  the  programme,  and  monitoring 
and reporting on performance. The engagement did not assess the performance of the programme itself. 

As the assignment is a consultancy engagement, the report did not contain an audit opinion or conclusion and 
no  formal  recommendations  were  issued.  Instead,  the  report  contained  issues  for  consideration.  Their 
effective implementation will not be formally followed up by the IAS. 

Education and citizenship 

1.  Audit  on  effectiveness  of  the  protection  of  personal  data  of  beneficiaries 
of  and  participants  in  the  Erasmus+  and  European  Solidarity  Corps 
programmes managed by DG EAC 

The objective of the audit was to assess whether DG EAC has put in place an effective and efficient control 
system for the protection of personal data of beneficiaries of and participants in the Erasmus+ and European 
Solidarity Corps programmes, in compliance with the key provisions of the internal data protection regulation 
(IDPR).  

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  EAC  that  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  30  November  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The  IAS  recognised  that  DG  EAC’s  main  actors  are  well  aware  of  the  IDPR,  its  content,  importance  and 
implications,  and  have  already  taken  actions  towards  compliance.  Notably,  DG  EAC  is  currently  addressing 

28 

 
 
 
 
challenges  with  regard  to  personal  data  protection  in  the  context  of  the  implementation  of  the  new 
technological  framework  and  a  new  information  technology  landscape  which  implements  the  principle  of 
personal data ‘by design and by default’. This will enable to remove many of the inconveniences of the past 
architecture  of  DG  EAC’s  mature  information  technology  environment  related  to  the  protection  of  personal 
data. 

The  IAS  identified  one  critical  issue  on  transfer  of  personal  data  to  third  countries  and  four  very  important 
issues  on:  (1)  information  to  all  Erasmus+  participants  during  personal  data  collection;  (2)  supervision  of 
processors’  compliance  with  the  IDPR;  (3)  storage  limitation  principle;  and  (4)  handling  of  personal  data 
breaches. The IAS formulated one critical and four very important recommendations: 

Transfer of personal data to third countries (1 critical recommendation) 

DG EAC should analyse, with the support of the Data Protection Officer, how compliance of its programmes 
with the IDPR concerning international transfers of  data can be ensured in the context of the order and the 
announced guidance of the European Data Protection Supervisor. 

Information to Erasmus+ participants during personal data collection (1 very important recommendation) 

DG  EAC  should  ensure  that  all  participants  whose  data  are  already  stored  in  Mobility  Tool+  are  informed 
about  the  fact  that  the  European  Commission  has  their  data  and  explain  the  way  they  can  exercise  their 
rights.  For  future  data  collection,  DG  EAC  should  inform  all  Erasmus+  participants  before  they  provide  any 
personal data about their rights as data subjects and the identity and contact details of the controller and the 
Data  Protection  Officer.  Furthermore,  the  agreements  signed  by  participants  should  be  updated  with  a 
reference to the privacy statement. 

Supervision of processors’ compliance with the IDPR (1 very important recommendation) 

DG EAC should, after consulting the Data Protection Officer and the Legal Service, complete/complement the 
delegation agreements and grant agreements templates with: (1) National Agencies’/beneficiaries’ obligation 
to report to DG EAC about the data protection measures put in place for ensuring compliance with the IDPR; 
and  (2)  reinforce  the  existing  concrete  monitoring  tools  (e.g.,  checks,  audits)  to  enable  the  European 
Commission to exercise its supervision/monitoring on how the National Agencies/beneficiaries handle personal 
data.  Based  on  the  reporting  obligations  for  the  National  Agencies,  independent  audit  bodies  and 
beneficiaries,  DG  EAC  should  reinforce  the  existing  monitoring  mechanisms  to  effectively  supervise  the 
processes of  handling of  participants’ personal data by the national authorities and the beneficiaries of the 
Erasmus+ and European Solidarity Corps programmes. 

Storage limitation principle (1 very important recommendation) 

DG EAC should assesses the retention periods currently applied, align them with the closure of projects and 
calls and respect the principle of storage limitation, and ensure that after the expiry of the retention period 
data is effectively deleted or anonymised. 

Handling of personal data breaches (1 very important recommendation) 

DG EAC should adopt and implement a formal procedure for handling data breaches and ensure that action 
plans adopted to address weaknesses which led to data breaches are effectively implemented. 

29 

 
 
 
 
 
Additional  information  provided  by  DG  EAC  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

DG  EAC  has  immediately  taken  extensive  proactive  measures  in  response  to  the  findings and  has prepared 
and  begun  implementing  an  action  plan  to  address  the  recommendations.  Four  out  of  the  six  actions  to 
mitigate  the  risks  identified  by  the  IAS  are  now  substantially  completed  or  launched.  Two  of  the  six 
recommendations  require  additional  time  due  to  the  roll-out  of  the  new  programme  and  the  process 
regarding third country transfers of contact data, respectively. Looking at the plan as a whole by sub-action, 
half of the sub-actions specified in the overall plan are now complete.  

On 25 March 2021, the IAS concluded a first follow-up of the audit on protection of personal data. Based on 
their  review  of  the  information  and  supporting  documents  provided,  the  IAS  consider  that  DG  EAC  partially 
mitigated  the  risks  related  to  observations  on  third  country  transfers  of  personal  data  (by  improving  the 
transparency  about  the  level  of  protection  of  the  data  in  the  host  countries)  and  the  procedure  on  data 
breaches (a revised coherent procedure has been adopted). The IAS decided, on that basis, to downgrade the 
recommendations respectively from ‘critical’ to ‘very important’ and from ‘very important’ to ‘important’. 

2.  Audit on grant management (phase 3) – ex post controls in EACEA 

The objective of the audit was to assess the effectiveness of the design and implementation by EACEA of its 
ex post control strategy in order to obtain reasonable assurance on the legality and regularity of underlying 
transactions. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  EACEA  that  relate  to  the 
area/process audited.  The  fieldwork  was  finalised  on  18  June  2020.  All  observations  and recommendations 
relate to the situation as of that date. 

The  IAS  recognised  the  efforts  made  by  the  agency  in  designing  and  implementing  the  ex  post  control 
strategy for the grant management of the programmes it implements and identified the following strengths 
and good practices: 

 

 

The internal review process on the quality and content of the audit reports and their findings, based on 
the four-eyes principle (from ex post controls and operational units) and two stages of review of the 
audit report (at the preliminary and the draft report). 

The  effective  collaboration  among  the  operational  units  and  the  ex  post  team  as  well  as  early 
coordination with the anti-fraud sector which ensures an effective exchange of information, synergies 
in the decision making process and early treatment of potential fraud cases.  

The IAS did not formulate any critical or very important recommendations. 

3.  Audit on grant management of the 2014-2020 Justice and Rights, Equality 

and Citizenship  programmes – implementation in DG JUST  

The  objective  of  the  audit  was  to  assess  whether  DG  JUST  has  put  in  place  effective  processes  for:  (1) 
managing the project implementation phase; and (2) implementing and reporting on ex post audit results. 

In  the  2019  Annual  Activity  Report  of  DG  JUST  there  is  one  reservation  regarding  the  process  audited  for 
centralised  direct  management  –  grants  (2007-2020  programmes)  as  the  residual  error  rate  at  year-end 
exceeds 2% (equal to 2.65%). DG JUST assessed that the financial impact of the reservation on the assurance 
equals to 0.94% of the payments made by DG JUST in  2019 amounting to EUR 1.68 million. The fieldwork 
was finalised on 30 July 2020. All observations and recommendations relate to the situation as of that date. 

The audit identified the following strengths. 

30 

 
 
 
 
 

 

DG  JUST  has  provided  extensive  support  to  applicants  and  beneficiaries  throughout  the  grant  award 
and  implementation  phases.  The  client  oriented  culture  together  with  constant  contacts  with 
beneficiaries  and  additional  pedagogical  efforts  made  by  project  officers  on  a  daily  basis  to  explain 
programme  and  the  grant  rules,  technicalities  of  the  information  technology  systems  especially  for 
first time applicants are good practices to be followed.  

The  grant  management  sector  of  Unit  JUST.04  has  made  effective  use  of  the  various  reporting 
functionalities of the information technology system for grant management, including for example, the 
systematic  use  of  the  business  activity  monitoring  reports  and CORDA  database.  This enables robust 
monitoring and regular assessment of achievements against key indicators.  

The IAS did not formulate any critical or very important recommendations.  

Economic and financial affairs  

1.  Limited  review  on  the  implementation  of  the  new  internal  control 

framework in DG COMP 

The  objective  of  the  limited  review  was  to  assess  if  the  authorising  officer  by  delegation  of  DG  COMP  had 
performed an adequate overall assessment of the presence and functioning of all internal control principles 
and components as laid down in the Communication on the revision of the internal control framework. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  COMP  that  relate  to  the 
area/process  reviewed.  The  fieldwork  was  finalised  on  21  August  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS recognised the ongoing efforts made by DG COMP to strengthen its internal control system. Notably, 
the following strengths were identified: 

 

 

DG  COMP  has  developed  an  ‘Internal  Control  Strategy  of  DG  Competition’  which  sets  out  control 
environment,  inherent  risks,  control  framework  and  monitoring  mechanisms  for  the  internal  control 
system. This demonstrates the Directorate-General’s commitment to set the right tone at the top.  

DG  COMP  has  implemented  a  decentralised  monitoring  system  for  the  internal  control  framework 
which involves all units. In particular, the units have to conduct the self-assessment and to monitor on 
an ongoing basis the controls under their responsibility. Representatives of the units and the Internal 
Control  Officer  participate  in  the  Internal  Control  Network,  which  ensures  coordination  on  internal 
control  aspects.  This  structure  promotes  commitment  of  management  and  staff,  and  enhances  the 
awareness and knowledge on the new internal control framework.  

The  IAS  identified  one  very  important  issue  on  the  identification  and  assessment  of  deficiencies  and 
formulated one very important recommendation: 

DG  COMP  should  include  in  its  internal  control  strategy  a  description  of  the  identification  of  strengths  and 
deficiencies,  ensure  that  all  relevant  sources  of  information  are  used  during  the  annual  assessment  of  the 
internal control framework and clearly describe, rate and document the identified deficiencies. 

31 

 
 
 
 
 
Additional  information  provided  by  DG  COMP  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

The  IAS  recommendation  will  be  addressed  in  line  with  the  agreed  action  plan,  to  be  implemented  in  2021 
and 2022. In particular, according to the action plan, DG COMP has included references to documents and/or 
other sources of evidence used in its assessment of the Internal Controls in 2020. DG COMP has also planned 
to include in its internal control strategy (to be concluded by mid-2021) a description of the identification of 
strengths and deficiencies, all relevant sources of information, and clear description, rating and documenting 
of the identified deficiencies. 

2.  Audit on supervision of the implementation of the 2014-2020 programme 
for the European geostationary navigation overlay service in DG DEFIS  

The objective of the audit was to assess the effectiveness of the supervision processes of DG DEFIS for: (1) 
monitoring and steering the effective and timely implementation of the 2014-2020 European geostationary 
navigation overlay service (EGNOS) programme; (2) obtaining assurance on the sound financial management 
of the 2014-2020 EGNOS budget entrusted to the European GNSS Agency and the legality and regularity of 
the  underlying  transactions;  (3)  ensuring  compliance  with  reporting  obligations  to  the  European  Parliament, 
the Council, and the programme committee, laid down in the GNSS regulation. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  GROW  (before  being 
transferred to the new DG DEFIS on 1 January 2020, the audited activity was performed by DG GROW) that 
relate to the area/process audited. The fieldwork was finalised on 18 November 2020. All observations and 
recommendations relate to the situation as of that date. 

The IAS recognised DG DEFIS efforts to supervise the effective and timely implementation of the 2014-2020 
EGNOS  programme.  The  staff  involved  in  supervision  of  the  EGNOS  programme  are  experienced, 
knowledgeable and committed. In particular, DG DEFIS:  

 

 

 

 

Has  put  in  place  thorough  project  management  (including  cost  and  schedule)  as  well  as  risk 
management  approaches in  line  with  the  standards  developed  through  the  European  cooperation  for 
space standardisation.  

Has  developed  strong  supervision  processes  based  on:  (1)  the  approval  of  programmatic  supervision 
documents at different levels of authority (programme committee, College, Director-General and GNSS 
Director);  (2)  the  approval  of  the  annual  acquisition  and  grant  plans  by  the  European  GNSS  Agency, 
including  the  right  to  select  procurements  to  scrutinise  the  tender  documentation  or  the  award 
procedure or both, and exercise veto rights; (3) detailed reporting on the implementation of the EGNOS 
2014-2020  programme  from  the  European  Space  Agency  and  the  EGNOS  service  provider  to  the 
European GNSS Agency and from the latter to DG DEFIS; (4) regular meetings for monitoring progress 
with approved minutes, including a systematic and formal follow-up of issues raised and actions to be 
taken.  

Has  developed  detailed  and  specific  checklists  to  review  the  budgetary  and  accounting  part  of  the 
annual and quarterly implementation reports prepared by the European GNSS Agency.  

Performs,  on  an  annual  basis,  ex  post  financial  audits  on  the  costs  declared  by  the  European  GNSS 
Agency for the implementation of the entrusted tasks. 

The IAS did not formulate any critical or very important recommendations. 

32 

 
 
 
 
3.  Audit on payments and accounting for tangible assets under the Galileo and 

Copernicus 2014-2020 programmes in DG DEFIS  

The objective of the audit was to assess the adequacy and effective application of the controls on payments 
and accounting for assets under Galileo and Copernicus 2014-2020 programmes. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  GROW  that  relate  to  the 
area/process audited (before being transferred to the new DG DEFIS on 1 January 2020, the audited activity 
was  performed  by  DG  GROW).  The  fieldwork  was  finalised  on  11  December  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS recognised the efforts made by DG DEFIS to ensure adequate and effective application of the controls 
on payments and accounting for assets under Galileo and Copernicus 2014-2020 programmes. In particular:  

 

 

 

DG  DEFIS  organises  annual  workshops  with  the  involvement  of  its  operational  units,  DG  BUDG,  the 
European  Space  Agency  (ESA)  and  the  European  Global  Navigation  Satellite  System  Agency  (GSA)  to 
discuss the overall status of the programmes as well as to analyse the costs eligible for capitalisation 
and the possible impairment of assets.  

The costs declared by the agencies for the implementation of the entrusted tasks are subject to annual 
ex post financial audits which results are taken into account during the clearings. 

The  staff  involved  in  the  supervision  of  the  Galileo  and  Copernicus  programmes  are  experienced, 
knowledgeable and committed.  

The IAS did not formulate any critical or very important recommendations. 

4.  Limited  review  on  the  implementation  of  the  new  internal  control 

framework in DG FISMA  

The  objective  of  the  limited  review  was  to  assess  if  the  authorising  officer by  delegation  of  DG  FISMA  had 
performed an adequate overall assessment of the presence and functioning of all internal control principles 
and components as laid down in the Communication on the revision of the internal control framework. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  FISMA  that  relate  to  the 
area/process  reviewed.  The  fieldwork  was  finalised  on  the  26st  of  June  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS did not formulate any critical or very important recommendations. 

5.  Audit on evaluation activities in DG TRADE 

The objective of the audit was to assess the adequacy of the design and the effectiveness of implementation 
of DG TRADE’s internal control systems for the management of evaluations and related contracts. 

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  TRADE  that  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  15  December  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The IAS recognised the ongoing efforts made by DG TRADE to continuously improve its evaluation processes 
and in particular found that:  

 

DG  TRADE  has  implemented  a  rigorous  quality  review  process  during  which  the  evaluation  support 
team  (Unit  A.3)  analyses  all  key  deliverables  and  verifies  that  the  contractor  has  followed  the 
methodology set in the terms of reference.  

33 

 
 
 
 

 

 

Unit  A.3  centrally  supports  the  operational  units  by  providing  advice  on  the  better  regulation 
requirements and the evaluation processes in general.  

The  preparation  of  the  economic  assessment  of  the  negotiated  outcome,  requires  knowledge  and 
technical  expertise  from  various  units  /  staff  in  DG  TRADE.  To  strengthen  this  process,  in  November 
2017 DG TRADE established a new procedure to formally appoint the units that will participate in the 
preparation of the assessment based on their respective expertise.  

For  the  three  types  of  evaluations  (i.e.  impact  assessment,  sustainability  impact  assessment  and  ex 
post evaluation), DG TRADE established interservice steering groups at the launch of the evaluations to 
support the evaluation work, monitor progress of the evaluation and provide feedback/ quality review 
of key deliverables. 

The IAS identified one very important issue concerning the  evaluation process: planning and monitoring and 
formulated one very important recommendation6: 

DG TRADE  should  put in place enhanced  planning and monitoring arrangements for its evaluation activities. 
This should include planning  for all types of evaluations,  defining criteria for the  selection and prioritisation 
the evaluations to be performed and monitoring the evaluation plan through a set of performance indicators. 
In order to address potential delays in the evaluation process, DG TRADE should document the lessons learned 
from relevant past evaluations and use this when setting timelines for deliverables of contractors. DG TRADE 
should also analyse the resources needed in the operational units for the evaluation activities and plan and 
monitor their use for each evaluation.  

Additional  information  provided  by  DG  TRADE  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

The IAS  recommendation will be addressed in line with the agreed action plan, to be implemented in 2021, 
notably  on  improvements  in  the  planning  and  monitoring  of  the  evaluations,  update  of  the  Sustainability 
Impact Assessment guidance and improvement of the communication guidance. 

General services 

1.  Audit on human resources management in DG ESTAT 

The objective of the audit was to assess whether Eurostat has put in place an adequate system for managing 
its human resources that supports effectively the achievement of its operational objectives. 

The 2019 Annual Activity Report of Eurostat does not include any observations/reservations that relate to the 
area/processes  audited.  The  fieldwork  was  finalised  on  16  December  2020.  All  observations  and 
recommendations relate to the situation as of that date. 

The  IAS  recognised  the  ongoing  efforts  made  by  Eurostat  to  address  its  human  resources  management 
challenges in the context of staff reduction and uncertainty linked to issues in recruitment in Luxembourg, and 
identified the following strengths/good practices: 

 

The human resources business correspondent team has set up a continuous and effective collaboration 
with the human resources account management centre 6. 

6  

DG TRADE accepted the recommendation but disagreed with the rating as very important. The Directorate-General acknowledges 
that there is room for improvement regarding the planning tool, but finds that several statements in the audit report are too broad 
or unsubstantiated on this topic. In particular, in its view the statement ‘lack of planning and monitoring for the evaluation 
activities’ does not reflect the actual situation, as the Directorate-General uses several planning tools and there has been no case 
in which insufficient planning was responsible for significant delays in publishing results of evaluations during past projects. 
34 

 
 
 
                                                           
 

 

 

Eurostat  has  organised  internal  staff  surveys  every  two  years  (the  last  one  in  2017)  to  collect 
information on staff satisfaction.  

The  2018  Commission  staff  survey  indicated  a  higher  satisfaction  rate  in  Eurostat  on  the  working 
environment (wellbeing and work-life balance) compared to the overall Commission rate.  

Eurostat organises many activities to foster good communication between management and staff and 
to enhance collaboration and sharing of information in-house. Furthermore, numerous well-being and 
social activities are offered to the Office’s staff.  

The  IAS  identified  three  very  important  issues  concerning:  (1)  human  resources  strategic  management;  (2) 
human  resources  planning;  and  (3)  human  resources  monitoring  and  reporting  and  formulated  eight  very 
important recommendations: 

Human resources strategic management (1 very important recommendation) 

ESTAT  should  develop  an  integrated  local  human  resource  strategy  (including  in  the  area  of  learning  and 
development)  aligned  with  the  business  strategy  (objective  and  priorities).  The  human  resource  strategy 
should  address  the  specific  human  resource  risks  that  Eurostat  is  facing  and  should  include  clear  human 
resource objectives, expected results and deliverables. 

Human resources planning (6 very important recommendations) 

Eurostat  should  design  and  implement  an  integrated  human  resources  planning  process  and  prepare  an 
annual human resource plan translating the strategic human resource priorities. Eurostat should also set up 
and implement a mapping exercise of tasks and skills / competences, develop a workload assessment system 
and, based on the results, revise the allocation of staff to remove possible imbalances. 

Human resources monitoring and reporting (1 very important recommendation) 

Eurostat should design and implement a monitoring and reporting system at Directorate-General level based 
on  a  set  of  human  resource  indicators  to  be  able  to  regularly  monitor  and  report  on  key  human  resource 
issues and identify areas where management follow-up/decisions are required. 

Additional information provided by ESTAT on the measures defined and/or implemented following 
the Internal Audit Service audit 

Eurostat  developed  an  action  plan  for  the  implementation  of  each  of  these  recommendations,  which  was 
agreed by IAS on 18 March 2021. The implementation of the action plan has already started.  

Concerning  the  recommendation  on  HR  strategic  management,  taking  into  account  the  upcoming  guidance 
from DG HR on developing a local HR strategy, Eurostat will develop a local Eurostat HR strategy, based on 
the following steps: specific HR risk identification and assessment, detailed description of objectives, expected 
results and deliverables and definition of a learning and development strategy.  

35 

 
 
 
 
 
Regarding  HR  planning  process,  Eurostat  will  describe  its  future  integrated  HR  planning  process  in  one 
document and ensure that the designed and implemented HR planning process covers the assessment of the 
existing resources, the identification of the priorities/tasks and related HR needs and the assessment of the 
workload, with the aim of supporting the most effective allocation of resources. 

Eurostat  will  also  develop  an  annual  HR  plan,  based  on  the  strategic  HR  priorities,  that  contains  a  set  of 
actions  with  clear targets, deliverables and responsibilities  for  the  upcoming  year.  In  doing  so,  Eurostat  will 
ensure that the long-term objectives are achieved. 

Eurostat will set up a comprehensive task mapping exercise in order to identify all tasks to be performed and 
the related resources in a comparable manner across the directorates. The task mapping exercise should lead 
to comparable data that can support the decision-making process. 

Eurostat will also carry out a skills mapping exercise by mapping of the available skills and the missing ones, 
cross  check  the  results  of  the  mapping  exercise  with  the  future  skills  needed,  and  will  develop  appropriate 
actions in the context of the HR strategy and the HR annual planning to fill the gaps where necessary. 

Concerning workload assessment, Eurostat has already reminded all staff to encode actual working hours in 
Sysper  on  19  March  2021.  Furthermore,  Eurostat  will  reflect  about  an  appropriate  scheme  to  measure 
workload  in  statistical  production  units  and  horizontal  support  units  including  the  impact  on  overtime  of  its 
staff with the aim to develop and adopt appropriate indicators to measure and monitor workload. 

When  reviewing  staff  allocation,  Eurostat  will  also  take  into  consideration  the  results  of  the  workload 
assessment exercise and its integration in the HR planning process. This will be done with the aim of ensuring 
the most effective staff allocation according to the priorities of the Directorate-General.  

Recommendation 8: HR monitoring and reporting. 

Based on the plan agreed at the 1091st (9 February 2021) Directors’ meeting, Eurostat carries out quarterly 
reporting  and  monitoring  of  key  aspects  of  human  resources situation  at  Directorate-General  level, starting 
from the first quarter 2021. The monitoring draws on the reports provided by HR Account Management Centre 
6.  It  aggregates  key  SYSPER  data  and  include  operational  indicators  related  to  the  staff  composition, 
workload, absenteeism, status of vacancies, flexitime management and attendance to trainings. Directors can 
analyse  the  indicators  provided  in  the  quarterly  HR  metrics  for  their  Directorate,  together  with  the  new 
reporting  tool,  the  Managers’  HR  Dashboard  offered  to  all  managers  in  the  Commission,  to  support  HR 
management  in  their  Directorate.  Furthermore,  the  HR  Business  Correspondent  in  Eurostat  will  prepare  a 
summary quarterly report of the key issues identified at Directorate-General level and areas where follow-up 
decisions are required. From April 2021, the report is being presented to the Directors’ Meeting in the month 
following the reference quarter. 

2.  Audit on performance management in OLAF 

The  objective  of  the  audit  was  to  assess  whether  OLAF  has  put  in  place  an  adequate  performance 
management framework to plan, monitor and report on the achievement of its key policy objectives. 

There  are  no  observations  /  reservations  in  OLAF’s  2019  Annual  Activity  Report  that  relate  to  the  audited 
process. The fieldwork was finalised on 30 November 2020. All observations and recommendations relate to 
the situation as of that date. 

The IAS recognised OLAF’s ongoing efforts to continuously improve its performance management system in 
the current changing environment and highlighted the following good practices: 

 

Effective  coordination:  Unit  OLAF.02  effectively  coordinates  the  strategic  planning  and  programming 
exercise.  It  provides  clear  instructions  for  units  involved  in  the  exercise,  organises  bilateral  meetings 
with  these  units to  clarify  any  methodological  issues and  orally  presents progress and  results  to  the 
Directors’ meetings in parallel with reviewing the compliance and quality of deliverables.  

36 

 
 
 
 
  Monitoring and reporting: OLAF level: The protection of the budget is a key priority of the Commission 
where OLAF plays an essential role. In this context, the European Parliament raised some concerns as 
regards  the  lack  of  information  on  amounts  actually  recovered  following  financial  recommendations 
resulting from OLAF investigations. In 2019, the Court of Auditors and the IAS also flagged issues on 
the monitoring and follow-up of OLAF financial recommendations. 

The  Commission  therefore  committed  itself  to  tackle  these  issues  and  the  Corporate  Management  Board 
requested the Commission services to strengthen their follow-up and to provide relevant information to OLAF 
and DG BUDG to enable a better corporate oversight of the follow-up of OLAF financial recommendations.  

In  this  context,  and  in  order  to  coordinate  efficiently  and  effectively  the  monitoring  of  and  reporting  on  its 
financial  but  also  judicial,  disciplinary  and  administrative  recommendations,  OLAF  created  a  dedicated  task 
force under the responsibility of its Director-General. This task force is in charge of developing good practices 
and  guidelines  on  the  implementation  of  the  monitoring  exercises,  analysing  the  implementation  of  OLAF’s 
recommendations  and  acting  as  OLAF’s  central  contact  point  on  the 
implementation  of  OLAF 
recommendations.  

At Directorates and Units’ level, in addition to objectives and indicators set in the Management Plan, the units 
in the four OLAF directorates have developed specific key performance indicators, which are monitored daily 
and reported in the weekly Directorates’ meetings and in the bi-monthly Directors’ meetings. 

The IAS did not formulate any critical or very important recommendations. 

3.  Limited  review  on  the  implementation  of  the  new  internal  control 

framework in OP  

The objective of the limited review was to assess if the authorising officer by delegation of OP has performed 
an  adequate  overall  assessment  of  the  presence  and  functioning  of  all  internal  control  principles  and 
components as laid down in the Communication on the revision of the internal control framework.  

There  are  no  observations/reservations  in  the  2019  Annual  Activity  Reports  of  OP  that  relate  to  the  area  / 
process audited. The fieldwork was finalised on 28 May 2020. All observations and recommendations relate 
to the situation as of that date. 

The IAS recognised the ongoing efforts made by the Office to establish a robust internal control assessment 
process,  in  particular  by  setting  out  very  clearly  the  roles  and  responsibilities  of  the  actors  involved  and 
ensuring that its various units are properly consulted during the process. 

The IAS did not formulate any critical or very important recommendations. 

Information technology audits 

1.  Audit on management of public cloud services (DG DIGIT, DG HR, SG) 

The  objective  of  the  audit  was  to  evaluate  whether  the  Commission  has  put  in  place  appropriate 
arrangements  for  the  use  of  public  infrastructure  as  a  service  and  platform  as  a  service  cloud  services, 
enabling it to achieve its objectives while reducing risk exposure to an acceptable level and optimising the use 
of resources. 

No reservations were made in the 2019 Annual Activity Reports for SG, DG DIGIT and DG HR that relate to the 
area audited. The fieldwork was finalised on 20 July 2020. All recommendations relate to the situation as of 
that date. 

37 

 
 
 
The IAS recognised the following strengths: the strategic vision for cloud computing, the dynamic purchasing 
system as a multi-institutional call for tender to procure cloud services, and DIGIT as being the single point of 
contact for procurement procedures with external cloud service providers. 

The IAS identified two issues concerning: (1) the governance of cloud services; and (2) cloud security services 
and formulated two very important recommendations: 

Governance of cloud services 

The  Information  Technology  and  Cybersecurity  Board  (chaired  by  SG),  should  strengthen  the  corporate 
governance  on  cloud  issues  through  the  creation  of  a  cloud  centre  of  excellence  for  promoting  cloud 
computing  adoption  and a  portfolio  of  cloud  services aligned  with  business needs,  through  adequate  cross-
functional  collaboration.  It  should  also  receive  regular  reporting  on  the  progress  made  in  implementing  the 
Commission’s cloud strategy. The Information Technology and Cybersecurity Board should ensure that cloud-
related  risks  (of  technological  investment,  security  and  budgetary  nature)  are  properly  reflected  in  the  risk 
management implementation guide so that main risks at department and corporate level are duly reported. 
Appropriate guidance should also be made available to Commission departments in assessing the scope and 
the  use  of  cloud  services  in  the  transition  process.  This  could  be  enhanced  by  developing  an  internal  cloud 
community of practice. 

Cloud security services 

DG DIGIT, through its different roles of cloud broker and cloud security service provider, should reinforce the 
development,  implementation  and  management  of  a  full  set  of  cloud  security  services,  based  on  a  cloud 
technical, data  and  security  architecture.  This should  ensure  a  correct  balance  between  security  baseline  of 
cloud  services  and  business  requirements  resulting  from  the  risk  assessment.  The  service  level  offered  by 
cloud security services should be effectively monitored in practice and the results reported on a regular basis 
to the corporate governance bodies, based on key performance indicators. 

Additional information provided by DG DIGIT and SG on the measures defined and/or implemented 
following the Internal Audit Service audit 

DG  DIGIT  is  progressing  with  the  timely  implementation  of  the  audit  recommendations,  as  described  in  the 
dedicated  action  plan  and  therefore  mitigating  the  related  risks.  DG  DIGIT  drafted  a  proposal  for  the 
establishment  of  a  new  Cloud  Council  and  its  mandate.  DG  DIGIT  also  revised  the  roadmap  for  their  cloud 
security services. Both elements were approved by the Information Technology and Cybersecurity Board (ITCB) 
on 25 March 2021. 

Both  of  the  above-mentioned  actions  are  crucial  for  the  implementation  of  the  remaining  parts  of  IAS 
recommendations, mentioned below, which are due later in 2021 and 2022.  

In  terms  of  governance,  the  Cloud  Council  will  oversee  the  cloud  users’  community  (i.e.  the  existing  Cloud 
Community of Practice that since end 2020 has a dedicated channel of communication), in which task it will 
be supported by a Cloud Center of Excellence already hosted in DIGIT as cloud broker. The Cloud Council will 
also investigate specific cloud requirements, or issues at a technical level, as notably, it will develop landing 
zones operational model and cloud services architecture, for ITCB endorsement. The establishment of a clear 
governance  structure  will  enable  updating  risk  management  to  ensure  that  the  risks  relevant  for  cloud 
environments are properly considered; and putting in place of regular yearly reporting about the progress of 
the implementation of the cloud strategy, in the scope of the European Commission Digital Strategy (ECDS) 
reporting. 

The  Roadmap  for  cloud-enabled  IT  security  services,  foresees  to  incrementally  develop,  during  a  two-year 
programme, a comprehensive set of cloud-enabled IT security services that covers the business needs on the 
usage  of  cloud  (security  consulting  services,  monitoring,  threat  hunting,  development,  identification  and 
remedial to weaknesses, detection of ‘Shadow IT’, etc.). The service offering will be complemented by a cloud 
security maturity model and by a set of key performance indicators that will enable the effective monitoring 
of the services. 

38 

 
 
 
2.  Audit on information technology security management in DG GROW 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effectiveness  of  the 
implementation  of  the  governance,  management  and  control  processes  put  in  place  by  DG  GROW  for  its 
information technology (IT) security management. 

The  fieldwork  was  finalised  on  24  November  2019.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS recognised the following strengths:  

 

 

DG  GROW  regularly  performs  vulnerability  scans  for  the  information  technology  application  IMI 
(Internal  Market  Information)  and  duly  follows  up  their  results.  The  IMI  vulnerability  scan  in  March 
2019  did  not  identify  any  high-level  risks.  Moreover,  during  the  development  of  the  information 
technology  application  MDR  EUDAMED  (European  Database  on  Medical  Devices),  DG  GROW  also 
performed regular vulnerability scans on the system.  

For  the  important  changes/updates  to  IMI,  the  specific  security  measures  are  identified,  documented 
and  regularly  reviewed  by  DG  GROW.  Team  leaders  of  MDR  EUDAMED  performed  code  reviews, 
applying  the  four-eyes  principle  during  the  software  development  lifecycle.  The  project  managers  of 
IMI,  CPNP  (Cosmetic  Products  Notifications  Portal)  and  MDR  EUDAMED  pay  special  attention  to  the 
security awareness of the developers when recruiting.  

The IAS did not formulate any critical or very important recommendations.  

3.  Audit  on  information  technology  governance  and  project  management  in 

JRC 

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of 
the  management  and  control  systems  put  in  place  by  JRC  for  its  information  technology  governance  and 
project management processes. 

There  were  no  observations/reservations  in  the  2018  Annual  Activity  Report  of  JRC  that  relate  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  26  May  2020.  All  observations  and  recommendations 
relate to the situation as of that date. 

The IAS recognised the ongoing efforts and significant improvements made by JRC in the past two years as 
regards  its  information  technology  governance  arrangements  and  in  the  initiation/approval  phase  of 
information technology projects. 

The following good practices were noted: 

 

 

 

in  JRC  are  well-defined,  formalised  and 
Information  technology  governance  arrangements 
implemented  in  practice.  Both  information  technology  and  business  stakeholders  periodically  discuss, 
monitor  and  decide  on  information  technology  activities  and  their  direction.  This  ensures  that 
information technology is seen by senior management as a key component to deliver on the long-term 
strategy of JRC and ensures business-focused and value-driven information technology.  

The  establishment  of  a  central  body  ‘JRC  ICT  Programme  Office’,  which  among  many  functions, 
examines  all  new  information  technology  investments  and  ensures  their  alignment  with  the  defined 
information  technology  architecture,  and  with  the  Commission  information  management  governance 
and project management methodology as well as supporting the implementation of the Commission’s 
digital strategy.  

The risk management process is well-defined, formalised and implemented in practice, in compliance 
with  the  Commission’s  regulatory  requirements,  and  in  line  with  the  JRC  integrated  management 
system processes, including information technology risks.  

39 

 
 
 
The IAS identified one very important issue concerning information technology project management practices 
and formulated one very important recommendation: 

JRC should define and implement a comprehensive information technology project management methodology 
with supporting artefacts and guidelines tailored to the type and size of the projects. This would ensure that 
each  project  has  a  clear  project  organisation  structure  in  place,  supported  by  appropriate  project  logs  and 
documentation, as well as stronger continuous reporting and monitoring of its status. 

Additional  information  provided  by  JRC  on  the  measures  defined  and/or  implemented  following 
the Internal Audit Service audit 

As agreed in the action plan accepted by the IAS on 29 October 2020, the identified very important issue will 
be addressed through the preparation of guidelines for IT project  management tailored to the needs of the 
JRC.  These  guidelines  will  contain  recommendations  for  a  clear  project  organisation  structure,  as  well  as 
project  monitoring  and reporting  processes  guidelines;  maintaining  project  management  logs and guidelines 
for project closure activities will be also treated. The guidelines for IT project management are planned to be 
submitted for approval to the ICT governance of the JRC by the end of 2021, together with a policy document 
in  preparation  regarding  the  system  ownership  for  IT  systems  funded  by  policy  DGs  (to  be  reviewed  and 
updated where needed). 

40 

 
 
 
 
 
PART 
(summarised) 

2: 

Follow-up 

engagements 

1.  Follow-up audit in DG BUDG on the effectiveness and efficiency of the new 
early  detection  and  exclusion  system  in  protecting  the  EU  financial 
interests  in  DG  BUDG,  DG  INTPA,  DG  REGIO  and  DG  RTD  (2  follow-ups 
performed in 2020) 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): guidelines and awareness raising 

Recommendation No 7 (very important): applying early detection and exclusion system in practice 

2.  Follow-up audit in DG CLIMA on the LIFE financial instrument: effectiveness 

and efficiency of the current framework in DG CLIMA and DG ENV 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): functioning of the steering committee 

Recommendation No 2 (important): financial and performance monitoring 

Recommendation No 3 (very important): visibility and promotion of the EU contribution 

3.  Follow-up  audit  in  DG  EMPL  on  monitoring  the  implementation  and 
performance of 2014-2020 operational programmes in DG EMPL, DG MARE 
and DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): assessing programme performance, identifying and following up on 
implementation weaknesses 

Recommendation No 3 (important): reporting on implementation 

4.  Follow-up  audit  in  DG  ENV  on  the  LIFE  financial  instrument:  effectiveness 

and efficiency of the current framework in DG CLIMA and DG ENV 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 3 (very important): visibility and promotion of the EU contribution  

DG ENV developed and approved a ‘Communication and Engagement Plan’ for the Natural Capital Financing 
Facility  (NCFF).  The  plan  was  approved  by  the  NCFF  steering  committee.  However,  to  date, DG  ENV  has not 
been  able  to  provide  evidence  that  the  ‘Communication  and  Engagement  Plan’  is  functioning  as  intended. 
Therefore, the recommendation cannot be closed.  

41 

 
 
 
However, the  IAS  acknowledged  that  in  the  light  of  the  Covid-19  crisis,  there  is considerable  uncertainty  as 
regards to when any new LIFE operations linked to the NCFF will be signed. When coupled with the fact that 
the ‘Communication and Engagement Plan’ has been developed and approved, if not yet fully implemented in 
practice, the IAS considered that the residual risks have been sufficiently reduced for the recommendation to 
be downgraded from ‘very important’ to ‘important’. 

5.  Follow-up  audit  in  DG  ESTAT  on  the  production  process  and  the quality  of 
statistics  not  produced  by  Eurostat  (DG  ENER,  DG  ESTAT,  DG  FISMA,  DG 
GROW and DG JUST) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation  No  1  (very  important):  framework  for  statistical  production  in  the  Commission  and 
Eurostat’s coordination role in the development and production of statistics by other Commission services 

Recommendation No 2 (very important): completion of the statistical inventory and masterplan 

6.  Follow-up  audit  in  DG  GROW  on  the  production  process  and the quality  of 
statistics  not  produced  by  Eurostat  (DG  ENER,  DG  ESTAT,  DG  FISMA,  DG 
GROW and DG JUST) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): completion of the statistical inventory and masterplan  

Recommendation  No  3  (important):  methodological  and  quality  framework  for  the  statistics  produced  or 
acquired internally 

Recommendation No 4 (important): referencing and use of disclaimer when publishing statistics 

7.  Follow-up  audit  in  DG  HOME  on  human  resources  management  and  staff 

allocation in DG HOME and DG JUST 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): DG HOME’s strategic approach to human resources management 

Recommendation  No  3  (important):  increasing  staff  performance  through  measures  of  sustainable 
management 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 2 (very important): allocation of human resources 

DG  HOME  dedicated  a  section  of  its  strategy  on  how  to  match  human  resources  to  needs.  The  strategy 
recognises the need for an allocation mechanism based on factual data and follows the corporate guidelines 
and  procedures  for  identifying  human  resources  needs  on  an  annual  basis.  DG  HOME  complemented  the 
corporate procedures with its own internal procedures to allow for an ongoing identification and monitoring of 
human resources needs, linked to political priorities.  It has also developed a template for unit  management 
plans, but it is not yet used. Nor has DG HOME provided evidence of the use of objective criteria to support 

42 

 
 
 
human resource decisions. However, the IAS considered that the residual risk has been partly mitigated and 
downgraded the rating of the recommendation from ‘very important’ to ‘important’. 

8.  Follow-up  audit  in  DG  HR  on  the  effectiveness  of  the  management  of 

absenteeism in OIB, OIL and PMO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): measurement, analysis and reporting on sickness absence level in the 
Commission 

Recommendation No 2 (very important): identification of the reference sickness absence rate at Commission 
level 

9.  Follow-up audit in DG INTPA on the effectiveness and efficiency of the new 
early  detection  and  exclusion  system  in  protecting  the  EU  financial 
interests in DG BUDG, DG INTPA, DG REGIO and DG RTD 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 2 (very important): guidelines and awareness raising 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 5 (very important): applying the early detection and exclusion system in practice 

The  IAS  acknowledged  the  progress  being  made  in  applying  the  early  detection  and  exclusion  system  in 
practice,  but  notes  that  further  actions  are  still  needed  to  strengthen  the  monitoring  of  OLAF  cases,  in 
particular by updating its internal procedures and guidelines. However, in view of the progress made overall, 
the  IAS  considered  that  the  residual  risks  have  been  reduced.  Consequently,  the  rating  of  this 
recommendation was downgraded from ‘very important’ to ‘important’. 

10. Follow-up  audit  in  DG  JUST  on  the  production  process  and  the  quality  of 
statistics  not  produced  by  Eurostat  in  DG  ENER,  DG  ESTAT,  DG  FISMA,  DG 
GROW and DG JUST 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): completion of the statistical inventory and masterplan 

Recommendation No 4 (important): referencing and use of disclaimer when publishing statistics 

11. Follow-up  audit  in  DG  JUST  on  human  resources  management  and  staff 

allocation in DG HOME and DG JUST 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 2 (very important): allocation of human resources 

43 

 
 
 
DG  JUST  follows  the  corporate  guidelines  and  procedures  on  the  yearly  identification  of  human  resources 
needs,  and  complemented  these  procedures  with  internal  ones  that  allow  for  ongoing  identification  and 
monitoring of human resources needs that are linked to political priorities. To close the gap between human 
resources  needs  and  available  resources,  it  also  introduced  new  tools  and  working  methods  that  facilitate 
staff  reallocation,  and  senior  management  meet  and  discuss  human  resources  matters  on  a  weekly-basis. 
However, DG JUST has not yet defined and used objective criteria to support its analysis of staff needs and 
related human resources decisions and has only recently started developing a template for unit management 
plans. 

Taking into consideration the actions already implemented, the IAS considered that the residual risk had been 
partly mitigated and downgraded the recommendation from 'very important' to 'important'. 

12. Follow-up audit in JRC on intellectual property rights supporting activities 

in DG COMM, DG DIGIT, DG GROW, JRC and OP 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (very important): corporate information technology management at the Commission 

13. Follow-up  audit  in  DG  MARE  on  monitoring  the  implementation  and 
performance of 2014-2020 operational programmes in DG EMPL, DG MARE 
and DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (very important): assessing programme performance, identifying and following up on 
implementation weaknesses  

14. Follow-up  audit  in  OIL  on  the  effectiveness  of  the  management  of 

absenteeism in OIB, OIL and PMO 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 1 (very important): in-depth analysis of absences at office level 

The IAS acknowledged that overall, there has been some progress in the analysis of sickness absences in the 
Office. However, a more comprehensive analysis is needed at Office level to identify the root-causes of the 
higher  absence  rates  in  certain  staff  categories,  in  order  to  define  the  adequate  measures  (at  local  or 
corporate level) with the objective of reducing those rates. Therefore, although the  risks identified during the 
audit  on  the  management  of  sickness  absences  have  not  been  fully  mitigated,  the  IAS  considered  that  the 
actions  implemented  so  far  have  reduced  the  residual  risk.  Consequently,  the  recommendation  was 
downgraded from ‘very important’ to ‘important’. 

15. Follow-up audit in OP on intellectual property rights supporting activities in 

JRC, DG COMM, DG GROW, DIGIT and OP 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): intellectual property rights management for EU-publications 

44 

 
 
 
16. Follow-up  audit  in  PMO  on  the  effectiveness  of  the  management  of 

absenteeism in OIB, OIL and PMO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 2 (important): sickness absence management by line managers 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 1 (very important): monitoring and analysis of absences at office level 

The IAS acknowledged that overall, there has been some progress in the analysis of sickness absences in the 
Office. However, a more  comprehensive analysis is needed at Office level to identify the root-causes of the 
higher  absence  rates  in  certain  staff  categories,  in  order  to  define  the  adequate  measures  (at  local  or 
corporate level) with the objective of reducing those rates. Therefore, although the risks identified during the 
audit  on  the  management  of  sickness  absences  had  not  been  fully  mitigated,  the  IAS  considered  that  the 
actions  implemented  so  far  have  reduced  the  residual  risk.  Consequently,  the  recommendation  was 
downgraded from ‘very important’ to ‘important’. 

17. Follow-up  audit  in  DG  REGIO  on  monitoring  the  implementation  and 
performance of 2014-2020 operational programmes in DG EMPL, DG MARE 
and DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): assessing programme performance, identifying and following up on 
implementation weaknesses  

Recommendation No 3 (important): reporting on implementation 

18. Follow-up audit in DG REGIO on the effectiveness and efficiency of the new 
early  detection  and  exclusion  system  in  protecting  the  EU  financial 
interests in DG BUDG, DG INTPA, DG REGIO and DG RTD 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 4 (very important): guidelines and awareness raising 

19. Follow-up  audit  in  DG  RTD  on  the  effectiveness  and  efficiency  of  the  new 
early  detection  and  exclusion  system  in  protecting  the  EU  financial 
interests in DG BUDG, DG INTPA, DG REGIO and RTD 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 3 (very important): guidelines and awareness raising 

Recommendation No 6 (very important): applying early detection and exclusion system in practice 

45 

 
 
 
20. Follow-up audit on the monitoring and enforcement of EU health law in DG 

SANTE 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): compliance assessments  

21. Follow-up  audit  on  the  management  of  the  employment  and  social 
innovation  programme  (EaSI)  with  special  emphasis  on  PROGRESS  axis  in 
DG EMPL (2 follow-up audits performed in 2020) 

Based on the results of the 2 follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): budgeting and call implementation 

Recommendation No 3 (important): call management and timeliness of the grant procedures 

22. Follow-up audit on ex ante controls on Horizon 2020 grant payments in DG 

CNECT 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): functioning of ex ante controls 

23. Follow-up  audit  on  human  resources  management  –  recruitment  of 

temporary scientific staff in JRC  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (very important): recruitment strategy 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 2 (very important): monitoring the recruitment process 

The IAS considered that sub-action 2.4 of the action plan is not fully implemented. In particular, a reporting 
tool has not yet been chosen, the frequency of monitoring of the indicators has not been established and the 
periodical  reporting  to  senior  management  has  not  been  put  in  place.  The  periodical  reassessment  of  the 
adequacy of the targets set for each indicator has also not been done yet.  

However, as the other main parts of the recommendation have been implemented and thus the residual risk 
has decreased, the recommendation was downgraded from ‘very important’ to ‘important’. 

24. Follow-up  audit  on  verification  plans  in  DG  INTPA  (2  follow-up  audits 

performed in 2020) 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented and were closed: 

46 

 
 
 
Recommendation No 2 (important): control framework - guidance 

Recommendation No 3 (important): control framework - training 

Recommendation No 4 (important): risk assessment in EU delegations – risk assessment process 

Recommendation No 8 (important): planning phase – assessment of contracts excluded from planning 

Recommendation No 9 (very important): key performance indicators and targets 

Recommendation No 10 (very important): monitoring mechanism on the implementation of audits in the audit 
and verification plan 

25. Follow-up audit on common foreign and security policy in FPI 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation  No  1  (very  important):  closure  of  mandates  of  common  security  and  defence  policy 
missions 

26. Follow-up audit on partnership instrument in FPI 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation  No  2  (very  important):  implementation  of  partnership  instruments  projects:  control 
environment and headquarters supervision 

27. Follow-up  audit  on  the  Neighbourhood  Investment  Facility  (NIF)  and  the 
Western  Balkans  investment  framework  (WBIF)  in  DG  NEAR  (2  follow-up 
audits performed in 2020) 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): NIF: pre-contract signature phase 

Recommendation No 2 (important): NIF: monitoring of project implementation 

Recommendation No 4 (very important): NIF: Commission monitoring and reporting (at facility level) 

The following recommendations were assessed as not fully and/or adequately implemented: 

Recommendation No 3 (very important): NIF: financial management 

Sub-recommendation  3e)  is  assessed  as  not  implemented  because  the  guidelines  to  assess  the  periodic 
financial and operational reports from the blending projects on an annual basis and where possible clear the 
related  pre-financing  are  currently  being  revised  and  the  updated  instructions  have  not  yet  been  issued. 
Considering  the  significant  progress  made  in  implementation,  this  recommendation  was  downgraded  from 
‘very important’ to ‘important’. 

Recommendation No 5 (important): WBIF: screening, assessment and approval of grants 

47 

 
 
 
The IAS assessed some remaining sub-recommendations as not fully implemented because DG NEAR had not 
yet updated the relevant documents and procedures. This concerns, in particular, the grant application form 
template (5b), the screening checklist (5c), and the guidelines on follow-up of assessors’ comments (5f). 

Recommendation No 6 (important): WBIF: EWBJF project reporting 

The IAS assessed the three sub-recommendations as not fully implemented. In particular, DG NEAR had not 
finalised the necessary revisions of the rules of procedure (6a) and the template of the progress  report (6b). 
Moreover,  it  was  not  possible  to  assess  the  implementation  of  communication  and  visibility  actions  as  the 
report summarising the actual actions carried out was not available (6c). 

Recommendation No 7 (very important): WBIF: monitoring at the facility level 

Sub-recommendation 7e) is assessed as partially implemented by the IAS because the 2018 versions of the 
management  declarations  are  in  compliance  with  the  contractual  arrangements,  however,  the  2019  Annual 
Activity Report does not mention the scope of the management declarations.  

Sub-recommendations  7a)  and  7b)  are  assessed  not  implemented  by  the  IAS  because  the  revision  of  the 
WBIF  architecture  and  relating  rules  of  procedure  had  not  taken  place  as  DG  NEAR  is  waiting  for  the  next 
multi-annual financial framework to be adopted. 

Recommendation No 8 (very important): WBIF: financial management and financial reporting  

The IAS assessed that all five parts of the recommendation have not been fully implemented. In particular, DG 
NEAR has not finalised the necessary revisions of the guidelines on the preparation of the grant application 
form (8a), has not yet ensured adequate disbursement forecasts for the WB-EDIF equity funds (8b), has not 
yet  revised  the  general  conditions  linked  to  the  calculation  of  the  fees  (8c),  has  not  yet  finalised  an 
agreement with the EBRD to provide regular financial information (8d), and is still in the process of analysing 
all open pre-financing and perform the clearing (8e). 

28. Follow-up audit on DG HOME’s audit activity and clearance of accounts 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 3 (very important): clearance of accounts 

29. Follow-up audit on procurement in DG JUST 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 2 (important): implementation of procurement procedures 

Recommendation No 3 (important): supervision of the procurement process7 

Recommendation No 4 (important): implementation of the anti-fraud strategy 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 1 (very important): preparation of procurement procedures 

7  

The IAS acknowledged that senior management of DG JUST has accepted the risk of not putting in place periodic ex post controls 
on procurement transactions. 

48 

 
 
 
                                                           
As per the action plan, DG JUST put in place a template for an ‘orientation document’. This document sets out 
certain key information on procurement activities, and policy units are requested to fill it in before the start of 
each  procurement  activity.  This  includes  the  nature  of  the  activity,  justification  of  the  outsourcing  option 
where  relevant,  and  links  the  activity  to  the  annual  work  programme.  For  all  the  procurement  activities 
sampled by the IAS, the policy units responsible had adequately completed the orientation documents which 
were also signed off by the respective Heads of Unit. 

The Directorate-General has taken a number of steps to ensure that a needs analysis is properly documented 
in  preparation  of  the  launch  of  procurement  procedures.  It  has  put  in  place  a  document  that  lists  planned 
procurement activities as part of the preparation for the 2019 annual work programme. However, it has yet to 
sufficiently develop all the necessary elements of the needs analysis. The needs analysis document sets out a 
description of the activity and the planned amount. For the 2019 annual work programme, this includes the 
justification and timing of the procedure in the comments section for some, but not all cases. For the 2020 
needs analysis document, there is a dedicated  column for the justification and the timing of the procedure. 
However,  in  both  years,  the  basis  on  which  the  planned  amounts  have  been  decided  on  is  not  consistently 
reflected. Furthermore, for both 2019 and 2020 annual work programmes, there was no sign-off/approval by 
the authorising officer.  

Nevertheless, although the risks identified during the audit have not been fully mitigated, the IAS considered 
that the actions implemented so far have reduced the residual risk and downgraded recommendation No 1 
from ‘very important’ to ‘important’. 

30. Follow-up audit on anti-fraud information system in OLAF 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 7 (important): anti-fraud information system multiannual strategy 

31. Follow-up audit on supervision of outsourced IT operations in TAXUD 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 2 (important): contract performance measurement and reporting 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 4 (important): configuration management 

The IAS noted that DG TAXUD has configured all configuration items in the service management tool (SMT). 
However, a number of actions have yet to be fully implemented:  

- The release of version No 9.62 of SMT allows access to documentary artefacts (e.g. methodology, 
policies, procedures, manuals, etc.) related to configuration items and processes in the configuration 
management database. However, DG TAXUD has yet to do this in practice.  

- DG TAXUD has decided to use template reports to identify reference and/or baseline configurations 
of configuration items, since the functionality of the service management tool does not enable it to 
integrate  them  in  a  way  that  suits  its  needs.  However,  DG  TAXUD  has  not  yet  been  using  these 
template reports. 

- The integration of procurement and assets inventory processes is not yet ensured. To achieve this, 
an asset management tool still needs to be implemented, enabling contractors to access data from 
the configuration management database. 

49 

 
 
 
32. Follow-up audit on the procurement process in DIGIT  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 3 (important): sensitive functions and follow-up of the ABAC access rights review 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 1 (important): ex ante controls 

While  the  IAS  acknowledged  that  DIGIT  re-engineered  some  financial  workflows,  including  optimisation 
measures, these actions did not address the aspects recommended by the IAS. In particular, no risk criteria (or 
thresholds)  were  established  to  delegate  powers  to  authorising  officers  by  sub-delegation  and  the  data 
provided by DIGIT showed that the authorisation of payments was not spread evenly among the authorising 
officers by sub-delegation during the last two years (2018 and 2019). Furthermore, DIGIT did not update the 
ex  ante  control  checklists  for  payments  to  reflect  the  controls  actually  carried  out.  Therefore,  the  IAS 
considered  that  the  risks  identified  in  the  original  audit  have  not  been  adequately  addressed  and 
consequently sub-recommendation 1.1 (design of the internal control system) has not been implemented. 

While DIGIT performed ex ante price checks as a user of the Natacha III framework contract, it did not advise 
the  other  users  of  the  framework  contract  to  perform  those  ex  ante  checks.  To  facilitate  a  consistent 
application of ex ante price checks by all users and address the risk of erroneous price conditions not being 
detected,  DIGIT  proposes  to  develop  guidance  on  ‘price  checks’  to  be  carried  out  by  each  user  for  the  new 
Natacha IV framework contract (expected to be signed in May 2021). Therefore, the IAS considered that sub-
recommendation 1.2 (application of ex ante controls for the framework contract ‘Natacha  III’)  has not been 
implemented. The IAS welcomed the proposal of DIGIT, as technical manager of the contract, to develop the 
above guidance on ex ante checks for a consistent application of price checks across users. 

33. Follow-up audit on Eurostat’s quality management of statistical processes  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (very important): design and implementation of quality reviews. 

34. Follow-up  audit  on  effectiveness  of  Eurostat’s  cooperation  with  external 

stakeholders  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 2 (important): roles and responsibilities and information sharing. 

35. Follow-up  audit  on  management  of  information  technology  security  in  DG 

DIGIT 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 3 (important): security logs for suspicious activity detection 

Recommendation No 4 (important): exception management of security vulnerability corrections 

50 

 
 
 
The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation  No  1  (very  important):  assurance  on  the  legitimacy  of  actions  performed  in  production 
systems 

DG DIGIT has performed an exercise to identify and publish good practices in the organisation for identifying 
and  assessing  the  legitimacy  of  activities  and  the  integrity  of  configurations  in  the  production  systems.  In 
addition, several solutions have been implemented to keep track of legitimate changes in the different types 
of systems (end user devices, servers and network). DG DIGIT also made available specific environments for 
special needs, such as developers who are granted sufficient privileges to perform normal functions, but with 
a reduced risk of potentially compromising production systems. Certain actions related to the management of 
baseline  configurations  still  need  to  be  fully  implemented.  However,  in  view  of  the  progress  made,  the  IAS 
considered  that  the  residual  risks  have  been  reduced  and  downgraded  the  rating  from  ‘very  important’  to 
‘important’. 

36. Follow-up audit on information technology governance in DG INTPA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (very important): information technology governance framework 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 4 (important): business process governance  

DG  INTPA’s  revised  information  technology  governance  framework  includes  a  new  governance  body  in  the 
form of a Business Processes Governance Board, mandated by the DG INTPA’s Information Technology Board 
to  ensure  that  business  processes  are  documented,  harmonised,  optimised  and  continuously  improved.  DG 
INTPA  appointed  external  experts  to  help  with  this  new  governance  structure,  based  on  a  phased  approach 
and encompassing five ‘work packages’. Although the Information Technology Board approved the activation 
of the Business Processes Governance Board, which will commence its work in the first quarter of 2021, the 
IAS considered that the Directorate-General has yet to fully implement the underlying enterprise architecture 
and business governance framework in practice. The workflow to establish an effective and efficient liaison 
between process owners and the various information technology system suppliers and service providers still 
needs  to  be  implemented.  Similarly,  the  framework  (mandate,  roles,  responsibilities,  resources)  needed  to 
document and manage business processes appropriately also needs to  be implemented. This is essential to 
have changes in business processes properly integrated in the information technology tools. 

37. Follow-up audit on information technology security management in DG RTD 

(2 follow-up audits performed in 2020) 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): traceability of administrator accounts activities 

Recommendation No 2 (important): security event logging and monitoring 

Recommendation  No  3  (important):  security  analysis  and  testing  activities  in  the  change  and  project 
management 

Recommendation No 5 (important): regular review of security measures 

51 

 
 
 
 
List  of  audits  for  which  all  recommendations  have  been  closed  in  2020  after  a 

follow-up audit 

Based on the results of the follow-up audits performed in 2020, the IAS assessed that the following audits 
listed below could be fully closed as all the recommendations had been implemented. 

Audit Title 

38,  39  and  40.  Audit  on  the  processes  for  managing  and  sharing  data  on  agri-
environmental-climate issues in DG AGRI, DG CLIMA and DG ENV 

41.  Limited  review  on  the  reporting  on  the  corrective  capacity  (DG  AGRI,  DG  BUDG,  DG 
EMPL, DG INTPA, DG REGIO, DG RTD and EASME) 

42 and 43. Audit on the management of intra-muros contractors (DG BUDG, DG COMM, DG 
DIGIT, DG HR, JRC)  

44 and 45. Audit on synergies and efficiencies review (DG BUDG, DG COMM, DG DIGIT, DG 
HR, DG SCIC, SG, OIB) 

46.  Audit  on  management  of  recovery  orders  for  competition  fines  (incl.  guarantees  for 
competition  fines)  and  for  recovery  orders  in  the  context  of  the  Commission’s  ‘corrective 
capacity’ – phase 1 (DG CNECT, DG ENER, SJ, EACEA) 

47, 48 and 49. Audit on the effectiveness of simplification measures under the 2014-2020 
European structural and investment funds in DG EMPL, DG MARE and DG REGIO 

50,  51,  52,  53,  54  and  55.  Audit  on  the  review  of  the  annual  assurance  packages  in  DG 
EMPL, DG MARE and DG REGIO 

56  and  57.  Audit  on  early  implementation  of  European  structural  and  investment  funds 
control strategy in DG EMPL and DG REGIO 

58. Audit on the evaluation process in DG EMPL and DG REGIO 

59.  Audit  on  the  coordination  and  working  arrangements  with  European  Union  regulatory 
agencies and bodies in DG HOME and DG SANTE 

60, 61 and 62. Audit on the management of the fruit and vegetables regime in DG AGRI 

63. Audit on the control strategy for the common agricultural policy 2014-2020 in DG AGRI 

64. Audit on the management of IPARD II in DG AGRI 

65. Limited review of the management of State aid in the field of agriculture in DG AGRI 

66. Audit on the approval process of the 2014-2020 rural development plans in DG AGRI 

67. Audit on the implementation of payments and corrections in DG AGRI 

68. and 69. Audit on major projects in DG REGIO 

70. Audit on Horizon 2020 grant management in ERCEA – phase 2 

71. Audit on competitive activities in JRC  

52 

 
 
 
72. Audit on Horizon 2020 grant management in REA  - phase 2 project monitoring and ex 
ante controls 

73.  Audit  on  the  implementation  of  the  FP7  ex  post  audit  strategy  by  the  Common  Audit 
Service in DG RTD8 

74. Audit on the assurance building process in DG INTPA headquarters 

75. and 76. Audit on Erasmus+ and Creative Europe grant management in EACEA - phase 2 
from project monitoring to payment  

77. Audit on evaluation in DG ECFIN 

78. Audit on the preparation of legislative initiatives by DG TAXUD  

79. Audit on financial management of procurement contracts and grants in DG TRADE 

80. Audit on internal processes supporting trade policy negotiations in DG TRADE 

81. Audit on the procurement process in DG COMM 

82. Limited review of the effective implementation of the new internal control framework 
in DG COMM 

83. Limited review of the effective implementation of the new internal control framework 
in DGT 

84. Limited review of the effective implementation of the new internal control framework 
in EPSO 

85. Audit on the support by Eurostat to the Europe 2020 strategy and the new Commission 
priorities 

86.  Audit  in  PMO  on  the  governance,  planning,  monitoring  and  implementation  of  the 
budget line of OLAF Supervisory Committee 

87. Audit on ethics in OLAF 

88. Limited review of the effective implementation of the new internal control framework 
in OIB 

89.  and  90.  Limited  review  of  the  effective  implementation  of  the  new  internal  control 
framework in OIL 

91. Limited review of the effective implementation of the new internal control framework 
in SCIC 

8 Recommendation No 3 on anti-fraud objectives and testing during ex post audits became obsolete and was closed without being 

implemented. 

53 

 
 
 
                                                           
92. Audit on management of European Commission Authentication Service in DG DIGIT  

93. Audit on information technology governance and portfolio management in DG GROW 

94. Audit on information technology security management in DG GROW 

95.  Audit  on  information  technology  security  in  JRC  information  and  communication 
technology systems 

96. Audit on information technology project management practices in OLAF 

97.  Audit  on  human  resources  information  technology  corporate  application  –  nouvelle 
application de paie (NAP) in PMO 

54 

 
 
 
 
 
 
Part 3: summary of long-outstanding recommendations – state of 
play as at 31 January 2021 

No. 

DG 

Audit title 

Recommendation 

Comments 

I 

NEAR 

Neighbourhood 
Investment Facility 
& Western Balkans 
Investment Facility 
in DG NEAR 

WBIF: Financial 
management and 
financial reporting 

DG NEAR marked the recommendation as ‘ready for review’ on 26 June 2020. A follow-
up  conducted  by  the  IAS  in  July  2020  assessed  all  sub-recommendations  as  not 
implemented. As a result, the IAS re-opened the recommendation and encouraged DG 
NEAR to implement the agreed action plan as soon as possible. 
The IAS will perform a second follow-up once DG NEAR reports this recommendation as 
‘ready for review’. 
Expected delay between the originally agreed and revised expected completion dates is 
12 months. 

Final report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

21.12.2018 

30.6.2020 

30.6.2021 

II 

SANTE 

III 

SANTE 

Efficiency and 
effectiveness of the 
Health and Food 
audits and analysis 
service 

Efficiency and 
effectiveness of the 
Health and Food 
audits and analysis 
service 

Staffing of activities 

The  IAS  recommended  that  DG  SANTE  assesses  the  impact  of  the  remote  location 
(Grange, Ireland) and the recruitment needs of its Health and Food Audits and Analysis 
Directorate and develops an HR strategy in relation to it. 

24.10.2019 

30.6.2020 

31.12.2022 

The  DG  reported  that  the  implementation  of  the  recommendation  is  delayed  due  the 
COVID-19 pandemic and the Commission’s new corporate HR strategy.   

Expected delay between the originally agreed and revised expected completion dates is 
2 years and 6 months. 

Time reporting and 
performance 
monitoring 

The IAS recommended that DG SANTE should assess  the scope for introducing a time 
recording system in the Audit and Analysis Directorate, collect and analyse performance 
information and finalise the development of the coverage of its audit universe. 

24.10.2019 

30.6.2020 

31.12.2021 

The  DG  reported  that  the  implementation  of  the  recommendation  is  delayed  due  the 
COVID-19 pandemic. 

Expected delay between the originally agreed and revised expected completion dates is 
18 months. 

55 

 
 
 
No. 

DG 

Audit title 

Recommendation 

Comments 

IV 

NEAR 

WBIF: Monitoring at 
the facility level 

Neighbourhood 
Investment Facility 
& Western Balkans 
Investment Facility 
in DG NEAR 

V 

OIB 

Procurement 
process in OIB, OIL 
and DG BUDG  

Procurement 
procedures 

DG  NEAR  marked  the  recommendation  as  ‘ready  for  review’  on  31  March  2020.  A 
follow-up conducted by the IAS in July 2020  assessed sub-recommendations 7c) and 
7d) as implemented, 7e) as partially implemented and 7a) and 7b) as not implemented. 
As  a  result,  the  IAS  re-opened  the  recommendation  and  encouraged  DG  NEAR  to 
implement the agreed action plan as soon as possible. 

The IAS will perform a second follow-up once DG NEAR reports this recommendation as 
‘ready for review’. 

Expected delay between the originally agreed and revised expected completion dates is 
15 months. 

OIB  prepared  a  working  document  including  a  proposal  to  revise  substantially  the 
current  real  estate  procedure  (‘Kallas  procedure’)  and  submitted  it  at  the  end  of 
September 2018 to the working group that was set up to prepare the revision of the 
procedure to align it with the Financial Regulation. Technical meetings took place with 
DG HR which submitted the revised new Kallas methodology to OIB in September 2020. 
The next steps are the consultation of the Legal Service and DG BUDG, and the launch 
of the inter-service consultation by DG HR for final approval. The further delay is due to 
the COVID-19 pandemic situation and the necessary changes in the Commission’s real 
estate strategy. 

A  follow-up  will  take  place  in  the  second  half  of  2021  as  soon  as  OIB  reports  the 
recommendation as ‘ready for review’.  

Expected delay between the originally agreed and revised expected completion dates is 
3 years and 9 months. 

Final report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

21.12.2018 

30.3.2020 

30.6.2021 

20.1.2017 

22.12.2017 

30.9.2021 

56 

 
 
 
Final report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

19.1.2017 

31.3.2018 

26.2.2021 

No. 

DG 

Audit title 

Recommendation 

Comments 

VI 

PMO 

Charge-back in PMO 

Service-level 
agreements (SLAs) 

it  had  not  yet 

In  its  first  follow-up  in  September  2019,  the  IAS  found  that,  while  PMO  had  made 
significant  progress, 
the 
recommendation.  In  particular,  it  had  not  fully  completed  the  revision  of  all  existing 
SLAs with external clients. Discussions with the parties concerned are still ongoing. The 
further delay is due to the COVID-19 pandemic situation and some specific issues still 
under discussion with certain European Institutions. 

important  parts  of 

implemented 

The  IAS  will  perform  a  second  follow-up  in  the  second  half  of  2021,  once  PMO 
management reports this recommendation as ‘ready for review’. 

Expected delay between the originally agreed and revised expected completion dates is 
2 years and 11 months. 

57