COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2021
Date: 2022-06-07
Institutions: European Commission, Secretariat-General
Subjects: activity report, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 7.6.2022  SWD(2022) 160 final  COMMISSION STAFF WORKING DOCUMENT       Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS   Annual report to the Discharge Authority on internal audits carried out in 2021 {COM(2022) 292 final}  
 
 
Table of contents 

TABLE OF CONTENTS .......................................................................................................................................................... 1 

CONTENT OF THE STAFF WORKING DOCUMENT ........................................................................................................ 4 

PART 1 FINAL REPORTS ..................................................................................................................................................... 5 

1.  Horizontal audits ........................................................................................................................................................................................... 6 

2. 

Agriculture, natural resources and health .................................................................................................................................. 15 

3. 

Cohesion .......................................................................................................................................................................................................... 17 

4. 

Research, energy and transport ........................................................................................................................................................ 19 

5. 

External actions ........................................................................................................................................................................................... 25 

6. 

Education and citizenship ..................................................................................................................................................................... 27 

7. 

Economic and financial affairs .......................................................................................................................................................... 29 

8.  General services .......................................................................................................................................................................................... 31 

9. 

Information technology audits .......................................................................................................................................................... 35 

PART 2 - FOLLOW-UP ENGAGEMENTS (SUMMARISED) ........................................................................................ 40 

List of audits for which all recommendations have been closed in 2021 after a follow-up audit ................... 63 

PART  3:  SUMMARY  OF  LONG-OUTSTANDING  RECOMMENDATIONS  –  STATE  OF  PLAY  AS  AT  31 
JANUARY 2022 .................................................................................................................................................................. 65 

1 

 
List of abbreviations 

CHAFEA: Consumers, Health; Agriculture and Food Executive Agency  
CINEA: European Climate, Infrastructure and Environment Executive Agency (former INEA – Innovation and 
Networks Executive Agency) 
DG AGRI: Directorate-General for Agriculture and Rural Development  
DG BUDG: Directorate-General for Budget  
DG CLIMA: Directorate-General for Climate Action  
DG CNECT: Directorate-General for Communications Networks, Content and Technology  
DG COMM: Directorate-General for Communication  
DG COMP: Directorate-General for Competition  
DG DEFIS: Directorate-General for Defence Industry and Space 
DG DEVCO: Directorate-General for International Cooperation and Development1  
DG DIGIT: Directorate-General for Informatics  
DG EAC: Directorate-General for Education, Youth, Sport and Culture  
DG ECFIN: Directorate-General for Economic and Financial Affairs 
DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations 
DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion  
DG ENER: Directorate-General for Energy 
DG ENV: Directorate-General for Environment  
DG ESTAT: Eurostat  
DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union  
DG GROW: Directorate-General for Internal Market, Industry, Entrepreneurship and SMEs  
DG HOME: Directorate-General for Migration and Home Affairs  
DG HR: Directorate-General for Human Resources and Security  
DG INTPA: Directorate-General for International Partnerships (former DG DEVCO) 
DG JUST: Directorate-General for Justice and Consumers  
DG MARE: Directorate-General for Maritime Affairs and Fisheries  
DG MOVE: Directorate-General for Mobility and Transport  
DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations  
DG REFORM: Directorate-General for Reform (former SRSS  
DG REGIO: Directorate-General for Regional and Urban Policy  
DG RTD: Directorate-General for Research and Innovation  
DG SANTE: Directorate-General for Health and Food Safety  
DG SCIC: Directorate-General for Interpretation  
DGT: Directorate-General for Translation  
DG TAXUD: Directorate-General for Taxation and Customs Union  
DG TRADE: Directorate-General for Trade  

EACEA: European Education and Culture Executive Agency (former Education, Audiovisual and Culture 
Executive Agency)  
ECHA: European Chemicals Agency 
EEA: European Environment Agency 
EISMEA: European Innovation Council and small and medium-sized enterprises (SMEs) Executive Agency  
EPPO: European Public Prosecution Office 
EPSO: European Personnel Selection Office  
ERCEA: European Research Council Executive Agency  
F4E: Joint Undertaking for ITER and the Development of Fusion for Energy (F4E) 

1 On 16 January 2021, DG DEVCO became the Directorate-General for International Partnerships (DG INTPA). 
To facilitate the reading, we used the name DG INTPA throughout this report. This should be understood 
to refer to DG DEVCO for all events, documents and figures before the aforementioned transition date. 

2 

 
 
 
                                                        
FPI: Service for Foreign Policy Instruments  
FRONTEX: European Border and Coast Guard Agency 
IAS: Internal Audit Service  
IDEA: Inspire, Debate, Engage, and Accelerate Action 
JRC: Joint Research Centre  
OIB: Office for Infrastructure and Logistics in Brussels  
OIL: Office for Infrastructure and Logistics in Luxembourg  
OLAF: European Anti-Fraud Office  
OP: Publications Office of the European Union  
PMO: Office for the Administration and Payment of Individual Entitlements  
REA: European Research Executive Agency  
SG: Secretariat-General  
SG.RECOVER: Secretariat-General Recovery 
SJ: Legal Service 

3 

 
 
Content of the staff working document 

Part 1 of this document contains: 

a  summary  of  the  internal  audit  engagements  performed  as  part  of  the  2021  Internal  Audit  Service  (IAS) 
audit plan (reports issued between 1 February 2021 and 31 January 2022); and  

the principal recommendations (critical and very important2) made.  

The  information  contained  in  this  document  reflects  the  state  of  play  when  the  audit  engagements  were 
finalised.  Each  audit  followed  the  applicable  standard  professional  validation  and  contradictory  procedures 
between  auditor  and  auditee  at  the  time  of  the  finalisation  of  the  engagement.  The  enclosed  summary  of 
each  engagement  aims  to  provide  an  overview  of  the  audits  and their main  results.    Additional, up-to-date 
information is provided in specific sections by the auditees on measures drawn up and already implemented 
after the internal audit engagements were finalised. 

Part  2  of  this  document  contains  a  summary  of  the  results  of  the  IAS  follow-up  engagements  performed 
between 1 February 2021 and 31 January 20223. 

Part 3 provides a summarised overview of the eight long overdue very important recommendations as at 31 
January 2022. 

2 

Important  recommendations  are  not  reproduced  in  this  Staff  Working  Document.  For  some  audit 
engagements  the  number  of  recommendations  may  be  higher  compared  to  the  number  of  issues  or 
observations  made,  as  one  audit  issue/observation  may  result  in  several,  separate  recommendations 
addressed to different Commission departments. 

3  The  summary  reflects  the  IAS’s  assessment  of  the  implementation  status  of  audit  recommendations  at 
the  end  of  the  follow-up  assignment.  It  does  not  take  into  account  the  potential  impact  of  any  further 
action on the status of the recommendation that the auditee may have undertaken and reported to the 
IAS since the issuance of the IAS follow-up note or report. 

4 

 
 
 
 
                                                        
Part 1 Final 
reports 

 
 
 
1.  Horizontal audits 

1.1.  Audit  on  the  implementation  of  audit  results  in  Horizon  2020 

(CINEA, DG CNECT, EISMEA, ERCEA, REA, DG RTD)  

The objective of the audit was to assess if the internal control system set up for the process for implementing 
H2020 Common Audit Service and European Court of  Auditors audit results, H2020 audit results extensions 
and financial recommendations from OLAF investigations in the research family is adequately designed and 
effectively implemented in compliance with the applicable rules. 

There are no observations/reservations in the 2020 Annual Activity Reports of the  Directorates-General and 
Executive Agencies involved that relate to the processes audited. . 

The  fieldwork  was  finalised  on  24  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The  IAS acknowledged the following strengths/good  practices in relation to the implementation of Common 
Audit Service audit results: 

 

 

 

The  process  for  the  implementation  of  the  Common  Audit  Service  audit  results  and  extensions  is 
overall well designed. 

The  roles  and  responsibilities  related  to  the  implementation  of  the  Common  Audit  Service  H2020 
audits results and extensions in the H2020 implementing entities are clearly defined. 

The project officers and the financial officers are provided with the necessary tools to implement the 
Common Audit Service audit results effectively. In particular: 

–  central  guidance  (eGrants  Vademecum)  has  been  developed  by  the  Common 
Implementation Centre which details the checks to be made for the implementation of 
the Common Audit Service audits results, i.e.  clear description of the checks and steps 
that  need  to  be  performed,  centrally  developed  templates  to  be  used  by  the  project 
officers and financial officers; 

–  the  implementation  of  Common  Audit  Service  audit  results  (including  extensions)  is 
supported  by  a  specifically  developed  electronic  workflow  (‘AURI’)  in  the  COMPASS  IT 
system. 

The IAS identified three very important issues at corporate family level (Common Implementation Centre - DG 
RTD) concerning: (1) monitoring of the implementation of Common Audit Service audit results and extensions; 
(2)  reporting  on  the  implementation  of  Common  Audit Service  and  European  Court of  Auditors audit results 
and extensions; (3) implementation of the results of the non-joint European Court of Auditors audits; and one 
very  important  issue  at  the  level  of  the  implementing  bodies  (CINEA):    implementation  of  Common  Audit 
Service audit results and extensions and formulated four very important recommendations: 

Monitoring of the implementation of Common Audit Service audit results and extensions (One very important 
recommendation addressed to the Common Implementation Centre - DG RTD) 

The Common Implementation Centre should define the guidance and methodology for the  monitoring of the 
implementation  of  audit  results  including  adopting  a  set  of  common  targets  and  indicators.  It  should  also 
improve  the  content  and  the  quality  of  the  COMPASS  AURI  report,  in  order  to  provide  a  reliable  supporting 
tool/monitoring instrument for Directorates-General/Executive Agencies. 

6 

 
Reporting on the implementation of Common Audit Service and European Court of Auditors audit results and 
extensions (One very important recommendation addressed to the Common Implementation Centre - DG RTD) 

The  Common  Implementation  Centre  should  develop  a  common  approach  on  how  the  implementing  bodies 
should  report  on  the  implementation  of  H2020  audit  results  and  audit  extensions  in  their  Annual  Activity 
Report, to ensure consistency and comparability/consolidating of data in the Research family. 

Implementation  of  the  results  of  non-joint  European  Court  of  Auditors  audits  (One  very  important 
recommendation addressed to the Common Implementation Centre - DG RTD) 

The  Common  Implementation  Centre  should  develop  a  central  guidance  for  the  implementation  of  the 
European  Court  of  Auditors  non-joint  audit  results  and  define  a  common  approach  for  the  use  of  the 
information technology system for European Court of Auditors non-joint audits 

Implementation  of  Common  Audit Service  audit  results  and  extensions  of  audit results  (One  very  important 
recommendation addressed to CINEA) 

CINEA should implement measures (such as participation of staff in trainings or workshops, organised by the 
Common Implementation Centre) to raise the financial officer’s awareness of the applicable H2020 guidance 
(e-grants  Vademecum)  on  the  process  of  completion  of  the  calculation  sheets,  the  implementation  of 
recovery orders, and the process related to deviations. 

Additional  information  provided  by  CINEA  and  DG  RTD  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

The action plan addressing the recommendations of the implementation of audit results was sent to the IAS 
on  24  February  2022.  According  to  DG  RTD’s  corporate  action  plan  the  implementation  of  the  following 
actions will be completed until the end of 2022. 

For recommendation n°2, the actions are: (1) to consult the members of the Research & Innovation Network 
of Ex ante Control practitioners (RINEC) and research and innovation audit network (RIAN) groups to analyse 
the targets and indicators used by the different implementing services to monitor the implementation of audit 
results; (2) to agree with the stakeholders on the best targets and indicators to monitor the implementation of 
audit  results; and finally (3)  to draft  guidance setting common targets and indicators for the  monitoring of 
implementation  of  audit  results.  The  Common  Implementation  Centre  will  assess  if  and  how  the  COMPASS 
AURI  report  can  be  improved  to  serve  as  a  reliable  supporting/monitoring  instrument  for  the  implementing 
services. 

For recommendation n°3, the Common Implementation Centre will coordinate with the different implementing 
services and define a common approach to be endorsed by the Common Implementation Centre Governance 
on  what  data  should  be  reported  on  the  implementation  of  H2020  audit  results/audit  extensions  in  their 
annual activity report.  

For  recommendation  n°4,  a  new  feature  in  the  corporate  database  for  the  external  audit  data  (AUDEX) 
allowing  the  encoding  of  results  on  these  non-joint  ECA  audits  is  currently  under  development.  This  new 
feature was presented in the RIAN meeting in October 2021 and the group unanimously welcomed it. Once 
the new feature is available in AUDEX, the AURI workflow will be used to implement the results of non-joint 
ECA audits the same way as that of any other audits. 

CINEA developed an action plan, which outlines two main actions to be implemented by the end of 2022 to 
ensure  that  all  financial  officers  have  the  adequate  knowledge.  The  actions  are  related  to  the  tutoring  of 
newcomers and the participation to relevant trainings. 

7 

 
1.2.  Audit  on  relations  with  decentralised  agencies:  European 
Environment  Agency  (EEA)  and  European  Chemicals  Agency 
(ECHA) (DG CLIMA, DG ENV)  

The objective of the audit was to assess whether DG ENV and DG CLIMA have put in place adequate internal 
control systems to ensure that relations with their main decentralised agencies (EEA and ECHA) are managed 
effectively and efficiently and in accordance with the applicable legislation and corporate guidance. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  ENV  and  DG  CLIMA  that 
relate to the area/process audited. 

The fieldwork was finalised on 30 June 2021. All observations and recommendations relate to the situation 
as of that date. 

The IAS recognised the in-depth knowledge, experience and strong commitment of staff of DG ENV and DG 
CLIMA  in  their  day-to-day  relations  with  the  EEA  and  the  ECHA  and  the  (longstanding  and)  good  working 
relationships that have been established over time. 

The IAS identified two very important issues concerning: (1) DG ENV supervision and coordination mechanisms 
with the EEA; and (2) the oversight role of both DGs CLIMA and ENV on the EEA’s resources,  and formulated 
three very important recommendations: 

DG  ENV  supervision  and  coordination  mechanisms  with  the  EEA  (One  very  important  recommendation 
addressed to DG ENV) 

DG ENV should establish a process including a written description to monitor the progress of activities that DG 
ENV  requests  to  the  EEA,  establish  a  supervision  strategy  vis-à-vis  the  EEA  with  key  elements  and  initiate 
discussion  with  Central  services  to  find  ways  to  strengthen  the  coordination  with  other  DGs  requesting 
activities to the EEA. 

Oversight  role  of  both  DGs  CLIMA  and  ENV  on  the  EEA’s  resources  (Two  very  important  recommendations 
addressed to DG CLIMA and DG ENV) 

DG  ENV  and  DG  CLIMA  should  enhance  controls  and  guidance  for  the  preparation  of  the  financial  fiches, 
strengthen the coordination with other Commission  services and clarify roles and responsibilities for shared 
projects  at  the  planning  stage,  including  to  the  extent  possible  the  financing  sources  to  ensure  optimal 
financing practices. 

Additional  information  provided  by  DG  CLIMA  and  DG  ENV  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

DG CLIMA and DG ENV have coordinated an action  plan,  to be implemented by the end of 2022. It notably 
aims  at  enhancing  controls  on  the  ‘financial  fiches’  requesting  resources  for  the  EEA,  strengthening  the 
structured  dialogues between  DG  ENV,  DG  CLIMA  and  the  EEA,  better coordinating  EEA  activities with  other 
Commission services, and preparing guidance on the financing of non-core activities.  

Work on the implementation of these recommendations has started. In particular, a ‘structured dialogue’ has 
been established between DG ENV, DG CLIMA and the EEA with Senior Management meetings twice a year to 
discuss  strategic  priorities  in  terms  of  the  EEA  support,  in  a  context  of  increasing  demands  and  limited 
resources. An ‘Intergroup’ (DG ENV – CLIMA – EEA) has been created for implementing such a strategy.   

8 

 
In addition, a permanent Inter-Service Group (ISG) has been established to strengthen the coordination with 
other DGs regarding EEA activities. In the context of the European Green Deal, more and more DGs request 
support and have agreements with the EEA (in total, 12  ongoing or foreseen agreements between EEA and 
other Commission services have been identified). The ISG will also be consulted for the evaluation of the EEA 
and for drafting the Commission Opinion on the agency Programming Documents.   

1.3.  Limited review on the error rate calculation (DG DEFIS, DG GROW)  

The objective of the limited review was to check the correctness of the calculation of the error rates by DG 
DEFIS and DG GROW and of the disclosure in their Annual Activity Reports.  

The IAS did not formulate any critical or very important recommendations. 

1.4.  Audit  on  crisis  communication  (DG  COMM,  DG  ECHO,  DG  SANTE, 

SG) 

The objective of the audit was to assess whether the Commission has put in place an adequate internal 
control system that is effective and efficient for communication during a crisis. 

There was no observation/reservation in the 2020 Annual Activity Reports of DG COMM, DG ECHO, DG SANTE 
and SG on crisis communication that relate to the area/process audited. 

The fieldwork was finalised on 22 July 2021. All observations and recommendations relate to the situation as 
of that date. 

The IAS acknowledged the commitment of the Commission’s communication community at large, which was 
visible during the multi-sectoral COVID-19 pandemic crisis when they managed extra tasks under high 
workload and tight deadlines, while at the same time adapting to novel working conditions. 

The IAS did not formulate any critical or very important recommendations. 

1.5.  Audit  on  delegations  and  efficiency  of  decision  making  in  the 
European  Joint  Undertaking  for  ITER  and  the  Development  of 
Fusion  for  Energy  and  cooperation  mechanisms  with  DG  ENER 
(DG ENER) 

The objective of the audit was to assess the adequacy of the design and the effective implementation of 
F4E’s internal control processes for financial circuits and financial delegations and deputising arrangements 
for its key operational processes. Furthermore, the audit assessed DG ENER’s and F4E’s cooperation and 
supervision mechanisms. 

The fieldwork was finalised on 30 September 2021. All observations and recommendations relate to the 
situation as of that date. 

The IAS recognised the DG ENER’s efforts to supervise Fusion for Energy (F4E). In particular: 

 

The supervision of F4E is carried out at the highest management level. Regular meetings are held 
between the Deputy Director-General and the Director of F4E. 

9 

 
 

The current supervision strategy for F4E provides a division of tasks between responsible units and a 
timeline for the main annual supervision activities (thus going beyond the guidance template 
provided by the Secretariat-General of the Commission). 

The IAS did not address any critical or very important recommendations to DG ENER. 

1.6.  Audit  on  interruptions,  suspensions  and  financial  corrections  for 
the  European  Structural  and  Investment  Funds  2014-2020  (DG 
EMPL, DG MARE, DG REGIO) 

The objective of the audit was to assess the adequacy of the design and the effective implementation of: (1) 
preventive  measures:  interruptions  and  suspensions  mechanisms;  and  (2)  corrective  measures:  financial 
correction processes applied by DG REGIO, DG EMPL and DG MARE to protect the EU budget. 

As regards reporting in the Annual Activity Reports, reservations were made by DG REGIO, DG EMPL and DG 
MARE for deficiencies in the management and control systems of a number of operational programmes which 
affect the legality and regularity of the payments concerned. 

The  fieldwork  was  finalised  on  31  October  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS identified a number of good practices that the Directorates-General apply in their management of the 
interruptions, suspensions and financial corrections processes: 

 

 

The dedicated SharePoint site for the Interruptions, suspensions and financial  corrections committee 
in  DG  REGIO,  the  presentation  of  the  committee’s  proceedings,  the  library  of  the  supporting 
documents and the monitoring tables available for both preventive and corrective measures facilitate 
an easy access to all relevant information on the decisions made and the status of specific cases. 

The  DG  REGIO  Wiki  tool,  an  online  library  of  the  procedures,  guidelines  and  explanatory  materials 
available for all users, is a best practice. 

  During  our  testing  we  noted  cases  of  very  good  cooperation  and  coordination  of  actions  between 
desk officers and auditors, both inside and across Directorates-General, especially in the context of 
strict legal deadlines that are applicable to preventive measures. 

 

The creation of the joint audit directorate is a catalyst for harmonising and streamlining the internal 
procedures for applying preventive and corrective measures and the role of the audit units. 

The IAS identified three very important issues concerning: (1) preventive measures - key criteria for preventive 
measures; (2) preventive measures - warning letters and (3) corrective measures - financial corrections, and 
formulated eight very important recommendations: 

Preventive measures - key criteria for preventive measures (Two very important recommendations addressed 
to DG EMPL, DG REGIO) 

For  the  2014-2020  programming  period,  DG  REGIO  and  DG  EMPL  should  ensure  that  the  use  of  the  10% 
threshold to interrupt payments is clearly explained in the related guidance, as well as how this links to the 
acceptance  of  accounts  process  and  subsequent  financial  corrections,  both  in  terms  of  the  underlying 
rationale  and  the  choice  of  this  particular  threshold  level.  In  this  context,  the  Directorates-General  should 
assess the need to revise the criteria for deciding on interruptions as part of a proactive response from the 
Commission  to  protect  the  budget  and  include  an  analysis  in  their  Annual  Activity  Reports  of  the  resulting 
impact on persistently high error rates.  

10 

 
For the 2021-2027 programming period, DG REGIO and DG EMPL should re-assess and explain clearly in the 
related guidance the underlying rationale for interrupting  payments taking into account different thresholds 
for retention of interim payments (5% instead of 10%) under the 2021-2027 period and include an analysis 
in their Annual Activity Reports on the possible impact on persistently high error rates. 

Preventive  measures  -  warning  letters  (Three  very  important  recommendations  addressed  to  DG  EMPL, 
DG REGIO) 

DG REGIO and DG EMPL should evaluate the effectiveness of warning letters sent in case a payment request 
was received (i.e. warning letters for corrective measures), manage more rigorously the process of issuing and 
following-up on warning letters and include an analysis in their Annual Activity Reports of the resulting impact 
on persistently high error rates. 

DG EMPL should set deadlines for initiating the internal process by geographical units for deciding on warning 
letters. 

Corrective  measures  -  financial  corrections  (Three  very  important  recommendations  addressed  to  DG  EMPL, 
DG MARE, DG REGIO) 

DG  REGIO,  DG  EMPL  and  DG  MARE  should  update  their  guidance  and  operational  procedures  on  financial 
corrections  to  set  internal  deadlines  for  the  key  steps  of  the  financial  corrections  process.  The  guidance 
should  be  updated  to  take  into  account  all  relevant  Legal  Service  opinions,  including  on  net  financial 
corrections.  The  Directorates-General  should  use  a  simple  document  (e.g.  a  checklist,  flow  chart)  listing  all 
requirements for pursuing net financial corrections and thereby document whether these conditions were met 
for  each  potential  case.  Finally,  the  Directorates-General  should  provide  a  clearer  explanation  in  their 
respective  Annual  Activity  Reports as regards the  legal  constraints in  applying  net  financial  corrections,  link 
this  clearly  to  the  fact  that  no  such  corrections  have  been  applied  in  practice  for  the  2014-2020 
programming period, and analyse the impact on the Commission’s corrective capacity. 

Additional  information  provided  by  DG  REGIO,  DG  EMPL  and  DG  MARE  on  the  measures  defined 
and/or implemented following the Internal Audit Service audit 

DG REGIO and DG EMPL will update the guidance note on interruptions and clearly explain in a guidance note 
the  use  and  impact  of  the  10%  threshold  to  interrupt  payments,  its  link  with  the  acceptance  of  accounts 
exercise  and  with  the  subsequent  potential  financial  correction  procedure.  The  criteria  for  deciding  on 
interruptions will also be reviewed in the light of persisting material levels of error reported by the ECA for the 
cohesion area. An evaluation of the effectiveness of warning letters for corrective measures will be made. The 
financial corrections manual will be updated. In the AAR 2021 a more comprehensive explanation on the net 
financial  corrections  instrument  is presented  highlighting  legal  constraints and challenges in  the  application 
and the impact on the Commission’s corrective capacity.   

DG MARE will update its financial corrections manual, and ensure consistency with those issued by DG REGIO 
and DG EMPL. 

1.7.  Audit on the preparation for the 2021-2027 programming period 

(DG EMPL, DG MARE, DG REGIO) 

The  objective  of  the  audit  was  to  assess  whether  DG  REGIO,  DG  EMPL  and  DG  MARE  had  designed  and 
implemented effective processes to support the start of the 2021-2027 programming period. 

11 

 
 
As  the  legislation  for  the  2021-2027  period  was  formally  adopted  in  2021,  in  their  2020  Annual  Activity 
Reports,  DG  REGIO,  DG  EMPL  and  DG  MARE  did  not  issue  a  reservation  specifically  on  the  2021-2027 
programming period.  

The  fieldwork  was  finalised  on  24  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS recognised the ongoing efforts made by DG REGIO, DG EMPL and DG MARE to effectively prepare for 
the  2021-2027  programming  period.  The  IAS  identified  the  following  strengths  and  good  practices  in  this 
area: 

  DG  REGIO’s  2021-2027  Programming  Negotiations  Progress  Reports:  regular  reports  are  prepared 
for the attention of the Board of Directors outlining the overall progress in the negotiations and the 
main issues arising during the latter to be flagged. The content of the report has evolved over time 
and is now very comprehensive covering different areas and topics relevant during the programming 
process.  Launch  of  the  2021-2027  programming  period:  based  on  the  experience  of  the  previous 
programming  period,  the  2021-2027  negotiations’  process  was  launched  on  time  in  2019  and 
subsequent coordination arrangements were decided and put in place by DG REGIO. 

  Coordination arrangements: the IAS welcomed the initiative of DG REGIO: (1) to engage the Common 
Provisions Regulation Directorates-General (and the SG country team leaders) in the discussions with 
information;  (2)  to  organise  coordination 
level 
Member  States  on  partnership  agreement 
arrangements  between  Directorates-General  timely  and  early  in  the  process  of  the  programming 
period; (3) to seek cooperation with other Directorates-General and services not part of the Common 
Provision Regulation family, e.g. DG AGRI, DG ENV. 

 

Stock  Taking  Group:  the  Stock  Taking  Group  is  an  important  tool  for  cooperation  between  the 
Commission  services  for  the  phases  of  informal  and  formal  dialogue  with  Member  States.  This 
includes  discussion  on  common  issues,  deciding  on  the  most  appropriate  solutions  for  the 
participating  Directorates-General,  information  sharing  as  regards  on-going  initiatives  on  joint 
planning. All Common Provisions Regulation Directorates-General (DG REGIO, DG EMPL, DG MARE and 
DG  HOME)  participate  actively  and  regularly  in  the  Group’s  meetings  and  the  Directorates-General 
have  made  efforts  to  incorporate  DG  HOME,  which  became  part  of  the  Common  Provisions 
Regulation family only as from the 2021-2027 programming period. 

The IAS identified two very important issues concerning: (1) support to Member States in the preparation of 
the 2021-2027 programming period (deficiencies in procedures to provide guidance for Member States); and 
(2)  timing  of  the  preparation  and  operational  start  of  the  2021-2027  programming  period  (delays  in 
launching 
important 
recommendations: 

internal  reporting)  and  formulated  seven  very 

IT  system  and  frequency  of 

Support  to  Member  States  in  the  preparation  of  the  2021-2027  programming  period  (Two  very  important 
recommendation addressed to DG REGIO) 

DG REGIO should: 

 

Establish a clear procedure for issuing ‘non-guidance documents’ (including the identification of the 
process  owner,  the  purpose  and  scope  of  these  documents,  the  procedure  for  preparation, 
consultation and adoption of such documents) and implement this procedure consistently.  

  Make all guidance and non-guidance documents addressed to Member State authorities responsible 

for programming, implementation and audit available in a common repository. 

DG REGIO should make all internal guidance and non-guidance documents related to the Common Provision 
Regulation  accessible  to  all  Common  Provision  Regulation  Directorates-General  desk  officers  in  a  common 
repository (i.e. REGIO Wiki). 

12 

 
Timing of the preparation and operational start of the 2021-2027 programming period (Five very important 
recommendations addressed to DG EMPL, DG MARE, DG REGIO) 

DG REGIO, DG EMPL and DG MARE should: 

 

 

Improve the communication and coordination between the structural funds common database team 
(SFC)  and  the  Common  Provisions  Regulation  Directorates-General  to  identify  elements  where  a 
common  approach  is  needed  in  SFC  2021  (in  particular  for  future  development  of  SFC  2021 
modules, such as payments to programmes or the reporting obligations).  

Ensure  the  participation  of  all  Common  Provisions  Regulation  Directorates-General  in  the 
development and finalisation of the checklist for the assessment of the horizontal enabling condition 
on the Charter of Fundamental Rights. 

 

Improve their internal reporting system to senior management. 

DG REGIO should finalise and upload the Interreg checklist for programmes assessment and upload in Wiki 
(and later on, when filled in, in MyWorkplace). 

DG EMPL should develop a financial checklist to support the relevant units in their checks while the validations 
rules in SFC 2021 are not yet fully operative. 

Additional  information  provided  by  DG  REGIO,  DG  EMPL  and  DG  MARE  on  the  measures  defined 
and/or implemented following the Internal Audit Service audit 

DG  EMPL  agreed  on  an  action  plan  with  the  IAS.  All  important  recommendations  have  been  implemented, 
including improvement of communication and coordination between the SFC Team and the Common Provision 
Regulation DGs as well as of the internal reporting system to the senior management, and the production of 
financial  checklists.  The  important  recommendation  concerning  clear  procedures  for  “non  guidance 
documents” will be implemented in accordance with the time limits (end June 2022) as indicated in the action 
plan. 

DG  MARE  has  implemented  the  actions  related  to  the  most  important  recommendations,  notably  the 
improvement  of  communication  and  coordination  between  the  SFC  Team  and  the  Common  Provisions 
Regulation  DGs  as  well  as  the  internal  reporting  system  to  the  senior  management,  and  the  production  of 
financial checklists. 

DG  REGIO  is  preparing  a  clear  procedure  for  issuing  (non-)  guidance  documents  and  creating  a  common 
repository of documents on the REGIO Wiki extranet accessible for the national authorities implementing the 
policy.  In  addition,  REGIO  further  improved  the  communication  and  coordination  between  SFC  Team  and 
Common  Provisions  Regulation  DGs  and  increased  reporting  frequency  to  senior  management,  including  on 
country specific issues. 

1.8.  Audit  on  governance,  stakeholder  management  and  external 
communication  in  the  European  Border  and  Coast  Guard  Agency 
comprising where relevant DG HOME 

The objective of the audit was to assess the adequacy of the design and the effective implementation of the 
governance  structure  and  arrangements  in  Frontex,  and  DG  HOME’s  oversight  role  and  responsibilities  as 
concerns Frontex. 

13 

 
 
The 2020 Annual Activity Report of DG HOME (2.1.5 Declaration of Assurance and reservations) comprises the 
following reservation, which relates to the areas and processes audited: 

‘Reservation  on 
the  effective 
implementation  of  Frontex’s  new  mandate  in  accordance  with  good  governance  and  the 
requirements of the European Border and Coast Guard Regulation.’ 

reputational  grounds 

to  weaknesses 

identified 

related 

in 

The  fieldwork  was  finalised  on  16  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS recognised the ongoing efforts of DG HOME to improve its oversight controls in Frontex. In particular, 
the IAS noted the following strengths: 

Frontex  Support  Group  Meetings  –  In  May  2021,  DG  HOME  put  in  place  a  new  process  aimed  at  ensuring 
internal coordination between the different units dealing  with Frontex-related topics.  Held every two weeks, 
the Frontex Support Group Meetings enable DG HOME staff to discuss those topics in an efficient manner by, 
for example: (1) providing updates on the state of play, with Directorate B briefing other directorates about 
relevant  information,  e.g.  following  Frontex’s  management  board  meetings;  (2)  discussing  current  priorities 
with  regard  to  the  Agency;  and  (3)  proving  inputs  to  letters  received  from  Frontex  and  discussing  the 
corresponding replies. 

The IAS did not formulate any critical or very important recommendations. 

14 

 
2.  Agriculture, natural resources and health 

2.1.  Audit  on  support,  monitoring  and  checks  of  the  work  of 

Certification Bodies (DG AGRI) 

The  objective  of  the  audit  was to  assess  whether the  measures  taken  by  DG  AGRI  to  support,  monitor and 
check  the  work  of  Certification  Bodies  are  adequately  designed  and  effectively  implemented  to  allow  it  to 
draw the necessary assurances from their work. 

There  were  no  observations/reservations  in  the  2019  Annual  Activity  Report  of  DG  AGRI  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  26  February  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS acknowledged the ongoing efforts made by DG AGRI to improve the implementation of the measures 
taken  to  support,  monitor  and  check  the  work  of  Certification  Bodies.  In  particular,  the  audit  identified  the 
following strengths: 

 

Enhanced coordination within Directorate H vis-à-vis Certification Body audit activities. DG AGRI.H has 
enhanced  coordination  between  audit  units  as  regards  audit  activities  on  Certification  Bodies  (e.g. 
through  the  creation  of  the  peer  review  group  or  specific  trainings  provided  by  AGRI.H.5  to  other 
Directorate H audit units).  

  DG  AGRI  has  incorporated  the  Certification  Body  risk  in  its  central  risk  analysis.  In  2019,  DG  AGRI 
reviewed its central risk analysis to include an additional risk factor linked to the risk of ‘insufficient 
or inadequate audit work by the Certification Body’. This new risk factor was used for the first time in 
the  2020-2023  multi-annual  work  programme  and  reflects  the  extended  role  given  to  the 
Certification Bodies by the 2013 horizontal regulation. 

The IAS did not formulate any critical or very important recommendations. 

2.2.  Audit on monitoring and supervision arrangements regarding land 

parcel identification system in Member States (DG AGRI) 

The objective of the audit was to assess the adequate design and effective implementation of the controls 
put in place by DG AGRI to support the management of Member States land parcel identification systems and 
to monitor their quality. 

There  are  no  reservations  in  the  2020  Annual  Activity  Report  of  DG  AGRI  that  relate  to  the  land  parcel 
identification system (LPIS) quality assessment (QA) process audited. 

The fieldwork was finalised on 3 August 2021. All observations and recommendations relate to the situation 
as of that date. 

The IAS acknowledged a number of strengths: 

 

The commitment, dedication and highly technical expertise of the staff within AGRI.D3 (unit AGRI.C1 
since 16 January 2022) involved in the land parcel identification system quality assessment exercise. 

15 

 
 

The efforts made by AGRI.D3 (unit AGRI.C1 since 16 January 2022), in cooperation with the JRC, to 
provide highly detailed and technical guidance to the Member States via the WikiCAP website. 

The  IAS  identified  one  very  important  issue  concerning  the  monitoring  and  follow-up  of  the  land  parcel 
identification system quality assurance exercise and formulated one very important recommendation: 

Regular analyses of the land parcel identification system quality assurance exercise 

DG AGRI should, on an annual basis, perform a global analysis of the outcome of the land parcel identification 
system quality assurance exercise and report on it to internal and external stakeholders. Moreover, in order to 
improve the monitoring of the land parcel identification system quality assurance, DG AGRI should perform a 
regular qualitative in-depth analysis of the assessment reports (in cooperation with other relevant services), 
an  annual  assessment  of  the  remedial  action  plans  based  on  agreed  criteria  and  put  in  place  working 
arrangements to systematically follow up identified remedial actions. Finally, DG AGRI should set up regular 
dedicated  internal  meetings  and  reporting  arrangements  regarding  the  land  parcel  identification  system 
quality assurance exercise. DG AGRI  should also improve  communication and coordination between AGRI.D3 
(unit AGRI.C1 since 16 January 2022) and AGRI.H3 to increase efficiency and synergies, whilst respecting the 
specific roles and mission of the two units. 

Additional  information  provided  by  DG  AGRI  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

DG  AGRI  accepted  the  recommendation  and  submitted  an  action  plan  that  was  assessed  as  satisfactory  to 
mitigate the risks identified by the IAS. The recommendation is due for 30 June 2022.  

DG AGRI committed to implement the following actions for the very important recommendation: 

1. 

2. 

Develop  a  template  for an  “annual  state  of  play  note  of  the  land  parcel  identification  system  (LPIS) 
quality assessment (QA)” for AGRI hierarchy and relevant units. A summary of this note will be shared 
with Member States at the nearest Committee meeting. 

a)  In  cooperation  with  other  relevant  services,  e.g.  the  JRC,  DG  AGRI  will  develop  and  describe  the 
methodology of a more in-depth analysis of LPIS QA reports. This analysis will be done every 3 years. 
The most recent  results of this exercise  will feed in and be summarised in the “annual state of play 
note of LPIS QA”. b) perform regular in-depth qualitative analyses of the assessment reports (ARs) in 
cooperation with other relevant services (e.g. JRC), an annual assessment of the remedial action plans 
(RAPs)  based  on  agreed  criteria  and  put  in  place  working  arrangements  to  systematically  follow  up 
identified remedial actions.  

DG AGRI has already implemented two actions, still to be confirmed by the IAS: 

1. 

2. 

DG AGRI developed a template for the annual state of play of LPIS QA. 

b) DG AGRI prepared three documents: a documentation on the  criteria used for the evaluation of the 
remedial  action  plans  and  criteria  for  follow-up;  a  template  for  the  evaluation  of  the  remedial  action 
plans  and  a  template  for reporting  on  the  status  of  the  remedial  action  that  will  serve  for  the  annual 
state of play of LPIS QA reports. 

16 

 
3.  Cohesion 

3.1.  Audit  on  processes  put  in  place  for  the  delivery  of  technical 

support to Member States (DG REFORM) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  effective  implementation  of  DG 
REFORM’s  processes  and  controls  for  delivering  technical  support  projects  carried  out  under  the  Structural 
Reform Support Programme. 

Reservations were raised in the 2017-2020 Annual Activity Reports on the rate of the residual error that was 
calculated under direct grant management – in the 2020 Annual Activity Reports, the reservations concerned 
grant agreements signed with non-pillar assessed beneficiaries under the technical support funds (European 
Structural  and  Investment  Funds  and  Structural  Reform  Support  Programme)  for  which  the  legality  and 
regularity-related criterion of 2% was breached. It is to be noted that the reservation was lifted in the 2021 
Annual Activity Report in application of the “de minimis” rule. 

The  fieldwork  was  finalised  on  21  October  2021.  All  observations  and  recommendations  relate  to  the 
situation as at that date. 

The  IAS  recognised  the  ongoing  efforts  made  by  DG  REFORM  to  improve  the  design  of  individual  projects 
under the SRSP programme and to strengthen the monitoring of their implementation. The IAS identified the 
following strengths and good practices in these areas: 

 

 

 

Policy officers are very knowledgeable about the available delivery means for implementing technical 
support  projects  and  the  established  processes  enable  the  selection  of  appropriate  delivery 
means/sub-tasks in each case. 

Existing  controls  ensure  that  the  reprogramming  of  the  projects  (i.e.  the  change  of  key  aspects  of 
projects) and amendments of the underlying individual contracts/grant agreements comply with the 
applicable rules. 

The recently reinstated JIRA (a project monitoring tool) correspondents’ network provides a platform 
for structured discussions on JIRA user needs and developments between operational units and the 
horizontal unit A2 which is responsible for JIRA. 

The IAS identified one very important issue concerning the project preparation and monitoring: tools, guidance 
and practices and formulated one very important recommendation: 

Project preparation and monitoring: tools, guidance and practices 

DG REFORM should: 

 

 

 

 

Finalise the e-manual of procedures and the revised JIRA workflows. 

Provide  a  common  information  technology  solution  for  monitoring  the  project  implementation  that 
will assist the responsible officers in their daily tasks. 

Persist in current efforts to improve the completeness and reliability of project data encoded in JIRA 
(e.g. through providing training courses and communication activities to the responsible officers). 

Put in place a robust tool for performing effective plagiarism checks on project deliverables. 

17 

 
Additional  information  provided  by  DG  REFORM  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

DG REFORM accepted all the recommendations received and submitted an action plan that was assessed as 
satisfactory to mitigate the risks identified by the IAS. The action plan has started with implementation at the 
latest by 30 June 2023.  

18 

 
 
4.  Research, energy and transport 

4.1.  Audit  on  support,  monitoring  and  enforcement  of  the  existing 

energy ‘acquis’ (DG ENER) 

The objective of the audit was to assess whether DG ENER has put in place an internal control system that 
ensures an effective and efficient support, monitoring and enforcement of EU energy law application. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  ENER  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  11  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS recognised the ongoing efforts made by DG ENER regarding the support, monitoring and enforcement 
of the energy acquis and identified the following strengths: 

  As regards the organisation, DG ENER staff responsible for the support, monitoring and enforcement 
of the energy acquis are knowledgeable and motivated, and have accumulated valuable experience 
in the legal energy field. In line with best practices highlighted in the coherence exercise, the same 
staff responsible for policy development are also responsible for the monitoring and enforcement of 
its implementation. 

 

There is good cooperation internally between the sectorial units and the Planning and Legal Affairs 
unit, as well as externally with key  stakeholders in  policy implementation (Member States, national 
regulators, supervisory agencies, etc.). Additionally, the Directorate-General has established effective 
cooperation with its Cabinet, which is systematically consulted on any key decision regarding new EU-
Pilot  dialogues  and  infringement  cases,  and  for  the  final  approval  of  proposals  for  infringement 
cases to be submitted for a decision at the College’s infringement cycle .  

  Before the entry into force of the energy legislative initiatives, there is proactive support to Member 
States,  as  well  as  regular  dialogue  and  effective  communication  with  Member  States  and  key 
stakeholders  regarding  challenges,  conflicts  of  interpretation  and  other  issues  identified  in  the 
implementation of the policy. This is used as lessons learnt for policy development. 

The  IAS  identified  one  very  important  issue  concerning  the  management  supervision  for  the  reporting  and 
verification  of  compliance  assessment  results  for  the  transposition  of  Directives  and  formulated  one  very 
important recommendation: 

Management supervision for the reporting and verification of compliance assessment results 

DG  ENER  should  develop  guidance  on  the  compliance  assessment  process and  define  the  requirements  for 
formal documentation of the compliance checks, including the verification of the assessment reports prepared 
by  external  contractors  and  the  basis  for  recommending  specific  enforcement  actions  on  detected  issues. 
Also,  it  should  ensure  and  document  adequate  management  supervision  of  the  compliance  assessment 
process. 

Additional  information  provided  by  DG  ENER  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

For implementation of the recommendation DG ENER has committed to: 

  Establish additional guidance on the compliance assessment process. 

19 

 
  Define the requirements for formal documentation of the compliance checks. 

  Develop  a  more  effective  and  documented  management  supervision  of  the  compliance  assessment 

process. 

4.2.  Consulting  on  supervision  of  the  Energy  Community  Secretariat 

(DG ENER) 

The  objective  of  the  consulting  engagement  was  to  propose  improvements  in  DG  ENER’s  processes  for 
supervising  the  Secretariat,  including  through  modifications  in  the  financial  and  staff  rules  of  the  Energy 
Community Secretariat. 

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion 
and  no  formal  recommendations  were  issued.  Instead,  the  report  contained  issues  for  consideration.  Their 
effective implementation will not be formally followed up by the IAS. 

4.3.  Audit on H2020 grant management - phase III, including scientific 

management for longer duration projects (ERCEA) 

The  objective  of  the  audit  was  to  assess  the  effectiveness  of  the  ex  ante  controls  on  the  H2020  grant 
payments  in  ERCEA,  and  their  contribution  to  the  assurance  on  the  legality,  regularity  and  sound  financial 
management of the related expenditure. 

There  are  no  observations/reservations  in  the  2020  annual  activity  report  of  ERCEA  relating  to  the 
area/process  audited.  The  fieldwork  was  finalised  on  15  May  2021.  All  observations  and  recommendations 
relate to the situation as of that date. The IAS acknowledged the efforts made by ERCEA in ensuring effective 
implementation  of  ex  ante  controls  on  H2020  grant  payments  in  the  context  of  an  increasing  workload.  In 
particular, ERCEA has a strong control environment and has applied the following good practices: 

 

 

The project officers produce a note to the file for every interim/final payment. This note summarises 
all  information  related  to  reviews  of  audits,  amendments,  outcome  of  the  mid-term/final  scientific 
reports, outcomes of previous interim periods and principal investigator’s time commitment reports. 
This note allows ERCEA to monitor the progress of a project during its lifetime; 

ERCEA has proactively reacted in response to the COVID-19 pandemic. In particular, by establishing a 
COVID-19 task force comprising representatives of each unit and providing an analysis of the impact 
of COVID-19 on ERCEA’s activities. 

  Unlike the other bodies implementing H2020, ERCEA carries out the scientific reviews mostly with its 
own staff and does not often use external experts. This allows flexibility to adapt the planning and 
cope  with  the  workload,  as  the  scientific  review  is  not  depending  on  the  availability  of  expert 
management. 

The IAS did not formulate any critical or very important recommendations. 

20 

 
4.4.  Audit  on  support,  monitoring  and  enforcement  of  the  transport 

‘acquis' (DG MOVE) 

The objective of the audit was to assess whether DG MOVE has put in place an internal control system that 
ensures effective support, monitoring and enforcement of EU transport law application. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  MOVE  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  10  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The  IAS  recognised  the  ongoing  efforts  made  by  DG  MOVE  regarding  the  support,  monitoring  and 
enforcement of the transport acquis, and identified the following strengths: 

  Since  its  establishment,  DG  MOVE  has  deployed  an  infringement  cell  in  the  coordination  Unit  A.4 
‘Legal  issues  &  enforcement’  to  support  the  line  units  on  all  procedural  aspects  related  to  the 
processing of complaints, EU-Pilot cases and infringements, including the monitoring of the state of 
play.  This  cell  participates  in  the  Secretariat-General-led  discussions  on  the  definition  of  the 
Commission’s  enforcement  and  monitoring  policy.  Unit  A.4  also  has  a  legal  cell  that  provides 
substantive  legal  advice  to  case  handlers  on  all  enforcement  cases  (i.e.  CHAP 4,  EU-Pilot  and 
infringements). Both cells communicate continuously and cooperate constructively on monitoring and 
enforcement of EU transport legislation with the line units. 

  DG MOVE set up a CHAP coordinator in October 2019 to supervise the registration and assignment of 
complaints to the relevant line unit, and to regularly remind the line units to respect the obligation to 
notify  the  complainant.  The  CHAP  coordinator  is  one  of  the  members  of  the  infringement  cell  and 
also provides substantive advice on the drafting of letters to complainants.  

 

In 2016, DG MOVE put in place a comprehensive Vade Mecum on infringements, aiming at bringing 
together  all  the  key  elements  relevant  to  the  Directorate-General’s  compliance  assessment  of 
directives  and  management  of  complaints,  EU-Pilot  cases  and  infringements.  The  document 
describes  the  internal  controls  performed  during  the  different  phases  of  the  process of  monitoring 
and enforcing EU transport legislation, as well as the actors involved. The Vade Mecum is regularly 
updated to take into account specific needs identified at Directorate-General level and any changes 
in the procedures decided at central level.   

The IAS did not formulate any critical or very important recommendations. 

4.5.  Audit on SEDIA implementation (REA) 

The objective of the audit was to assess whether the Single Electronic Data Interchange Area (SEDIA)-related 
services  by  REA  are  provided  in  an  effective  and  efficient  manner,  in  compliance  with  the  applicable 
regulations, and as agreed between the parties. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  REA  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  27  September  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

4 

Information technology system for complaints handling. 

21 

 
                                                        
The IAS acknowledged the following strengths: 

 

The  results  of  the  Central  Validation  Service  clients’  survey  conducted  by  the  IAS  in  the  context  of 
this audit show a high satisfaction rate (92%) of REA’s clients. 

  SEDIA  is  implemented  by  knowledgeable  and  committed  staff  in  the  Central  Validation  Service. 
Furthermore, a good collaboration between REA and DG BUDG and the effectiveness of the controls 
performed by REA has enabled DG BUDG to reduce its controls on legal validations, moving from a 
systematic verification to a sampled-based one. 

  REA implements effective controls on legal and financial validation and verification services despite 
recurrent  and  significant  delays  in  the  delivery  of  information  technology  components  for  the 
upgrade of the participant data management (PDM) information technology system. 

The IAS identified two very important issues concerning: (1) personal data protection and access to personal 
data  and;  (2)  delivery  of  information  technology  components  and  formulated  two  very  important 
recommendations: 

Personal data protection and access to personal data 

REA should review the information provided to the participants in order to clarify that identity documents can 
only be uploaded in the folder ‘identity documents’. In addition, it should assess with the service provider the 
feasibility  of  implementing  automated  controls  on  the  documents  uploaded  by  the  participants,  review  the 
existing documents uploaded in PDM and remove those that include personal data. Finally, REA should finalise 
and  endorse  the  internal  implementing  rules  for  personal  data  management  and  access  to  PDM  for  the 
Central Validation Service. 

Delivery of IT components 

REA  should,  in  the  short  term,  prepare  a  plan  for  the  remaining  information  technology  developments, 
including detailed milestones and deliverables and a narrative of the expected improvements, and submit it to 
the Grant and Procurement Steering Board for endorsement. In the mid-term, REA should perform a high-level 
analysis,  together  with  DG  Budget,  the  Common  Implementation  Centre  and  DG  DIGIT  on  either:  (1)  the 
potential integration/interface of PDM by/with SUMMA5; or (2) developing a new PDM tool as part of the new 
generation  of  eGrants/eProcurement  suite,  and  submit  it  to  the  Grant  and  Procurement  Steering  Board  for 
decision. 

Additional  information  provided  by  REA  on  the  measures  defined  and/or  implemented  following 
the Internal Audit Service audit 

REA accepted all the IAS recommendations. 

According to the action plan accepted by the IAS, the following actions will be taken. In respect to improving 
the protection of personal data in SEDIA: 

-  REA  will  provide  to  DG  DIGIT  the  updated  information  to  be  visible  to  the  participants  in  the  Participant 
Register, in the form of a pop-up window. 

5 

The new European Commission’s information system for budget and accounting. 

22 

 
                                                        
- REA will request from DG DIGIT to perform a common assessment on the technical possibilities of the PDM 
tool  to  determine  the  feasibility:  to  implement  automated  controls  on  the  documents  uploaded  by  the 
participants  that  detect  in  particular  identity  documents;  and  to  review  the  existing  documents  uploaded  in 
PDM and remove those that include personal data, where not required. The results of these assessments will 
be  discussed  with DIGIT in order  to  reach a common  position on the technical  possibilities of implementing 
these control features. 

-  REA’s  Central  Validation  Service  will  finalise  and  endorse  a)  the  internal  implementing  rules  for  personal 
data management and b) the document on access to PDM for the Central Validation Service. 

In respect to improve the timely delivery of IT components by DG DIGIT, REA will: 

-  Prepare  together  with  DG  DIGIT  a  plan  for  the  remaining  IT  developments.  The  Business  Process  Owner 
(BPO)  for  Participant  Register  will  then  submit  it  to  the  Grant  and  Procurement  Steering  Board  (GPSB)  for 
endorsement. 

-  Perform  a  high-level  analysis  recommended  by  the  IAS,  together  with  DG  BUDG,  the  Common 
Implementation  Centre  (DG  RTD)  and  DG  DIGIT,  to  be  submitted  by  the  BPO  for  Participant  Register  to  the 
GPSB for decision. 

The prospective implementation time for the recommendation is mid 2022 for the recommendation regarding 
the delivery of IT components, and end 2022 for those relating to personal data protection. 

4.6.  Audit on ‘Article 185 bodies’ (DG RTD) 

The objective of the audit was to assess whether the supervision of article 185 bodies by DG RTD is effective 
and provides the necessary assurance that the financial contribution of the European Union is compliant with 
the applicable rules.  

The audit engagement was launched in December 2020 and the preliminary survey phase, carried out in the 
first quarter of 2021, covered the five article 185 bodies under the responsibility of DG RTD.  

The evidence gathered by the IAS during the preliminary survey, during which no major weaknesses related to 
the key supervisory tools used by DG RTD (in particular the project officers’ checks for the assessment of the 
annual  reports)  were  identified,  complemented  by  the  fact  that  only  two  out  of  the  five  article  185  bodies 
under  DG  RTD  responsibility  will  continue  in  the  present  form  under  Horizon  Europe, enabled  the  IAS  to  re-
assess the inherent risks related to the design and implementation of the supervision of article 185 bodies by 
DG RTD as medium to low. 

As a result, the IAS decided to close the audit after the preliminary survey. 

The IAS did not formulate any critical or very important recommendations. 

4.7.  Limited review on the Horizon 2020 error rate calculation by the 

Common Audit Service (DG RTD) 

The objective of the limited review was to assess if the Common Audit Service effectively implemented the 
revised methodology for the calculation of the detected and residual error rates for H2020 and its disclosure 
in the 2020 Annual Activity Reports in the research and innovation family. 

There are no observations/reservations in the 2020 Annual Activity Report of Directorate-General in Research 
and Innovation (DG RTD) that relate to the area/process audited. 

23 

 
The fieldwork was finalised on 5 March 2021. All observations and recommendations relate to the situation 
as of that date. 

The IAS identified the following strengths and good practices: 

 

 

The use of information technology tools to encode audit data and in the calculation of the detected 
error rate (Microsoft  Access currently used  for the old  methodology)  makes these  procedures more 
efficient (less resources spent on performing the same tasks) and effective (less error prone). 

The  experience  and  knowledge  of  the  staff  involved  in  the  calculation  of  the  error  rates  at  the 
different  stages  of  the  process  (calculation  of  the  top-up,  of  the  detected  error  rate  through  the 
Microsoft Access database and of the residual error rate). 

The IAS did not formulate any critical or very important recommendations. 

24 

 
5.  External actions 

5.1.  Limited  review  on  the  measures  implemented  to  address  the 
error  rate  for  indirect  management  with  beneficiary  countries 
(DG INTPA) 

The objective of the limited review was to assess the adequacy and effectiveness of the actions taken by DG 
INTPA to analyse the root causes of errors detected by the Residual Error Rate study in indirect management 
with beneficiary countries contracts; the design of the measures to address them; and the implementation of 
these measures. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  INTPA  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 21 June 2021. All observations and recommendations relate to the situation 
as of that date. 

The IAS recognised the ongoing efforts made by DG INTPA to prepare and implement annually an action plan 
to address the root causes of the errors and other high risk areas, and to assess its implementation regularly. 

The IAS did not formulate any critical or very important recommendations. 

5.2.  Audit on the closure process of previous programmes - IPA I and 

ENPI (DG NEAR) 

The audit assessed the adequacy of the design and the efficient and effective implementation of the controls 
put  in  place  by  DG  NEAR  for  managing  the  closure  of  contracts  and  programmes  for  the  European 
Neighbourhood and Partnership Instrument and the Instrument for Pre Accession I. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  DG  NEAR  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  22  September  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS identified the following strengths: 

 

 

The closure checklists are clear, complete and suitable for the different management modes and, in 
our  sample,  they  were  correctly  filled-in  by  staff  responsible  for  closing  contracts  and  financing 
decisions.  

The  high  level  of  digitalisation  of  the  closure  file  (checklists,  routing  slip,  explanatory  notes,  etc.) 
provides an easily accessible audit trail. 

  Staff in both DG NEAR headquarters and EU Delegations are fully aware of the monitoring tools at 

their disposal. 

 

The key performance indicators related to closure (such as expired contracts, reduction of old ‘Reste 
à Liquider’, and the annual ‘potentially abnormal Reste à Liquider’ exercise) provide the Directorate-
General with an aggregate view on its contract portfolio on aspects relating to closure. 

The IAS did not formulate any critical or very important recommendations. 

25 

 
5.3.  Audit on IPA II grants in direct management (DG NEAR) 

The audit objective was to assess whether internal controls on the Instrument for Pre Accession (IPA) II grants 
in direct management are adequately designed and efficiently and effectively implemented to ensure legality 
and regularity of the underlying transactions. 

DG  NEAR  made  the  following  reservation  in  the  2020  Annual  Activity  Report  concerning  the  area/process 
under  the  scope  of  this  audit  engagement:  reservation  concerning  the  errors  in  expenditure  in  direct 
management  grants,  due  to  a  residual  error  rate  (3.17%)  above  2%.  The  actual  exposure  for  2020  was 
estimated at EUR 20.8 million. 

The  fieldwork  was  finalised  on  25  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The  auditors  recognised  the  ongoing  efforts  made  by  DG  NEAR  to  maintain  and  continuously  update  its 
internal control framework underpinning the legality and regularity of IPA II grants in direct management. In 
particular, the following strengths/good practices were observed: 

  Since  2001,  the  grant  selection  and  award  process  has  been  governed  by  the  ‘Practical  guide  on 
contract procedures for European Union external action’,  which is a complete and regularly updated 
body of guidance used by DG INTPA, DG NEAR and FPI. Overall, the grants in our sample conformed 
to key requirements of the guide applicable to the processes under audit. 

  DG NEAR’s manual of procedures which details the ex ante checks to be performed when processing 
the  payments.  Overall,  the  grants  in  our  sample  conformed  to  key  manual  of  procedures 
requirements. 

 

The IPA Contracts and Finance unit (NEAR.R.5) regularly  organises  meetings with staff dealing with 
finance  and  contracts  in  IPA  Delegations  and  Headquarters,  serving  as  a  platform  for  awareness 
raising on financial and control procedures and for the exchange of best practices. 

  Headquarters supervision missions to IPA Delegations have appropriate frequency and geographical 
coverage.  They  represent  a  good  monitoring  control  on  the  application  of  the  internal  control 
framework in the Delegations. 

 

The EU Delegation to Serbia and the EU Office to Kosovo established the good practice of performing 
on the spot project visits, which are carried out at least once in the lifetime of each grant by teams 
composted of both financial and operational staff. The cooperation between the Finance & Contracts 
and Operation sections may contribute to more effectively detecting ineligible costs and taking timely 
corrective measures. 

  DG  NEAR  measures  the  time  from  informing  applicants  that  they  have  been  successful  to  signing 
grant  agreement  via  key  performance  indicator  5  ‘Time  to  grant’  and  reports  on  it  in  the  Annual 
Activity Report. On this key performance indicator, DG NEAR was significantly below the maximum of 
90 days stipulated in the Financial Regulation (38.4 days in 2019 and 50.2 days in 2020). 

The IAS did not formulate any critical or very important recommendations. 

26 

 
6.  Education and citizenship 

6.1.  Audit on the preparation for the 2021-2027 programming period 

of DG HOME funds (DG HOME) 

The objective of the audit was to assess whether DG HOME has designed and put in place an effective 
internal control system in support of its preparation for the start of the 2021-2027 programming period. 

As the legislation for the 2021-2027 period was formally adopted in 2021, in its 2020 Annual Activity Report, 
DG HOME did not issue a reservation specifically on the 2021-2027 programming period. 

The fieldwork was finalised on 30 November 2021. All observations and recommendations relate to the 
situation as of that date. 

The IAS identified the following strengths in the practices followed by DG HOME: 

 

In the programming period 2021-2027, DG HOME is for the first time part of the Common Provisions 
Regulation  family.  The  IAS  acknowledges  the  involvement  of  DG  HOME  into  the  coordination 
arrangements of the other Common Provision Regulation DGs (DG EMPL, DG MARE, and DG REGIO). 
The Stock Taking Group is a long-standing well-established coordinating mechanism and remains an 
important  tool  for  the  preparation  and  the  programming  of  the  2021-2027  Multi-annual  Financial 
Framework  between  the  Commission  services  during  the  informal  dialogue  and  the  formal 
negotiations with Member States. Compared to previous programming periods where DG HOME was 
not  part  of  the  Common  Provision  Regulation  family,  DG  HOME  now  regularly  attends  the  steering 
group  meetings  and  actively  participates  in  them.  Not  only  does  DG  HOME  play  an  active  role  in 
contributing to the discussions by sharing views with other DGs via this platform, but it also adopts 
good practices already developed and implemented by the other Common Provision Regulation DGs 
in previous programming periods. 

  DG  HOME  has developed its  own tool in order to  monitor the internal progress in  programming. Its 
so-called  dashboard  is  an  Excel  spreadsheet,  published  on  the  2021-2027  programming  period 
intranet site and available to all DG HOME staff. Its Desk Officers update  it for each country on an 
ongoing basis. It aggregates information on the negotiation process for partnership agreements and 
operational  programmes  (for  DG  HOME  funds  and  other  than  DG  HOME  funds)  for  each  Member 
State.  The  dashboard  also  includes  information  on  submission  dates,  registration,  leading 
Directorates-General, ongoing internal and inter-service consultations and the latest state of play on 
the respective Member State negotiation. Thus, the dashboard provides a comprehensive overview of 
the latest status of the negotiation progress for horizontal units and desk officers from DG HOME’s 
perspective. 

The  IAS  identified  two  very  important  issues  concerning:  (1)  delays  in  work  programmes  of  the  thematic 
facility; and (2) monitoring of progress in the programming of the 2021-2027 period and reporting to senior 
management and formulated two very important recommendations: 

Delays in work programmes of the thematic facility 

DG HOME should: (1) as a matter of urgency finalise the adoption of the outstanding work programmes and 
financing  decisions  for  the  thematic  facility  2021-2022;  (2)  prepare  guidance  on  the  management  of  the 
thematic  facility  to  all  parties  involved,  e.g.  desk  officers,  members  of  the  evaluation  committees,  future 
applicants/beneficiaries. 

27 

 
Monitoring of progress in the programming of the 2021-2027 period and reporting to senior management 

DG HOME should: (1) establish an effective monitoring of the programming process in the Member State to 
ensure correct estimates about the state of play and reliable forecasts of expected submission dates of 
programmes by Member State; (2) prepare regular written reporting to senior management on the progress 
on the programming process. 

Additional  information  provided  by  DG  HOME  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

For  one  very  important  recommendation  (delays  in  work  programmes  of  the  Thematic  Facility)  DG  HOME 
implemented already the actions related to the adoption of work programmes and financing decisions for the 
Thematic  Facility  2021-2022,  and  will  fully  implement  the  remaining  action  to  provide  guidance  by  June 
2022.  

In relation to the second recommendation (monitoring of progress in the programming 2021-27 period and 
reporting to senior management) DG HOME already took actions in relation to the effective monitoring of the 
programming process in the Member States by developing a dashboard and also by reporting weekly to senior 
management. The full implementation of this recommendation is foreseen by June 2022. 

28 

 
7.  Economic and financial affairs 

7.1.  Audit on preparedness of the Competition programme (DG COMP) 

The  objective  of  the  audit  was  to  assess  whether  DG  COMP  has  put  in  place  an  adequate  framework  to 
prepare  for  the  Competition  programme  under  the  2021-2027  multi-annual  financial  framework  and  has 
adequately designed the elements necessary for its implementation. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  COMP  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  18  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS recognised the efforts made by DG COMP to establish and improve its internal processes in order to 
prepare  for  the  adoption  and  implementation  of  the  Competition  programme.  In  this  respect,  DG  COMP 
developed a monitoring system for the procurement of studies called the ‘traffic lights system’ which enables 
the  tracking  of  the  progress  of  planned  actions  and  their  compliance  with  the  estimated  timetable,  thus 
helping to ensure a timely implementation of the actions. The ‘traffic lights system’ is coordinated by Unit R2; 
and each Directorate is responsible for monitoring and reporting on the progress made. 

The  IAS  identified  one  very  important  issue  concerning  the  elements  for  the  implementation  of  the 
Competition programme and formulated three very important recommendations: 

Elements  for  the  implementation  of  the  Competition  programme  (Three  very  important  recommendations 
addressed to DG COMP) 

DG COMP should formally define the internal process for the implementation of the Competition programme 
covering  the  main  steps  (planning,  monitoring  and  reporting)  and  should  finalise  the  design  of  internal 
arrangements and tools which support the implementation of the programme.  

In addition, DG COMP should update the design of the specific planning and programming process to include: 
(1)  clear  steps  for  the  prioritisation  of  activities;  and  (2)  a  clear  methodology  for  the  approval  of  budget 
adjustments and subsequent budget reallocations at the programme level.  

Finally, DG COMP should define the internal Competition programme monitoring and reporting arrangements. 

Additional  information  provided  by  DG  COMP  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

An action plan to address the recommendations was submitted and agreed with the IAS in January 2022, for 
implementation by September 2022. 

7.2.  Audit  on  the  performance  of  the  treatment  of  stakeholders' 

complaints concerning the Internal Market (DG GROW) 

The objective of the audit was to assess the design and  effective implementation of DG GROW’s processes 
for treating stakeholder complaints, including compliance with existing rules and procedures and monitoring 
arrangements. 

29 

 
There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  GROW  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  15  November  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS recognised the ongoing efforts made by DG GROW to handle the increasing number of stakeholders' 
complaints  concerning  the  Internal  Market  on  a  timely  basis,  while  at  the  same  time  streamlining  and 
adjusting the relevant processes following the reorganisation which took place in the first quarter of the year. 

DG GROW has put in place procedures that address the necessary steps of the complaint handling cycle and 
which  are  aligned  with  the  relevant  corporate  guidance.  The  staff  members  involved  in  the  handling  of 
complaints are experienced and showed commitment. 

The internal communication channels enable management and staff to fulfil their responsibilities related to 
case  handling effectively. DG GROW uses standard communication channels with other actors involved (SG, 
Legal Service, associated Directorates-General, Cabinet) in line with corporate standards. 

The IAS did not formulate any critical or very important recommendations. 

7.3.  Audit on effectiveness of cooperation with external stakeholders 

(DG TAXUD) 

The  objective  of  the  audit  was  to  assess  whether  DG  TAXUD  has  set  up  and  implemented  appropriate 
management  and  control  systems  to  effectively  organise,  monitor  and  improve  the  cooperation  with  its 
external stakeholders. 

There  are  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  TAXUD  that  relate  to  the 
area/process audited. 

The  audit  covered  the  period  2020-2021.  The  fieldwork  was  finalised  on  23  November  2021  and  all 
observations and recommendations relate to the situation as of that date. 

The  IAS  recognised  the  ongoing  efforts  made  by  DG  TAXUD to  cooperate  effectively  with  its  wide  range  of 
external stakeholders and observed the following strengths in relation to the audited process: 

  Over  the  years,  DG  TAXUD  has  established  an  effective  cooperation  within  its  expert  groups  that 
contributes  to  achieving  their  mandate.  The  external  members  of  such  groups  meet  DG  TAXUD’s 
expectations in terms of effectively contributing to discussions to support the Directorate-General’s 
policy work and the achievement of the related objectives.  

  DG  TAXUD  is  striving  to  continuously  improve  cooperation  with  its  external  stakeholders  within  its 
expert groups. For instance, the Directorate-General made efforts to foster a more pro-active role of 
the  external  members  in  the  discussions  held  within  certain  groups,  and  to  embrace  the  new 
challenges  related  to  its  policy  work  (e.g.  by  including  members  from  civil  society  in  certain  expert 
groups). 

  DG  TAXUD  has  taken  actions  towards  a  better  oversight  over  the  activities  in  the  audited  area  to 
improve  their efficiency  and  effectiveness.  These  actions  include  setting  up  the  list  of  its  recurrent 
meetings,  and  the  ongoing  exercise  aiming  at  streamlining  the  numerous  groups  the  Directorate-
General interacts with. 

The IAS did not formulate any critical or very important recommendations. 

30 

 
8.  General services 

8.1.  Consulting  on  synergies  and  efficiencies 

in  procurement 

(DG COMM) 

The  objective  of  the  consulting  engagement  was  to  provide  advice  to  DG  COMM’s  management  in  further 
achieving synergies and efficiencies in procurement and the related financial management. 

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion 
and  no  formal  recommendations  were  issued.  Instead,  the  report  contained  issues  for  consideration.  Their 
effective implementation will not be formally followed up by the IAS. 

8.2.  Audit  on  preparedness  for  the  new  European  Statistical 
the  2021-2027  Multiannual  Financial 

Programme  under 
Framework’ (DG ESTAT) 

The objective of the engagement was to assess whether DG ESTAT: 

 

 

has put in place an adequate framework (i.e. governance, definition of roles and responsibilities, 
internal  coordination,  planning  of  resources,  etc.)  to  prepare  the  Directorate-General  for  the 
implementation of the European Statistical Programme of the 2021-2027 Multi-annual Financial 
Framework;  

has  adequately  designed  the  elements  necessary  for  successfully  implementing  the  European 
Statistical  programme  (planning  and  programming,  monitoring  and  reporting  systems,  financial 
management procedures). 

The IAS did not formulate any critical or very important recommendations. 

8.3.  Consulting on ‘Globalisation risk’ (DG ESTAT) 

The objective of the consulting engagement was to provide advice to DG ESTAT on how to further improve the 
‘Early  Warning  System’,  created  to  mitigate  the  impact  of  major  restructuring  of  multinational  enterprise 
groups on the quality of European business statistics, national accounts and balance of payments statistics. 

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion 
and  no  formal  recommendations  were  issued.  Instead,  the  report  contained  issues  for  consideration.  Their 
effective implementation will not be formally followed up by the IAS. 

8.4.  Audit on preparedness to implement the European Public 

Prosecutor’s Office Regulation (OLAF)  

The objective of the audit was to assess the adequacy and effectiveness of the internal control systems put 
in place by OLAF to prepare for the future cooperation with the European Public Prosecutor’s Office (EPPO).  

There are no reservations in the 2020 Annual Activity Report of OLAF that relate to the area/process audited. 

31 

 
The  fieldwork  was  finalised  on  20  September  2021.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The  IAS  recognised  the  ongoing  efforts  made  by  OLAF  to  prepare  for  the  cooperation  with  EPPO  and  in 
particular found that: 

  OLAF  has  implemented  a  number  of  organisational  changes  to  align  its  structure  to  the  new 
environment. In particular, in 2018, OLAF set up a specific task force to support the set-up of EPPO 
which was operational until mid-2020 while in 2021, it established an ‘EPPO Team’ responsible for 
discussing  and  coordinating  with  EPPO  staff  on  the  key  operational  aspects  of  the  cooperation 
arrangements, and  finally  created  a  new  Unit  03  responsible  for  all  operational  matters  related  to 
the cooperation with EPPO. 

 

In  September  2020,  OLAF  reinforced  its  internal  workgroup  on  ‘Investigation  Instructions  and 
Workforms’  (INWOG)  to  work  on  the  proposal  for  the  new  OLAF  Regulation  and  revision  of  OLAF’s 
internal guidelines and instructions. 

  OLAF reported regularly to its Supervisory Committee on key aspects of the internal preparations for 

cooperation with EPPO. 

  During EPPO’s set up phase (2019-2020), OLAF delivered awareness-raising sessions to all its staff 
focusing on the state of play of the establishment of EPPO and the revision of the OLAF regulation. 
Moreover,  in  March  2021,  OLAF  organised  a  Questions  and  answers  debate  for  its  staff  with  two 
representatives from EPPO on the topic of ‘Everything that you always wanted to know about, and 
dare to ask to EPPO’. 

 

In the period June – mid-July 2021, OLAF transferred to EPPO 155 cases which OLAF’s operational 
units previously identified as falling under EPPO’s responsibility. OLAF explained that as result of the 
transfer, EPPO initiated around 80 criminal investigations contributing to the overall protection of the 
EU budget. 

  On 5 July 2021, OLAF signed with EPPO the ‘Working arrangement between the European Anti-fraud 
office  and  the  European  Public  Prosecutor’s  Office’  to  establish  and  formalise  the  areas  of 
cooperation between the two organisations in the exercise of their respective mandates. 

The  IAS  identified  three  very  important  issues  concerning:  (1)  planning  and  monitoring  of  the  internal 
preparatory  process,  (2)  investigation  and  data  protection  guidelines,  (3)  information  technology  related 
aspects and formulated three very important recommendations: 

Planning and monitoring of the internal preparatory process 

OLAF  should  reassess  the  risks  related  to  the  cooperation  with  EPPO,  identify  and  implement  the  relevant 
mitigating  measures,  as  well  as  monitor  and  update  its  risk  register  accordingly.  Regarding  the  2021 
‘Preparedness  plan  for  the  Arrival  of  EPPO’,  OLAF  should  ensure  that  it  is  formally  adopted  by  senior 
management  and  communicated  to  all  relevant  staff.  The  plan  should  indicate  all  responsible  actors.  The 
status of implementation of the actions in the plan should be monitored regularly by senior management. 

Investigation and data protection guidelines 

OLAF  should  plan  and  implement  the  update  of  all  its  investigation  and  data  protection  guidelines  and 
templates.  It  should  adopt  the  updated  guidelines and  publish  them  as  relevant.  It  should  prepare  a  list  of 
new  templates  needed  for  the  cooperation  with  EPPO,  define  the  timeline  for  their  creation,  adoption  and 
regular update. 

Information technology related aspects 

OLAF should implement the changes to its case management system related to the cooperation with EPPO as 
soon as possible. It should develop and agree with EPPO technical annexes to their working arrangement on 
the  hit/no-hit  system  and  secure  communication  line.  Furthermore,  it  should  adopt  a  methodology  for  the 

32 

 
implementation  of  the  current  manual  hit/no-hit  system  and  subsequent  information  exchange  process. 
Finally, it should perform an analysis of the key elements necessary to take informed decisions on the future 
of the hit/no-hit system. 

Additional information provided by OLAF on the measures defined and/or implemented following 
the Internal Audit Service audit 

OLAF has prepared an action plan to address the recommendations from the ‘audit on preparedness of OLAF 
to implement the EPPO regulation’. In this action plan, OLAF will implement several specific measures, to be 
carried  out  until  December  2022,  approximately.  These  measures  include  identifying  and  monitoring  risks 
related to the cooperation with EPPO, as well as keeping the OLAF "Preparedness plan for the Arrival of EPPO" 
continuously  updated  and  adapted  to  the  cooperation  between  both  offices.  This  plan  will  be  approved  by 
OLAF’s senior management and will be implemented by the end of 2022. 

Regarding the update of OLAF investigation and data protection guidelines and templates, OLAF has started a 
new  revision  of  the  Guidelines  on  investigation  procedures,  as  well  as  necessary  updates  of  standard 
templates.  Those  that  have  already  been  developed  are  being  continuously  updated,  especially  the  ones 
related  to  the  cooperation  with  EPPO.  The  Guidelines  for  Data  Protection,  on  the  other  hand,  have  already 
been approved and developed.  

Lastly,  all  the  recommended  changes  related  to  OLAF's  case  management  system  are  currently  under 
development  and  will  be  implemented  before  the  end  of  the  year.  The  technical  annexes  included  in  the 
OLAF-EPPO working arrangements are being discussed with the EPPO on a continuous basis and will also be 
finalised by December 2022. 

8.5.  Consulting on risk management (OLAF) 

The  objective  of  the  consulting  engagement  was  to  provide  advice  to  OLAF’s  Director-General  on  how  to 
improve the risk management process in his service. 

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion 
and  no  formal  recommendations  were  issued.  Instead,  the  report  contained  issues  for  consideration.  Their 
effective implementation will not be formally followed up by the IAS. 

8.6.  Audit  on  establishment  of  statutory  rights  and  calculation  of 

individual entitlements (PMO) 

The objective of the audit was to assess whether PMO has an effective and efficient control system in place 
to ensure the correct establishment of rights and calculation of entitlements for active and post-active staff. 

There  were  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  PMO  that  relate  to  the 
processes audited. 

The fieldwork was finalised on 23 July 2021. All observations and recommendations relate to the situation as 
of that date. 

The IAS identified the following strengths: 

  Since February 2021, significant changes in the management process have been made, supported by 
a  ‘change  management  strategy’,  with  a  clear  roadmap  and  objectives.  The  changes  involve 
consulting  staff  to  identify  PMO’s  main  challenges  and  collecting  suggestions  for  improvement. 

33 

 
Furthermore, a ‘collaboration forum’ and ‘communities of practice’ have been established. Finally, a 
number  of  focused  workshops  have  been  organised  and  improvements  made  to  communication 
channels.  

 

 

The IAS welcomed these changes, in particular, the establishment of the ‘community of practice’ on 
internal  control  and  on  knowledge  management,  which  aims  at  improving  coherence  and 
collaboration,  the  exchange  of  good  practices  and  training  on  cross-cutting  issues  in  the  Office. 
Expected  outcomes  from  the  knowledge  management  community  of  practice  include  more 
harmonised,  streamlined  and  efficient  procedures  and  working  methods,  commonly  developed 
guidelines for staff, and an improved knowledge management system overall.  

The IAS also welcomed the continuous information technology developments aimed at supporting the 
activities of the Office. In relation to the audited processes, new online declarations on the place of 
origin and installation allowance are now in a test phase, and a new module to manage the entry into 
service  rights  and  mobility  is  being  developed.  These  developments  are  expected  to  increase 
efficiency, lower the cost of control and reduce the risk of error. 

The  IAS  identified  one  very  important  issue  concerning  the  control  strategy  and  formulated  one  very 
important recommendation: 

Control strategy 

PMO should strengthen its  general control system, in particular by developing a single and coherent  control 
strategy (aligned with the applicable provisions of the legal base in relation to effective control systems) for 
the  establishment  of  rights  and  calculation  of  individual  entitlements  at  Office  level.  It  should  establish  a 
process  to  identify  and  assess  operational  risks  at  process  level  and  match  the  intensity  and  frequency  of 
controls  with  the  level  of  risks.  PMO  should  also  strengthen  the  ex  ante  controls  related  to  the  category 
‘allowances from other sources’ and clearly distinguish between  ex ante and ex post controls to ensure that 
they are  performed in compliance with the  provisions of  the Financial Regulation. Furthermore, PMO  should 
centralise the ex post control function to ensure segregation of duties and independence of actors involved in 
those controls. Finally, it should substantially revise its  ex post control methodology and the method for the 
calculation of the error rate, by applying a statistically representative sampling approach. 

Additional  information  provided  by  the  PMO  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

An action plan has been recently adopted and is currently being implemented.  Following the reorganisation of 
PMO, the ex post control function is already centralised in unit PMO.7 as of 1 January 2022.   

34 

 
9.  Information technology audits 

9.1.  Consulting on SUMMA programme (DG BUDG) 

The objective of this consulting engagement was to review and advise DG BUDG on improvements required, if 
any, in the design of the governance setup for the SUMMA programme and in the DG’s process for identifying 
business  requirements  and  defining  the  target  solutions,  which  aim  to  simplify  and  harmonise  business 
processes and stay as close as possible to standard SAP functionalities. 

As the assignment was a consultancy engagement, the report did not contain an audit opinion or conclusion 
and  no  formal  recommendations  were  issued.  Instead,  the  report  contained  issues  for  consideration.  Their 
effective implementation will not be formally followed up by the IAS. 

9.2.  Audit on the management and monitoring of compliance with the 
framework 

technology  security 

information 

Commission’s 
(DG DIGIT) 

The objective of the audit was to assess the adequacy of DG DIGIT’s processes for managing and monitoring 
compliance with the Commission’s information technology security framework. 

The IAS noted a number of good practices regarding the processes for managing and monitoring information 
technology security compliance: 

  As regards the information technology security framework itself, although a limited number of areas 
remain  to  be  completed  (i.e.  creating  or  updating  standards  on  ‘Network  Security’,  ‘Identity 
Management’ and ‘Secure Software  Development’ planned  for inter-service consultation at the end 
of 2021), the framework is largely in place in terms of implementing rules and standards.  

  DG  DIGIT  has  made  significant  progress  in  the  rollout  of  the  information  technology  security 
governance, risk and compliance tool, which is designed to facilitate the Directorates-General actual 
implementation of the information technology security requirements and provide for its monitoring. 
This constitutes a key part of the compliance management and monitoring process and has been a 
major challenge for DG DIGIT to provide a comprehensive and workable tool. 

The  IAS  identified  two  very  important  issues  concerning:  (1)  information  technology  security  compliance 
management  and  reporting  practices,  and  (2)  information  technology  security  compliance  management 
process and formulated two very important recommendations: 

Information technology security compliance management and reporting practices 

DG  DIGIT  should  launch  a  Commission-wide  campaign  to  raise  awareness  on  the  information  technology 
security framework compliance monitoring activities and to report in a comprehensive and reliable way on the 
current  status  of  implementation  of  information  technology  security  framework  controls.  In  particular,  the 
requirements needed to be compliant with the Commission’s information technology security framework need 
to  be  clarified  more  precisely.  Based  on  the  information  and  practical  experience  collected  from  the 
Directorates-General,  DG  DIGIT  should  propose  to  the  Information  Technology  and  Cybersecurity  Board 
additional and effective methods for enforcing information technology security compliance. 

Information technology security compliance management process 

DG DIGIT should create standard compliance assessment, management and monitoring procedures, guidelines 
and  training  materials to  help  make  the  overall  process  as operational  and as streamlined  as  possible  and 

35 

 
thus to promote commitment and take-up. To facilitate the process and help the Directorates-General to use 
their  resources  most  effectively,  DG  DIGIT  should  also  define  the  relative  priorities  of  the  information 
technology security controls so stakeholders can focus the compliance efforts on the most critical information 
technology security controls and risks. These should be made clear to the process stakeholders as part of a 
concerted communication effort. 

DG  DIGIT  should  also  examine  the  possibilities  for  improving  synergies  and  coherence  between  the 
information technology risk assessment and information technology security compliance processes to ensure 
maximum possible alignment of the underlying information technology security framework and effective use 
of resources. 

Additional  information  provided  by  DG  DIGIT  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

DG  DIGIT  prepared  and  submitted  an  action  plan  end  October  2021,  which  was  accepted  by  IAS  early 
November  2021.  DIGIT  is  currently  implementing  the  action  plan  according  to  the  agreed  target  dates, 
therefore mitigating the related risks. 

As  part  of  the  audit  action  plan  to  improve  overall  monitoring  and  reporting  on  the  compliance  levels,  DG 
DIGIT  is  working  closely  with  the  other  DGs  to  collect  a  first  set  of  priority  compliance  attestations  and  to 
report  compliance  key  performance  indicators  to  the  Information  Technology  and  Cybersecurity  Board.  To 
further  improve  the  execution  efficiency  of  the  DGs  in  their  overall  IT  security  management  activities,  DG 
DIGIT is also providing a compliance support tool and is working on an integrated risk and compliance process 
and workflow. 

9.3.  Audit on information technology security management in the HR 

family (DG DIGIT, EPSO, DG HR, PMO) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effectiveness  of  the 
implementation of the governance, management and  control processes put in  place by HR family members 
for their systems.  

There are no observations/reservations in the 2019-2020 Annual Activity Report of the audited Directorates-
General that relate to the area/process audited. The fieldwork was finalised on 30 April 2021. All observations 
and recommendations relate to the situation as of that date. 

The  IAS  recognised  the  ongoing  efforts  by  EPSO  to  continuously  further  improve  information  security  and 
identified the following strengths: 

 

 

There  is a  solid  knowledge  of  technical  and  non-technical  information  security  issues  amongst  key 
personnel. 

There  is  effective  and  close  cooperation  between  the  business  and  information  technology  sides 
defining and enforcing the business needs on the information technology security domain. 

There  is  effective  communication  between  EPSO  and  DG  DIGIT  as  in  respect  of  the  development  and 
management of the communication and information systems. 

The IAS recognised the ongoing efforts by PMO to improve information security and identified the following 
strengths: 

  A Systems Security Officer has been appointed. 

  Systems risk exercises are performed using the ITSRM² methodology. 

36 

 
 

There are first or draft versions of security plans for all systems (as at the completion of the audit 
fieldwork stage). 

The IAS identified three very important issues concerning: (1) logical system-related controls (2) information 
technology  service  provider  management  (3)  information  technology  security  governance  (and  risk 
management) and formulated seven very important recommendations:  

Logical system-related controls (Two very important recommendations addressed to DG DIGIT and DG HR) 

DG DIGIT should strengthen user access management processes on database level and ensure, together with 
HR family members, that obsolete database interfaces are timely deleted. Moreover, DG DIGIT should reduce 
the  use  of  production  data  in  non-production  environments  to  a  minimum.  Furthermore,  DG  DIGIT  should 
provide the system owners with a regular security health check report on technical level. In addition, DG DIGIT 
should  strengthen  oversight  of  manual  interventions  by  sample  cross  checks  of  activities  performed  on 
database level. 

DG  HR  should  assess  whether  the  secure  hosting  solution  offered  by  DG  DIGIT  would  be  feasible  or,  as  a 
minimum, some individual controls from this solution could be applied in the current basic hosting solution to 
strengthen  the  security  level.  Based  on  the  results,  DG  HR  should  (in  cooperation  with  the  other  HR  family 
members) complete a service level agreement with DG DIGIT and clearly identify roles and responsibilities as 
regards the implementation, monitoring and reporting of information technology security controls. 

Information technology service provider management (Two very important recommendations addressed to DG 
DIGIT and DG HR) 

DG DIGIT should inform the system owners about substantial changes having an impact on production data, 
such as the creation of environments storing production data or the establishment of system interfaces in a 
production environment.  

DG DIGIT should launch an exercise together with HR family members to assess the gaps between the basic 
hosting  and  the  secure  hosting  solution.  Based  on  this  process,  DG  DIGIT  should  update  the  service  level 
agreements with the family members. In these service level agreements, roles and responsibilities should be 
clearly defined. 

DG  HR  should  define  and  implement  basic  security  processes,  including  user  account  management,  logging 
and  monitoring,  vulnerability  management  as  well  as  reviewing  system  interfaces.  It  should  strengthen 
oversight  on  manual  interventions  in  Sysper,  assess  the  feasibility  to  improve  protection  of  data  in  motion 
and reduce the use of production data in non-production environments to a minimum. 

Information technology security governance (One very important recommendation addressed to DG HR) 

DG  HR  should  improve  its  information  technology  security  management  by  keeping  an  up-to-date  system 
inventory  and  endorsing  information  technology  security  plans  as  a  key  tool  for  steering  information 
technology security. Moreover, DG HR should strengthen its process for ensuring a continuous improvement of 
its  information  technology  security  arrangements,  including  roles and  responsibilities  related  to  information 
technology security. 

Information technology security governance (One very important recommendation addressed to EPSO) 

EPSO  should  restart  the  information  technology  steering  committee  meetings,  ensuring  information 
technology  security  issues  are  discussed  in  these  meetings.  It  should  also  develop/improve  its  information 
technology  security  standards  and  procedures  ensuring  all  staff  involved  are  aware  of  the  framework  and 
their  roles  and  responsibilities.  Moreover,  EPSO  should  implement  the  security  controls  identified  on  the 
information  technology  security  plan  and  yet  to  be  implemented,  and  formally  appoint  the  relevant 
information technology security roles and ensure the objectives of each role are properly fulfilled. 

37 

 
Information  technology  security  governance  and  risk  management  (One  very  important  recommendation 
addressed to PMO) 

PMO should:  

  Strengthen its internal oversight on technical security controls implemented by DG DIGIT. 

  Strengthen  the  LISO  function  by  enhancing  his/her  involvement  in  information  technology  security 

issues across the service. 

  Strengthen the process of continuous improvement of information technology security by executing 

risk-based assessments on all PMO systems, and implementing compensating measures. 

  Assess the risk landscape for all PMO systems, and review alignment of these risks with the technical 

and organisational controls in place. 

  Update all PMO security plans and for the missing controls, prepare a roadmap on how to implement 

these controls. 

Additional  information  provided  by  DG  DIGIT,  DG  HR,  PMO  and  EPSO  on  the  measures  defined 
and/or implemented following the Internal Audit Service audit 

DG  DIGIT  prepared  and  submitted  an  action  plan  early  December  2021,  which  was  accepted  by  IAS  mid-
December  2021.  DIGIT  is  currently  implementing  the  action  plan  according  to  the  agreed  target  dates, 
therefore mitigating the related risks. 

Relevant actions are in progress in the following areas: 

  User  access  management  (developing  procedures  on  user  access  management  on  database  level; 
defining, in collaboration with the HR family, a process for review of user accounts on database level).  

 

System  interfaces  and  separation  of  production  from  non-production  (producing  inventory  of  database 
links in the HR family systems). 

  Manual interventions (reviewing the current available tools for reconciliation activities). 

  Use of production data (reviewing current situation of environments). 

  Assessment of appropriate hosting solutions (gathering inputs from the hosting provider).  

Following  the  IAS’  acceptance  of  DG  HR’s  action  plan  in  December  2021,  implementation  progresses  are 
according  to  plan.  Actions  requiring  major  technical  investments  are  being  assessed  for  timely  and  cost 
efficient ‘solutioning’. 

An action plan has been recently adopted and is currently being implemented. Since the end of the audit, risk 
management for PMO systems is carried out by PMO (instead of DIGIT), additional mitigating measures are 
planned, and the local information security officer is more involved in this process. 

EPSO has accepted all audit findings and recommendations and submitted in December 2021 an action plan, 
which was accepted  by  IAS,  to implement all  recommendations by the end of 2022.  EPSO  has restarted to 
have regular IT Steering Committee (ITSC) meetings with DIGIT, with the presence of our c-LISO, to also cover 
any  security  related  matters.  Ad-hoc  meetings  also  take  place  between  c-LISO  and  senior  management  of 
EPSO  to  discuss  relevant  security  matters.  Work  is  on-going  on  the  implementation  of  the  other 
recommendations  (security  standards,  security  controls,  roles  -  due  end  2022),  with  the  collaboration  of 
DIGIT.IT Security plans covering all EPSO’s IT systems have been finalised in January 2022. 

38 

 
9.4.  Audit  on 

information  technology  project  management  and 

software development (DG RTD) 

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of 
the  management  and  control  systems  put  in  place  by  DG  RTD  for  its  information  technology  project 
management and software development processes.  

There  were  no  observations/reservations  in  the  2020  Annual  Activity  Report  of  DG  RTD  that  relate  to  the 
area/process audited. 

The IAS noted a number of strengths regarding project management and software development practices in 
DG RTD. Specifically, that the key elements of the audited processes are mature and well established, notably 
the  respective  methodologies,  governance  structures,  effective  business-provider  relationships  and 
interactions,  monitoring/reporting  of  projects  and  software  development,  code/development  review  and 
testing, software release management. Also, the common  information technology  service provides effective 
project management and software development services to support the defined business needs and services. 

More precisely, the IAS noted: 

  Defined,  formalised  and  implemented  business  process  and  project  governance  arrangements, 
involving  both  information  technology  service  providers  and business  stakeholders who  periodically 
discuss, monitor and decide on information technology activities and the associated objectives. 

  Defined  comprehensive  information  technology  work  plans  with  key  strategic  objectives  for  the 

upcoming year.  

  Comprehensive  involvement  of  stakeholders  through  formal  project  organisation  structures.  This 
ensures  that  business  requirements  and  expectations  are  identified,  continuously  validated  and,  if 
needed, updated throughout the duration of the project. 

  Defined project management and software development methodology (for large majority of projects) 

aligned with the Commission standards. 

  Use of automated tools and tests for ensuring source code and software quality. 

The IAS did not formulate any critical or very important recommendations. 

39 

 
Part 2 - FOLLOW-UP 
ENGAGEMENTS 
(SUMMARISED)

40 

 
1.  Follow-up  audit  in  DG  BUDG  on  pillar  assessment  in  the  external  action 
family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on two follow-
up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 2 (very important): guidance on pillar assessment process  

Recommendation No 7 (very important): repository of pillar-assessed entities  

Recommendation 10 (important): complementary assessments 

Recommendation 11 (important): sub-delegation pillar 

2.  Follow-up  audit  in  DG  BUDG  on  management  of  recovery  orders  for 
competition  fines  and  for  recovery  orders  in  the  context  of  the 
Commission’s corrective capacity – Phase II (DG BUDG, DG COMP) (based on 
two follow-up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 4 (very important): the offsetting process by the accounting officer 

Recommendation No 6 (important): characteristics of the recovery process for competition fines 

3.  Follow-up  audit  in  CINEA  on  the  effectiveness  of  the  design  and  of  the 
implementation of the ex post control strategy for the Connecting Europe 
Facility 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): preparation of the annual audit plan 

Recommendation  No  2  (very  important):  assessment  of  the  legality  and  regularity  of  the  amendments  to 
implementing contracts 

4.  Follow-up audit in CINEA on WiFi4EU (DG CNECT, DG DIGIT, INEA) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): recovery orders 

41 

 
5.  Follow-up audit in DG CNECT on WiFi4EU (DG CNECT, DG DIGIT, INEA) (based 

on two follow-up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 2 (important): alignment information technology/business requirements 

Recommendation No 6 (important): monitoring the results of the policy objectives 

Recommendation No 7 (important): management of legacy 

6.  Follow-up  audit  in  DG  CNECT  on  implementation  of  the  better  regulation 

principles in the preparation of digital single market policy proposals 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 2 (important): monitoring the implementation of the better regulation requirements and 
document management 

7.  Follow-up  audit  in  DG  CNECT  on  Connecting  Europe  Facility  telecom 

governance 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): strengthening the internal governance set-up 

Recommendation No 2 (very important): improve the current performance framework of the programme and 
monitor its progress and the results 

8.  Follow-up audit in DG COMP on the internal control framework (based on 

two follow-up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 2 (important): internal control monitoring criteria 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 1 (very important): identification and assessment of deficiencies.  

DG COMP revised its internal control strategy in 2021, which now includes: (1) an assessment of the ongoing 
monitoring  of  performance  processes;  (2)  use  of  ‘other  sources’  of  information  to  complement  the  internal 
control monitoring criteria self-assessment; and (3) identification and reporting of strengths and deficiencies 
procedure.  

The  internal  control  strategy  and  the  assessment  process  cycle  now  provide  clear  guidance  and  include  all 
elements to properly perform the annual internal control assessment. 

42 

 
The exercise for the year 2020 has been finalised in March 2021, before the approval of the revised internal 
control strategy. All internal control principles have been assessed, however, the IAS did not find evidence that 
the exercise was performed using the assessment forms provided by DG BUDG. Furthermore, the assessment 
report did not include the following elements: (1) the description, rating and reporting of deficiencies; and (2) 
the internal control assessment at components level. 

Considering the elements already implemented, the recommendation was downgraded from ‘very important’ 
to ‘important’ as the residual risk level is considered medium. 

9.  Follow-up audit in DG DIGIT on WiFi4EU (DG CNECT, DG DIGIT, INEA) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 4 (important): awareness on password storage 

10. Follow-up audit on past audits in DG DIGIT 

Audit on the management of information technology security in DG DIGIT: 

Based on the results of the first follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented and were closed: 

Recommendation  No  1  (very  important):  assurance  on  the  legitimacy  of  actions  performed  in  production 
systems. 

Recommendation  No  2  (very  important):  technical  inventories  of  management  information  for  security 
vulnerabilities 

Recommendation No 5 (important): security vulnerabilities in software developed in-house. 

Audit on information technology project management practices for multi-DG projects in DG DIGIT: 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 2 (important): project management methodology 

Recommendation No 3 (important): total cost of ownership 

Recommendation No 4 (important): risk assessment 

The following recommendations were assessed as not fully and/or adequately implemented. 

Recommendation No 5 (important): quality control 

The IAS acknowledged that DG DIGIT defined an initial set of quality indicators, but noted that these should be 
systematically  and  automatically  measured  through  the  use  of  the  CITnet  platform.  In  addition  these 
indicators  should  be  included  in  the  regular  reporting  to  the  steering  committees.  Finally,  a  global  quality 
indicator has yet to  be implemented. DG  DIGIT  prepared  a mock-up  version, but the analysis of the  current 
state of the key performance indicator dashboard with quality indicators revealed some technical limitations. 
During  the  course  of  2021,  DG  DIGIT  plans  to  address  this  technical  limitation  by:  (1)  gathering  further 
requirements from project officers; (2) launching a new  contract for further development of the dashboard, 
along with the global quality indicator; (3) following up the progress by DIGIT.B.4 PMO. 

43 

 
Recommendation No 6 (important): user acceptance testing 

The IAS noted that PM² methodology has been improved to describe a protocol and roles and responsibilities 
for user acceptance testing. User acceptance testing is now part of the deliverables acceptance management 
plan  and  for  a  particular  project,  the  approach  adopted  is  described  in  its  test  plan.  Defining  acceptance 
criteria is now part of the requirements management. Once the requirements are approved, the test scenarios 
are  defined  and  a  cross  matrix  is  made  to  check  that  every  requirement  has  one  or  more  test  scenarios 
assigned to it. 

However, a number of activities have yet to be fully implemented at DG DIGIT, as follows: 

 

 

 

 

The template for deliverables acceptance management plan including the list of specific deliverables 
regarding testing activities and its test plan are not defined as artefacts in PM2 methodology. 

There  is  no  standard  methodology  on  the  way  to  define  criteria  for  acceptance  of  test  results  with 
business representatives. 

There  is  no  template  for  evidencing  results  of  user  acceptance  testing  based  on  predefined  criteria 
(evaluation sheet / test report). 

There is no evidence that for all projects in the portfolio, the test scenarios are defined with concrete 
activities to prepare, set-up, execute and report on the testing to check that every requirement has one 
or more test scenarios assigned to it. 

11. Follow-up  audit  in  DG  DIGIT  on  Connecting  Europe  Facility  telecom 
governance  (DG  CNECT,  DGT,  DG  DIGIT,  DG  EMPL,  DG  GROW,  DG  JUST, 
DG SANTE) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): internal governance arrangements 

12. Follow-up  audit  in  DGT  on  Connecting  Europe  Facility  telecom  governance 

(DG CNECT, DGT, DG DIGIT, DG EMPL, DG GROW, DG JUST, DG SANTE) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): performance framework 

Recommendation No 2 (important): data protection 

13. Follow-up  audit  in  DG  EAC  on  effectiveness  of  the  protection  of  personal 
data  of  beneficiaries  of  and  participants  in  the  Erasmus+  and  European 
Solidarity Corps programmes 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
assessed as not fully and/or adequately implemented.  

Recommendation No 5 (critical): transfer of personal data to third countries  

DG EAC has been in close contact with the Data Protection Officer of the Commission to revise and correct the 
privacy statement for Erasmus+.   

44 

 
The IAS has performed a desk review of the revised privacy statement for the Erasmus+ programme and a 
check  of  the  IT  system  ‘Mobility  Tool+’,  which  is  used  for  the  mobility  actions,  including  those  triggering 
international transfers of personal data. 

The IAS review showed that the revised privacy statement now includes: 

  A clear explanation of who introduces the participants’ personal data in the ‘Mobility Tool+’ 

and who the data processors are. 

  A distinction between the two types of personal data transfers, i.e. to: 

  EU/European Economic Area country or countries for which the Commission adopted an adequacy 

decision ensuring an adequate level of protection, 

 

third countries for which there is no Commission adequacy decision; 

  The  clarification  that  in  the  case  of  third  countries  for  which  there  is  no  Commission 
adequacy decision, the protection of the data subjects’ rights with respect to their personal 
data might not be equivalent to the EU legislation (as it depends on the law or practice of 
that third country). 

  Clear  information  on  who  has  access  to  the  participants’  personal  data  in  the  different 
scenarios:  (i)  EU/European  Economic  Area  country  and  countries  for  which  the  Commission 
adopted an adequacy decision ensuring an adequate level of protection and (ii) other third 
countries. 

  A list of the situations when personal data is transferred to third countries. 

Based  on  the  above,  the  IAS  considers  that  the  revised  privacy  statement  for  the  ‘Mobility  tool+’  is 
transparent and no longer misleading. 

DG  EAC,  in  collaboration  with  central  services,  must  still  take  the  necessary  steps  in  order  to  identify 
supplementary  measures  regarding  the  transfer  of  data  outside  the  European  Economic  Area.  For  these 
reasons, the IAS concluded that this recommendation is not fully implemented, but the risk has partially been 
mitigated, hence justifying its downgrading from ‘critical’ to ‘very important’.  

Recommendation No 6 (very important): handling of personal data breaches 

The Directors’ Steering Committee of DG EAC adopted a procedure for handling the personal data breaches 
that follows the guidance of the Data Protection Officer. In particular, this guidance elaborates on the internal 
handling workflow for personal data breaches, taking into account the Commission decision (EU) 2020/969, 
as  well  as  the  guidance  of  the  European  Data  Protection  Service  and  the  Commission’s  Data  Protection 
Officer on this topic.  

However, DG EAC has not yet implemented an effective follow up of actions planned after data breaches, in 
order to avoid that such breaches re-occur. For this reason, the IAS concludes that the recommendation is not 
fully implemented. However, the risk has partially been mitigated, hence justifying its downgrading from ‘very 
important’ to ‘important’. 

14. Follow-up  audit  in  DG  EAC  on  information  technology  governance  and 
project management (based on two follow-up audits performed in 2021) 

Based  on  the  result  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 2 (important): project management methodology and practices 

45 

 
Recommendation No 4 (important): project budgeting and cost monitoring 

15. Follow-up  audit  in  DG  ECHO  on  the  control  strategy  for  humanitarian  aid 

actions 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): control strategy description 

Recommendation No 4 (important): ex post controls at project level 

Recommendation No 6 (important): control strategy – assurance building 

The  following  recommendations  were  assessed  as  not  fully  and/or  adequately  implemented  and  were 
downgraded to important: 

Recommendation No 3 (very important): ex ante controls on final reports and final payments 

DG ECHO has: 

  Updated its financial manual to include the requirement that the e-signatory of the Ares workflow for 
final  payments  is  made  visible  to  middle  management,  allowing  for  appropriate  supervision  of  the 
payments.  

  Updated its external audit sector procedures to ensure that final reports (including from field audits) 
are shared with the financial officers checking the final payments (officers in unit ECHO.E3 Contracts 
and Finance).   

  Made the following improvements to its financial and operational checks on Value Added Tax status 

of the implementing partners: 

  The  revised  Single  Form  (applicable  since  1  January  2021)  used  by  UN  agencies, 
international  organisations  and  non-governmental  organisations  requires  more  information 
on their Value Added Tax status; 

  The template of the final financial report has been changed so that the non-governmental 
organisations  and  UN/international  organisations  explicitly  state  (if  applicable)  the  amount 
of Value Added Tax included in the incurred cost; 

  Specific checks and instructions related to the Value Added Tax status were included in the 
checklists  to  be  used  before  authorising  final  payments  to  both  UN/international 
organisations and non-governmental organisations; 

  The new DG ECHO audit strategy includes the Value Added Tax exemption status in the list 

of criteria for selecting partners for risk-based audits; 

  DG  ECHO  reviewed  the  cases  identified  by  the  IAS  during  the  audit  where  no  explanation 
from the partners on the absence of  Value  Added Tax exemption was  provided, as well as 
other  ECHO-funded  projects  with  the  same  partners  in  the  same  country,  and  took  the 
necessary actions.  

 

Revised aspects of the ‘certified correct’ process: 

  The  template  for  the  ‘certified  correct’  note  was  revised  in  line  with  Article  111.4  of  the 
Financial  Regulation,  to  indicate  the  amount  of  the  total  eligible  costs  accepted  by  the 
authorising officer instead of the amount to be paid and whether the action has been carried 
out in all respects in compliance with the grant agreement; 

  Reviewed  the  assignment  of  the  user  profile  ‘workflow  manager’  in  FichOp  and  introduced 
an extra layer of control in the form of a log showing who made modifications in the fields 
and when. 

46 

 
However, the following sub-recommendations have not been implemented: 

  The  checklists  for  the  financial  officers  contain  a  significant  number  of  conditional  checks. 
The  financial  officers  are  not  instructed  to  provide  information  in  Fichop  about  which  of 
these  checks  are  applicable  and,  when  they  are,  whether  they  are  performed.  They  only 
indicate the results of the checks they consider most relevant. Consequently, the authorising 
officer by sub-delegation may not be informed before authorising a final payment about the 
complete set of checks that were performed by the financial initiator and verifier; 

  DG ECHO has not specified in its financial manual who the financial initiators need to encode 

in ABAC6 as officer providing the ‘certified correct’ clearance/approval; 

  DG  ECHO  has  not  introduced  checks  in  the  review  process  of  final  reports  to  verify  if  the 
UN/international  organisations  correctly  report  who  were  their  implementing  partners  and 
contractors. 

Given  that  DG  ECHO  has  addressed  the  high  risks  identified  in  the  audit,  the  recommendation  was 
downgraded from ‘very important’ to ‘important'. 

Recommendation No 5 (very important): ex post headquarters audits and verifications 

DG ECHO has: 

  Revised its audit methodology regarding the sampling in ex post audits and verifications. 

  Adopted  a  new  ‘Audit  Strategy  (2021-2027)  applicable  to  Humanitarian  Aid  and  Civil 
Protection  Funds  managed  by  DG  ECHO’  in  April  2021.  Both  the  strategy  and  a 
methodological package were communicated to DG ECHO’s external audit contractors. 

  Revised the template of the representation letter requested from the UN agencies after an 

Headquarters audit. 

  Developed a quality control procedure for review of reports from the audit contractors, which 
includes a checklist and a detailed process flowchart, and communicated it to relevant audit 
sector staff. 

However, the following sub-recommendations have not been implemented: 

 

 

The revision of DG ECHO’s audit manual has not been completed.  

The  follow-up  approach  for  significant  recommendations  made  to  non-governmental  organisations 
has not been revised. 

Given  that  DG  ECHO  has  addressed  the  high  risks  identified  in  the  audit,  the  recommendation  was 
downgraded from ‘very important’ to ‘important'. 

16. Follow-up  audit  in  DG  ECHO  on  pillar  assessment  in  the  external  action 
family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on two follow-
up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

6   The European Commission’s information system for the execution and monitoring of all budgetary and 

accounting operations. 

47 

 
                                                        
Recommendation No 5 (important): guidance on pillar assessment process 

Recommendation No 15 (very important): substantive changes 

Recommendation No 17 (important): pillar assessment of United Nations entities 

Recommendation No 22 (critical): agreements signed with pillar assessed entities 

Recommendation No 25 (very important): Commission’s services involvement in the pillar assessment process 

17. Follow-up  audit  in  DG  EMPL  on  the  management  of  the  employment  and 
innovation  programme  (EaSI)  with  special  emphasis  on  the 

social 
PROGRESS axis 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 4 (important): upscaling of employment and social innovation projects 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 2 (important): monitoring and evaluation framework 

In  line  with  the  IAS  recommendation,  unit  A3  developed  a  template  for  the  provision  of  information  by 
employment  and  social  innovation  beneficiaries  on  the  financed  projects’  milestones,  the  progress  made 
against  these  milestones  and  any  critical  implementation  risks  as  well  as  mitigating  actions.  This  template 
was uploaded on the Directorate-General’s intranet so that the operational units can publish it together with 
the new employment and social innovation calls and propose that the beneficiaries of ongoing grants use it to 
provide the necessary information (at the end of each reporting period). 

However,  as  at  the  date  of  the  IAS  follow-up,  the  performance  framework  of  the  employment  and  social 
innovation  strand  of  the  European  Social  Fund+  Regulation7  (setting  indicators,  targets and  baseline  values 
for the EaSI projects financed during the period 2021-2027) was still under development.  

The  recommendation  on  the  EaSI  performance  framework  was  closed  on  08  February  2022.  All 
recommendations were effectively implemented as indicated in the follow up note of the IAS. 

18. Follow-up  audit  in  DG  EMPL  on  Connecting  Europe  Facility  telecom 
governance  (DG  CNECT,  DGT,  DG  DIGIT,  DG  EMPL,  DG  GROW,  DG  JUST, 
DG SANTE) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): internal governance arrangements 

Recommendation No 2 (important): performance framework 

7 The new ESF+ Regulation (Regulation EU 2021/1057) was adopted on 30 June 2021. 

48 

 
                                                        
19. Follow-up audit in DG ENV on LIFE financial instruments: effectiveness and 

efficiency of the current framework (DG CLIMA, DG ENV) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): functioning of the steering committee 

20. Follow-up audit in DG ESTAT on human resources management 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 8 (very important): human resources monitoring and reporting 

21. Follow-up  audit  in  DG  FISMA  on  effectiveness  and  efficiency  of  the 

performance management system 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): performance management framework – planning and monitoring of ‘other 
tasks’ and objective setting 

22. Follow-up audit in FPI on the Partnership Instrument 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
assessed as not fully and/or adequately implemented. 

Recommendation No 1 (important): quality of partnership instrument concept notes and action fiches 

Sub-recommendations  1  a)  and  1  b)  have  been  adequately  implemented,  as  FPI  improved  the  quality  of 
concept notes and action fiches by implementing the following measures: 

 

The  action  fiches  for  the  annual  action  programme  exercises  now  clearly  reflect  the  comments  of  the 
quality support group on proposed partnership instrument actions. 

  Quality support group quality controls are now also conducted for public diplomacy actions. 

Concerning  sub-recommendation  1  c),  FPI  has  launched  a  new  study  to  update  the  2015  Analysis  of  the 
perception  of  the  EU  and  of  EU's  policies  abroad.  However,  as  the  launch  was  delayed,  the  results  of  the 
perception study will only be available in September 2021.  

Moreover, the external evaluation of public diplomacy actions has been delayed and the contract is expected 
to start in mid-July 2021. 

For these reasons, sub-recommendation 1 c) is not fully implemented. 

23. Follow-up audit in FPI on Common Foreign and Security Policy 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

49 

 
Recommendation No 4 (very important): mitigating measures applied for EUCAP Somalia 

24. Follow-up  audit  in  FPI  on  pillar  assessment  in  the  external  action  family 
(DG  BUDG,  DG  ECHO,  FPI,  DG  INTPA,  DG  NEAR)  (based  on  two  follow-up 
audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 6 (important): guidance on pillar assessment 

Recommendation No 16 (very important): substantive changes 

Recommendation No 26 (very important): Commission services’ involvement in the pillar assessment process 

25. Follow-up  audit  in  FPI  on  EC-EEAS  coordination  (EEAS,  FPI,  DG  INTPA, 

DG NEAR) (based on two follow-up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 2.3 (important): working arrangements 

Recommendation No 3.5 (important): project level coordination 

26. Follow-up audit in FPI on the instrument contributing to stability and peace 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 3 (important): guidance to and supervision of EU Delegations 

27. Follow-up  audit  in  DG  GROW  on  Connecting  Europe  Facility  telecom 
governance  (DG  CNECT,  DGT,  DG  DIGIT,  DG  EMPL,  DG  GROW,  DG  JUST, 
DG SANTE) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): internal governance arrangements 

Recommendation No 2 (important): performance framework 

28. Follow-up audit in DG HR on data protection (DG DIGIT, DG HR, LS, JRC, SG) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 2b (very important): nomination of data protection coordinators 

50 

 
29. Follow-up  audit  on  past  audits  in  DG  INTPA  (based  on  three  follow-up 

audits performed in 2021) 

Indirect management with entrusted entities (DG INTPA, DG NEAR) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): guidance on the contribution agreement template 

Recommendation No 3 (important): negotiating and preparing indirect management contracts 

Recommendation No 5 (important): risk-based ex ante checks 

Recommendation No 7 (important): implementing contractual provisions: management declarations 

30. Follow-up  audit  in  DG  INTPA  on  pillar  assessment  in  the  external  action 
family  (DG  BUDG,  DG  ECHO,  FPI,  DG  INTPA,  DG  NEAR)  (based  on  three 
follow-up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 3 (very important): guidance on pillar assessment process 

Recommendation No 8 (important): repository of pillar-assessed entities 

Recommendation No 13 (very important): substantive changes 

Recommendation No 18 (very important, downgraded from critical): pillar assessment of the United Nations 
Secretariat 

Recommendation No 20 (critical): agreements signed with pillar-assessed entities 

Recommendation No 23 (very important): Commission services’ involvement in the pillar assessment process 

31. Follow-up  audit  in  DG  INTPA  on  management  of  investment  facilities 

(financial instruments) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): blending project cycle: post-contact signature phase - monitoring of 
project implementation 

Recommendation No 2 (important, downgraded from very important): pre-financing 

Recommendation No 5 (important): European Bank for Reconstruction and Development 

The following recommendations were assessed as not fully and/or adequately implemented. 

Recommendation No 3 (important): blending project cycle: pre-contract signature phase 

51 

 
The blending guidelines now strengthen the role of the EU Delegations in the identification of the projects for 
blending financial instruments. Moreover, in order to reinforce the technical assessments, in 2018, DG INTPA 
appointed three supervisors of the blending facilities whose task is to ensure correct and complete use of the 
project assessment framework.  

Finally,  DG  INTPA  revised  the  blending  guidelines  which  now  include  a  five  working  days  deadline  for  the 
preparation of the  draft technical assessment  meeting and  board  minutes after the meeting and the same 
number of days for obtaining comments. These deadlines aim to ensure timely adoption and distribution of 
the  minutes.  They  also  provide  a  better  allocation  of  the  assessment  questions  among  the  assessors  and 
include additional guidance for the assessment  process.  However, the guidelines do not include information 
on the preparation of the consolidated assessment sheet summarising all assessment results. In addition, the 
assessment grid template does not include an explicit assessment on the quality of performance indicators. 

Recommendation No 4 (important): procedures and guidance for blending operations 

The  issues  related  to  the  definition  and  recovery  of  fees  were  addressed  in  a  revision  of  the  PAGoDA 
template8 in 2018, in the contribution agreement template adopted 2018 and in the contribution agreement 
for financial instruments adopted in 2019. The blending guidelines now explain the use of the conditionality 
clauses  related  to  the  pre-financing  and  provide  instruction  on  the  applicable  contractual  template  and 
framework agreements. 

While  this  addresses  to  a  large  extent  the  recommendation,  two  specific  points  were  not  reflected  in  the 
revised blending guidelines: the role of the EU Delegations is  signing amendments and riders related to the 
ongoing agreements and the definition of the content of the project files to be kept for each blending project. 

32. Follow-up audit in DG INTPA on EC-EEAS coordination (EEAS, FPI, DG INTPA, 

DG NEAR) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1.1 (very important): country-level coordination 

Recommendation No 3.4 (important): project-level coordination 

33. Follow-up audit in JRC on scientific project management 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 4 (important): work programme tiers' terminology 

The following recommendations were assessed as not fully and/or adequately implemented. 

Recommendation No 1 (important): overall scientific project management set-up 

JRC  has prepared  comprehensive9  guidance  for  its  scientific  projects,  as  part  of  its  Integrated  Management 
System10 based on the PM2 project management methodology.  

8   C(2018) 8892 – 18/12/2018. 
9   Except for the IMS-JRC-M3.1-PRO-0012: Work Programme monitoring and reporting (procedure at Work 

Programme, not at project level) the drafting of which was put on hold until the work in progress 
regarding project and Work Programme monitoring is finished. 

52 

 
                                                        
The guidance includes the roles and responsibilities of all actors involved in JRC’s work programme. 

JRC  has  also  enhanced  the  training  of  staff  in  the  area  of  project  management,  by  increasing  attendance 
rates to existing Commission trainings as well as by designing and offering specific PM2 courses adapted to 
the specificities of JRC.  

However, the new procedures and manuals entered into force in 2021, in parallel to the start of the new JRC 
scientific projects management cycle 2021-2022 during which guidance on planning and monitoring will be 
further refined. In particular, there is still work in progress regarding project and work programme monitoring 
in order to develop the new  project work  plan11  and project monitoring  modules in  the JRC project browser, 
which will support improved JRC project and work programme monitoring capabilities. Consequently, it is too 
early to conclude on its effective and consistent implementation. 

Recommendation No 2 (important): planning of scientific projects and work packages 

JRC has established corporate guidelines for the detailed planning of scientific projects but has not yet put in 
place a centralised or harmonised management tool at project level. A new module in JRC project browwer, 
called the project work plan, was expected to be finalised by the second quarter of 2021 but its development 
only started recently (as JRC project brower system providers (JRC Unit I.5) had difficulties hiring consultant 
developers  throughout  2020  due  to  COVID-19).  Furthermore,  JRC  is in  the  process  of  putting  in  place  clear 
guidance  on  planning,  accompanied  by  a  monitoring  process  to  revise  the  approach  to  planned  outputs 
(deliverables).  

Recommendation No 3 (very important): monitoring of scientific projects’ and work packages’ execution 

JRC was recommended to improve the monitoring of the execution of its work programme and work packages 
by  designing  and  implementing  adequate  project  management  monitoring  practices  for  the  work  packages 
execution  (as  part  of  the  new  scientific  project  management  methodology  and  guidance  implementation12) 
and by providing a JRC-wide guidance for monitoring at work package, unit and scientific directorate levels13.   

The  monitoring  of  the  work  package  (now  called  project)  execution  level  is  covered  by  the  new  procedure 
‘IMS-JRC-C1.1-PRO-0012:  Execution  and  monitoring  of  scientific  research  projects’.  However,  the  procedure 
for the monitoring at work programme level14 still has to be completed, pending the finalisation of the new 
‘Project work plan’ module in JRC project browser. 

34. Follow-up audit in JRC on nuclear decommissioning and waste management 

programme implementation 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (very important): human resources management 

The following recommendation was assessed as not fully and/or adequately implemented. 

10  

In 2012, JRC launched the development of the Integrated Management System (IMS), an integrated 
framework of processes intended to enable the Directorate-General to work as a single entity and to 
achieve its unified objectives. 

11   A new IT module specifically designed for JRC. 
12   Recommendation 3a). 
13   Recommendation 3b). 
14  

IMS-JRC-M3.1-PRO-0012: work programme monitoring and reporting. 

53 

 
                                                                                                                                                                             
Recommendation No 2 (important): information technology tools supporting the decommissioning and waste 
management programme implementation 

JRC has made an inventory  of  the information technology tools supporting the  decommissioning and waste 
management  programme 
(i.e.  the  software  applications  used  for  administration, 
management  of  measurements,  management  of  waste,  management  of  sources  and  measurement 
instrument purposes) and has concluded that there is no duplication among the tools. 

implementation 

However, the conclusion is not based on a documented analysis of the possible integration of the applications 
used in different sites. Moreover, there is no documentation of the analysis of the roadmap mentioned in the 
action plan and JRC has not yet communicated the measures taken  to build adequate in house information 
technology  expertise  for  its  critical  information  technology  tools.  The  purpose  of  these  measures  is  to 
decrease JRC’s dependence from external contractors. 

35. Follow-up audit in JRC on site management infrastructure support services 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 3 (important): procurement implementation 

The following recommendation was assessed as not fully and/or adequately implemented. 

Recommendation No 4 (important): asset management: stocktaking exercise for fixed assets 

JRC, in the frame of the JRC asset management network: 

  Decided to perform physical inventory on a continuous basis in all JRC sites. 

  Decided  to  further analyse  the  cost-effectiveness of  outsourcing  physical  inventory  controls,  based 
on  experiences  already  gained  from  two  sites  supporting  different  approaches  including  partial 
outsourcing. 

  Requested all units to ensure proper back-up arrangements for stocktaking exercises. 

  Acknowledged that adequate storage space has been allocated in Ispra for items to be donated. 

However, JRC has not yet completed the analysis of the cost-effectiveness of outsourcing physical inventory 
controls and has not yet implemented measures to ensure that the responsible units are adequately staffed. 

36.  Follow-up audit in JRC on information technology governance and project 

management 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (very important): information technology project management practices 

37. Follow-up  audit  in  DG  JUST  on  human  resources  management  and  staff 

allocation 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

54 

 
Recommendation No 1 (important): DG JUST’s human resource strategy 

38. Follow-up  audit  in  DG  JUST  on  Connecting  Europe  Facility  telecom 
governance  (DG  CNECT,  DGT,  DG  DIGIT,  DG  EMPL,  DG  GROW,  DG  JUST, 
DG SANTE) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): internal governance arrangements 

39. Follow-up  audit  in  DG  MARE  on  monitoring  the  implementation  and 
performance  of  2014-2020  operational  programmes  (DG  EMPL,  DG  MARE, 
DG REGIO)  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 3 (important): reporting on implementation 

40. Follow-up  audit  in  DG  NEAR  on  indirect  management  with  entrusted 

entities (DG INTPA, DG NEAR) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 2 (important): guidance on the contribution agreement template 

Recommendation No 4 (important): negotiating and preparing indirect management contracts 

Recommendation No 8 (important): implementing contractual provisions: management declarations 

41. Follow-up audit in DG NEAR on the neighbourhood investment facility and 
the  Western  Balkans  Investment  Framework  (based  on  two  follow-up 
audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 3 (important, downgraded from very important): financial management 

Recommendation  No  5  (important):  Western  Balkans  investment  framework  –  screening,  assessment  and 
approval of grants 

The following recommendation was assessed as not fully and/or adequately implemented. 

Recommendation No 8 (very important): Western Balkans investment framework - financial management and 
financial reporting  

DG NEAR has: 

55 

 
  Updated the guidelines on the preparation of the grant application form as regards the preparation of 
the  payments  schedules  of  the  projects  financed  by  the  European  Western  Balkans  joint  fund.  The 
grant application forms funded by the European Western Balkans joint fund approved since 2019 now 
have payment schedule included in their final version. 

  Taken on board the IAS recommendation in its discussions with the European Investment Fund and the 
European Bank for Reconstruction and Development for the two successor equity funds ENIF 15 II and 
ENEF16 II. The EU contribution for these funds will only be paid in instalments, to respond to the needs 
of  the  fund  and  respective  calls for  funds.  The  respective  payment  forecasts  are  already  encoded  in 
MIS17.  

  Obtained from the European Bank for Reconstruction and Development detailed financial information 
for 2019 and 2020. The 2019 management declaration contains commitments and disbursements and 
fees at the level of each EU grant of EU funds received into European Western Balkans joint fund and 
from  European  Western  Balkans  joint  fund  to  international  financial  institutions  for  grants  signed  in 
2016 and 2017.  

  The IAS observed that the declaration was obtained in December 2020, i.e. one year after the end of 
the  relevant  implementation  period  (2019).  The  IAS  suggests  that  DG  NEAR  insists  to  receive  the 
information earlier so that it enables adequate monitoring of the commitments and disbursements at 
project level, as well as of the fees due and paid. 

  Analysed  the  open  pre-financing  and  performed  the  clearing  as appropriate.  A  specific  action  plan  is 

implemented for each cluster of contracts, namely: 

  all  open  Instrument  of  Pre  Accession  I  pre-financing  that  could  be  reasonably  recognised  as  cost 

was cleared; 

  for  contribution  arrangements  signed  after  the  approval  of  the  new  general  conditions  of  the 
European Western Balkans joint fund in 2016, DG NEAR run last year the first clearing exercise for 
the  three  lead  international  financial  institutions  implementing  EU  financed  grants  under  the 
European Western Balkans joint fund. 

DG NEAR has not revised the general conditions linked to the calculation of the fees for cancelled or partially 
implemented  grants.  This  will  be  done  at  the  end  of  2021,  in  conjunction  with  updating  of  the  Western 
Balkans Investment Facility legal framework. Considering the significant progress made in its implementation, 
this recommendation is downgraded from ‘very important’ to ‘important’. 

42. Follow-up audit in DG NEAR on annual audit plans 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): roles, responsibilities and guidance 

The following recommendations were assessed as not fully and/or adequately implemented. 

Recommendation No 2 (very important): follow-up of audit results 

Sub-recommendation 2.1: follow-up of financial findings 

15   Enterprise Innovation Fund.  
16   Enterprise Expansion Fund.  
17   MIS: IT tool supporting the implementation and monitoring of the WBIF. 

56 

 
                                                        
  DG  NEAR  updated  the  manual  of  procedure  by  instructing  the  responsible  authorising  officers  by 
sub-delegation  that  in  case  of  financial  findings  he/she  shall  take  actions  that  ‘go  beyond  the 
recovery of ineligible expenditure’ and depend ‘on the type and seriousness of the findings’.  

Among  the  possible  actions,  the  manual  quotes  ‘meetings  with  the  beneficiary  to  discuss  the 
findings and possible remedial actions, increasing the probability of the ‘legality and regularity’ risk 
factor in the risk assessment of other contracts with the same beneficiary, and/or including controls 
on other contracts with the same beneficiary in the annual control plan’.  

In  relation  to  ‘increasing  the  probability  of  the  legality  and  regularity  risk  factor’,  ‘DG  NEAR’s 
Guidelines  on  Risk  Assessment  and  Establishment  of  the  Directorate-General’s  Control  Plan  2021’ 
refer to a couple of issues to be taken into consideration when assessing the risk, namely the nature 
and  gravity  of  findings  of  previous  verifications  and  audits  and  the  follow-up  of  findings  from 
previous verifications/ audits.  

However,  the  IAS  found  that  the  manual  and  the  risk  assessment  guidelines  are  too  generic  and 
therefore do not provide sufficient guidance to authorising officers by sub-delegation on actions to 
take when following up financial findings. 

 

The part of the action plan concerning the implementation of Article 202 of the Financial Regulation 
on  the  extrapolation  of  audit  results  and  the  inclusion  of  relevant  provisions  in  DG  NEAR’s  model 
grant has not yet been implemented. A general corporate template for the model grant agreement 
reflecting such a possibility was adopted in June 202018, however it has not been integrated into the 
‘Practical  guide  on  contract  procedures  for  European  Union  external  action’.  Moreover,  DG  NEAR’s 
contract templates still do not include a  relevant provision on the extrapolation of audit results to 
other grants.  

According to DG NEAR, the new corporate model grant agreement is still not in use due to ongoing 
discussions  between  DG  INTPA,  DG  NEAR  and  central  services  on  the  complex  specificities  of 
external action grants. 

Sub-recommendation 2.2: findings stemming from verification missions to international organisations 

During the audit on annual audit plans, the IAS found that neither the EU Delegations nor the Headquarters 
followed up on the non-financial findings stemming from verification missions to international organisations, 
hence possibly failing to identify repetitive internal control issues that might affect their pillar-compliance and 
the  reliance  that  can  be  put  on  their  internal  control  systems.  In  its  action  plan,  DG  NEAR  committed  to 
undertake  a  yearly  in-house  (by  EU  Delegations  for  their  verifications  and  Unit  R.3  for  Headquarter 
verifications) analysis of the findings. 

However, this recommendation was put on hold in October 2020 pending the completion of the IAS audit on 
pillar assessment where a similar issue was detected for the other Directorates-General in the external action 
family.  In  the  final  report  of  this  audit,  the  IAS  recommended  to  DG  INTPA  to  modify  the  expenditure 
verification  report  template  used  by  both  DG  INTPA  and  DG  NEAR  in  order  to  allow  auditors  to  report  on 
relevant/systemic  internal  control  and  pillar compliance-related  findings,  hence  enabling  DG  NEAR  to  obtain 
the information necessary for a proper follow up of non-financial issues. Following DG INTPA’s acceptance of 
this recommendation, DG NEAR resumed the implementation of its recommendation 2.2 and set a new target 
date for it completion by 14 January 2022.  

Recommendation No 3 (very important): key performance indicators and reporting 

18   C(2020)3759 amending Commission Decision C(2018) 5120 on the Internal rules on the implementation 
of the general budget of the European Union (European Commission section) as regards the model grant 
agreement for use as from 2021. 

57 

 
                                                        
Jointly with DG INTPA, DG NEAR adjusted the benchmarks for the audit related key performance indicators 21, 
22 and 23, setting revised targets for 2020/2021 and agreed to the establishment of a new key performance 
indicator 25 measuring the percentage of reduction of expired unclosed audits.  

The 2020 and 2021 annual targets are as follow: 

Audit key performance indicators 

2020 

2021 

KPI 21 

KPI 22 

KPI 23 

% of audits contracted Year N 

% draft audit reports received Year N-1 

% final reports received: Year N-2 

New KPI 25 

% reduction of expired unclosed audits 

70% 

60% 

70% 

30% 

70% 

70% 

80% 

40% 

However, the IAS considered that the action plan is not fully implemented for the following reasons: 

 

The revised targets of the key performance indicators related to effectiveness of DG NEAR’s audit 
system  are  not  ambitious  enough  to  ensure  full  completion  of  the  annual  audit  plan  within  the 
three-year  implementation  timeframe  (where  only  80%  of  the  final  reports  are  expected  to  be 
finalised).  

The  IAS  observed  that  all  directorates  of  DG  NEAR  reached  the  2020  targets  for  key  performance 
indicators 21-23 and for the new key performance indicator 25, except for key performance indicator 22 
due to the restrictions from the COVID-19 pandemic. Moreover, regarding the revised key performance 
indicators 21 to 23, DG NEAR strongly encouraged staff to exceed the minimum target values for 2021 
and  to  complete  audits  as  early  as  possible  (earlier  than  planned)  in  the  three-year  implementation 
period.  However,  the  increase  of  key  performance  indicators  22,  23  and  25  targets  is  too  modest  to 
enable the timely completion of the annual audit plan. 

 

 

For key performance indicators 21 and 22, the number of audits contracted and draft audit reports 
received  (i.e.  intermediate  outputs)  are  still  used  instead  of  focusing  on  the  number  of  approved 
final reports as recommended. 

The target for former key performance indicator 25 (now key performance indicator 24) ‘ineligible 
amounts identified by audits as % of audited amount’, has not been dropped19 as recommended. 

  Key performance indicators 23 (now key  performance indicator 22) and 24 (now  key performance 

indicator 23) have not been correctly reported in DG NEAR’s Annual Activity Report. 

DG INTPA also introduced two other indicators I8 and I9 in the key performance indicator dashboard to 
enable  DG  NEAR  to  address  the  IAS  recommendation  on  monitoring  the  completion  of  the  audit  and 
verification plans. The new indicators are currently being measured, however: 

  No  targets  have  been  set.  Consequently  is it  not  clear on  which  basis the  Directorate-General  will 

assess the satisfactory implementation of the audit plans. 

 

They  are  not  yet  reported  in  DG  NEAR’s  Annual  Activity  Report.  Consequently,  it  is  too  early  to 
conclude on the effective implementation of the recommendation. 

19   Part of recommendation 3.3.  

58 

 
 
                                                        
43. Follow-up  audit  in  DG  NEAR  on  pillar  assessment  in  the  external  action 
family (DG BUDG, DG ECHO, FPI, DG INTPA, DG NEAR) (based on two follow-
up audits performed in 2021) 

Based  on  the  results  of  the  follow-up  audits,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 4 (very important): guidance on pillar assessment process 

Recommendation No 14 (very important): substantive changes 

Recommendation No 21 (critical): agreements signed with pillar assessed entities 

Recommendation No 24 (very important): Commission services’ involvement in the pillar assessment process 

44. Follow-up audit in DG NEAR on EC-EEAS coordination (EEAS, FPI, DG INTPA, 

DG NEAR) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1.2 (very important): country-level coordination. 

45. Follow-up audit in DG NEAR on the grant and procurement  award process 

under the European Neighbourhood Instrument’s direct management 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): procedures and guidance 

Recommendation No 2 (important): implementation of grant and procurement award procedures 

The following recommendation was assessed as not fully and/or adequately implemented: 

Recommendation No 3 (very important): supervision missions  

DG NEAR has duly updated its process manual for supervision missions, according to the recommendations on 
multi-annual planning frequency, performance and follow-up of the missions. It has also addressed the issue 
of  sharing  problems identified  during  missions  with  other  EU  Delegations  and the  external  action  family  of 
Directorates-General.  However,  in  practice  the  frequency  of  missions  had  not  increased  despite  the 
requirement in the updated manual of July 2019. Furthermore, as from March 2020, no missions could occur 
due  to  the  COVID-19  restrictions.  The  IAS  acknowledged  that  DG  NEAR  has  put  in  place  a  temporary 
methodology  to  supervise  the  Delegations  remotely.  As  these  measures  do  not  fully  mitigate  the  identified 
residual  risks,  the  IAS  will  further  follow-up  the  effective  implementation  of  this  recommendation  once 
missions have resumed. 

46. Follow-up  audit  in  OP  on  information  technology  governance  and  project 

management 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

59 

 
Recommendation No 1 (very important): governance practices for monitoring 

Recommendation No 3 (important): information technology project management practices 

47. Follow-up audit on past audits in PMO 

Audit on effectiveness of the management of absenteeism in the Offices (OIB, OIL, PMO)  

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented and was closed: 

Recommendation No 1 (important): monitoring and analysis of absences at office level.  

Audit on control strategy for the Joint Sickness and Insurance Scheme and accidents insurance: 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
assessed as not fully and/or adequately implemented: 

Recommendation No 1 (very important): review and documentation of Joint Sickness and Insurance Scheme 
control strategy. 

The IAS recommended PMO to review the various components which make up its control strategy for the Joint 
Sickness Insurance Scheme and accidents and bring these together in a formalised and consolidated control 
strategy document, which should clearly describe the control objectives, the main actors and their roles and 
responsibilities,  as  well  as a  risk analysis,  including  the  intensity  and frequency  of  the  ex  ante  and  ex  post 
controls. It should also include the automated information technology controls, the anti-fraud measures put in 
place,  the  reporting  on  the  results  of  controls  together  with  their  evaluation  and  follow-up.  This  document 
should be regularly reviewed and updated and approved by the Authorising Officer by Delegation. 

PMO  described  in  a  single  document  the  control  strategy  which  is  structured  on  three  control  layers  (IT 
controls/warnings, ex ante controls and ex post controls). While the IAS acknowledges the progress made to 
consolidate  the  various  control  documents/guidance  available,  the  consolidated  control  strategy  document 
needs to be further strengthened. In particular, more information is needed on the roles and responsibilities of 
the  different  actors,  the  results  of  the  risk  analysis,  the  way  the  different  control  activities  are  integrated 
when calculating error rates and drawing assurance conclusions and how the issues identified are followed-
up. Furthermore, this document, which should integrate any changes in the control procedures resulting from 
the  other  open  recommendations20,  should  be  approved  by  the  Authorising  Officer  by  Delegation  and 
communicated to all actors concerned.  

48. Follow-up audit in DG SANTE on TRAde Control and Expert System (TRACES) 

(based on two follow-up audits performed in 2021) 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): information technology governance 

Recommendation No 4 (important): project management and application support 

The following recommendation was assessed as not fully and/or adequately implemented: 

20 Reference final audit report: Ares(2019)404417 – 24 January 2019 (Recommendations No 2, 3, 4 and 5). 

60 

 
                                                        
Recommendation No 2 (very important): information technology security 

The recommendation consists of 10 sub-recommendations of which 8 have been implemented. 

For the remaining two sub-recommendations, significant progress has been made, but the following actions 
still need to be completed: 

 

 

Finalise the feasibility study to assess whether secure hosting can support the business requirements 
and service/operations continuity of TRACES.  

Finalise the implementation of the security measures defined in the security plan for TRACES. 

The  IAS  recognised  the  progress  made  on  strengthening  the  security  of  TRACES  and  considers  that  the 
residual risk has been reduced for this recommendation. As a consequence, the recommendation remains but 
the rating was downgraded from ‘very important’ to ‘important’. 

49. Follow-up  audit  in  DG  SANTE  on  Connecting  Europe  Facility  telecom 
governance  (DG  CNECT,  DGT,  DG  DIGIT,  DG  EMPL,  DG  GROW,  DG  JUST, 
DG SANTE) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (important): internal governance arrangements 

Recommendation No 2 (important): performance framework 

50. Follow-up audit in SG on data protection (DG DIGIT, DG HR, JRC, LS, SG) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation  No  1a  (very  important):  Data  Protection  Officer:  guidance  on  the  Data  Protection 
Coordinator function 

Recommendation  No  2a  (very  important):  Data  Protection  Officer:  guidance  on  the  shared  Data  Protection 
Coordinator function 

51. Follow-up audit in DG TAXUD on human resources management 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented and were closed: 

Recommendation No 1 (very important): human resources strategic management 

Recommendation No 2 (important): human resources monitoring and reporting 

Recommendation No 5 (important): staff development 

61 

 
Of  five  accepted  (all)  recommendations,  (3  'very  important'),  DG  TAXUD  timely  implemented  three:  two 
important  and  one  very  important.  Two  remaining  very  important  recommendations  on  mapping  tasks  and 
skills  and  on  workload  assessment  and  staff  allocation  have  original  implementation  date  end  June  2021, 
extended until June 2022. By the end 2021, DG TAXUD had implemented some parts on both very important 
recommendations. 

52. Follow-up audit in DG TRADE on human resources management 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
assessed as not fully and/or adequately implemented: 

Recommendation No 1 (important): flexible project teams.  

DG  TRADE  has  provided  a  definition  of  flexible  project  team/task  force  and  has  published  a  guidance 
document on setting up DG TRADE’s project teams/task forces and the list of the task forces in place. 

In  particular,  the  guidance  document  defines  the  procedure,  rule  and  guidance  for  the  establishment  of 
project  teams/task  forces  as  well  as  the  applicable  working  arrangements.  However,  DG  TRADE  has  not 
defined  the  final  deliverables  of  project  teams/task  forces  and  has  not  collected  feedback  and  assessed 
possible  improvements  of  the  implementation  of  these  flexible  working  arrangements  after  six  months  of 
experience with them. 

62 

 
 
 
List  of  audits  for  which  all  recommendations  have  been 
closed in 2021 after a follow-up audit 

Based on the results of the follow-up audits performed in 2021, the IAS assessed that the following audits 
listed below could be fully closed as all the recommendations had been implemented. 

Audit Title 

53. Audit on effectiveness and efficiency of the new Early Detection and Exclusion System 
in protecting the EU financial interests (DG BUDG, DG INTPA, DG REGIO, DG RTD) 

54. Audit on evaluations and studies (DG CLIMA, DG ENV) (based on two follow-up audits 
performed in 2021) 

55. Audit on dissemination and exploitation of Horizon 2020 results (DG CNECT, ERCEA, 
REA, DG RTD) (based on four follow-up audits performed in 2021) 

56. Audit on the production process and the quality of statistics not produced by Eurostat 
(DG ENER, DG ESTAT, DG FISMA, DG GROW, DG JUST) (based on three follow-up audits 
performed in 2021) 

57. Audit on the financial management of the 2014-2020 European Agricultural Fund for 
Rural Development in DG AGRI 

58. Audit on the design and implementation of CHAFEA’s control strategy 

59. Audit on international activities in DG ENV (based on two follow-up audits performed in 
2021) 

60. Audit on the monitoring and enforcement of European Union health law in DG SANTE 

61. Audit on Horizon 2020 ex ante controls on payments in DG CNECT 

62. Follow-up audit on past audits in DG ENER: 

Audit on the implementation of the control  strategy of DG ENER for the delegated bodies 
implementing the Nuclear Decommissioning Assistance Programme 

Audit on legacy programmes in DG ENER - management of final payments and closure 

63. Follow-up audit on past audits in DG RTD: 

Audit on the design and set-up of the internal control systems for Horizon 2020 in DG RTD  

Audit on Horizon 2020 ex ante controls on payments in DG RTD 

Consolidated report on Horizon 2020 project management and ex ante controls audits  

Audit on H2020 project management in DG RTD 

64. Audit on enforcement of the EU antitrust policy - cooperation with EU national 
competition authorities and national courts in DG COMP  

65. Audit on supervision of project management and payment for Galileo in DG DEFIS 

66. Follow-up audit on past audits in EASME: 

Audit on H2020 project management in EASME  

Audit on LIFE project management in EASME 

67. Audit on the effectiveness and efficiency of the performance management system in 
DG ECFIN  

68. Audit on the adequacy of DG GROW's preparation and supervision of the parts of the 
COSME work programme delegated to EASME 

69. Audit on monitoring of EU law implementation in DG TAXUD 

63 

 
70. Follow-up audit on past audits in DG INTPA:  

Audit on annual audit and verification plans and implementation of audit results in DG 
INTPA 

71. Audit on direct management of grants (DCI & EDF) in DG INTPA 

72. Audit on the performance management system in DG INTPA 

73. Audit on information technology governance in DG INTPA 

74. Audit on ex ante payments under European Neighbourhood Instrument and European 
Neighbourhood and Partnership Instrument in DG NEAR 

75. Audit on grant management phase III – ex post controls in EACEA 

76. Follow-up audit on past audits in DG JUST: 

Audit on procurement in DG JUST 

Audit on impact assessment in DG JUST 

77. Audit on the procurement process in DG DIGIT  

78. Audit on effectiveness of DG ESTAT’s cooperation with external stakeholders 

79. Audit of the Anti-Fraud Information System (AFIS) in OLAF 

80. Limited review on the implementation of the new internal control framework in OP 

81. Audit on management of accidents’ insurance in PMO 

82. Audit on the charge-back process in PMO 

83. Audit on the management of information technology security in DG DIGIT  

84. Audit on security of information technology applications supporting nuclear 
accountancy and inspection processes in DG ENER 

85. Audit on information technology security management in DG RTD 

86. Audit on supervision of outsourced information technology operations in DG TAXUD 

64 

 
Part  3:  summary  of  long-outstanding  recommendations  –  state  of  play  as  at  31 
January 2022 

No. 

DG 

Audit title 

Recommendation 

Comments 

I 

BUDG 

Recovery orders 
and bank 
guarantees for fines 

Dealing with 
insolvencies and 
bankruptcies 

DG BUDG reported that a substantial part of the recommendation is already implemented. 
However, the set up of a comprehensive and reliable set of tools at Commission level to monitor 
the financial and legal situation of contractors and beneficiaries is on-going. This action has been 
included into the proposal for a corporate strategy for the management of accounts receivable 
prepared by DG BUDG. The ‘Communication to the Commission - An enhanced corporate debt 
management strategy’ is planned to be launched in interservice consultation for adoption by the 
Commission in the second quarter of 2022. 

A follow-up will take place in the second quarter of 2022 as soon as DG BUDG reports the 
recommendation as ‘ready for review’. 

Expected delay between the originally agreed and revised expected completion dates 
is 12 months. 

Final 
report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

20.11.2019 

30.6.2021 

30.9.2022 

65 

 
 
No. 

DG 

Audit title 

Recommendation 

Comments 

II 

BUDG 

Pillar assessment in 
the external actions 
family 

Corporate oversight 

III 

TAXUD  HR management in 
DG TAXUD 

Human resources 
management: task 
and skills mapping 

Following the recommendation to further develop its corporate oversight role, create the 
necessary tools for it and formalise it in the Internal Rules of the Commission, DG BUDG has 
clarified its role and the mandatory nature of its instructions as regards pillar assessment. In the 
framework of its function, DG BUDG has developed guidance and instructions, including prior 
approval, has put in place a central repository of pillar assessed entities and is working on an 
automated version of this repository to enable  access to reliable information by all Services and in 
a second stage to process all stages of pillar assessments. 

The formalisation of DG BUDG’s corporate oversight role is one of the elements of the Internal 
Rules revision which is ongoing after the closure of the inter-service consultation on 11 May 2022. 
DG BUDG has modified the completion date accordingly. The original high risk has however been 
substantially mitigated meanwhile.  

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’. 
Expected delay between the originally agreed and revised expected completion dates 
is 12 months. 

The IAS recommended that DG TAXUD should implement processes to map tasks and skills 
covering all the activities of the service. 

The DG reported that the implementation of the recommendation is delayed due the lack of 
resources and the forthcoming adoption of the Commission’s new corporate HR strategy. 

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’. 

Expected delay between the originally agreed and revised expected completion dates 
is 12 months. 

Final 
report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

29.1.2021 

30.6.2021 

30.6.2022 

28.01.2020 

30.6.2021 

30.6.2022 

66 

 
No. 

DG 

Audit title 

Recommendation 

Comments 

IV 

TAXUD  HR management in 
DG TAXUD 

Workload 
assessment, staff 
allocation and 
project team 

The IAS recommended that DG TAXUD should develop a workload assessment framework and 
assess if the current allocation of staff is appropriate by taking into consideration the tasks to be 
accomplished and the workload across the DG. It should also set up its expectations and the 
conditions for applying flexitime recuperation and analyse the reasons for non-recoverable 
overtime. Moreover, it should further promote project teams and put in place relevant guidelines. 

The DG reported that the implementation of the recommendation is delayed due the lack of 
resources and the forthcoming adoption of the Commission’s new corporate HR strategy. 

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’. 

Expected delay between the originally agreed and revised expected completion dates 
is 12 months. 

Final 
report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

28.01.2020 

30.6.2021 

30.6.2022 

67 

 
Final 
report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

20.1.2017 

22.12.2017 

31.3.2022 

No. 

DG 

Audit title 

Recommendation 

Comments 

V 

OIB 

Procurement 
process 

Procurement 
procedures 

OIB prepared a working document including a proposal to revise substantially the current real 
estate procedure (‘Kallas procedure’) and submitted it at the end of September 2018 to the 
working group that was set up to prepare the revision of the procedure to align it with the 
Financial Regulation. Technical meetings took place with DG HR which submitted the revised new 
Kallas methodology to OIB in September 2020. The revised procedure was discussed with DG 
BUDG and the Legal Service. According to OIB, the further delay is due to the COVID-19 pandemic 
situation and the necessary changes in the Commission’s real estate strategy. 

According to recent information provided by OIB in February 2022, Annex 20 of the Commission 
Decision C(2018) 5120 on the Internal rules for the implementation of the general budget of the 
EU, constitutes currently the formalised rules for the management of real estate transactions and 
they are aligned with the provisions of the Financial Regulation. 

The drafting of the replacement of the above “Kallas methodology”, a methodology deriving from 
a Communication from the Commission in 2007 (COM(2007) 501), is being finalised. OIB, OIL, 
BUDG, SG, LS and DG HR have already agreed at operational level on a new document, which 
describes the various steps to be followed regarding the acquisition/occupation of Commission’s 
buildings. 

The current state of play (the Financial regulation and Annex 20 of the Commission Decision 
C(2018) 5120) with the new document describing the methodology for acquisition/occupation of 
Commission’s buildings sufficiently mitigates the identified weaknesses. Consequently, the OIB 
reported the recommendation as ‘ready for review’ in mid-February 2022. A follow-up will take 
place in the second quarter of 2022.  

Expected delay between the originally agreed and revised expected completion dates is 4 years 
and 3 months. 

68 

 
No. 

DG 

Audit title 

Recommendation 

Comments 

VI 

OLAF 

Human resources 
strategy 

Human resources 
strategic plan and 
monitoring 

VII 

SANTE 

Efficiency and 
effectiveness of the 
Health and Food 
audits and analysis 
service 

Staffing of activities 

The IAS found that the human resources strategic plan, adopted in January 2019, did not refer to 
a detailed analysis of future staffing (in quality and quantity) needed to achieve the business 
objectives. In addition, OLAF had not established a monitoring framework to follow the 
implementation of the strategic plan. For consistency purposes, OLAF prefers to wait for the 
adoption of the Commission’s new corporate HR strategy before it issues a new OLAF HR strategic 
plan. 

The IAS will perform a follow-up audit once the recommendation is reported as ‘ready for review’. 

Expected delay between the originally agreed and revised expected completion dates is 1 year and 
3 months. 

The IAS recommended that DG SANTE should assess the impact of the remote location (Grange, 
Ireland) and the recruitment needs of its Health and Food Audits and Analysis Directorate and 
develop an HR strategy in relation to it. 

The DG reported that the implementation of the recommendation was delayed due the COVID-19 
pandemic and the forthcoming adoption of the Commission’s new corporate HR strategy. 

Expected delay between the originally agreed and revised expected completion dates is 2 years 
and 6 months. 

Final 
report 
date 

Original 
agreed 
completion 
date 

Revised 
expected 
completion 
date 

17.12.2019 

31.12.2020 

21.4.2022 

24.10.2019 

30.06.2020 

31.12.2022 

VIII 

SANTE 

Efficiency and 
effectiveness of the 
Health and Food 
audits and analysis 
service 

Time reporting and 
performance 
monitoring 

The IAS recommended that DG SANTE should assess the scope for introducing a time recording 
system in the Audit and Analysis Directorate, collect and analyse performance information and 
finalise the development of the coverage of its audit universe. 

24.10.2019 

30.06.2020 

30.06.2022 

The DG reported that the implementation of the recommendation was delayed due the COVID-19 
pandemic. 

Expected delay between the originally agreed and revised expected completion dates is 2 years. 

69