REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2021
Date: 2022-06-07
Institutions: European Commission, Secretariat-General
Subjects: activity report, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 7.6.2022  COM(2022) 292 final  REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS                   Annual report to the Discharge Authority on internal audits carried out in 2021 {SWD(2022) 160 final}  
 
 
Table of Contents 

1. 
2. 

OBJECTIVES AND SCOPE OF THE REPORT ................................................................................... 2 
THE INTERNAL AUDIT SERVICE MISSION: ACCOUNTABILITY, INDEPENDENCE AND 
OBJECTIVITY ..................................................................................................................................... 2 
OVERVIEW OF AUDIT WORK ........................................................................................................... 3 
Implementation of the 2021 audit plan ............................................................................................ 3 
Statistical data on Internal Audit Service recommendations ............................................................ 4 
CONCLUSIONS BASED ON THE AUDIT WORK PERFORMED IN 2021 ....................................... 6 
Conclusion on performance audits ..................................................................................................... 6 

3. 
3.1. 
3.2. 
4. 
4.1. 
4.1.1.  Preparedness  for  the  implementation  of  the  2021-2027  Multi-annual  Financial 

Framework .......................................................................................................................................... 7 
4.1.2.  Supervision strategies for the implementation of programmes by third parties ............................. 8 
4.1.3.  Internal  control  systems  in  selected  Directorates-General:  Legality  and  regularity, 

compliance .......................................................................................................................................... 9 
4.1.4.  EU law implementation .................................................................................................................... 10 
4.1.5.  Information technology security ...................................................................................................... 11 
4.1.6.  Other processes ................................................................................................................................ 11 
4.2. 
Internal Audit Service limited conclusions ....................................................................................... 11 
4.3.  Overall opinion on the Commission’s financial management ......................................................... 12 
5. 
CONSULTATION WITH THE COMMISSION’S FINANCIAL IRREGULARITIES PANEL ................ 14 
6. 
MITIGATING  MEASURES 
INTEREST 
(INTERNATIONAL  INTERNAL  AUDITING  STANDARDS)  —  INVESTIGATION  OF  THE 
EUROPEAN OMBUDSMAN.............................................................................................................. 14 

CONFLICTS  OF 

POTENTIAL 

FOR 

1 

 
 
 
1.  OBJECTIVES AND SCOPE OF THE REPORT 

This  report  informs  the  European  Parliament  and  Council,  as  part  of  the  discharge  procedure,  about 
internal  audits  carried  out  in  2021  by  the  Internal  Audit  Service  of  the  European 
Commission  in  the  Commission  Directorates-General,  services  and  executive  agencies1.  It 
contains:  (i)  a  summary  of  the  number  and  type  of  internal  audits  carried  out;  (ii)  a  synthesis  of  the 
recommendations  made;  and  (iii)  the  action  taken  on  those  recommendations.  In  accordance  with 
Articles  118(8)  and  247  of  the  Financial  Regulation2,  the  Commission  forwards  the  report  to  the 
European Parliament and to the Council. It is based on the report drawn up in accordance with Article 
118(4) of the Financial Regulation by the Commission’s Internal Auditor on Internal Audit Service audits 
and consulting reports completed in 20213. 

2.  THE  INTERNAL  AUDIT  SERVICE  MISSION:  ACCOUNTABILITY,  INDEPENDENCE  AND 

OBJECTIVITY 

The  mission  of  the  Internal  Audit  Service  is  to  enhance  and  protect  organisational  value  by 
providing  risk-based  and  objective  assurance,  advice  and  insight.  The  Internal  Audit  Service 
helps the Commission accomplish its objectives by bringing a systematic, disciplined approach in order 
to evaluate and improve the effectiveness of risk management, control and governance processes. Its 
tasks  include  assessing  and  making  appropriate  recommendations  to  improve  the  risk  management, 
control and  governance processes to achieve the following three objectives: (i)  promoting appropriate 
ethics  and  values  within  the  organisation;  (ii)  ensuring  effective  organisational  performance 
management  and  accountability;  and  (iii)  effectively  communicating  risk  and  control  information  to 
appropriate areas of the organisation. In doing this, the Internal Audit Service aims to promote a culture 
of efficient and effective management within the Commission and its departments. 

The  independence  of  the  work  of  the  Internal  Audit  Service  is  enshrined  in  the  Financial 
Regulation and its mission charter 4 as adopted by the Commission. This charter stipulates that, to 
ensure objectivity in their judgement and avoid conflict of interest, Internal Audit Service auditors must 
preserve their independence in relation to the activities and operations they review. If their objectivity is 
impaired  in  fact  or  in  appearance,  the  details  of  the  impairment  should  be  disclosed.  If  the  Internal 
Auditor  considers  it  necessary,  he/she  may  address  himself/herself  directly  to  the  President  of  the 
Commission and/or the College. 

The  Internal  Audit  Service  performs  its  work  in  accordance  with  the  Financial  Regulation,  the 
International Standards for the Professional Practice of Internal Auditing, and the Code of Ethics of the 
Institute of Internal Auditors. 

The Internal Audit Service reports — and is accountable functionally — to the Audit Progress 
Committee.  The  Internal  Audit  Service: (i)  reports to  the  Audit  Progress Committee  significant  issues 
arising  from  its  audits  and  potential  improvements  to  the  audited  processes;  (ii)  provides  an  annual 
overall  opinion  on  the  state  of  financial  management  in  the  Commission;  and  (iii)  reports  (at  least 
annually)  on  its  mission  and  performance, as  set  out  in  its  annual  audit  plan.  This  reporting  includes 
significant risk exposures, control issues, corporate governance issues and other matters. 

1  

2  

3  

4  

The report does not cover the decentralised European agencies, the European External Action Service or other bodies audited by the 
Internal Audit Service, which receive separate annual reports. 

Regulation  (EU,  Euratom)  2018/1046  of  the  European  Parliament  and  of  the  Council  of  18  July  2018  on  the  financial  rules 
applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, 
(EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision No 541/2014/EU 
and repealing Regulation (EU, Euratom) No 966/2012OJ L 193, 30.7.2018. 

The audit reports finalised in the period 1 February 2021 to 31 January 2022 are included in this report. 

Communication to the Commission, Mission Charter of the Internal Audit Service of the European Commission,  C(2020)1760 final 
of 25 March 2020. 

2 

 
 
                                                           
The  Audit  Progress Committee  assists the  College  of  Commissioners  in  fulfilling  its  obligations  under 
the Treaties, the Financial Regulation and other statutory  instruments.  It does this by:  (i) ensuring the 
independence  of  the  Internal  Audit  Service;  (ii) monitoring  the  quality  of  internal  audit  work; 
(iii) ensuring that internal and external audit recommendations are properly taken into account by the 
Commission  services; and  (iv)  ensuring  that  these  recommendations  receive  appropriate  follow-up.  In 
this way, the Audit Progress Committee helps improve the Commission’s effectiveness and efficiency in 
achieving  its  goals.  The  Audit  Progress  Committee  also  facilitates  the  College’s  oversight  of  the 
Commission’s governance, risk management, and internal control practices5.  

The Internal Audit Service does not audit Member States’ systems of control over the EU funds. Such 
audits  reach  down  to  the  level  of  individual  beneficiaries,  and  are  carried  out  by  Member  States’ 
internal auditors, national audit authorities, other Commission Directorates-General and the European 
Court of Auditors. However, the Internal Audit Service does audit measures taken by the Commission to 
supervise  and  audit:  (i) bodies  in  Member  States;  and  (ii) other  bodies  which  are  responsible  for 
disbursing EU funds, such as the United Nations. As provided for in the Financial Regulation, the Internal 
Audit Service can carry out these duties on the spot, including in the Member States.  

3.  OVERVIEW OF AUDIT WORK 

3.1. 

Implementation of the 2021 audit plan 

The Internal Audit Service implemented the 2021 audit plan in the context of the COVID-19 pandemic, 
in  full  respect  of  the  applicable  working  arrangements  at  corporate  level.  Despite  the  challenges 
brought  by  these  circumstances,  the  Internal  Audit  Service  completed  143  ‘engagements’  (audits, 
consulting, follow-ups and reviews), and issued  148  reports (including  follow-up and closing notes)6. 
This  was  achieved  by  using  the  digitalisation  opportunities  available  in  the  Commission,  with  tools 
supporting efficient and effective remote auditing processes. 

The overall number and breakdown by type of engagements and reports completed is contained in the 
charts below.  By the cut-off  date of 31 January 2022, 100% of the 2021 audit plan as updated to 
take account of the evolving risks at mid-year had been implemented. 

No of 2021 engagements by type

No of 2021 reports by type

3

27

4

5

143

108

108

31

5

148

Audit
Follow-up

Consulting
Limited review

Audit
Follow-up

Consulting
Limited review

Source: European Commission, Internal Audit Service 

5  

6  

For details, see Communication to the Commission, Charter of the Audit Progress Committee of the European Commission, C(2020) 
1165 final of 27 February 2020. The Charter of the Audit Progress Committee was updated in 2020 to take account of the 2019—
2024 Commission entering into office on 1 December 2019 and changes in the Committee’s membership. 

The Internal Audit Service audit universe of the Commission includes in total 50 organisational entities. For some of these entities, 
more  than  one  final  audit,  review  or  consulting  report  was  issued  in  2021.  See  the  Staff  Working  Document  for  the  detailed 
overview of entities for which final audit, review or consulting reports were issued. 

3 

 
 
 
 
                                                           
The initial 2021 plan contained 38 audit engagements (audits, reviews and  consulting engagements, 
but excluding follow-ups) planned to be completed by the cut-off date of 31 January 2022, moreover, 
the 2021 initial plan contained 35 additional engagements planned to start before 31 January 2022 
and  to  be  completed  after  that  date.  The  2021  initial  plan  was  updated  in  September  and  October 
2021. The Audit Progress Committee took both the initial and updated plans into consideration. 

The  Internal  Audit  Service  plans  its  audit  work  on  the  basis  of  a  risk  assessment  and  a  capacity 
analysis. This is required by its charter and international standards, aims at defining a plan that covers 
the  highest  risk  areas,  hence  maximising  the  added  value  of  the  Internal  Audit  Service,  and  helps 
ensuring  the  best  use  of  resources  and  the  efficient  and  effective  implementation  of  the  plan.  Its 
implementation is regularly monitored and adjusted as necessary. 

3.2.  Statistical data on Internal Audit Service recommendations 

The figure below shows the number of recommendations the Internal Audit Service issued in 2021.  

No of 2021 recommendations by rating

0

20

40

60

80

100

120

140

g
n
i
t
a
R

45

87

132

N°

Very Important

Important

Total

Source: European Commission, Internal Audit Service 

An  annual  comprehensive  overview  of  the  Internal  Audit  Service  follow-up  of  internal  audit 
recommendations which were more than six months overdue on the cut-off date of 31 January 2022 
was addressed to the Audit Progress Committee. Moreover, the Internal Audit Service prepares three 
additional  quarterly  reports  on  the  implementation  of  long  overdue  recommendations,  which  are 
discussed during Audit Progress Committee preparatory group meetings.  

In  2021, the  auditees accepted  all  but  one  of  the  Internal  Audit  Service’s  recommendations 7  .  In  all 
cases, the auditees drafted action plans, which they then submitted to the Internal Audit Service, who 
in turn assessed the plans as being satisfactory. 

At the cut-off date of 31 January 2022, 652 (74%) out of a total of 881 (including partially) accepted 
recommendations8   made by  the Internal  Audit Service  during the period 2017-2021  were assessed 
by  the  auditees as  implemented9  .  This leaves  a  total  of  229  recommendations  (26%)  that  are  still 
open. 

7   One important recommendation was rejected by the auditee. Management accepted the residual risk and implemented part of the 
Internal  Audit  Service  recommendation  and  no  further  discussion  at  Audit  Progress  Committee  preparatory  group  level  was 
necessary. 

8   One important recommendation was rejected by the auditee. Management accepted the residual risk and implemented part of the 
Internal  Audit  Service  recommendation  and  no  further  discussion  at  Audit  Progress  Committee  preparatory  group  level  was 
necessary. 

9   The  chart  shows  the  rating  of  the  recommendations  at  the  cut-off  date.  This  may  differ  from  the  rating  in  the  original  report  if 
actions subsequently taken by the auditee are deemed sufficient by the Internal Audit Service to partly mitigate the risks identified 
and therefore lead to a downgrading of the rating of the recommendation. 

4 

 
 
 
                                                           
No of accepted 
recommendations issued in 
2017-2021 by status (based on 
the auditees assessment)

No of open recommendations 
by rating

229

881

72

0

229

652

157

Implemented

Open

Critical

Very important

Important

Source: European Commission, Internal Audit Service 

Of these 229 open recommendations, none are rated as critical, 72 are rated very important, and 157 
are  rated  important.  65  of  these  are  overdue  (i.e.  not  implemented  by  the  originally  agreed 
implementation  date).  These  overdue  recommendations  represent  7.4%  of  the  total  (partially) 
accepted recommendations. Of these overdue recommendations, 7 very important ones are classified 
as long overdue (a recommendation is long overdue when it is still open more than 6 months after the 
original implementation date). These very important long overdue recommendations represent 0,8% of 
the  total  number  of  accepted  recommendations  in  the  period  2017-2021  (compared  to  0.6%  in  the 
previous  reporting  period).  In  addition,  one  very  important  recommendation  that  falls  outside  the 
reporting period is also long overdue. 

5 

 
 
 
 
THE INTERNAL AUDIT SERVICE HAS A STRICT FOLLOW-UP POLICY TO ASSESS 
THE IMPLEMENTATION OF ITS RECOMMENDATIONS. RESULTS SHOW THAT THE 
VAST MAJORITY OF INTERNAL AUDIT SERVICE RECOMMENDATIONS ARE 
EFFECTIVELY AND TIMELY IMPLEMENTED. 

Age of delayed recommendations issued in 2017-2021 
by rating

35
30
25
20
15
10
5
0

0 < 6 months

6 - 12 months

> 12 months

Critical

Very important

Important

Total

0

10

23

33

0

4

5

9

0

3

20

23

Critical

Very important

Important

Total

Source: European Commission, Internal Audit Service 

Overall,  the  Internal  Audit  Service  considers  the  implementation  of  its  recommendations  to  be 
satisfactory  and  comparable  to  previous  reporting  periods.  This  state  of  play  indicates  that  the 
Commission  services  are  diligent  in  implementing  the  critical  and  very  important  recommendations, 
thereby mitigating the risks identified by the Internal Audit Service. Nevertheless, attention should be 
paid to the individual recommendations rated very important which are long overdue.  

Part  3  of  the  Staff  Working  Document  summarises  these  very  important  and  long  overdue 
recommendations. 

4.  CONCLUSIONS BASED ON THE AUDIT WORK PERFORMED IN 2021 

4.1.  Conclusion on performance audits 

To  contribute  to  the  Commission’s  performance  based  culture  and  its  greater  focus  on  value  for 
money,  the  Internal  Audit  Service  carried  out  two  types  of  audits  in  2021:  performance  audits  and 
comprehensive audits10 covering important aspects of performance. 

In line with its methodology and best practices, the Internal Audit Service approaches performance in 
an indirect way, by assessing the performance of departments in implementing policies, programmes 
and actions by reference to the risks associated with them. With this approach, it aims to ensure that 
Directorates-General and services have developed appropriate performance frameworks, performance 
measurement tools, key indicators and monitoring systems.  

10  

In total, the Internal Audit Service carried out 24  performance and comprehensive audits. For more details see the  Staff Working 
Document. 

6 

 
 
 
 
                                                           
 
The  following  sections  set  out  the  Internal  Audit  Service’s  conclusions  on  the  various  aspects  of 
performance it focused on in the audits it carried out in 2021. 

4.1.1.  Preparedness for the implementation of the 2021-2027 

Multi-annual Financial Framework 

The 2021-2027 Multi-annual Financial Framework and the recovery package under NextGenerationEU 
should be implemented in accordance with the Financial Regulation and be complementary as regards 
the funding opportunities and results to be achieved. A number of audits in 2021 focused on the risks 
related to the design of the  overall package, the Commission’s enhanced  role in some areas and its 
new  areas  of  responsibility.  The  results  of  these  audits  indicate  that  significant  improvements  are 
necessary in this domain going forward, with a number11 of very important recommendations issued in 
2021 addressed to the Directorates-General audited. 

1)  One  audit  assessed  the  preparation  of  the  2021-2027  programming  period  in  the 
Directorates-General  for  Employment,  Social  affairs  and  Inclusion,  Maritime  Affairs  and 
Fisheries,  and  Regional  and  Urban  Policy.  This  audit  gave  rise  to  seven  very  important 
recommendations.  The  Directorates-General  preparation  for  the  2021-2027  programming 
period is a process which was still ongoing at the date of the audit report, and therefore the 
audit  was  in  effect  addressing  a  moving  target.  Although  the  Directorates-General  had 
designed  and  implemented  adequate  processes  to  support  the  start  of  the  2021-2027 
programming period, there were two weaknesses affecting their effectiveness and efficiency, 
notably  as  regards  the  support  to  Member  States  and  the  timing  of  the  preparation  and 
operational start of the programming period. 

2)  A  second  audit  concerned  the  preparation  for  the  2021-2027  programming  period  of  the 
Directorate-General for Migration and Home Affairs funds. It gave rise to two very important 
recommendations. The Internal Audit Service noted that the  preparation  for the 2021-2027 
programming  period  is  a  process  which  was  still  ongoing  at  the  date  of  the  audit  report. 
Although  the  Directorate-General  for  Migration  and  Home  Affairs  had  designed  and 
implemented  adequate  processes  to  support  the  start  of  the  2021-2027  programming 
period, there remained a number of weaknesses affecting their effectiveness and efficiency, 
notably as regards delays in work programmes of the thematic facility and the monitoring of 
progress in the programming of the 2021-2027 period and reporting to senior management. 

For  both  audits,  given  the  continuing  nature  of  the  preparations  and  the  fact  that  the  audits 
represented  a  snapshot  at  a  particular  point  in  time,  the  weaknesses  identified  may,  if  left 
unaddressed, have an impact on subsequent phases of the programming period. 

3)  A  third  audit  assessed  the  European  Anti-Fraud  Office’s  preparedness  to  implement  the 
Regulation on the establishment of the European Public Prosecutor’s Office12. In this audit, the  
Internal  Audit  Service  found  that  the  internal  control  system  of  the  European  Anti-Fraud 
Office to prepare for the future cooperation with the European Public Prosecutor’s Office was 
not fully adequate and effective. It identified weaknesses in the planning and  monitoring of 
the preparatory process, in the investigation and data protection guidelines and in information 
technology related aspects and issued three very important recommendations. 

4)  A  fourth  audit  assessed  the  Directorate-General  for  Competition’s  preparedness  of  the 
Competition programme. Although the Directorate-General had put in place a framework for 
the  implementation  of  the  Competition  programme  under  the  2021-2027  Multi-annual 
Financial  Framework,  the  audit  identified  a  remaining  weakness  in  defining  and  structuring 
some  of  the  key  elements  of  the  Competition  programme,  which  may  in  turn  affect  its 

11   15 of the 45 (33%) very important recommendations issued in 2021. 

12   Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European 

Public Prosecutor’s Office (‘the EPPO’) 

7 

 
 
                                                           
effective 
recommendations. 

implementation.  The 

Internal  Audit  Service 

issued  three  very 

important 

5)  Finally, the audit on the preparedness for the new European Statistical Programme under the 
2021-2027  programming  period  in  Eurostat  did  not  identify  any  significant  performance 
issues. 

4.1.2.  Supervision strategies for the implementation of 

programmes by third parties 

Authorising officers have to set up adequate and effective strategies and activities for supervising and 
monitoring the delegated entities' effective implementation of the programmes and protection of the 
EU budget, and for promptly addressing any identified potential difficulties.  

In previous years, the Internal Audit Service performed several audits of the supervision arrangements 
in place in Directorates-General and services for the implementation of programmes (and/or policies) 
by third parties. It frequently identified weaknesses in the effectiveness of the supervision strategies. 
In  its  overall  opinion  on  financial  management,  and  as  in  previous  years,  the  Internal  Audit  Service 
once again formulated an emphasis of matter in relation to the supervision strategies for third parties 
implementing  policies.  At  the  same  time,  based  on  the  2021  audit  results,  the  conclusion  is that,  in 
some policy areas, the situation is improving. 

1) 

In its 2021-2023 strategic audit plan, the Internal Audit Service aimed for an integrated risk-
based  approach,  to  perform,  where  appropriate,  audits  encompassing  both  Commission 
partner Directorates-General  and decentralised  agencies or other autonomous EU  bodies.  In 
2021, the first two multi-entity audits were finalised, focusing, at the level of the Commission 
Directorates-General,  on  the  supervision  arrangements  in  place  between  respectively  the 
Directorate-General for Energy and Fusion for Energy (F4E), (the European joint undertaking 
managing  Europe's  contribution  to  ITER)  and  between  the  Directorate-General  for  Migration 
and  Home  Affairs  and  the  European  Border  and  Coast  Guard  Agency  (Frontex).  The  results 
were  satisfactory  with  no  high  residual  risks  or  major  weaknesses  identified  in  the 
Commission Directorates-General audited. 

2)  Another audit was performed in the Directorates-General for Climate Action and Environment 
on  their  relations  with  the  European  Environment  Agency  and  the  European  Chemicals 
Agency.  In  contrast  to  the  above  two  multi-entity  audits,  the  Internal  Audit  Service  did  not 
include these two agencies in the audit scope as the audit was launched in 2020, prior to the 
reorganisation of the Internal Audit Service. The Directorates-General have both put in place 
adequate  processes  to  support  their  relations  with  the  decentralised  agencies  concerned. 
However, their effectiveness and efficiency was found to be impaired by a weakness related 
to the oversight role of both the Directorates-General for Climate Action and Environment on 
the European  Environment  Agency’s resources. Another weakness in the  Directorate-General 
for Environment related to the supervision and coordination mechanisms  with the European 
Environment Agency. 

3)  Finally, an audit aimed at assessing the supervision of Article 185 bodies by the Directorate-
General for Research and Innovation. This audit was closed after the preliminary survey, when 
the inherent risks, initially assessed as high, were re-assessed by the auditors as medium to 
low, in particular as only two out of the five Article 185 bodies under the responsibility of the 
Directorate-General for Research and Innovation will continue in the present form under the 
2021-2027 framework programme for research, Horizon Europe. 

4.1.3.  Internal  control  systems  in  selected  Directorates-General: 

Legality and regularity, compliance 

While the Internal Audit Service placed more emphasis on performance issues over the last few years, 
political stakeholders and the European Court of Auditors maintain an in-depth level of scrutiny of the 

8 

 
 
Commission’s  management  of  the  EU  budget,  as  regards  legality  and  regularity,  and  compliance. 
Therefore, one of the priorities of the 2021 audit plan (based on the 2021-2023 strategic audit plan) 
was to provide reassurance to the College and the Directorates-General and services on the efficient 
and effective functioning of the internal control systems as regards financial management. 

In the area of shared management, the Internal Audit Service finalised three audits. 

1) 

In  the  audit  on  interruptions,  suspensions  and  financial  corrections  for  the  2014-2020 
European  Structural  and  Investment  Fund,  the  Internal  Audit  Service  acknowledged  that  the 
Directorates-General  for  Employment,  Social  Affairs  and  Inclusion,  for  Maritime  Affairs  and 
Fisheries  and  for  Regional  and  Urban  Policy  are  operating  under  the  constraints  of  a  very 
challenging legal framework in the form of the Common Provisions Regulation. In particular, 
the  conditions  for  the  application  of  net  financial  corrections  are  stricter  than  the 
Commission’s  original  proposals.  Consequently,  the  audit  findings  need  to  be  seen  in  this 
context.  The  Internal  Audit  Service  concluded  that  there  are  a  number  of  weaknesses  that 
have an impact on the effective implementation of the Directorates-General’s processes for 
interruptions,  suspensions  and  financial  corrections  and  had  therefore  issued  eight  very 
important recommendations in total. 

2)  The land parcel identification system is a key control mechanism based on aerial or satellite 
photographs,  which  records  all  agricultural  parcels  in  the  Member  States.  The  system  is 
designed  to  verify  the  eligibility  for  area-based  subsidies  under  the  Common  Agricultural 
Policy (‘CAP’) and plays an essential role in checking compliance with various CAP obligations, 
including in relation to the greening of the CAP. The Internal Audit Service found that although 
the  Directorate-General  for  Agriculture  and  Rural  Development  has  put  in  place  adequate 
controls  to  support  the  management  of  the  Member  States’  systems  and  to  monitor  their 
quality, their effectiveness  is  affected  by  weaknesses.  The  monitoring  and  follow-up  of  the 
land parcel identification system quality assessment exercise needs to be improved. 

3)  The  audit  in  the  Directorate-General  for  Agriculture  and  Rural  Development  on  support, 
monitoring and checks of the work of certification bodies did not result in the identification of 
any significant performance issues. 

The Internal Audit Service also finalised various audits in direct management. 

4) 

In the audit on the implementation of audit results in Horizon 2020, the Internal Audit Service 
found that the audited Directorates-General and Executive Agencies have overall set-up and 
implemented  an  adequate  and  effective  internal  control  system  for  the  implementation  of 
audit results of the Common Audit Service. Roles and responsibilities are clearly defined and 
tools  are  available  to  the  project  and  financial  officers,  in  compliance  with  the  applicable 
rules.  Nevertheless,  weaknesses  remain  as  regards  the  monitoring  and  reporting  on  the 
implementation of the ex post audit results13.  

5)  The Internal Audit Service also examined the Commission’s ‘single electronic data interchange 
area’ (SEDIA) initiative. The objective of SEDIA is to fully automate and integrate the process 
for  handling  information  on  procurement  and  grants,  limiting  to  the  strict  minimum  the 
manual input of data, and promoting the alignment and reuse of such data along the whole 
process. The purpose of SEDIA is to provide applicants, candidates and tenderers with a single 
entry point to communicate and exchange information on procurement and grant procedures. 
The  implementation  of  the  SEDIA  initiative  supports  the  achievement  of  the  business 
objectives  of  a  high  number  of  clients,  and  ultimately  of  the  whole  Commission.  Being  a 
recent  Commission  initiative,  unique  in  its  kind,  the  European  Research  Executive  Agency 
could  not  benefit  from  experience  in  terms  of  governance  structure,  internal  control 
framework  and  information  technology  support  systems  in  implementing  SEDIA.  Moreover, 
since  its  launch  in  2017,  the  initiative  has  faced  considerable  constraints  in  terms  of 

13  

‘Audit results’ refers to the Common Audit Service and European Court of Auditors audit results (including audit results extensions), 
as well as European Anti-Fraud Office’s investigation results (under the form of financial recommendations). 

9 

 
 
                                                           
availability  of  adequate  information  technology  tools.  Although  the  Research  Executive 
Agency  delivers  the  services  for  which  it  is  responsible  under  the  SEDIA  initiative  in  an 
effective manner, in compliance with the Financial Regulation and as agreed with its clients, 
there  are  weaknesses  affecting  the  efficiency  of  the  delivery  of  the  SEDIA-related  services 
and compliance with the rules on the protection of personal data processed in the context of 
the agency’s SEDIA operations. 

6)  The Directorate-General for Structural Reform Support delivers a growing number of technical 
support  projects  to  EU  Member  States,  mainly  through  the  Structural  Reform  Support 
Programme  for  the  2014-2020  programming  period  and  the  Technical  Support  Instrument 
for the 2021–2027 programming period. The Internal Audit Service found that although the 
Directorate-General overall designed adequate processes and controls for delivering technical 
support to the Member States under the Structural Reform Support Programme, weaknesses 
exist as regards its  IT  capacities (tools, guidance and practices) for  monitoring the effective 
implementation of projects. 

7)  The  establishment  of  statutory  rights  and  calculation  of  individual  entitlements  are  core 
services provided by the Office for the Administration and Payment of Individual Entitlements 
to current and former staff of the European Commission and other EU institutions and bodies. 
The Office processes a large volume of transactions for various categories of rights, based on 
a  complex  legal  base,  and  for  a  variety  of  EU  institutions  and  clients  with  different 
characteristics and needs. In this challenging environment, although the office has designed 
an adequate control framework to ensure the correct establishment of rights and calculation 
of  entitlements  for  active  and  post-active  staff,  there  remains  a  very  important  weakness 
regarding the effectiveness and efficiency of its control strategy. 

8) 

In  the  audits  on:  (1)  Horizon  2020  grant  management  in  the  European  Research  Council 
Executive Agency; (2) the Instrument for Pre Accession II grants in direct management in the 
Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations;  and  (3)  the  closure 
processes  of  previous  programmes  (implemented  under  different  budget  implementation 
modes)  in  the  Directorate-General  for  Neighbourhood  and  Enlargement  Negotiations,  the 
Internal Audit Service did not identify any significant issues. 

4.1.4.  EU law implementation 

A key responsibility of Directorates-General is to support, monitor and enforce the implementation and 
application of the European Union (EU) law (‘acquis’).  

1)  Two  audits  assessed  how  the  Directorates-General  concerned:  (1)  proactively  support  and 
monitor Member States in the correct implementation and application of EU legislation before 
its entering into force and assess the transposition of EU directives; (2) monitor the ongoing 
application of EU law, including the handling of stakeholder complaints and management of 
own-initiative cases; and (3) manage the enforcement of potential breaches and weaknesses 
via dialogues with Member States and infringement procedures. 

2)  The  Internal  Audit  Service  acknowledged  the  particular  resource  challenges  faced  by  the 
Directorate-General  for  Energy  to  strike  a  balance  between  an  increasingly  demanding 
portfolio of responsibilities, in particular as regards achieving the objectives of the European 
Green Deal, and the increasing workload associated with new policy and legislative initiatives. 
The  Internal  Audit  Service  concluded  that,  although  the  Directorate-General  for  Energy  has 
overall  designed  adequate  internal  controls  for  the  support,  monitoring  and  enforcement  of 
EU  energy  law  application,  there  remains  a  weakness  with  regard  to  the  management 
supervision of the compliance assessment process, which in turn impacts on its effectiveness 
and efficiency. 

3)  At the level of the Directorate-General for Mobility and Transport, the internal control system 
in  place  ensures  an  effective  support,  monitoring  and  enforcement  of  the  EU  transport  law 
application. 

10 

 
 
4) 

In  addition,  a  third  audit  targeted  the  stakeholders’  complaints  process  in  the  Directorate-
General for Internal Market, Industry, Entrepreneurship and SMEs. No significant performance 
issues were identified. 

4.1.5.  Information technology security 

The Internal Audit Service completed two audits concerning information technology security: a central-
level  audit  on  the  management  and  monitoring  of  compliance  with  the  Commission’s  information 
technology  security  framework  and  a  local-level,  multi-Directorate-General  audit  on  information 
technology security in the human resource family.  

1)  The first audit on managing and monitoring compliance revealed the magnitude of the task at 
hand  and  the  challenges  faced  by  the  Directorate-General  for  Informatics  to  get  all 
Directorates-General to report on their compliance with the very high number of information 
security  controls,  particularly  when  they  are  faced  with  many  other  priorities.  Although  the 
Directorate-General for Informatics had put in place the necessary corporate tools to support 
the  effective  implementation  of  information  technology  security  requirements  across  the 
Commission,  significant  weaknesses  remained  in  two  areas:  (1)  in  information  technology 
security  compliance  management  and  reporting  practices;  and  (2)  in  the  compliance 
management process. 

2)  Due to the sensitive nature of the information treated by the services of the human resource 
family, it is essential to have highly  secured information technology  systems,  and adequate 
security  controls.  The  audit  yielded  mixed  results  in  terms  of  the  importance  of  the  issues 
found  and  that  information  technology  security  is  at  varying  levels  of  maturity  between 
services.  For  the  Directorate-General  for  Human  Resources  and  Security,  a  number  of 
significant  weaknesses  led  the  Internal  Audit  Service  to  conclude  that  the  information 
technology  governance,  management  and  control  processes  need  to  be  further improved  to 
sufficiently  mitigate  the  risks  identified.  In  the  Office  for  Administration  and  Payment  of 
Individual  Entitlements  and  the  European  Personnel  Selection  Office,  despite  certain 
weaknesses, the situation was positive overall. As regards the role played by the Directorate-
General for Informatics as service provider to the human resource family, the audit found a 
number of significant weaknesses in how it interacts with those Directorates-General/services. 

4.1.6.   Other processes 

Two audits assessed performance aspects of other processes (external stakeholder management and 
crisis  communication)  with  satisfactory  results.  The  Internal  Audit  Service  did  not  identify  any 
significant weaknesses. 

4.2. 

Internal Audit Service limited conclusions 

The  Internal  Audit  Service  issued  limited  conclusions  on  the  state  of  internal  control  to  every14  
Directorate-General and service in February 2022. These limited conclusions contributed to the 2021 
annual activity reports of the Directorates-General and services concerned. Drawing on the audit work 
carried  out  in  the  last  3  years,  they  cover  all  open  recommendations  issued.  The  Internal  Audit 
Service’s conclusion on the state of internal control is limited to the management and control systems 
that were audited. It  does not cover systems not audited  by the Internal  Audit Service in the past  3 
years. 

14   Except  for  the  Directorate-General  for  European  Health  Emergency  Preparedness  and  Response  Authority  (HERA),  and  for  the 
European  Health  and  Digital  executive  agency  (HaDEA).  HERA  and  HaDEA  were  set-up  during  2021  and  therefore  no  limited 
conclusions could be provided for these entities. In the case of the advisory service Inspire, Debate, Engage and Accelerate Action 
(IDEA)  no  audits  were  carried  out  during  the  2019-2021  period  as  no  high  risks  were  identified,  and  therefore  no  limited 
conclusions were provided. 

11 

 
 
                                                           
4.3.  Overall opinion on the Commission’s financial management 

As required by its mission charter, the Internal  Audit Service issues an annual overall  opinion on the 
Commission’s  financial  management.  This  is  based  on  the  audit  work  in  the  area  of  financial 
management  in  the  Commission  carried  out  by  the  Internal  Audit  Service  during  the  past  3  years 
(2019 to 2021). It also takes into account information from other sources, namely the reports of the 
European Court of Auditors. The overall opinion is issued at the same time as this report and covers 
the same year. 

Based on this audit information, the internal auditor considered that, in 2021, the Commission had put 
in  place  governance,  risk  management  and  internal  control  procedures  which, taken  as a  whole, are 
adequate  to  give  reasonable  assurance  on  the  achievement  of  its  financial  objectives.  However,  the 
overall opinion is qualified with regard to the reservations the authorising officers by delegation made 
in their declarations of assurance issued in their respective annual activity reports. 

In  arriving  at  the  overall  opinion,  the  internal  auditor  also  considered  the  combined  impact  of  all 
amounts estimated to be at risk at payment as these go beyond the amounts put under reservation. 
The overall amounts at risk at payment are the best estimation of authorising officers by delegation 
of  the  amount  of  the  expenditure  authorised  that  was  not  in  conformity  with  the  applicable 
contractual  and  regulatory  provisions  at  the  time  of  the  payment  in  2021.  In  their  annual  activity 
reports,  the  directorates-general/services  estimate  amounts  at  risk  at  payment  to  total  between 
approximately EUR 2 784 million and EUR 3 249 million approximately. This corresponds to between 
1.6% and 1.9% of total relevant expenditure15 from the Commission budget,  European Development 
Fund  and  EU  Trust  Funds  in  2021  and  therefore  below  the  materiality  of  2%  as  defined  in  the 
instructions for the preparation of the 2021 Annual Activity Reports. These amounts at risk at payment 
in 2021 do not yet include any financial corrections and recoveries related to deficiencies and errors 
the  Directorates-General/services  will  detect  and  correct  in  the  future  due  to  the  multi-annual 
corrective mechanisms built into the Commission's internal control systems16. 

Given these elements, the Internal Audit Service considers that the EU budget is adequately protected 
in total and over time.  

Without  further  qualifying  the  overall  opinion,  the  Internal  Audit  Service  emphasised  the  following 
matters: 

1. Implementation of the EU budget in the context of the crisis related to the COVID-19 pandemic  

The  health,  social,  economic  and  financial  situation  created  by  the  COVID-19  pandemic  entails 
potentially high, cross-cutting risks for the institution as regards the implementation of the EU budget 
and the delivery of its policy priorities. 

This  includes  the  operations  which  are  part  of  the  2014-2020  multiannual  financial  framework,  for 
which  adequate  controls (ex  post  in  particular)  still  need  to  be  performed,  and operations  under the 
2021-2027  multiannual  financial  framework  and  the  recovery  package  under  NextGenerationEU,  on 
assurance, compliance and performance aspects.  

To ensure the budget is duly protected over time in the face of the existing unprecedented challenges, 
the  Internal  Audit  Service  stresses  that  the  Commission’s  Directorates-General  and  services  should 
continue  to  (i)  duly  assess  the  risks  caused  by  the  COVID-19  pandemic  related  to  financial 
management  in  terms  of  assurance,  performance,  compliance  with  the  legal  framework,  and  the 
potential impact on the effectiveness of the Commission’s ability to implement corrective actions due 
to possible logistical constraints to undertake controls on the spot and the very challenging economic 

15   Expenditure means the total amount of payments made in 2021 minus the total amount of new prefinancing paid in 2021 plus the 
total amount of old pre-financing cleared in 2021 as reported by the Commission services in their 2021 Annual Activity Reports. 

16  

In view of the importance of the multi-annual corrective mechanism leading to the amounts at risk at closure, the IAS is carrying 
out in 2022 a limited review on the reporting of the Commission’s preventive and corrective measures (corrective capacity) in six 
DGs covering the four policy areas with the highest amounts for these measures. 

12 

 
 
                                                           
situation  faced  at  EU  and  national  levels  (including  the  possible  bankruptcies  of  final  beneficiaries, 
which  could  make  it  difficult  to  recover  undue  amounts);  and  (ii)  define  and  implement  adequate 
mitigating measures, such as adjusting or redefining their control strategies. 

Furthermore,  the  Commission’s  Directorates-General  should  continue  to  design  and  implement 
appropriate financial management, audit and control strategies for operations to support the recovery 
under  NextGenerationEU,  in  particular  as  concerns  the  Recovery  and  Resilience  Facility.  Due  to  the 
implementation of a new performance-based approach, certain elements of the design of the control 
strategy  covering  legality  and  regularity  are  still  to  be  further  elaborated  in  2022,  namely  the 
procedures  for  suspension  of  payments  and  reduction  of  support  in  cases  where  milestones  and 
targets for a particular payment request have not been met partially or fully. In addition, the control 
design  has  to  be  completed  as concerns  the  residual  responsibility  of  the  Commission  in  relation  to 
other  elements  of  compliance  (i.e.  protection  of  the  financial  interests  of  the  Union  in  the  case  of 
fraud, corruption, and conflicts of interest or a serious breach of an obligation resulting from the Loan 
or Financing Agreement). 

2. Supervision strategies regarding third parties implementing policies and programmes. 

Although  the  Commission  remains  fully  responsible  for  ensuring  the  legality  and  regularity  of 
expenditure  and  sound  financial  management  (and  also  for the  achievement  of  policy  objectives), it 
has  increasingly  relied  on  third  parties  to  implement  its  programmes.  This  is  mostly  done  by 
delegating the implementation of the EU’s operational budget or certain tasks to countries outside the 
EU, international organisations or international financial institutions, national authorities and national 
agencies  in  Member  States,  joint  undertakings,  non-EU  bodies  and  EU  decentralised  agencies. 
Moreover,  in  certain  policy  areas,  alternative  funding  mechanisms  such  as  financial  instruments  are 
increasingly used and entail specific challenges and risks for the Commission, as also highlighted by 
the European Court of Auditors.  

To fulfil their overall responsibilities, the Directorates-General have to oversee the implementation of 
the  programmes  and  policies  and  provide  guidance  and  assistance  where  needed.  Therefore,  they 
have  to  define  and  implement  adequate,  effective  and  efficient  supervision/monitoring/reporting 
activities  to  ensure  that  the  delegated  entities  and  other  partners  effectively  implement  the 
programmes,  adequately  protect  the  financial  interests  of  the  EU,  comply  with  the  delegation 
agreements, when applicable, and that any potential issues which are identified are addressed as soon 
as possible.  

Although actions have been taken in recent years both at the level of the central services and at that 
of the relevant Directorates-General to mitigate the risks identified as a result of audit work, further 
improvements are still needed in some areas and in particular as regards pillar assessment in indirect 
management.  This  is  relevant  not  only  in  relation  with  the  closure  of  activities  delegated  under  the 
2014-2020 multiannual financial framework, but more so in view of the increase in the use of equity, 
guarantee and risk-sharing instruments in the 2021-2027 multiannual financial framework. 

3. Reporting on the corrective capacity of the multiannual control systems 

The  Commission  has  put  in  place,  together  with  the  Member  States  (when  applicable),  multiannual 
control  systems to ensure the sound financial  management of EU  funds. These systems encompass 
preventive measures (i.e. controls aiming at preventing errors before payments are made) as well as 
corrective  measures  (i.e.  controls  carried  out  after  the  payments  and  until  the  closure  of  the 
programmes,  when  applicable).  These  measures  constitute  the  Commission’s  overall  corrective 
capacity (including measures implemented by the Member States).  

Considering  the  multiannual  nature  of  the  Commission’s  control  system,  the  control  results  are 
reported  at  two  moments  of  the  programmes’  cycle  through  the  estimated  ‘risk  at  payment’17  (i.e. 

17   The  ‘risk  at  payment’  quantifies  any  errors  that  remain  after  preventive  measures  and  payments  have  been  made  but  before 

corrective measures have been applied. 

13 

 
 
                                                           
after preventive measures) and ‘risk at  closure’18 (i.e. after preventive and corrective  measures). The 
‘risk  at  closure’  is  calculated  by  subtracting  the  ‘estimated  future  corrections’19  from  the  estimated 
‘risk at payment’. 

Overall, the  IAS  notes  some  improvements  made  in  the  Directorates-General’s  2021  Annual  Activity 
Reports  and  the  (draft)  Annual  Management  and  Performance  Report  regarding  information  on 
preventive  and  corrective  measures  applied  by  the  Commission  and  Member  States.  However, 
considering  the  increasing  importance  of  corrections  implemented  by  Member  States  as  an  integral 
part of the control architecture in shared management, the information provided about the corrective 
capacity still needs to be further improved (in terms of its clarity and the split of the relevant data) to 
adequately substantiate the Commission’s overall corrective capacity (including corrections requested 
by  the  Commission  and  accepted  by  Member  States),  the  ‘estimated  future  corrections’  and  the 
resulting  ‘risk at  closure’.  In  particular,  (a)  additional  data  is needed  on  the  split  between  preventive 
and  corrective  measures  implemented  by  the  Member  States  and  (b)  the  relationship  between  the 
‘estimated  future  corrections’  and  the  ‘corrections  implemented’  has  to  be  clearly  explained  and 
supported  by  relevant  data,  firstly  at  Directorate-General  level  in  the  Annual  Activity  Reports20  and 
secondly at Commission level in the Annual Management and Performance Report. 

5.  CONSULTATION WITH THE COMMISSION’S FINANCIAL IRREGULARITIES PANEL21 

No  systemic  problems  were  reported  in  2021  by  the  panel  set  up  pursuant  to  Article  143  of  the 
Financial Regulation, where it gives the opinion referred to in Article 93 of the Financial Regulation. 

6.  MITIGATING  MEASURES  FOR  POTENTIAL  CONFLICTS  OF  INTEREST  (INTERNATIONAL 
INVESTIGATION  OF  THE  EUROPEAN 

INTERNAL  AUDITING  STANDARDS)  — 
OMBUDSMAN 

The  current  Director-General  of  the  Internal  Audit  Service,  Internal  Auditor  of  the  Commission,  Mr 
Manfred  Kraff,  took  office  on  1  March  2017.  Mr  Kraff  was  previously  Deputy  Director-General  and 
Accounting Officer of the Commission in the Directorate-General for Budget. 

In  line  with  international  audit  standards22,  on  7  March  2017,  following  his appointment  as  Director-
General  and  Internal  Auditor,  Mr  Kraff  issued  instructions  on  the  arrangements  to  be  put  in  place  to 
mitigate and/or avoid any potential or perceived conflict of interest in Internal Audit Service audit work 
in  relation  to  his  former  responsibilities.  These  arrangements  were  prolonged  in  2018,  2019,  2020, 
2021  and  in  2022  (until  1  March  2023),  through  instruction  notes  to  all  Internal  Audit  Service  staff 
issued by Mr Kraff. According to the arrangements, Mr Kraff would not be involved in the supervision of 
audit work relating to operations for which he was responsible before joining the Internal Audit Service. 
The  supervision  of  the  audit  work  in  such  cases  ultimately  fell/will  fall  under  the  responsibility  of  Mr 
Jeff  Mason,  Director  in  the  Internal  Audit  Service  (Directorate  B,  Audit  in  Commission,  Executive 
Agencies, EU  Agencies and other autonomous bodies II).  The arrangements also  stated that the Audit 

18  

19  

20  

21  

22  

The ‘risk at closure’ is the risk estimated when controls are completed and legally no further action can be taken. 

The  ‘estimated  future  corrections’  (or  ‘estimated  corrective  measures’)  is  the  amount  of  expenditure  in  breach  of  applicable 
regulatory and contractual provisions, that the DG conservatively estimates it will identify and correct through controls that will be 
implemented after the payment is authorised (i.e. not only including those already implemented at the time of reporting (i.e. Annual 
Activity Reports) but also those that will be implemented during the next years until the end of the programme). 

These key improvements are particularly important in the area of Cohesion as most of the corrections are implemented by Member 
States. The IAS notes the commitment of the Cohesion DGs to improve the data in this regard. 

Since the entry into application of the new Financial Regulation the functions of all institutions’ financial irregularities panel have 
been transferred to the Early Detection and Exclusion System Panel referred to in Article 143 of the FR. 

The  international  audit  standards,  to  which  the  Financial  Regulation  expressly  refers  in  Article  98  ("Appointment  of  the  Internal 
Auditor"),  state  that:  ‘If  independence  or  objectivity  is  impaired  in  fact  or  appearance,  the  details  of  the  impairment  must  be 
disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment." (IIA-IPPF standard 1130). Moreover, 
the  standards  state  that:  "internal  auditors  must  refrain  from  assessing  specific  operations  for  which  they  were  previously 
responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the 
internal auditor had responsibility within the previous year’ (IIA-IPPF standard 1130.A1). 

14 

 
 
                                                           
Progress Committee would be informed of these instructions and of their implementation and that Mr 
Mason would refer to the Audit Progress Committee for the assessment of any situation that may be 
interpreted as impairing Mr Kraff's independence or objectivity. In those cases, Mr Kraff would refrain 
from any supervision of the audit in question. 

The arrangements in place were discussed with the Audit Progress Committee at its meeting of March 
2018. The committee considered that the measures drawn up by the Internal Audit Service adequately 
address  the  risk  of  conflict  of  interest  in  line  with  the  international  standards  and  best  practice.  The 
committee also noted with satisfaction that arrangements to ensure organisational independence had 
been implemented in practice in the  relevant audits. The  Audit Progress Committee also took note of 
the  continuation  of  these  arrangements  during  January  2021  (preparatory  group)  and  further  noted 
with satisfaction that these arrangements had been implemented in practice in a number of audits and 
considered that this was leading practice in the internal audit profession. 

In  the  period  2018-2020,  during  the  hearings  as  part  of  the  reporting  year  discharge,  Mr  Kraff 
presented  the  arrangements  in  place  to  the  European  Parliament’s  Budgetary  Control  Committee 
(CONT). 

15