REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2023
Date: 2024-06-19
Institutions: European Commission, Secretariat-General
Subjects: activity report, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 19.6.2024  COM(2024) 249 final  REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS  Annual report to the Discharge Authority on internal audits carried out in 2023         {SWD(2024) 145 final}  
 
 
Table of contents 

1. OBJECTIVES AND SCOPE OF THE REPORT .......................................................................................................................................... 2 

2. MISSION OF THE INTERNAL AUDIT SERVICE: ACCOUNTABILITY, INDEPENDENCE AND OBJECTIVITY ............ 2 

3. OVERVIEW OF AUDIT WORK ........................................................................................................................................................................ 3 

3.1. Implementation of the 2023 audit plan ............................................................................................................................... 3 

3.2. Statistical data on Internal Audit Service recommendations .................................................................................. 5 

4. CONCLUSIONS BASED ON THE AUDIT WORK PERFORMED IN 2023 ................................................................................. 7 

4.1. Conclusions on performance audits ......................................................................................................................................... 7 

4.1.1. 

Performance management ......................................................................................................................................... 7 

4.1.2. 

EU policy implementation ............................................................................................................................................ 8 

4.1.3. 

Internal control systems in relation to legality and regularity ............................................................. 8 

4.1.4. 

Preparedness for and early implementation of the EU budget ........................................................ 10 

4.1.5. 

Cooperation with third parties implementing policies and programmes ................................... 11 

4.1.6. 

Information security and technology ................................................................................................................ 11 

4.1.7. 

Other processes .............................................................................................................................................................. 12 

4.2. Internal Audit Service limited conclusions ........................................................................................................................ 13 

4.3. Overall opinion on the Commission’s financial management............................................................................... 13 

5. CONSULTATION WITH THE COMMISSION’S FINANCIAL IRREGULARITIES PANEL ..................................................... 14 

 
 
 
 
1. Objectives and scope of the report 

This  report  informs  the  European  Parliament  and  the  Council,  as  part  of  the  discharge  procedure,  about 
internal  audits  carried  out  in  2023  by  the  European  Commission’s  Internal  Audit  Service  in  its 
Directorates-General, services and executive agencies (1). It contains: (i) a summary of the number and 
type of internal audits carried out; (ii) a synthesis of the principal recommendations made; and (iii) the action 
taken on those recommendations. In accordance with Articles 118(8) and 247 of the Financial Regulation (2), 
the Commission forwards the report to the European Parliament and to the Council. It is based on the report 
drawn up in accordance with Article 118(4) of the Financial Regulation by the Commission’s Internal Auditor on 
Internal Audit Service audits and consulting reports completed in 2023 (3). 

2. Mission of the Internal Audit Service: 
accountability, independence and 
objectivity 

The Internal Audit Service’s mission is to increase and protect organisational value by providing risk-
based and objective assurance, advice and insight. It helps the Commission to accomplish its objectives 
by  bringing  a  systematic,  disciplined  approach  in  order  to  evaluate  and  improve  the  effectiveness  of  risk 
management,  control  and  governance  processes.  Its  tasks  include  assessing  and  making  appropriate 
recommendations  to  improve  risk  management,  control  and  governance  processes  in  order  to  achieve  the 
following three objectives: (i) promote appropriate ethics and values within the organisation; (ii) ensure effective 
organisational performance management and accountability; and (iii) effectively communicate risk and control 
information to appropriate areas of the organisation. In doing this, the Internal Audit Service aims to promote 
a culture of efficient and effective management within the Commission and its departments. 

The independence of the Internal Audit Service’s work is enshrined in the Financial Regulation and 
its mission charter (4) as adopted by the Commission. This charter stipulates that, to ensure objectivity in 
their judgement and avoid conflicts of interest, its management and auditors must preserve their independence 
in relation to the activities and operations they review. If their objectivity is impaired in fact or in appearance, 
the  details  of  the  impairment  should  be  disclosed.  If  the  Internal  Auditor  considers  it  necessary,  she  may 
address the President of the Commission and/or the College of Commissioners directly. 

The  Internal  Audit  Service  performs  its  work  in  accordance  with  the  Financial  Regulation,  the  International 
Standards for the Professional Practice of Internal Auditing, and the Code of Ethics of the Institute of Internal 
Auditors. 

The  Internal  Audit  Service  reports  —  and  is  functionally  accountable  —  to  the  Audit  Progress 
Committee established under Article 123 of the Financial Regulation. The Internal Audit Service: (i) reports 
significant issues arising from its audits and potential improvements to the audited processes; (ii) provides an 
annual  overall  opinion  on  the  state  of  financial  management  in  the  Commission;  and  (iii)  reports  (at  least 
annually) on its mission and performance, as set out in its annual audit plan. This reporting includes significant 
risk exposures, control issues, corporate governance issues and other matters. 

(1) 

The report does not cover the European Peace Facility, decentralised European agencies, the European External Action Service or other 
autonomous bodies audited by the Internal Audit Service, which receive separate reports. 

(2)  Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules applicable 
to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013, (EU) No 
1304/2013,  (EU)  No  1309/2013,  (EU)  No  1316/2013,  (EU)  No  223/2014,  (EU)  No  283/2014,  and  Decision No  541/2014/EU  and 
repealing Regulation (EU, Euratom) No 966/2012OJ L 193, 30.7.2018, Amending Regulation 2022/2434 (EU, Euratom).  
The audit reports finalised from 1 February 2023 to 31 January 2024 are included in this report. 

(3) 
(4)  Communication to the Commission, Mission Charter of the Internal Audit Service of the European Commission, C(2022)8450 final of 

28 November 2022. 

2 

 
 
 
 
The Audit Progress Committee assists the College in fulfilling its obligations under the Treaties, the Financial 
Regulation and other statutory instruments. It does this by: (i) ensuring the independence of the Internal Audit 
Service;  (ii) monitoring  the  quality  of  internal  audit  work;  (iii) ensuring  that  internal  and  external  audit 
recommendations  are  properly  taken  into  account  by  Commission  services;  and  (iv)  ensuring  that  these 
recommendations  receive  appropriate  follow-up.  In  this  way,  the  Audit  Progress  Committee  helps  the 
Commission to improve its effectiveness and efficiency in achieving its goals. It also facilitates the College’s 
oversight of the Commission’s governance, risk management, and internal control practices (5).   

The Internal Audit Service does not audit Member States’ systems of control over EU funds. Such audits reach 
down to the level of individual beneficiaries, and are carried out by Member States’ internal auditors, national 
audit authorities, other Commission Directorates-General and the European Court of  Auditors. However, the 
Internal  Audit  Service  does  audit  measures  taken  by  the  Commission  to  supervise  and  audit:  (i) bodies  in 
Member States; and (ii) other bodies that are responsible for disbursing EU funds. In accordance with Article 
118(2) of the Financial Regulation, the Internal Audit Service enjoys full and unlimited access to all information 
required to perform its duties, if necessary, also on-the-spot access, including in Member States and non-EU 
countries.  

3. Overview of audit work 

3.1. 

Implementation of the 2023 audit plan 

The Internal Audit Service implemented the 2023 audit plan against the backdrop of  mounting pressure on 
resources in some of the Commission Directorates-Generals and broader challenges related to Russia’s war of 
aggression against Ukraine and other emerging geopolitical crises. By the cut-off date of 31 January 2024, 
the  Internal  Audit  Service  had  completed  a  total  of  93  engagements  (audits,  reviews  and  follow-up 
engagements), and issued 139 reports (including final audit and review reports, follow-up and closing notes, 
and management letters (6).  

By the cut-off date of 31 January 2024, the Internal Audit Service had completed  34 audit engagements 
(audits, reviews, and a consultancy engagement). This represents a 97% completion rate of the updated 2023 
audit plan (34 out of 35 engagements) (7).  

In accordance with its charter and with international auditing standards, the Internal Audit Service plans its 
audit work on the basis of a risk assessment and a capacity analysis. The aim is to define an audit plan that 
covers the highest risk areas, thereby maximising its added value, and helps to ensure the best use of resources 
and the efficient and effective implementation of the audit plan. The Internal Audit Service regularly monitors 
the implementation of the audit plan and adjusts it as necessary. 

The Internal Audit Service followed up 59 previous audit engagements to review the implementation of 
recommendations and issued 81 follow-up notes to the respective Directorates-General and services (8). As a 
result, 41 engagements were closed (9). The Internal Audit Service concluded that all recommendations were 
effectively implemented), while 18 remained open with ongoing implementation by the cut-off date.  

(5) 

(6) 

For details, see Communication to the Commission, Charter of the Audit Progress Committee of the European Commission, C(2020) 
1165 final of 27 February 2020. 
The Internal Audit Service’s audit universe covers 50 organisational entities in total. For some of these entities, more than one final 
audit,  review  or  consulting  report  was  issued  in  2023.  See  the  staff  working  document  accompanying  this  report  for  a  detailed 
overview of entities for which final audit and review reports were issued.  

(7)  0ne engagement was carried over from the 2023 audit plan to the 2024 audit plan – Audit on anti-fraud strategy in the Directorates-
General for International Partnerships, Neighbourhood and Enlargement Negotiations, European Civil Protection and Humanitarian 
Aid Operations, the Service for Foreign Policy Instruments, and the European External Action Service. 

(8)  Some audit engagements were followed-up more than once and some follow-up notes covered more than one audit engagement.  
(9) 

The list of audits closed after a follow-up is included in section 2.2 of the Annex.  

3 

 
 
 
 
The overall number and breakdown by engagement types completed by the cut-off date of 31 January 
2024 is shown in the charts below. 

Engagements by type 

Source: European Commission 

Follow-up engagements 

Source: European Commission, Internal Audit Service 

In  2023,  the  Internal  Audit  Service  issued  38  reports  (final  audit  reports  and  management  letters).  The 
number of reports is higher than the number of engagements because, for some horizontal or multi-entity 
audits (10), the Internal Audit Service produces several reports or management letters for the different auditees 
within the scope of the audit. In 2023, it conducted 17 horizontal and multi-entity audits (and issued 18 final 
ports and 2 management letters liked to these audits). 

(10)  This refers to audits that span multiple Commission Directorates-General and/or services (multi-DG audits) or audits conducted in 
Commission Directorates-General/services and in the decentralised agencies or other autonomous bodies (multi-entity audits).  

4 

 
 
 
 
 
 
3.2.  Statistical data on Internal Audit Service recommendations 

The Internal Audit Service issued 170 recommendations stemming from its 2023 audit work. As illustrated 
below, approximately two-thirds of these recommendations (69%) were rated important and one-third (31%) 
very important, with no critical recommendations. 

Recommendations by rating 

Source: European Commission, Internal Audit Service 

In  2023,  the  auditees  accepted  all  170  recommendations  issued  by  the  Internal  Audit  Service.  For  all 
recommendations, the auditees drafted action plans. These were submitted to the Internal Audit Service, which 
then assessed them as being satisfactory or requested a revised action plan. 

RECOMMENDATIONS ISSUED BETWEEN 2019 AND 2023 

The  Internal  Audit  Service  addressed  a  comprehensive  overview  of  the  follow-up  of  recommendations  that 
were  overdue  by  more  than  six  months to  the  Audit  Progress  Committee.  In  addition,  it  prepared  quarterly 
reports on the implementation of recommendations overdue by more than six months. These were discussed 
during preparatory group meetings of the Audit Progress Committee.  

As  illustrated  below,  at  the  cut-off  date  of  31  January  2024,  out  of  a  total  of  791  (partially)  accepted 
recommendations (11) made  by  the  Internal  Audit  Service  in  2019-2023,  557  (70%)  were  assessed  by  the 
auditees as implemented (12). This leaves a total of 234 recommendations (30%) that remain open. 

(11)  Out of 795 recommendations issued in 2019-2023, 789 recommendations were fully accepted, two were partially accepted and four 

were rejected.  

(12)  The chart shows the rating of the recommendations at the cut-off date. This may differ from the rating in the original audit report 
because,  in  the  context  of  a  follow-up  audit,  the  Internal  Audit  Service  may  assess  that  the  actions  taken  by  the  auditee  partly 
mitigated the risks initially identified and the rating of the recommendation was therefore downgraded. 

5 

 
 
 
 
 
 
 
Number of accepted recommendations  
issued in 2019-2023 by status  
(based on the auditees assessment) 

Number of open recommendations by rating 

Source: European Commission, Internal Audit Service 

Of the 234 recommendations that remained open at the cut-off date, none were rated as critical, 64 
(27%) were rated as very important, and 170 (73%) as important. 

Of  the  open  recommendations,  38  were  overdue  (not  implemented  by  the  originally  agreed  date).  These 
overdue  recommendations  represent  4.8%  of  the  (partially)  accepted  recommendations.  Of  the  overdue 
recommendations, three very important recommendations are classified as long overdue (a recommendation 
is long overdue when it is still open more than six months after the original implementation date). This is in 
line with the previous year, attesting to the strict follow-up policy of the Internal Audit Service in assessing the 
implementation of its recommendations. These very important long overdue recommendations represent 0.4% 
of  the  total  number  of  (partially)  accepted  recommendations  in  2019-2023  (same  percentage  as  in  the 
previous reporting period). There are no very important long overdue recommendations issued before 2019. 

Delay of overdue recommendations by rating  
(Issued in 2019-2023) 

Source: European Commission, Internal Audit Service 

Overall, the Internal Audit Service considers the implementation of its recommendations to be satisfactory and 
comparable to previous reporting periods. This state of play indicates that the Commission services are diligent 
in implementing the critical and very important recommendations, thereby mitigating the risks identified by the 
Internal Audit Service. Nevertheless, attention should be paid to the long overdue individual recommendations 
rated very important.  

Part 3 of the Annex to this report summarises these very important and long overdue recommendations. 

6 

 
 
 
 
4. Conclusions based on the audit work 

performed in 2023 

4.1.  Conclusions on performance audits 

Contributing  to  the  Commission’s  performance-based  culture  and  greater  focus  on  value  for  money,  the 
Internal  Audit  Service  carried  out  performance  audits  and  comprehensive  audits  (13)  in  2023  as  part  of  its 
strategic audit plan. For half of these engagements, the Internal Audit Service did not identify high residual 
risks  in  the  areas  or  processes  audited  and  did  not  issue  any  critical  or  very  important  recommendations. 
Various strengths and good practices were noted, including strong and continuous staff commitment, despite 
the high workload and challenging environment in which various auditees operated (for more details see section 
1 of the Annex). 

The  resulting  audit  conclusions  concerned: (1)  performance  management;  (2)  EU  policy  implementation; (3) 
internal control systems in relation to legality and regularity; (4) preparedness for and early implementation of 
the  EU  budget; (5)  cooperation  with  third  parties  that  implement  policies and  programmes;  (6)  information 
technology; and (7) other processes. 

In line with its methodology and best practices, the Internal Audit Service approaches performance in an indirect 
way.  It  assesses  the  performance  of  the  Commission’s  departments  and  services  in  implementing  policies, 
programmes and actions by reference to the risks associated with them. With this approach, it aims to ensure 
that  Directorates-General  and  services  have  developed  appropriate  performance  frameworks,  performance 
measurement tools, and comprehensive monitoring systems.  

The following sections set out the Internal Audit Service’s conclusions on the various performance aspects it 
focused on in its 2023 audits. 

4.1.1.  Performance management  

A  robust  performance  management  system  is  essential  for  ensuring  that  (i)  objectives  and  performance 
indicators are effectively set and in line with the Commission priorities; (ii) they are regularly monitored and 
reported  on;  and  (iii)  the  activities of  the  Commission  deliver the  maximum  performance  and added  value. 
Stakeholders  and  citizens  increasingly  require  clear  evidence  of  the  Commission’s  delivery  on  political  and 
operational objectives. 

The Commission is therefore committed to applying a strong performance framework. The Communication on 
the EU budget performance framework under the 2021-2027 multiannual financial framework comprises the 
necessary tools and procedures to set objectives, and measure and monitor progress towards them.  

It is within the performance framework that the Internal Audit Service conducted three audits in the area of 
performance management and issued a number of very important recommendations (14):  

(1)  The  Commission  uses  evaluations  as an  important  tool  for the  effective  and  efficient  management  of 
interventions (15). In this context, the Internal Audit Service conducted  an audit on intervention-level 
evaluations  in  the  Directorates-General  for  International  Partnerships,  and  for  Neighbourhood  and 
Enlargement Negotiations and the Service for Foreign Policy Instruments. The objective of the audit was 
to  assess  whether  the  process  to  evaluate  interventions  is  adequately  designed,  and  effectively  and 
efficiently  implemented  so  that  the  main  evaluation  objectives  (i.e.  assessing  the  performance  of  an 

(13) 

In total, the Internal Audit Service carried out 32 performance and comprehensive audit engagements and engagements with some 
performance aspects (limited reviews and financial/compliance audits). For more details see the Annex. 

(14)    10 out of a total of 52 very important recommendations issued in 2023 (19%). 
(15) 

In the external action domain, ‘interventions’ are all activities implemented or funded to achieve policy objectives, such as an individual project or a 
budget support operation. 

7 

 
 
 
 
intervention, identifying opportunities to improve current  and future interventions, and reporting on the 
outcome to stakeholders and the wider public) are achieved. The Internal Audit Service concluded that the 
audited Directorates-General and the Service for Foreign Policy Instruments have put in place an evaluation 
framework encompassing  guidance, templates, an information technology tool, and outsourced support 
services. However, the process put in place to evaluate interventions would require further improvements 
for the efficient and effective achievement of the main evaluation objectives, relating to (i) shortcomings 
in  the  evaluation  guidance,  templates,  and  the  information  technology  tool;  (ii)  implementation  of  the 
evaluation process; and (iii) monitoring, overview, and reporting at headquarters. 

(2)  A  second  audit  was  conducted  on  Horizon  Europe.  The  audit  considered  the  state  of  play  of 
implementation of the Horizon Europe programme and assessed specific aspects of its performance. The 
Internal Audit Service found that although the governance arrangements and the processes to prepare the 
work  programmes  and  the  budget  planning  are,  adequately  designed  and  effectively  implemented  in 
general, further improvement would be needed on the specific governance arrangements for EU missions.  

(3)  A third audit aimed to assess the processes put in place for measuring and reporting on the performance 
of  technical  support  projects  in  the  Directorate-General  for  Structural  Reform  Support.  The 
Directorate-General designed and put in place processes and controls for performance measurement and 
reporting  on  project  outcomes  and  results  in  general.  However,  there  would  be  a  need  for  further 
improvement in their effectiveness relating to the performance measurement methodology. 

4.1.2.  EU policy implementation 

In  2019,  the  President  of  the  Commission  defined  the  political  priorities  for  a  five-year  period.  A  key 
responsibility of the Commission is to translate these priorities into concrete actions. The different Directorates-
General  and services  play  an  active  role  in  designing  and  implementing  EU  policies.  They  do  so  by,  among 
others,  proposing  EU  legislation,  assisting  Member  States  in  its  implementation,  ensuring  that  EU  law  is 
complied with, and ensuring the EU’s external representation for matters other than foreign affairs and security 
policy. Two audits conducted by the Internal Audit Service assessed:   

(1)  Eurostat’s role in the European Statistical System;   

(2)  The European Anti-Fraud Office’s effectiveness in fraud prevention activities. 

Both audits concluded that there are adequate controls in place to effectively implement the respective audited 
processes  

4.1.3.  Internal control systems in relation to legality and regularity  

Providing reassurance to the College, as well as to the Directorates-General and services, on the efficient and 
effective implementation of internal controls  on financial management remains one of the priorities of the 
Internal Audit Service. Following a comprehensive risk assessment and the resulting strategic audit plan for 
2021-2023, the Internal Audit Service conducted  eleven  audit  engagements in this area in  2023.  These 
audits revealed a need for significant improvements and led to the issuance of a number of very  important 
recommendations (16).  

(1)  The Internal Audit Service conducted a thematic review of the Commission’s risk at payment in the 
Directorate-General for Budget and a sample of Directorates-General and services such as Directorate-
General  for  Agriculture  and  Rural  Development  Directorate-General  for  Employment,  Social  Affairs  and 
Inclusion; Directorate-General for International Partnerships; Directorate-General for Neighbourhood and 
Enlargement  Negotiations;  Directorate-General  for  Regional  and  Urban  Policy;  Directorate-General  for 
Research  and  Innovation;  European  Innovation  Council  &  SMEs  Executive  Agency;  European  Research 
Council Executive Agency; and European Research Executive Agency. This engagement aimed  to provide 
(re)assurance on the calculation of the Commission’s risk at payment and, ultimately, to contribute to a 

(16)  28 out of a total of 52 very important recommendations issued in 2023 (54%).    

8 

 
 
 
 
consistent and convincing narrative (mainly in the discharge procedure) concerning: (i) differences with the 
European Court of Auditors errors; and (ii) together with the Internal Audit Service’s previous review of the 
Commission’s  corrective  capacity,  the  Commission’s  capacity  to  protect  the  EU  budget,  considering  its 
multi-annual control systems. The Internal Audit Service recognised that the Commission had made efforts 
to  improve  the  quality  and  clarity  of  the  reporting  on  the  risk  at  payment  both  at  the  Directorate-
General/service level (in the annual activity reports) and at corporate level (in the annual management and 
performance report). The audit concluded that the corporate instructions for the reporting on the risk at 
payment  and  risk  categorisation  were  overall  well  designed  and  effectively  implemented  by  the 
Directorates-General and services sampled. However, further improvement is required in the Commission’s 
analysis and reporting on the root causes of errors in relation with the European Court of Auditor’s findings. 

(2)  The  audit  on  the  preparedness  for  closing  the  2014-2020  programming  period  of  the  European 
Structural and Investment Funds was conducted in the Directorates-General for Regional and Urban Policy, 
for Employment, Social Affairs and Inclusion, and for Maritime Affairs and Fisheries.  The audits focused 
on the operational programme’s life cycle during which the Commission made conclusive checks on the 
legality  and  regularity  of  the  expenditure.  The  audit  found  that  the  Directorates-General  had  already 
implemented several key measures to support effectively and efficiently the preparation of the closure 
process.  However,  further  improvement  in  the  internal  planning  of  the  closure  exercise  and  the 
arrangements for the financial settlement at closure are needed.  

(3)  Following the merger of the former audit functions of the Directorates-General for Regional and Urban 
Policy  and  for  Employment,  Social  Affairs  and  Inclusion  in  2021,  which  created  the  Joint  Audit 
Directorate for Cohesion, the Internal Audit Service assessed the adequacy of the management and 
control systems put in place by the Joint Audit Directorate for Cohesion to ensure the efficient and effective 
implementation of its mandate. The audit concluded that although the Joint Audit Directorate for Cohesion 
had  put  in  place  adequately  designed  management  and  control  systems  to  implement  its  mandate 
effectively, there  remains a  need for further improvement in the efficiency of its  internal activities.  Its 
complex organisational structure had led to a loss of efficiency in internal administrative support processes 
(including human resources management, budget and financial management, reporting). In addition, it had 
not  made  a  documented  comprehensive  assessment  of  the  efficiency  gains  achieved  from  its 
establishment. Furthermore, it continued to use different information technology systems and tools of the 
two  Directorates-General  to  support  its  processes,  which  were  not  fully  integrated,  and  impacted  the 
efficiency of operations. 

(4)  The Internal Audit Service carried out an audit on the implementation of the Innovation Fund, up to 
the signature of the grant agreements, in the Directorate-General for Climate Action and the European 
Climate, Infrastructure and Environment Executive Agency. It concluded that overall adequate controls and 
processes for the implementation of the Innovation Fund had been designed and put in place. However, 
there is a need for further improvement in the efficiency and effectiveness of the process for evaluating 
proposals. 

(5)  The Recovery and Resilience Facility entered into force in 2021 as the key element of the NextGenerationEU 
temporary recovery instrument. The Internal Audit Service conducted an audit on ex ante controls of 
the Recovery and Resilience Facility payment requests (prior to the authorisation of the payments to 
a Member State) in the Directorate General for Economic and Financial Affairs and in the Recovery and 
Resilience  Task  Force.  It  concluded  that  while  acknowledging  the  steps  already  taken,  the  design  and 
implementation of the ex ante controls for the assessment of the Member States’ payment requests under 
the Recovery and Resilience Facility needed to be further enhanced to strengthen their effectiveness. In 
particular, further improvement is required in the assessment of the audit and control milestones and in 
the protection of sensitive non-classified information.  

(6)  An audit was conducted in the Directorates-General for Environment, for Energy, for Climate Action, and 
in the European Climate, Infrastructure and Environment Executive Agency. It focused on the execution 
of the Programme for the Environment and Climate Action (LIFE programme) for the period 2021-
2027 (design and implementation up to the signature of the grant agreements). It concluded that, while 
the governance, controls and processes put in place by the audited Directorates-General and the executive 
agency  for  the  implementation  of  the  LIFE  programme  2021-2027  were  overall  adequately  designed. 

9 

 
 
However,  further  improvement  is  needed  in  the  management  of  conflicts  of  interest  in  the  evaluation 
process. 

(7)  Five engagements were carried out by the Internal Audit Service for which no critical or very important 
weaknesses  in  the  internal  control  systems  of  the  audited  entities  were  identified:  two  audits  were 
conducted in the Directorate-General for European Civil Protection and the Humanitarian Aid Operations 
with an audit on annual financial clearance of accounts in the Directorate-General for Agriculture and Rural 
Development. While they concentrated on financial matters, they also included performance issues, namely 
an audit on the financial management of humanitarian aid under indirect management. Another audit in 
the Directorate-General for Migration and Home Affairs focused on the preparedness for closing actions 
and  programmes  funded  under  the  2014-2020  Internal  Security  Fund  and  the  Asylum,  Migration  and 
Integration Fund. The Internal Audit Service also conducted a limited review on data protection in the 
Directorates-General for International Partnerships, for Neighbourhood and Enlargement Negotiations, for 
European Civil Protection and Humanitarian Aid Operations, for Trade, for Taxation and Customs Union and 
the  Service  for  Foreign  Policy  Instruments.  It  focused  on  the  state  of  compliance  of  the  audited 
Directorates-General and services with the key provisions of the EU Data Protection Regulation (Regulation 
(EU) 2018/1725) and the associated implementing rules, with particular consideration to the transfer of 
data to non-EU countries. Lastly, the Internal Audit Service conducted a limited review on the assessment 
process performed by the Health Emergency Preparedness and Response Authority of its internal 
control framework and reported in the annual activity report for 2022. 

4.1.4.  Preparedness for and early implementation of the EU budget  

(1)  The  management  of  a  significant  budget  and  the  realisation  of  its  goals  under  the  multiannual 
financial  framework  for  2021-2027,  together  with  NextGenerationEU,  including  the  Recovery  and 
Resilience Facility, aimed to mitigate the socio-economic effects of the COVID-19 pandemic and facilitate 
Europe’s progression towards a modern, greener and more sustainable future, which carries substantial 
inherent  risks.  In  this  context  the  Internal  Audit  Service  included  in  its  2023  audit  plan  seven  audits 
covering the initial steps in planning and implementing the EU budget. For the majority of these audits the 
results  were  overall  positive,  except  for  two  audits  where  the  Internal  Audit  Service  issued  two 
recommendations rated as very important. 

(2)  The Internal Audit Service carried out an audit in the Directorate-General for Defence Industry and Space 
on the preparedness of its management and control systems for implementation of the 2021-2027 Space 
Programme. It concluded that although the management and control systems were overall adequately 
designed  for  implementation  of  the  2021-2027  Space  Programme,  there  is  a  need  for  further 
improvement in relation to the security management plans. 

(3)  The Internal Audit Service conducted an  audit on the Digital  Europe  Programme in the  Directorate-
General  for  Communications  Networks,  Content  and  Technology  and  the  European  Health  and  Digital 
Executive  Agency.  It  focused  on  the  early  phases  of  implementation  of  the  2021-2027  Digital  Europe 
Programme supporting and fostering the digital transition in the European economy in the years to come. 
The audit concluded that the controls and processes put in place by the audited entities for the early phases 
of  implementation  of  the  Digital  Europe  Programme  were  overall  adequately  designed  and  effective. 
However, improvement is needed in the design of the controls for the management of conflicts of interest 
and ethics. 

(4)  A further five  engagements did not identify any critical or very important weaknesses in the internal 
control  systems  of  the  audited  entities:  two  of  these  engagements  covered  the  first  implementation 
phase (from the publication of the calls for proposal until the signature of the grant agreements) of grant 
management under the Horizon Europe programme, one in the Research Executive Agency, and another 
one in the European Research Council Executive Agency and the  European Health and Digital Executive 
Agency.  Three  audits  focused  on  the  early  stages  of  implementation  of  the  2021-2027  multiannual 
financial  framework,  mainly  on  the  preparedness of  the  management  and  control  systems:  (1)  for  the 
implementation of the Citizens, Equality, Rights and Values and Justice programmes in the Directorate-
General for Justice and Consumers and the European Education and Culture Executive Agency; (2) for the 
implementation by the European Education and Culture Executive Agency of the Erasmus+, Creative Europe 

10 

 
 
and European Solidarity Corps programmes and their supervision by the Directorate-General for Education, 
Youth, Sport and Culture; and (3) for early implementation of grants in the EU4Health Programme in the 
Directorate-General  for  Health  and  Food  Safety,  the  European  Health  Emergency,  Preparedness  and 
Response Authority and the European Health and Digital Executive Agency. 

4.1.5.  Cooperation with third parties implementing policies and programmes 

Budget implementation tasks can be entrusted to EU bodies referred to in Articles 70 and 71 of the Financial 
Regulation.  Currently,  the  landscape  of  EU  decentralised  agencies  is  diverse  in  terms  of  their  governance 
structures, mandates and tasks. Considering the risks identified by the Internal Audit  Service related to the 
Commission’s responsibility in cooperating with, monitoring and supervising these bodies.  

(1)  The Internal Audit Service carried out two engagements in 2023, which involved a Commission partner, 
Directorates-General and various decentralised agencies or other autonomous bodies. They covered the 
coordination between the Directorate-General for Migration and Home Affairs and the EU decentralised 
agencies (17) together with a limited review on the cooperation and coordination mechanisms to prevent, 
detect and  respond to  serious cross-border threats to health in the Directorate-General for Health and 
Food Safety, European Health Emergency Preparedness and Response Authority, the European Centre for 
Disease Prevention and Control and the European  Medicines Agency. The Internal Audit Service  did not 
identify any critical or very important weaknesses. 

4.1.6.  Information security and technology  

In view of generally heightened security concerns, legal obligations, Member States’ expectations, new user 
requirements, and a corporate approach to information management, the Commission established in 2019 a 
corporate information security strategy. This strategy complements the Commission’s Data, Information and 
Knowledge  Management  strategy,  the  Digital  strategy,  and  the  information  technology  security  strategy. 
Furthermore, the Commission adopted, in 2022, a proposal for a Regulation of the European Parliament and 
of the Council on common information security rules for all Union institutions, bodies, offices and agencies, 
and a proposal for a Regulation of the European Parliament and of the Council laying down measures for a 
high  common  level  of  cybersecurity  at  the  institutions,  bodies,  offices  and  agencies  of  the  Union  which, 
following the interinstitutional negotiations, was adopted by the co-legislators in December 2023, and entered 
into force in January 2024. 

The Internal Audit Service conducted four audits on information security and technology in 2023. These audits 
identified  a  number  of  areas  requiring  further  improvement  (10  out  of  a  total  of  52  very  important 
recommendations issued in 2023).  

(1)  The Commission is exposed to high inherent information security risks, including the risk to confidentiality 
of information. New information security risks have been emerging in recent years as more information is 
handled  electronically.  To  address  these  risks,  effective  controls should  be  in  place  to  ensure  that,  the 
information is categorised in line with its sensitivity and is handled according to its categorisation level to 
protect confidentiality. The audit on protection of confidentiality of information covered the three 
key  actors  at  corporate  level  responsible  for  information  security  -  the  Directorate-General  for  Human 
Resources  and  Security,  the  Directorate-General  for  Digital  Services  and  the  Secretariat-General.  It 
concluded that the Commission has progressed in putting in place an adequate corporate framework and 
effective  corporate  controls,  including  effective  risk  management  to  protect  the  confidentiality  of 
information. The audit identified additional actions required at corporate level to support more effectively 
the  Commission  services  in  their  responsibility  to  protect  the  confidentiality  of  information  concerning 
external  service  providers,  information  technology  controls,  and  the  process  for  managing  information 
security incidents. 

(17)  European  Monitoring  Centre  for  Drugs  and  Drug  Addiction;  European  Union  Agency  for  Asylum;  European  Union  Agency  for  Law 
Enforcement Cooperation; European Union Agency for Law  Enforcement Training; and European Union Agency for the Operational 
Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice. 

11 

 
 
 
 
(2)  The  Internal  Audit  Service  conducted  an  audit  in  the  Directorate-General  for  Competition  on  Case 
Management  Rationalisation  (CASE@EC).  This  is  the  flagship  of  the  Commission’s  information 
systems  rationalisation  exercise  project  under  this  DG’s  lead.  The  audit  concluded  that  although  the 
Directorate General for Competition has made progress in designing and implementing governance and 
internal control processes for the CASE@EC project, there is a need for further improvement in the way in 
which certain information technology security controls have been designed, applied or documented. In this 
context, the Internal Audit Service identified two very important issues. 

(3)  The EU’s emissions trading system (EU ETS) is a cornerstone of the EU’s policy to combat climate change 
and its key tool for reducing greenhouse gas emissions in a cost-effective manner. It is the world’s first 
major carbon market and remains the biggest one, managed by the Directorate-General for Climate Action 
and  a  third  party.  The  Directorate-General  for  Digital  Services  is  one  of  several  system  suppliers,  and 
provides standardised information technology services, including some security services. The Internal Audit 
Service conducted a limited review of the security plan and associated security measures of the EU 
ETS  information  system  managed  by  the  Directorate-General  for  Climate  Action.  While  the  security 
processes of the EU ETS information system had gradually become more mature, further improvement is 
required in their design and effectiveness. The audit identified two very important issues in the design of 
the 2022 information technology security plan for the EU ETS information system and the governance 
framework for its implementation. Since 2010, the Directorate-General for Climate Action has issued a 
reservation every year in its annual activity reports on reputational, legal, and financial grounds related to 
security risks identified in relation to the Union Registry under EU ETS. 

(4)  Another  audit  was  conducted  on  the  management  of  information  technology  security  in  the 
Directorate-General for Education, Youth, Sport and Culture concerning the control system to manage the 
security  of  the  information  technology  systems.  The  audit  concluded  that  there  is  a  need  for  further 
improvement in its effective implementation.  It identified inconsistencies in data classification between 
the  information  technology  security  plan  for  the  indirect  grant  management  platform  and  its  business 
impact assessment conclusion. 

4.1.7.  Other processes 

Three audits assessed performance aspects within other processes on:  

(1)  corporate communication in the Directorate-General for Communication; 

(2)  human resources management in the Directorate-General for Competition; 

The two audits did not reveal critical or very important weaknesses in the control systems.  

(3)  large-scale building projects involving works in the Office for Infrastructure and Logistics in Brussels 

and the Office for Infrastructure and Logistics in Luxembourg.  

The Internal Audit Service acknowledged the challenges faced by the  two offices, mainly that they need to 
manage  a  wide  client  base  with  different  needs  and  the  fact  that  they  are  operating  in  a  dynamic  and 
competitive real-estate market as well as in a complex and changing legal frameworks. The audit concluded 
that although the offices had, overall, designed and effectively implemented an adequate framework for the 
management of large-scale building projects, there remained a need for further improvement in its efficiency, 
including  the  extent  to  which  the  procurement  procedures  are  sufficiently  documented,  transparent  and 
competitive. 

12 

 
 
4.2. 

Internal Audit Service limited conclusions 

The  Internal  Audit  Service  issued  limited  conclusions  on  the  state  of  internal  control  to  all  Commission’s 
Directorates-General and  services (18) in February  2024. These limited  conclusions contributed to the 2023 
annual activity reports of the Directorates-General and services concerned. Drawing on the audit work carried 
out in the last five years, they cover all open recommendations issued. The Internal Audit Service’s conclusion 
on the state of internal control is limited to the management and control systems that were audited. It does 
not cover systems not audited by the Internal Audit Service in the past five years. 

4.3.  Overall opinion on the Commission’s financial management 

As  required  by  its  mission  charter,  the  Internal  Audit  Service  issues  an  annual  overall  opinion  on  the 
Commission’s financial management. This is based on the audit work in the area of financial management in 
the Commission carried out by the Internal Audit Service during the past three years (2021 to 2023). It also 
takes into account information from other sources, namely the reports of the European Court of Auditors. The 
overall opinion is issued at the same time as this report and covers the same year. 

Based on this audit information, the internal auditor considered that, in 2023, the Commission had put in place 
governance, risk management and internal control procedures which, taken as a whole, are adequate to give 
reasonable assurance over the achievement of its financial objectives. However, the overall opinion is qualified 
with regard to the reservations the authorising officers by delegation made in their declarations of assurance 
issued in their respective annual activity reports. 

In arriving at the overall opinion, the Internal Audit Service also considered the combined impact of all amounts 
estimated to be at risk at payment as these go beyond the amounts put under reservation. The overall amounts 
at  risk  at  payment  are  the  best  estimation  of  the  authorising  officers  by  delegation  of  the  amount  of  the 
expenditure authorised not in conformity with the applicable contractual and regulatory provisions at the time 
of the payment in 2023. In their annual activity reports, Directorates-General and services estimate amounts 
at  risk  at  payment  to  total  between  EUR  2  742.5  million  and  EUR  3  291.5  million  approximately.  This 
corresponds  to  between  1.6%  and  1.9%  of  total  relevant  expenditure  (19)  from  the  Commission  budget, 
European Development Fund and EU Trust Funds in 2023 and therefore below the materiality of 2% as defined 
in the instructions for the preparation of the 2023 annual activity reports. 

These amounts at risk at payment in 2023 do not yet take into account any financial corrections and recoveries 
related to deficiencies and errors which the Directorates-General and services will detect and correct in the 
future due to the multi-annual corrective mechanisms built into the Commission’s internal control systems. 

Given these elements, the Internal Audit Service considers that the EU budget is therefore adequately protected 
in total and over time. 

Without further qualifying the overall opinion, the Internal Audit Service drew the attention of the Commission 
to the need to build on the lessons from managing its financial resources in a challenging context. 

The  response  to  challenges  over  the  past  few  years  has  underlined  the  strengths  and  flexibility  of  the  EU 
budget  and  NextGenerationEU  to  react  to  crises.  However,  new  high  risks  that  may  affect  assurance  and 
performance  have  arisen  due  to  the  fast-paced  and  volatile  environment,  where  responding  to  crises  is 
becoming  the  norm,  coupled  with  the  unprecedented  amounts  mobilised,  the  creation  of  innovative  and 
complex instruments and new approaches to existing programmes. 

(18)  No audits were carried out in the advisory service Inspire, Debate, Engage and Accelerate Action during the 2019-2023 period, as no 

high risks were identified, and therefore no limited conclusion was provided. 

(19)  Relevant expenditure means the total amount of payments made in 2023 minus the total amount of new pre-financing paid in 2023 
plus the total amount of old pre-financing cleared in 2023 as reported by the Commission services in their 2023 annual activity 
reports. 

13 

 
 
 
 
To ensure that the budget is duly protected over time, it is important to keep the focus on measures to mitigate 
these risks. In addition to collaboration with Member States and with third parties, areas that will continue to 
require particular attention include performance-based programmes and financial instruments. This is against 
a  backdrop  of  extraordinary  pressure  on  human  resources,  already  identified  within  the  Commission  as  a 
crosscutting  risk,  which  makes  the  achievement  of  policy  and  financial  management  objectives  even  more 
challenging. 

Furthermore, the Commission needs to ensure that adequate governance, risk management and internal control 
arrangements are designed for the programmes and instruments conceived for the next Multiannual Financial 
Framework. 

The Internal Audit Service will continue to monitor the impact of the risks on the soundness of the Commission’s 
financial management. 

5. Consultation with the Commission’s 

financial irregularities panel  

No  systemic  problems  were  reported  in  2023  by  the  panel  set  up  pursuant  to  Article  143  of  the  Financial 
Regulation (20), where it gives the opinion referred to in Article 93 of the Financial Regulation. 

(20)  Since the entry into force of the 2018 Financial Regulation the functions of all institutions’ financial  irregularities panel have been 

transferred to the Early Detection and Exclusion System Panel referred to in Article 143 of the Financial Regulation. 

14