COMMISSION STAFF WORKING DOCUMENT Accompanying the document REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2024
Date: 2025-06-17
Institutions: European Commission, Secretariat-General
Subjects: activity report, administrative check, audit, budgetary discharge, financial year, fraud against the EU, management audit

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 17.6.2025  SWD(2025) 159 final  COMMISSION STAFF WORKING DOCUMENT     Accompanying the document REPORT FROM THE COMMISSION   TO THE EUROPEAN PARLIAMENT, THE COUNCIL AND THE COURT OF AUDITORS Annual report to the Discharge Authority on internal audits carried out in 2024 {COM(2025) 314 final}  
 
 
Contents 
PART 1  ………………………………………………………………………………………………………………………………………………..6 

FINAL REPORTS..................................................................................................................................................................... 6 

Horizontal audits ................................................................................................................................................................. 7 

1.1. 

1.2. 

1.3. 

1.4. 
1.5. 

1.6. 

Audit on the planning, programming, governance, and coordination of the Single Market 
Programme (DG COMP, DG ESTAT, DG FISMA, DG GROW, DG JUST, DG SANTE, DG TAXUD, EISMEA, 
HaDEA) ............................................................................................................................................................................................................ 7 

Audit on the assessment of human resource needs in the Commission at corporate level (DG 
BUDG, DG HR, the SG) ............................................................................................................................................................................ 7 

Audit on the allocation of human resources in EU Delegations (DG INTPA, DG NEAR, DG TRADE, the 
FPI, EEAS) ....................................................................................................................................................................................................... 9 
Audit on the design of the control strategy for Horizon Europe (DG BUDG, DG RTD, SJ) ........................ 10 

Audit on anti-fraud strategies in the external action family (DG ECHO, the FPI, DG INTPA (), DG 
NEAR, EEAS) .............................................................................................................................................................................................. 12 

Audit on the assurance building processes and audit strategy for the 2021-2027 programming 
period - Phase I: design (DG EMPL, DG MARE, DG REGIO) ........................................................................................... 14 

1.7. 

Audit on IT security risk management at the Commission (DG AGRI, DG CNECT, DG DGT, DG DIGIT, 
DG ECHO, DG ENER, DG MARE, OLAF, OP, DG RTD, DG SANTE, DG TRADE) ....................................................... 15 
Single Market, Innovation and Digital ...................................................................................................................... 18 

1.8. 

Audit on the preparation of the macro financial assistance programme to enlargement and 
neighbourhood countries (DG ECFIN) ........................................................................................................................................ 18 
Audit on human resources management (DG FISMA) .................................................................................................... 18 
1.9. 
1.10.  Audit on the new nuclear decommissioning and waste management programme (NDWMP) (JRC) 19 
1.11.  Audit on Horizon Europe – grant management phase I (from publication of the calls until signature 
of the grant agreements) (CINEA) .............................................................................................................................................. 21 
1.12.  Audit on Horizon 2020 grant management phase IV (final payment and closure) (ERCEA) ................. 22 
Cohesion, resilience and values .................................................................................................................................. 22 

1.13.  Audit on the European Union Solidarity Fund (EUSF) (DG REGIO) ............................................................................ 22 
1.14.  Audit on the performance of the management of experts for proposal evaluation (EACEA) ............... 24 
Natural resources and environment ......................................................................................................................... 25 

1.15.  Audit on the preparedness of DG AGRI in designing the assurance building model under the new 

Common Agricultural Policy strategic plans (DG AGRI) ................................................................................................. 25 

1.16.  Audit on the implementation and monitoring of the EU emission trading system (EU ETS) (DG 

CLIMA)........................................................................................................................................................................................................... 26 
1.17.  Audit on assurance building for expenditure under direct management (DG MARE) ................................. 28 
Neighbourhood and the world ..................................................................................................................................... 30 

1.18.  Audit on controls over the financial management of the civilian Common Security and Defence 

Policy Missions implemented by the Service for Foreign Policy Instruments (FPI) ...................................... 30 
1.19.  Audit on indirect management with partner countries (DG INTPA) ....................................................................... 31 
General services ............................................................................................................................................................... 34 

1.20.  Audit on the protection of personal data (PMO) ................................................................................................................ 34 
1.21.  Audit on procurement (DG SCIC) .................................................................................................................................................. 35 
Information technology ................................................................................................................................................. 37 

 
 
1.22.  Limited review of SUMMA in preparation for ‘going live’ (DG BUDG) .................................................................. 37 
1.23.  Audit on IT financing framework (DG DIGIT) ........................................................................................................................ 38 

PART 2  FOLLOW-UP ENGAGEMENTS ......................................................................................................................... 40 

Audits for which some recommendations remain open ..................................................................................... 41 

2.1. 
2.2. 

2.3. 
2.4. 
2.5. 
2.6. 
2.7. 
2.8. 

2.9. 

Audit on the design and set-up of the Digital Europe Programme in DG CNECT and HaDEA .............. 41 

Audit on preparedness of the management and control systems regarding the implementation of 
the Citizens, Equality, Rights and Values (CERV) and Justice programmes in DG JUST and EACEA . 41 
Audit on crisis communication in DG COMM, DG ECHO, DG SANTE and the SG ............................................ 42 
Audit on European Commission actions against food fraud in DG AGRI, OLAF and DG SANTE........... 42 
Audit on the implementation of the Innovation Fund in DG CLIMA and CINEA ............................................. 42 
Audit on the management of public cloud services in DG DIGIT, DG HR and the SG ................................. 43 
Audit on IT security management in the HR family - DG DIGIT, DG HR, EPSO and PMO ......................... 44 

Audit on the protection of personal data under the responsibility of DG RTD (CIC), CINEA, EACEA, 
EISMEA, ERCEA and REA .................................................................................................................................................................... 44 

Audit on interruptions, suspensions and financial corrections for European Structural and 
Investment Funds 2014-2020 by DG EMPL, DG MARE and DG REGIO ............................................................... 45 

2.10.  Audit on the preparedness for closing the 2014-2020 programming period of the European 

Structural and Investment Funds in DG EMPL, DG MARE and DG REGIO ........................................................... 45 

2.11.  Audit on the management of recovery orders for competition fines (incl. guarantees for 

competition fines) and for recovery orders in the context of the Commission's 'corrective capacity' 
– Phase II .................................................................................................................................................................................................... 46 
2.12.  Audit on the physical security of persons and assets in the Commission – DG COMM, DG DIGIT, DG 
HR, OIB and OIL ...................................................................................................................................................................................... 46 

2.13.  Audit on the review of the Commission’s risk at payment in DG AGRI, DG BUDG, DG EMPL, DG 

INTPA, DG NEAR, DG REGIO, DG RTD, EISMEA, ERCEA and REA ................................................................................ 47 
2.14.  Audit on the performance framework for research ......................................................................................................... 48 
2.15.  Audit on the pillar assessment in the external action family – DG BUDG, DG ECHO, the FPI, DG 

INTPA and DG NEAR ............................................................................................................................................................................. 49 
2.16.  Audit on indirect management with entrusted entities in DG INTPA and DG NEAR .................................... 49 
2.17.  Audit on the implementation of bilateral trade agreements in DG AGRI, DG ENV and DG TRADE .... 49 
2.18.  Audit on contractual expenditure verifications in the FPI, DG INTPA and DG NEAR .................................... 50 
2.19.  Limited review on data protection in DG ECHO, the FPI, DG INTPA, DG NEAR, DG TRADE and DG 

TAXUD ........................................................................................................................................................................................................... 52 
2.20.  Limited review of SUMMA in preparation for ‘going live’ in DG BUDG ................................................................ 52 
2.21.  Limited review of the security plan and associated security measures of the EU emissions trading 
system (ETS) information system managed by DG CLIMA ......................................................................................... 53 
2.22.  Audit on the CASE@EC project in DG COMP ......................................................................................................................... 53 
2.23.  Audit on human resources management in DG COMP .................................................................................................. 54 
2.24.  Audit on public procurement in DG DIGIT ............................................................................................................................... 54 
2.25.  Audit on the effectiveness of the protection of personal data of beneficiaries of and participants in 
the Erasmus+ and European Solidarity Corps programmes managed by DG EAC ...................................... 55 
2.26.  Audit on human resources management in DG ECFIN .................................................................................................. 55 
2.27.  Limited review of the Recovery and Resilience Facility control and audit strategies in DG ECFIN .... 55 

 
 
2.28.  Audit on the financial management of Humanitarian Aid under indirect management in DG ECHO

 55 

2.29.  Audit on the effectiveness and efficiency of Eurostat’s performance management system – DG 

ESTAT ............................................................................................................................................................................................................. 55 
2.30.  Audit on performance management in the FPI .................................................................................................................. 55 
2.31.  Audit on the performance of the treatment of stakeholders' complaints concerning the internal 

market in DG GROW ............................................................................................................................................................................. 57 
2.32.  Audit on the European anti-fraud office´s effectiveness in the area of fraud prevention activities - 
OLAF .............................................................................................................................................................................................................. 57 

2.33.  Audit on the grant and procurement award process under European Neighbourhood Instrument 

(ENI) direct management in DG NEAR ...................................................................................................................................... 57 
2.34.  Audit on the annual audit plan in DG NEAR .......................................................................................................................... 58 
2.35.  Audit on performance management in DG TAXUD ........................................................................................................... 58 
List of audits for which all recommendations were closed in 2024 ............................................................ 59 

PART 3 - SUMMARY OF LONG OVERDUE RECOMMENDATIONS ......................................................................... 61 

 
 
 
 
 
List of abbreviations 

CIC: Common Implementation Centre 
CINEA: European Climate, Infrastructure and Environment Executive Agency 
DG AGRI: Directorate-General for Agriculture and Rural Development  
DG BUDG: Directorate-General for Budget  
DG CLIMA: Directorate-General for Climate Action  
DG CNECT: Directorate-General for Communications Networks, Content and Technology  
DG COMM: Directorate-General for Communication  
DG COMP: Directorate-General for Competition  
DG DEFIS: Directorate-General for Defence Industry and Space 
DG DIGIT: Directorate-General for Digital Services  
DG EAC: Directorate-General for Education, Youth, Sport and Culture  
DG ECFIN: Directorate-General for Economic and Financial Affairs 
DG ECHO: Directorate-General for European Civil Protection and Humanitarian Aid Operations 
DG EMPL: Directorate-General for Employment, Social Affairs and Inclusion  
DG ENER: Directorate-General for Energy 
DG ENV: Directorate-General for Environment  
DG ESTAT: Eurostat  
DG FISMA: Directorate-General for Financial Stability, Financial Services and Capital Markets Union  
DG HOME: Directorate-General for Migration and Home Affairs  
DG HR: Directorate-General for Human Resources and Security  
DG INTPA: Directorate-General for International Partnerships 
DG JUST: Directorate-General for Justice and Consumers  
DG MARE: Directorate-General for Maritime Affairs and Fisheries  
DG MOVE: Directorate-General for Mobility and Transport  
DG NEAR: Directorate-General for Neighbourhood and Enlargement Negotiations  
DG REFORM: Directorate-General for Structural Reform Support 
DG REGIO: Directorate-General for Regional and Urban Policy  
DG RTD: Directorate-General for Research and Innovation  
DG SANTE: Directorate-General for Health and Food Safety  
DG TAXUD: Directorate-General for Taxation and Customs Union  
DG TRADE: Directorate-General for Trade  
EACEA: Education and Culture Executive Agency  
EEA: European Environment Agency 
EEAS: European External Action Service 
EISMEA: European Innovation Council and Small and Medium-sized Enterprises Executive Agency 
EFCA: European Fisheries Control Agency 
ERCEA: European Research Council Executive Agency  
ETF: European Training Foundation 
FPI: Service for Foreign Policy Instruments  
IAS: Internal Audit Service  
IT: Information technology 
JRC: Joint Research Centre  
LS: Legal Service 
OIB: Office for Infrastructure and Logistics in Brussels  
OIL: Office for Infrastructure and Logistics in Luxembourg  
OLAF: European Anti-Fraud Office  
OP: Publications Office of the European Union  
PMO: Office for the Administration and Payment of Individual Entitlements  
REA: Research Executive Agency  
SG: Secretariat-General  

 
 
Context of this Staff Working Document 

Part 1 of this Staff Working Document contains: 

• 

• 

• 

a summary of the 23 finalised internal audit engagements (1) performed as part of the 2024 Internal 
Audit Service (IAS) audit plan (audits whose reports were issued between 1 February 2024 and 31 
January 2025) (2), 

the main recommendations (critical and very important) (3) stemming from these engagements, 

information  provided  by  the  Directorates-General/services  on  the  actions  drawn  up  and/or 
implemented to address the IAS audit recommendations.  

Each audit engagement followed the standard professional validation procedures and contradictory procedures 
involving  auditor  and  auditee  applicable  when  the  engagement  was  finalised.  The  summary  of  each 
engagement aims to provide an overview of the audits and their main results. 

Part 2 of this Staff Working Document includes a summary of the results of the IAS follow-up engagements 
performed between 1 February 2024 and 31 January 2025 (4), including a list of audit engagements for which 
all recommendations were assessed as implemented following a follow-up audit by the IAS. 

Part 3 provides an overview of the six long overdue very important recommendations as at 31 January 2025. 

(1)  The IAS also finalised four other engagements (a risk assessment and insight notes) which are not included in this Staff 

Working Document. 

(2)   Except for the audit on Human Resources management in the DG FISMA for which the final audit report was issued on 

10 March 2025 and which, as an exception, is included in the Annual Internal Audit report for 2024. 
Important recommendations are not listed in this Staff Working Document. 

(3) 
(4)  Each summary reflects the IAS’s assessment of the implementation status of audit recommendations at the end of the 
follow-up engagement. They do not take account of any further action which the auditee may have undertaken and 
reported to the IAS since the release of the IAS follow-up note even if that action may have had an impact on the 
status of the recommendations.  

5 

 
 
 
 
 
Part 1  
Final reports

6 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Horizontal audits 

1.1. 

Audit  on  the  planning,  programming,  governance,  and 
coordination  of  the  Single  Market  Programme  (DG  COMP,  DG 
ESTAT,  DG  FISMA,  DG  GROW,  DG  JUST,  DG  SANTE,  DG  TAXUD, 
EISMEA, HaDEA) 

The objective of the audit was to assess the adequacy of the design and the efficiency and effectiveness of the 
governance  and  coordination  processes  of  the  Single  Market  Programme,  including  the  preparation  of  the 
financing decisions/work programmes, and the budget planning, allocation, and monitoring. 

There  are  no  observations/reservations  in  the  2022  Annual  Activity  Reports  of  DG  GROW  and  the  other  six 
Directorates-General  and  two  Executive  Agencies  that  implement  the  programme  that  relate  to  the 
areas/processes audited. 

The fieldwork was finalised on 20 February 2024. All observations and recommendations relate to the situation 
as of that date. 

The IAS acknowledged the commitment demonstrated by the DG GROW team responsible for coordinating the 
management of the Single Market Programme. The team has made continuous and proactive efforts to improve 
the programme’s governance and coordination arrangements/processes, such as: 

• 

• 

going  beyond  the  original  remit  envisaged  in  the  memorandum  of  understanding  to  organise  all 
monthly  coordination  meetings  and  taking  a  hands-on  approach  to  programme  management  and 
coordination; 

looking to continually improve the process of preparation of the financing decision/work programme 
every year by incorporating the lessons learned from the previous exercise. These efforts helped to 
ensure that, for the first time, the programme’s financing decision and work programme (2024) was 
adopted in the year preceding the year of implementation (2023). 

The IAS did not formulate any critical or very important recommendations. 

1.2. 

Audit  on  the  assessment  of  human  resource  needs  in  the 
Commission at corporate level (DG BUDG, DG HR, the SG) 

The objective of the audit was to assess whether the guidance and tools provided to the operational services 
and the processes employed by the central services (DG BUDG, DG HR and the SG) for the assessment of human 
resource (HR) needs in the Commission are adequate and effective to support the Commission in delivering 
existing and new tasks in line with its objectives and priorities. 

There are no observations/reservations in the 2023 Annual Activity Report of the three audited Directorates-
General that relate to the process audited. However, DG BUDG, DG HR and  the SG have maintained a critical 
crosscutting risk related to the high pressure on resources, both human and financial.  

The fieldwork was finalised on 4 December 2023. All observations and recommendations relate to the situation 
as at that date. 

The IAS identified two very important issues concerning support from the central services for the assessment 
of HR needs at local level and quality checks on the Commission’s HR needs by the central services. It formulated 
six very important recommendations addressed to DG HR, DG BUDG and the SG.  

7 

 
On support from the central services for the  assessing of HR needs at local level (three very important 
recommendations), DG HR, DG BUDG and the SG, should: 

• 

complement the existing reporting requirements for HR needs in the budgetary (standard HR planning 
form) and legislative (legislative financial statement) context, with common principles and guidance 
to be used by Directorates-General in their assessment of HR needs. These should: 

—  be proportionate in striking the right balance between flexibility and ensuring the consistency 
needed  to  allow  the  central  services  to  consolidate  the  overall  information  at  Commission 
level; 

—  given the context of scarce resources, emphasise the need  for the Directorates-General to 
exploit effectively all possibilities for internal redeployment and identify alternative ways to 
address  the  HR  needs,  including  by  effectively  deciding  on  negative  priorities  and  by 
proactively looking for synergies; 

—  strengthen  the  instructions  for  the  preparation  of  legislative  financial  statement  for  the 
Directorates-General to report clearly whether the HR needs of the new proposal will be met 
by the existing staff or via additional resources; 

—  assess the appropriateness of continue using the ‘incremental’ approach or exploring the use 

of alternative approaches to assess HR needs, depending on the circumstances; 

—  provide relevant parameters to assess workload, sufficiently flexible to allow both qualitative, 
and, where appropriate, quantitative aspects, such as output or more indirect indicators; and 

—  enable  the  Directorates-General  to  have  access  to  and  interpret  the  data  regarding  the 

parameters to be used for their workload assessment. 

• 

reinforce  the  exchange  of  good  practices  between  services  on  the  assessment  of  HR  needs  (for 
example in the context of the HR correspondent network and HR pills). 

On  the  quality  checks  of  the  Commission’s  HR  needs  by  the  central  services  (three  very  important 
recommendations), DG HR, DG BUDG and the SG should:  

• 

• 

• 

given the limited resources available at the central level, set up a procedure for proportionate and 
focussed  quality  checks  to  be  performed  by  the  central  services on  the  HR  needs  reported  by  the 
Directorates-General  in  the  legislative  context  (via  the  legislative  financial  statements)  and  the 
budgetary context (via the standard planning forms). These consistency/plausibility checks should aim 
at ensuring that the common principles and guidance (to be defined as per recommendations stated 
above) are respected by the Directorates-General when assessing their HR needs;   

ensure that the quality checks are implemented in practice; 

based  on  information  (to  be)  provided  by  operational  Directorates-General,  build  a  sufficiently 
granular overview of the staff allocated to Commission activities. This will help the central services to 
identify  and  assess  HR  needs  by  comparing  the  distribution  of  resources  allocated  to  activities 
between the Directorates-General to prioritise their HR needs and to identify any potential for (further) 
synergies. 

Additional information provided  the SG, DG  BUDG,  DG HR on the measures defined and/or 
implemented following the Internal Audit Service audit 

A joint action plan was adopted by the three concerned DGs, with DG BUDG leading the most significant 
actions. 

Support from the central services for the assessment of HR needs at local level has been implemented, 
mainly  with  the  introduction  of  a  revised  Legislative  Financial  and  Digital  Statement  (LFDS)  to 
accompany each new legislative proposal, which was adopted as part of the revision  of the Internal 
Rules in 2024. The new LFDS better assesses the staffing requests of DGs when presenting legislative 
proposals, with a requirement to specify what is possible by internal redeployment, what is additional, 

8 

 
and how any additional needs can be financed. This sets out a much clearer framework for DGs, in which 
they can indicate  which staff for a  new initiative will be found via redeployment, and  which cannot, 
aiding  the  overall  assessment  and  quality  checking  process.  Several  other  actions  have  been 
implemented, such as introducing new workload indicators and providing guidance on available tools for 
assessing workload. Developments in the new human resources transformation tool are ongoing. Work 
on the quality checks of the Commission’s HR needs by the corporate services continues in collaboration 
with the SG, BUDG and HR, and in view of the preparation of the complementary allocation for 2025. 

1.3. 

Audit  on the allocation of human resources in EU Delegations 
(DG INTPA, DG NEAR, DG TRADE, the FPI, EEAS) 

The objective of the audit was to assess if the process for allocating human resources in EU Delegations (EUDs) 
is  adequately  designed  and  efficiently  and  effectively  implemented  by  the  Commission  Directorates-
General/Services and the EEAS, and if it reflects the current budgetary constraints and the (geopolitical) priorities 
of the EU. 

There are no observations/reservations in the 2023 Annual Activity Reports of the audited Directorates-General 
and Services that relate to the area/process audited. 

The fieldwork was finalised on 3 June 2024. All observations and recommendations relate to the situation as 
at that date. 

The audit identified the following strengths/good practices: 

• 

• 

• 

• 

overall, the audited Directorates-General comply with the instructions of the ‘budget circular’ and the 
‘stable staffing’ principle; 

the 2022 workload assessment in EUDs (WLAD) was a comprehensive exercise that was prepared, 
launched and monitored through intensive consultations between the Commission’s external action 
Directorates-General and the EEAS in the COMDEL and EUDEL committees. It was the first time that 
such an assessment led, especially for DG INTPA, DG NEAR and the FPI, to a comparison and scoring 
of  EUDs  workload  through  the  analysis  of  a  set  of  quantitative  indicators.  The  assessment  was 
completed with the full support and participation of EUDs; 

the collection, management  and maintenance of the WLAD data for the Commission Directorates-
General  was  ensured  by  key  staff  in  DG  INTPA  who  processed  a  significant  amount  of  data  and 
produced informative reports including graphical depictions through tables, charts and data sheets of 
key parameters and indicators;   

the COMDEL and EUDEL committees function well as platforms for escalating and discussing issues 
pertaining to the allocation and management of staff in EUDs. 

The IAS identified one very important issue concerning the design and implementation of the WLAD and 
formulated six very important recommendations.  

DG INTPA, DG NEAR, the FPI in view of the WLAD or a similar exercise, should: 

• 

• 

agree on a methodology that allows for comparisons of EUDs at global level;  

select the subset of key indicators that will contribute to the workload assessment, to improve the 
efficiency of the data collection process. 

DG TRADE should: 

• 

define, for the next WLAD or a similar exercise, a methodology combining the qualitative assessment 
with an analysis of available relevant quantitative data and criteria. 

9 

 
DG INTPA should: 

•  define what they intend to do with the WLAD data, particularly in view of:  

— 

— 

their usage in the strategic reflections on size of the EUDs network and/or; 

the opportunity to use historical data to set benchmarks for future workload assessments in 
EUDs. 

DG INTPA should: 

• 

as chair of the COMDEL and centre of gravity for Commission staff in EUDs, make the necessary 
arrangements for the Committee to follow-up and report (to the College and relevant stakeholders) 
on  the  ‘more  thorough  assessment’  of  the  adequacy  and  alignment  to  political  priorities  of  staff 
posted by line Directorates-General in EUDs 

Additional information provided by the FPI, DG INTPA, DG NEAR, DG TRADE on the measures 
defined and/or implemented following the Internal Audit Service audit 

The proposed action plan sent by the FPI has been accepted by the IAS and is under implementation. 

DG INTPA has accepted all recommendations and adopted action plans that are currently under review 
by the IAS.  The auditors concluded that some weaknesses exist in the design and implementation of 
the process and formulated one very important recommendation. DG NEAR has adopted an action plan 
with a view to 1) engage with other Commission services to agree on a methodology that allows the 
comparison  of  all  EU  delegations,  2)  select  the  subset  of  key  indicators  that  will  contribute  to  the 
workload assessment, to improve the efficiency of the data collection process. The IAS has accepted the 
action plan at the end of April 2025 and its implementation id ongoing.  

In  March  2025,  the  IAS  accepted  DG  TRADE’s  action  plan  of  December  2024  related  to  the  very 
important recommendation on the methodology, and its implementation is ongoing. 

1.4. 

Audit on the design of the control strategy for Horizon Europe 
(DG BUDG, DG RTD, SJ) 

The objective of the audit was to assess the design of the control strategy for the implementation of Horizon 
Europe. 

There  are  no  observations/reservations  in  the  2023  Annual  Activity  Report  of  DG  RTD  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  16  September  2024.  All  observations  and  recommendations  relate  to  the 
situation as at that date. 

The IAS identified the following good practices and noted positive developments during the audit: 

• 

• 

the  results  of  the  survey  conducted  by  the  IAS  in  the  context  of  the  audit  overall  show  a  high 
satisfaction  rate  of  the  Directorates-General  and  the  Executive  Agencies  with  the  control  strategy 
currently developed for Horizon Europe; 

the  Common  Implementation  Centre  (CIC)  has  developed  a  number of  initiatives in  support  to  the 
control strategy and in parallel to the development of the specific control strategy documents: 

— 

the  CIC  developed  a  learning  framework  for  Horizon  Europe  with  input  from  implementing 
services,  approved  by  the  Horizon  Europe  Executive  Committee  on  21  February  2024.  The 
framework  consists of  various learning  packages  tailored  to  the  different  staff  categories, 

10 

 
— 

— 

— 

which are implemented through the EU Learn platform and aims to assist staff in managing 
Horizon Europe calls and projects effectively; 

in the framework of the ‘Client Centricity Project’, the Funding & Tenders Portal was revamped 
in March 2024 and an eGrants mobile app is under development and planned to be launched 
in 2025. The portal now offers an artificial intelligence-based search functionality, a modern 
presentation of the website, as well as the possibility to set personalised recommendations 
to the users;  

to facilitate the introduction and the implementation of lump sums, the CIC organised several 
promotion campaigns and held regular meetings with the stakeholders; 

the CIC established a lump sum practitioners’ group as a forum to discuss the methodology 
and the guidance for the implementation of lump sums within the Research family. Moreover, 
the CIC coordinated an exercise on the lessons learned in November/December 2023 with the 
Executive Agencies and Joint Undertakings and created an action plan for improvement of the 
lump sum approach under Horizon Europe in December 2023. 

The IAS identified two very important issues concerning the design of the overarching ‘Control Strategy’ and the 
design of the ex post controls, and formulated two very important recommendations addressed to DG RTD. 

On the design of the overarching ‘Control Strategy’ DG RTD should:  

• 

• 

develop  a  detailed  roadmap(s)  or  action  plan(s)  to  translate  the  strategic  measures  into  concrete 
actions  and  timelines  and  define  objectives,  targets,  and  indicators  and  it  should  establish  and 
implement the monitoring and reporting mechanism on the progress in the implementation; and  

develop  the  risks  register  specific  for  Horizon  Europe  as  well  as  the  practical  modalities  for  its 
management  and  complete  the  risks  and  controls  in  Annex  1  ‘Relevant  control  system  for  direct 
management under Horizon Europe’. 

On the design of the ex post controls, DG RTD should:  

• 

• 

finalise the establishment of the comprehensive framework for the performance of ex post controls 
in  Horizon  Europe  (for  example  technical  reviews  on  lump  sum  grants,  the  common  audit  service 
working arrangements and the methodology for the performance of the system and process audits 
and the related IT development); and 

considering the tight deadlines in launching the framework contract, the objective of  performing a 
number  of  audits  in  2024  and  2025  and  the  average  duration  of  the  audits,  closely  monitor  the 
achievement of the targets for the audited participations, as set in the multi-annual audit plan, by 
developing regular reporting on the progress made and identifying corrective measures to be taken, 
if necessary. 

Additional  information  provided  by  DG  RTD  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

DG RTD has accepted all the recommendations and an action plan commonly drafted and agreed upon 
by RTD, BUDG and LS has been submitted mid-February 2025 to the IAS, which accepted it. 

The two ‘very important’ recommendations are already being tackled by DG RTD, with various concrete 
actions for implementing the six strategic measures into one single document, together with relevant 
objectives, targets and indicators, being compiled. 

DG RTD also started reassessing the risks presented in the Horizon Europe Control Strategy and updating 
the COMPASS checklist together with DG BUDG. Most other actions for recommendations 4, 5 and 6 
from the IAS report have started or are already completed. 

11 

 
1.5. 

Audit on anti-fraud strategies in the external action family (DG 
ECHO, the FPI, DG INTPA (5), DG NEAR, EEAS) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective  and  efficient 
implementation of the anti-fraud activities in DG ECHO, DG INTPA, DG NEAR, the FPI and the EEAS as part of 
the external action family. 

The IAS acknowledged the following strengths and good practices in DG ECHO: 

•  DG ECHO spent a lot of efforts in developing its anti-fraud strategy (AFS), in particular as regards the 
involvement of partners in its anti-fraud activities, resulting in an important number of cases being 
detected and reported by them. Furthermore, the cooperation with OLAF and the analysis of past fraud 
cases are examples of the efforts undertaken by DG ECHO to make its AFS a success; 

•  DG  ECHO  provides  relevant  manuals  and  information  on  the  reporting  mechanism  for  fraudulent 
behaviour both on its intranet (for staff) and its external webpage (for partners). In particular, it has 
developed templates that its partners and individuals should use to report fraud allegations and has 
prepared a document for staff describing how they can identify red flags in the different areas of its 
activity; 

•  DG ECHO analyses its fraud statistics to establish the level of undetected fraud in its funds. The results 
of this analysis have been discussed at family level and led to the identification of a cross-cutting risk 
regarding underreporting of fraud (undetected fraud) by United Nations agencies, for which a relevant 
action has been included in the 2023 Commission AFS action plan; 

• 

despite the important number of allegations managed, DG ECHO’s fraud team, ensures an effective 
assessment  and  follow-up  of  these  cases,  performing  the  preliminary  inquiries,  identifying  and 
supporting  the  adoption  of  precautionary,  corrective  or  reinforcing  measures  (suspension  of  new 
contracts and payments by the partner in a country or overall, suspension of payment until clarification 
on the existence of fraud is obtained, deduction from the final payment of the amount impacted by 
fraud, suspension and termination of the partnership upon different conditions);  

•  DG ECHO cooperated with the FPI and DG HOME in implementing the specific measure 29 (6) stemming 
from the Commission AFS 2019 and prepared a note which summarises the joint fraud risk analysis 
performed. This exercise enabled to identify common issues between different Directorates-General 
and Services, share good practices and to overcome the specificities and peculiarities of the specific 
Directorate-General and Service. 

The IAS acknowledged the following strengths and good practices in the FPI: 

• 

the FPI, cooperated with DG ECHO and DG HOME in implementing the specific measure 29 stemming 
from the Commission AFS 2019 and prepared a note which summarises the joint fraud risk analysis 
performed. This exercise enabled to identify common issues between different Directorates-General 
and Services, share good practices and to overcome the specificities and peculiarities of the specific 
Directorate-General and Service; 

•  when preparing its AFS and related action plan,  the FPI performed an in-depth  risk assessment to 
identify potential fraud risks associated with different financial instruments as well as the existing 
mitigating measures in place. This has enabled the FPI to optimise the use of resources by focusing 
on targeted controls that addressed the most significant fraud risks; 

• 

the FPI has established a good fraud reporting mechanism to management at the level of instruments 
with sufficient detail per fraud case; 

(5)  The final audit report for DG INTPA was not issued by the cut-off date of 31 January 2025. This report is expected to 

be included in the Annual Internal Audit report for 2025.  

(6)  Evaluation of fraud risks and vulnerabilities with regard to spending in emergency situations. 

12 

 
 
 
• 

• 

the FPI sends annual reminders to staff on their obligation to report fraud; 

the FPI OLAF/EPPO contact point plays the same role also for LS, Ombudsman and Early Detection 
and Exclusion System because of the small size of the service (in Commission Directorates-General 
several colleagues fulfil these roles). This enables the OLAF/EPPO correspondent to have an overview 
on the different aspects of handling fraud allegations and implementing fraud recommendations. That 
knowledge allows giving adequate advice to operational/financial colleagues on pre-cautionary and 
corrective measures and efficient and effective use of the available fraud tools. 

The IAS acknowledged the following strengths and good practices in DG NEAR: 

•  DG  NEAR’s anti-fraud  manual clearly defines and allocates roles and responsibilities for fraud  risk 

management at different levels in the Directorate-General;  

•  DG  NEAR  set  up  a  procedure  for  the  follow  up  of  OLAF  recommendations  that  defines  who  is 
responsible  for  the  assessment  and  the  implementation  of  the  recommendations  as  well  as  the 
obligation to adopt an action plan within 3 months from the reception of OLAF’s report. The procedure 
was the result of a joint effort of DG NEAR’s anti-fraud team and the network of fraud focal points in 
the  Delegations,  which  has  improved  the  coordination  and  exchange  of  information  between 
headquarters  and  delegations  and  clarified  roles  and  responsibilities  of  the  various  actors  in  the 
follow-up of OLAF recommendations; 

•  DG NEAR management is annually required to remind their staff about the obligation to report fraud; 

• 

the information on the fraud cases provided to the (top) management as well as information on fraud, 
prevention, detection, and correction included in the annual activity report is comprehensive; 

•  DG  NEAR’s  anti-fraud  team is very  attentive  to  possible  cross-cutting  fraud  issues at  the  external 
relations family level. In this respect, it detected two issues on mobility of local agent and on experts’ 
database which have been included in the Commission AFS and followed up at family and Commission 
level respectively; 

•  DG NEAR set up working groups whose mandate is to assess existing controls and mitigating measures 

in case of recurrent fraud risks; 

•  DG NEAR performed a broad fraud risk assessment exercise in which it involved staff dealing more 
systematically with fraud and DG NEAR’s management. The exercise included an in-depth analysis of 
the Directorate-General’s fraud risk exposures; 

•  DG NEAR’s OLAF team organises various anti-fraud awareness activities together with DG INTPA, OLAF 
and the FPI. It also launches regularly a dedicated anti-fraud survey, to both staff at headquarters 
and in the EUDs; 

•  DG NEAR is very engaged in promoting awareness among partners in pre-accession countries about 
their obligation in preventing frauds and detecting irregularities. In cooperation with OLAF, DG NEAR’s 
OLAF correspondent participates in training sessions for national authorities and other partners’ fora. 
Further  to  building  stakeholders’  knowledge  on  fraud  prevention  and  detection,  a  brochure  about 
‘fighting fraud in external relations’ for national authorities and implementing partners, but also for 
‘committed citizens’, was developed and since December 2023 is available on DG NEAR’s intranet and 
Europa webpage. The webpage and the brochure strongly encourage anyone with relevant information 
or a suspicion regarding possible wrongdoing involving EU funds to report the matter either to OLAF 
or the contracting authority (for those implementing the EU-funded projects from a partner country). 

The IAS did not formulate any critical or very important recommendations. 

13 

 
 
1.6. 

Audit  on  the  assurance  building  processes  and  audit  strategy 
for  the  2021-2027  programming  period  -  Phase  I:  design  (DG 
EMPL, DG MARE, DG REGIO) 

The  objective  of  the  audit  was to  assess  if  the  Directorates-General’s assurance  building  processes  for  the 
funds implemented under shared management are adequately designed to mitigate key risks and address the 
main new elements of the 2021-2027 programming period. 

The following reservations were made in the 2023 Annual Activity Reports (AAR) of DG REGIO, EMPL and MARE 
concerning specifically the processes under the scope of this audit engagement: 

• 

• 

• 

for DG REGIO, a reservation concerning ERDF/CF management and control systems for 5 programmes 
of the 2021-2027 period (in 4 Member States); 

for  DG  EMPL,  for  the  2021-2027  programmes,  DG  EMPL  assessed  that  management  and  control 
systems  functioned  effectively,  except  for  three  programmes  (for  two  programmes  deficiencies 
concern only part of the system;  

for DG MARE, as regards the European Maritime, Fisheries and Aquaculture Fund (EMFAF 2021-2027), 
no reservation was made for the 2021-2027 programming period. 

The  fieldwork  was  finalised  on  27  November  2024.  All  observations  and  recommendations  relate  to  the 
situation as of that date. 

The IAS recognised the ongoing efforts made by DG REGIO, DG EMPL and DG MARE in designing an adequate 
assurance framework, taking into account the new elements introduced by the 2021-2027 programming period 
legislation. The IAS identified the following strengths and good practices in this area: 

• 

• 

• 

• 

single audit strategy (SAS): the SAS was jointly developed by the audited Directorates-General and 
sets out in a single document a common audit framework to be applied. More specifically, the SAS 
sets out the main audit objectives, the risks identified and the audit approach and methodology to 
mitigate those risks. This is particularly important in the context of multi-fund programmes, resources 
constraints and the slow start-up of the 2021-2027 programmes;  

comprehensive guidance and tools: the development of a robust set of methodological notes, planning 
memoranda, and checklists enable the Commission audit services to have a solid basis for the audit 
work. These notes and tools are also shared with the Member State authorities for their own use; 

Early Preventive System Audits (EPSAs): a clearly defined methodology is in place to reach an audit 
conclusion  or  audit  opinion  for  the  audited  part  of  the  system  and  related  key  requirements.  This 
demonstrates that the type and extent of the audit work undertaken is reflected in the audit results. 
An audit conclusion is given when the audit covers the methodology  and test of controls, while an 
audit opinion is issued when EPSA includes both test of controls and substantive testing; 

coordination  arrangements  with  Audit  Authorities  (AA):  the  Directorates-General  have  established 
mature coordination arrangements with the AAs through (1) issuance of methodological notes (for 
example note on assessing the Member States management control systems or the reflection paper 
on risk based management verifications) (2) regular meetings including a bilateral annual coordination 
meeting with the AA of each Member State, homologues (7) meeting and two multilateral technical 
meetings  per  year  with  the  AAs.  These  initiatives  promote  consistent  communication,  facilitate 
knowledge sharing, and align auditing practices, contributing to a harmonised approach across regions 
and programmes. 

(7)  Annual meeting of the European auditors of cohesion policy funds: ‘the homologues group’. 

14 

 
 
 
The IAS identified one very important issue concerning the single audit strategy and formulated three very 
important recommendations addressed to DG EMPL, DG MARE and DG REGIO. 

DG REGIO, DG MARE and DG EMPL should update the SAS and/or other internal documents by: 

• 

• 

setting  out  how  the  joint  audit  directorate  for  cohesion  (DG  REGIO  and  DG  EMPL)  will  increase 
significantly the coverage of programmes through its on-the-spot audits, including the different types 
of compliance audit work and their contribution to its assurance objectives, taking into account the 
available resources, the implications for workload and the single audit arrangements; and 

explaining how they will obtain assurance on the reliability of the AAs work; how assurance will be 
provided to the Authorising Officer by Sub Delegation for financing not linked to cost schemes; and 
the overall approach for providing assurance on enhanced proportionate arrangement programmes, 
including  the  period  when  adjustments  are  necessary  or  when  an  enhanced  proportionate 
arrangement is revoked. 

Additional    information  provided  by  DG  EMPL,  DG  MARE  and  DG  REGIO  on  the  measures 
defined and/or implemented following the Internal Audit Service audit 

The action plan was satisfactory assessed by the IAS and the DGs started its implementation. The Single 
Audit Strategy is being updated, to address the recommendations from the IAS, in particular to explain 
how assurance on the reliability of audit authorities is obtained and how it will provide assurance for 
programmes under enhanced proportionate arrangements. 

Only one very important recommendation on the Single Audit Strategy was issued to DG MARE. This 
recommendation is being addressed in accordance with the agreed action plan approved by the IAS and 
is expected to be completed as planned by 31 December 2025. 

1.7. 

Audit  on  IT  security  risk  management  at  the  Commission  (DG 
AGRI, DG CNECT, DG DGT, DG DIGIT, DG ECHO, DG ENER, DG MARE, 
OLAF, OP, DG RTD, DG SANTE, DG TRADE) 

The  objective  of  the  audit  was to  provide  assurance  on  the  adequacy  of  the  design,  the  efficiency  and  the 
effectiveness  of  the  information  technology  security  risk  management  (ITSRM)  framework  (methodologies, 
standards,  guidelines  and  tools)  and  processes  at  the  corporate  (Commission)  and  at  the  decentralised 
(department)  level,  thus  ensuring  compliance  with  the  European  Commission  IT  security  framework  and 
international best practices. 

There are no observations/reservations in the 2023 Annual Activity Reports of the Directorates-General covered 
by the audit that related to the area/process audited. 

The fieldwork was finalised on 21 October 2024. All observations and recommendations relate to the situation 
as at that date. 

The auditors identified the following strengths in relation to the ITSRM practices in the Commission: 

• 

• 

• 

• 

there is an established ITSRM methodology, with supporting IT tools for performing the risk studies; 

there is an established  set of training materials and supporting services for conducting the ITSRM 
process; 

there is an established IT governance structure in place with regular reporting to it; 

strengths  relating  to  ITSRM  by  each  audited  Commission  department  were  also  identified  and are 
presented in the respective annexes providing the outcome of the audit work for each department and 
their related communication and information systems. 

15 

 
The IAS identified four very important issues concerning the ITSRM methodologies and tools, the risk appetite 
and acceptance criteria, the IT security monitoring and reporting and the completeness of accuracy if IT security 
information and formulated nineteen very important recommendations. 

On ITSRM methodologies and tools the IAS formulated twelve very important recommendations:  

At Directorates-General level: 

DG AGRI, DG CNECT, DG DGT, DG DIGIT, DG ENER, DG MARE, OLAF, OP, DG TRADE should: 

• 

update the IT security risk studies and related IT security plans during its next review to address the 
issues identified. In addition, residual risks above the risk acceptance criteria level should be formally 
accepted  at  the  relevant  organisational  level  and the  IT  security  measures  defined  in  the  security 
plans should be timely implemented or reassessed.  

At Commission level: 

DG DIGIT should: 

• 

develop a vision for the ITSRM framework. In this respect, DG DIGIT should establish and promote the 
use  of  Commission-acceptable  IT  security  risk  management  methodologies  and  related  tools.  DG 
DIGIT should also provide up-to-date guidance on how to implement the ITSRM methodologies, and 
their related tools, and to overcome their limitations. A quality approach for IT security risk studies 
and plans should be established.  

On risk appetite and acceptance criteria the IAS formulated five very important recommendations:  

At Directorates-General level: 

DG DGT, DG ENER, OLAF and OP should: 

• 

formally  define  and  document  their  IT  security  risk  appetite  and  translate  this  into  specific  risk 
acceptance criteria (and levels) to be used as part of the IT security risk assessments. 

At Commission level: 

DG DIGIT should: 

• 

in  consultation  with  the  Information  Technology  and  Cybersecurity  Board,  the  SG  and  DG  BUDG, 
provide  guidance:  (1)  for  determining  IT  security  risk  objectives,  risk  appetite,  associated  risk 
acceptance criteria levels, in alignment with the corresponding business, department and corporate 
risks,  and  to  propose  thresholds  and  an  approach  to  follow  in  case  the  thresholds  would  not  be 
respected; (2) on how to integrate the corporate IT security risk management with the Commission 
risk  management  framework,  including  the  mapping  of  the  risk  scales  of  the  IT  security  risk 
methodologies with the ones of the Commission risk management. 

On IT security monitoring and reporting the IAS formulated one very important recommendation: 

At Commission level: 

DG DIGIT should: 

• 

enhance its reporting towards the Information Technology and Cybersecurity Board and be clearer on 
the coverage and quality of certain indicators. In coordination with the Information Technology and 
Cybersecurity Board, it should also define clear escalation paths and criteria for when and how the 
Commission departments should escalate high residual risks or lack of implementation of security 
measures  to  DG  DIGIT  and  to  the  Information  Technology  and  Cybersecurity  Board.  Commission 

16 

 
departments should be reminded of the obligation to ensure the independence of the local information 
security  officer  as  well  as  his/her  ability  to  report  directly  to  the  Head  of  his/her  Commission 
department. In addition, a standard format and content for system owners’ reporting to DG DIGIT on 
the risks, risk management activities and security measures taken per communication and information 
system should be agreed upon. 

On  completeness  and  accuracy  of  IT  security  information  the  IAS  formulated  one  very  important 
recommendation: 

At Commission level: 

DG DIGIT should: 

• 

reiterate  to  the  Commission  departments  the  importance  of  correctly  and  completely  entering  IT 
security data into the relevant registries (for example risk register, portfolio management) and provide 
guidance  in  this  respect.  Where  feasible,  a  central  monitoring  of  the  accuracy  of  the  data  in  the 
repositories  should  be  established.  DG  DIGIT,  in  consultation  with  the  Information  Technology  and 
Cybersecurity Board, the SG and DG BUDG, should emphasise that IT security activities are taken into 
account  in  the  various  phases  of  the  communication  and  information  system  life-cycle.  DG  DIGIT 
should also remind all Commission departments of the importance of consulting, supporting and/or 
keeping  informed  all  relevant  stakeholders  (for  example  delegated/operational  controllers,  data 
protection coordinator, local information security officer) in the different steps of the IT security risk 
management. 

Additional information provided by DG DG AGRI, DG CNECT, DG DGT, DG DIGIT, DG ECHO, DG 
ENER,  DG  MARE,  OLAF,  OP,  DG  RTD,  DG  TRADE,  DG  SANTE  on  the  measures  defined  and/or 
implemented following the Internal Audit Service audit 

All audited departments have accepted all of the recommendations and have provided a satisfactory 
action plan. Implementation of actions is ongoing, and some have already been marked as implemented. 

17 

 
 
 
 
Single Market, Innovation and Digital 

1.8. 

Audit  on  the  preparation  of  the  macro  financial  assistance 
programme  to  enlargement  and  neighbourhood  countries  (DG 
ECFIN) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  efficient  and  effective 
implementation of the governance, risk management and control processes put in place by DG ECFIN for the 
preparation of macro financial assistance (MFA) measures to enlargement and neighbourhood countries. 

The  fieldwork  was  finalised  on  26  September  2024.  All  observations  and  recommendations  relate  to  the 
situation as at that date. 

The IAS identified two very important issues concerning the control strategy for MFA operations and the marking 
and protection of sensitive-non classified information and formulated two very important recommendations. 

On control strategy for MFA operations, DG ECFIN should: 

• 

• 

further develop the control strategy for MFA operations, supported by a comprehensive risk analysis, 
to ensure that it: 

—  encompasses the different steps of the process and related risks; 

— 

takes into account all the high risks affecting the MFA operations; 

—  covers all controls that contribute to the assurance-building of the Directorate-General. 

define  an  ex  post  audit  approach  for  MFA  operations  covering  both  loans  and  grants  (and 
communicate it to the operational staff responsible for MFA). 

On marking and protection of sensitive-non classified information, DG ECFIN should:  

• 

• 

assess and define which MFA-related documents are sensitive non-classified in the framework of the 
Commission Decision on Security, handle and store them according to the instructions; 

provide guidance and training to the relevant staff members. 

Additional information provided by DG ECFIN on the measures defined and/or implemented 
following the Internal Audit Service audit 

DG ECFIN has accepted all the recommendations, and an action plan has been submitted mid-February 
2025 to the IAS, who accepted it. 

1.9. 

Audit on human resources management (DG FISMA) 

The objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of the 
internal control system put in place by DG FISMA to manage its human resources that supports the achievement 
of its operational objectives. 

There  are  no  reservations  in  the  2023  Annual  Activity  Report  of  DG  FISMA  that  relate  to  the  area/process 
audited. 

The  fieldwork  was  finalised  on  18  December  2024.  All  observations  and  recommendations  relate  to  the 
situation as at that date. 

18 

 
The IAS acknowledged the following strengths: 

•  DG  FISMA  has  a  matrix  organisational  structure  where  project  teams  complement,  where 
needed/relevant,  the  regular  units  work  on  DG  FISMA’s  policy  areas.  The  project  teams  provide  a 
collaborative cross-unit platform to pull know-how from within the Directorate-General; 

• 

the project teams initiative is perceived by the Directorate’s-General staff overall positively as a tool 
to promote collaboration and skills exchange, with positive impact on policy work and staff personal 
development;  

•  DG FISMA monitors human resource (HR) activities through restricted senior management meetings 

on resources, held every 1-2 months; 

• 

the HR correspondent team organises regular meetings for middle management to keep Heads of Unit 
informed  about  key  HR  topics  discussed  at  senior  management  level.  These  meetings  ensure 
alignment and communication throughout the management levels. 

The IAS identified one very important issue concerning the HR strategic framework and formulated one 
very important recommendation. 

DG FISMA should: 

• 

prepare its high-level local HR strategy bringing together, complementing and framing strategically 
all the existing initiatives. This document should be developed starting from the Directorate-General’s 
specific critical/high HR risk areas and the future HR needs and contain the Directorate-General specific 
human resource management strategic objectives, the initiatives/actions to achieve these objectives, 
and the indicators to measure the results obtained. The local HR strategy should include actions with 
clear responsibilities for their implementation, deadlines, indicators and targets. 

Additional information provided by DG FISMA on the measures defined and/or implemented 
following the Internal Audit Service audit 

The improvements envisaged have been included in a satisfactory action plan. 

1.10.  Audit  on  the  new  nuclear  decommissioning  and  waste 

management programme (NDWMP) (JRC) 

The objective of the audit was to assess whether the JRC has adequately designed and efficiently and 
effectively implemented governance, management and control systems for the new nuclear decommissioning 
and waste management programme across all JRC nuclear sites. 

There are no observations/reservations in the 2023 Annual Activity Report of the JRC that relate to the 
area/process audited. 

The fieldwork was finalised on 10 July 2024. All observations and recommendations relate to the situation as 
at that date. 

The IAS identified the following good practices and noted positive developments during the audit: 

• 

• 

• 

the creation of a new JRC directorate to manage the NDWMP activities separately from the nuclear 
research activities; 

the experience and commitment of JRC NDWMP staff, with a combination of technical, project and 
contract management skill-sets unique to this department; 

the strategies developed to deal with uncertainties which are beyond the JRC’s control,  for example 
nuclear licensing delays and regulatory changes, lack of host Member State progress in construction 
of geological repositories for long-term storage of nuclear waste, technical constraints and contractual 
issues; 

19 

 
• 

• 

• 

the JRC has assessed internally the current status of NDWMP governance, cross-site organisation and 
its HR situation and has developed new ideas and approaches to be implemented to address the issues 
identified; 

an increasingly proactive approach to dealing with host Member States; 

progress made in decommissioning and waste management projects on the Ispra site, for example 
the  first  decommissioning  licences  have  been  granted  by  the  Italian  nuclear  authorities  for  two 
facilities; achievement of technical/financial solutions to reduce the volume of certain types of waste 
and  to  incinerate  others;  procurement  for  framework  contracts  to  externalise  aspects  of  the 
decommissioning and waste management activities. 

The  IAS  identified  four  very  important  issues  concerning  the  JRC  internal  organisation  of  NDWMP 
responsibilities, the decommissioning plans for the JRC sites, the estimates for decommissioning the JRC 
nuclear  sites,  and  the  NDWMP  budget  flexibility  needs,  and  formulated  four  very  important 
recommendations. 

On JRC internal organisation of NDWMP responsibilities, the JRC should: 

• 

• 

• 

design  a  structure  and  approach  to  reinforce  the  inter-site  organisation,  coordination  and 
communication between the various directorates;  

clearly define the NDWMP-related roles and responsibilities of the relevant units, including for the 
coordination with DG ENER; and 

clarify which types of activity should be covered by which budget line (NDWMP or other). 

On decommissioning plans for the JRC sites responsibilities, the JRC should: 

• 

• 

define  a  common  method  and  timing  for  preparing,  approving  and  updating  the  decommissioning 
plans for the four nuclear sites, taking into consideration the relevant legal requirements and then 
prepare and approve (updated) decommissioning plans for all sites accordingly; and 

use the updated/approved decommissioning plans for the preparation of future NDWMP multiannual 
work programmes. 

On estimates for decommissioning the JRC nuclear sites, the JRC should: 

• 

• 

conduct a new overall cost estimate exercise for its decommissioning activities, covering all four sites 
and using a harmonised methodology to the extent possible (including separating decommissioning 
from waste management costs and include full cost of staff involved in NDWM activities); and 

based on the outcome of the new overall cost estimate, reevaluate, in collaboration with DG BUDG, 
the ‘financial provision for the nuclear dismantlement of JRC sites’ in the EU annual accounts. 

On NDWMP budget flexibility needs, the JRC should: 

• 

In  the  context  of  the  preparation  of  the  next  multi-annual  financial  framework,  document  the 
difficulties related to the N+1 rule for the NDWMP and discuss with DG BUDG the feasibility of an 
exception from the N+1 rule. 

Additional  information  provided  by  JRC  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

There are four very important recommendations under implementation stemming from this audit. The 
JRC prepared an action plan addressing the recommendations which was approved by the IAS in October 
2024. The JRC has implemented in good time the first actions addressing the recommendations and is 
progressing as planned. Decisive steps have been taken to reinforce the governance, management and 
control  systems  framework  of  the  NDWM  programme  across  its  nuclear  sites.  As  most  of  the 
decommissioning  activities will  gradually  increase  in  the  coming  years,  the  recommendations  of  the 

20 

 
audit will support the improvement and strengthening of the functioning of the NDWMP in the future. 
However,  they  have  no  material  impact  on  the  effectiveness  of  the  internal  control  system  and 
achievement of the internal control objectives over the reporting period. 

1.11.  Audit  on  Horizon  Europe  –  grant  management  phase  I  (from 
publication of the calls until signature of the grant agreements) 
(CINEA) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective  and  efficient 
implementation of the internal control system for the Horizon Europe grant management processes (from the 
preparation of the call for proposals to the signature of the grant agreements) in CINEA, with a particular focus 
on whether:  

• 

• 

the grant agreements effectively support the achievement of the Horizon Europe objectives; and 

the processes in place ensure that the best research projects are selected and translated into grant 
agreements in compliance with the applicable rules. 

There are no  reservations in  the 2023 Annual  Activity Report of CINEA related to grant management under 
Horizon Europe. 

The fieldwork was finalised on 6 December 2024. All observations and recommendations relate to the situation 
as of that date. 

The IAS acknowledged the ongoing efforts made by CINEA to ensure the effective implementation of the internal 
control system for the initial phases of the Horizon Europe grant management processes in the context of an 
increasing workload and time pressure. 

The IAS identified the following good practices and noted positive developments during the audit:  

• 

in relation to the grant agreement preparation, CINEA has established clear tasks and responsibilities 
between the relevant departments and actors (i.e. operational (project officer) and financial (financial 
officer) aligned with the eGrants Vademecum, complementing the IT system (Compass); 

•  when performing their work, the project officers and financial officers complete detailed checklists to 
document the process leading to the conclusions of their checks. The checklists are uploaded in the 
Compass grant agreement preparation workflow. 

The  IAS  identified  two  very  important  issues  concerning  the  management  of  conflict  of  interest  and  the 
evaluation process and formulated two very important recommendations. 

On Management of conflict of interest (CoI), CINEA should: 

• 

• 

• 

include, in its procedures for Horizon Europe, operational provisions on how to perform and document 
the checks on CoI for experts participating in evaluations and how to assess the existence of CoI; 

ensure that the checks are effectively performed and documented and that there is appropriate trace 
of the decisions taken when a CoI situation is detected; and 

send  reminders  for  the  update  of  the  expert’s  profiles  at  the  latest  prior  to  assignment  of  the 
proposals. 

On evaluation process, CINEA should: 

• 

ensure  that  the  formal  appointment  of  the  evaluation  committee  is  performed  in  line  with  the 
guidance  in  place  in  the  eGrants  Vademecum  by  adequately  completing  the  relevant  appointing 
document validated and archived in ARES. CINEA should also ensure that the panel report includes all 

21 

 
relevant information as defined by the corporate template, all panel reports are signed by the relevant 
actors in ARES as indicated in the eGrants Vademecum, the information on the gender ratio for the 
proposals with equal ranking is included in the panel report and the call evaluation report. 

Additional  information  provided  by  CINEA  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

An action plan was established to address all audit findings and considered satisfactory by the IAS on 
15 April 2025. 

1.12.  Audit  on  Horizon  2020  grant  management  phase  IV  (final 

payment and closure) (ERCEA) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  the  effective  and  efficient 
implementation of ERCEA’s internal control system related to Horizon 2020 final payments and closure of the 
projects,  to  ensure  that  it  supports  the  legality,  regularity  and  sound  financial  management  of  ERCEA’s 
expenditure. 

The period on which the audit focused was the final payments executed from January 2022 to March 2024. 

There  are  no  observations  or  reservations  in  the  2023  Annual  Activity  Report  of  ERCEA  that  relate  to  the 
area/process audited. 

The  fieldwork  was  finalised  on  10  December  2024.  All  observations  and  recommendations  relate  to  the 
situation as at that date. 

The auditors acknowledged the efforts made by ERCEA in ensuring the effective implementation of the grant 
management processes for the final payments and closure under the Horizon 2020 programme. 

In this context, the IAS identified the following strengths/good practices: 

• 

• 

• 

ERCEA effectively processes the final payments for  Horizon 2020 projects in a timely manner (i.e. 
reaching the targets of the time-to-pay indicator);  

ERCEA  manages  effectively  the  beneficiary’s  complaints  on  the  final  payment  (contradictory 
procedure); 

ERCEA adequately processes the release of guarantee funds and the initiation and validation of de-
commitments in ABAC (8). 

The IAS did not formulate any critical or very important recommendations. 

Cohesion, resilience and values 

1.13.  Audit on the European Union Solidarity Fund (EUSF) (DG REGIO) 

The objective of the audit was to assess the adequacy of the design and the effective implementation of DG 
REGIO’s internal control processes for managing the EUSF. 

(8)  Tool for accrual based and budgetary accounting. 

22 

 
 
 
There  are  no  observations/reservations  in  the  2023  Annual  Activity  Report  of  DG  REGIO  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 10 April 2024. All observations and recommendations relate to the situation as 
of that date. 

The IAS recognised the ongoing efforts made by DG REGIO and identified the following strengths and good 
practices concerning the preparation of applications and the implementation on the ground:  

• 

in the process of preparing the application, DG REGIO provides rapid ad hoc support to help with the 
application forms upon the applicant country’s request. For example, in view of the Covid-19 crisis the 
Directorate-General organised three Question and Answer sessions to help eligible states with major 
public health emergencies (MPHE) at the stage of: (1) preparation of applications, (2) preparation of 
disbursement of the EUSF assistance and its implementation, and (3) at closure; and 

•  DG REGIO facilitates knowledge sharing between beneficiary States, for example between the Italian 
and  Croatian  authorities  and  by  encouraging  Croatia  to  help  Turkey  by  sharing  knowledge  on  the 
designation of the independent audit body and the implementation phase. 

The IAS identified two very important issues concerning the design of the management and control system of 
the EUSF and the management process of the EUSF and formulated two very important recommendations. 

On the design of the management and control system of the EUSF, DG REGIO should: 

• 

• 

• 

• 

in times of temporary peaks in activity or unavailability of resources, monitor risks to the effective 
management and business continuity of the EUSF, and  where  necessary, take adequate measures 
including through flexible solutions to allocate staff; 

ensure that guidance available for applicant countries for natural disasters is updated when needed, 
provide information on methodologies for damage assessment and reflect on alternatives to evaluate 
damages to cultural heritage; 

reassess the legal framework and guidelines for MPHE, taking into account the previous experience 
with managing MPHE applications; and 

ensure that sensitive information is always protected when using the Commission's ICT services. 

On the management process of the EUSF, DG REGIO should: 

• 

• 

• 

update the assessment checklist (form) with information on the checks to be done for the preliminary 
/  initial  assessment  of  applications,  sufficiently  support  the  assessment  of  the  applications  with 
relevant  documents  and  ensure  that  reasons/justifications  for  rejecting  a  request  for  advance 
payment are properly explained and documented; 

regularly update the monitoring tables and take actions to improve the timeliness of  the different 
phases of the EUSF management process; and 

submit reports on the EUSF to the European Parliament and the Council on time. 

Additional  information provided by DG REGIO on the measures defined and/or implemented 
following the Internal Audit Service audit 

An action plan has been submitted mid-September 2024 and it was satisfactory assessed by the IAS. 
The  implementation  of  the  action  plan  is  ongoing.  This  includes  addressing  the  design  of  the 
management  and  control  system  of  the  EUSF  by  developing  flexible  solutions  to  allocate  staff  and 
updating procedures and guidance. The management process of the EUSF is also being enhanced by 
updating the assessment form/checklist and monitoring tables and the section on EUSF in the single 
audit strategy. 

23 

 
1.14.  Audit  on  the  performance  of  the  management  of  experts  for 

proposal evaluation (EACEA) 

The  objective  of  the  audit  was  to  assess  if  the  internal  control  system  set-up  for  the  expert  evaluator 
management  process  (selection,  contracting  and  payment)  in  EACEA  is adequately  designed  and  effectively 
implemented to ensure: 

• 

• 

that  the  selected  experts  adhere  to  the  criteria  (in  terms  of  experience,  skills,  knowledge  and 
independence) defined for the fulfilment of their evaluation tasks; 

compliance with applicable rules. 

The fieldwork was finalised on 12 July 2024. All observations and recommendations relate to the situation as 
at that date. 

The IAS did not formulate any critical or very important recommendations. 

24 

 
 
 
Natural resources and environment 

1.15.  Audit  on  the  preparedness  of  DG  AGRI  in  designing  the 
assurance building model under the new Common Agricultural 
Policy strategic plans (DG AGRI) 

The objective of the audit was to assess the preparedness of DG AGRI in designing the control framework to 
provide  assurance  that  the  Common  Agricultural  Policy  (CAP)  expenditure  under  the  new  delivery  model  is 
implemented in line with the CAP legal framework. 

There  are  no  observations/reservations  in  the  2023  Annual  Activity  Report  of  DG  AGRI  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 12 June 2024. All observations and recommendations relate to the situation as 
at that date. 

The IAS recognised that despite a slow start, the work of DG AGRI in designing the assurance framework under 
the  CAP  new  delivery  model  gathered  good  pace,  especially  from  the  last  quarter  of  2023  onwards.  The 
adaptation of the IT systems, notably SFC (9), Compass Corporate (10) and CATS/COMBO (11) was completed in 
time  for  the  2023  clearance  exercise.  DG  AGRI  staff  have  also  produced  relevant  guidance  and  clear  draft 
documents that address the requirements of the clearance procedure under the new delivery model and respond 
to  the  questions  of  the  Member  States.  GREX  (12)  and  bilateral  meetings  provide  a  good  framework  for  a 
continuous dialogue with the Member States and the IAS auditors observed that the information sharing with 
Member States is done in a transparent way.  

Furthermore, the IAS acknowledged the competence and commitment of DG AGRI staff who have concomitantly 
contributed to the implementation of the new CAP and to the measures addressing recent and ongoing crises 
impacting the agricultural sector (in relation to food security, energy and fertiliser prices), in spite of the limited 
availability of resources. 

The IAS identified three very important issues concerning the design of the assurance framework under the new 
delivery model, the assessment of the certification bodies’ audit strategies and the decision on how to report 
on assurance for expenditure under the CAP strategic plans in the Annual Activity Report, and formulated three 
very important recommendations. 

On the design of the assurance framework under the new delivery model, DG AGRI should: 

• 

finalise the working document on serious deficiencies, the guidelines on the calculation of financial 
corrections and on the grading of the governance systems. 

In addition, it should prepare and/or update internal guidelines to make full use of the assessment of 
the integrated administration and control system quality assurance report results for the purpose of 
assessing certification body’s work on the functioning of the governance systems. 

On the assessment of the certification bodies’ audit strategies, DG AGRI should: 

(9)  SFC stands for ‘Shared Fund Management Common System’. It is the IT tool for electronic exchange of information 

between Member States and the Commission. 

(10)  Tool co-developed with other Directorate-Generals and used in DG AGRI to automate the processing of the CAP strategic 

plans, and Annual Performance Reports. 

(11)  Integrated audit system for the management of the audit process in AGRI Directorate H. 
(12)  Expert group on horizontal questions concerning the CAP.  

25 

 
 
 
• 

further assess the adequacy of the audit strategies of the certification bodies. Furthermore, it should 
use the results of this ongoing analysis to feed its risk assessment as well as to justify direct audit 
work in line with the provision of Article 48 of the CAP horizontal Regulation. 

On the decision on how to report on assurance for expenditure under the CAP strategic plans in the Annual 
Activity Report, DG AGRI should: 

• 

In consultation with DG BUDG and the SG, develop and implement a revised reporting methodology 
for its Annual Activity Report, in line with the requirements of the Financial Regulation.  

Additional information provided by  DG AGRI on the measures defined and/or implemented 
following the Internal Audit Service audit 

DG  AGRI  submitted  an  action  plan  that  was  accepted  by  the  IAS  on  9  December  2024  and  its 
implementation is ongoing. On 14 March 2025 as a result of its follow-up, the IAS concluded that the 
first recommendation had been adequately and effectively implemented and could therefore be closed. 

1.16.  Audit on the implementation and monitoring of the EU emission 

trading system (EU ETS) (DG CLIMA) 

The  objective  of  the  audit  was  to  assess  the  adequacy  of  the  design  and  effective  implementation  of  the 
processes (governance, risk management and internal controls) put in place by DG CLIMA for implementing and 
monitoring the EU ETS (stationary installations only), including the Union Registry and related tools and the 
management of EU ETS auctions. 

The following reservation was made in the 2023 Annual Activity Report concerning specifically the area/process 
under the scope of this audit engagement: 

• 

Reservation on reputational/legal/financial grounds related to remaining significant security weakness 
identified in the Union Registry of the EU ETS. 

The fieldwork was finalised on 29 November 2024. All observations and recommendations relate to the situation 
as at that date. 

The IAS acknowledged that DG CLIMA used the opportunity of reopening the delegated and implementing acts 
under the EU ETS Directive to address some of the issues identified in the EU ETS Phase 3 and to implement 
lessons learnt.  

Despite the  heavy workload  and complex legal  framework, DG CLIMA staff showed commitment to  perform 
their tasks and willingness to improve the efficiency of the EU ETS related processes. 

The IAS also recognised the immense work and efforts by DG CLIMA in the areas of EU ETS reviewed (including 
the management of auctions), despite the scarce resources they operate with. 

The IAS identified six very important issues concerning the administration of the free allowances, the monitoring 
of  allowances  under  phase  4  of  the  EU  ETS,  the  process  for  updating  the  national  allocation  tables,  the 
monitoring  of  the  Member  State  implementation  of  the  EU  ETS  legal  framework,  the  reliance  on  external 
consultants  and  the  user  access  management,  confidentiality  of  information  and  sensitive  functions,  and 
formulated ten very important recommendations. 

On administration of the free allowances, (three very important recommendations), DG CLIMA should: 

26 

 
• 

• 

• 

• 

align the processes for introducing updates to the national allocation table in the Union Registry with 
the  provisions  of  the  delegated  acts  and  ensure  that  these  updates  are  adequately  and  timely 
integrated in the Union Registry; 

clarify in the legal basis (delegated regulation) the responsibility for ensuring the correct allocation of 
the free allowances to the holding accounts within the legal deadline. 

prepare a written procedure clarifying how to handle the impact of retroactive changes, in particular 
as regards decrease of allocated free allowances adopted after the surrendering deadline. 

assess, as part of the review of the national implementation measures for the period 2026-2030, the 
economic  and  climate  impact  of  free  allocations  allocated  to  operators  in  excess  of  their  verified 
emission as well as report regularly on them. 

On monitoring of allowances under phase 4 of the EU ETS (one very important recommendation), DG CLIMA 
should: 

• 

• 

put in place written procedures for the monitoring and use, where relevant, of the not needed amounts 
of the 3% conditional free allowances; 

ensure  that  the  opening  balance  and  all  subsequent  movements  of  the  new  entrants’  reserve  are 
properly documented and kept up-to-date and that national allocation table updates are recorded in 
line with the legal basis. 

On process for updating the national allocation tables (one very important recommendation), DG CLIMA 
should: 

• 

• 

reinforce its monitoring of the status and progress in the assessment of the requests in the activity 
level change (ALC) tool;  

as from the 2nd period of the phase 4 of the ETS put in place a process to monitor whether all change 
requests are submitted by the Member States, provided that the amendments to the ALC Regulation 
to obtain additional data on activity level changes are adopted. 

On  monitoring  of  the  Member  State  implementation  of  the  EU  ETS  legal  framework  (one  very 
important recommendation), DG CLIMA should: 

• 

• 

establish a structured and documented process for monitoring whether the Member States implement 
the EU ETS legal framework adequately; 

propose implementing acts including detailed rules on penalties to be adopted by the Commission. 

On reliance on consultants (one very important recommendation), DG CLIMA should: 

• 

perform a comprehensive assessment of the EU ETS tasks outsourced, to assess the related risks, and 
design and implement adequate mitigating measures as appropriate, in consultation with the central 
services. 

On  user  access  management,  confidentiality  of  information  and  sensitive  functions  (three  very 
important recommendations), DG CLIMA should: 

• 

• 

• 

• 

design and implement procedures for offboarding users and for regularly reviewing user accounts and 
access rights;  

revise  the  assessment  of  the  sensitive  functions  related  to  the  EU  ETS  and  implement  necessary 
actions;  

update its instructions for the handling of sensitive information and put in place procedures to ensure 
that all relevant documents are marked, in line with the instructions; 

enhance security measures to protect confidentiality of information. 

27 

 
Additional information provided by DG CLIMA on the measures defined and/or implemented 
following the Internal Audit Service audit 

The audit was finalised at the very end of 2024 and resulted in ten very important recommendations 
as  a  result  of  the  extensive  scope  of  the  audit.  Moreover,  the  implementation  of  several  of  the 
recommendations started already, with the majority of the actions planned to be completed in 2025. 

1.17.  Audit  on  assurance  building  for  expenditure  under  direct 

management (DG MARE) 

The objective of the audit was to assess the adequacy of the design and the effectiveness and efficiency of DG 
MARE’s assurance building processes covering expenditure under direct management relating to sustainable 
fisheries partnership agreements (SFPAs), grants and procurement. 

There are no reservations in the 2023 Annual Activity Report of DG MARE that relate to the process audited. 

The fieldwork was finalised on 30 May 2024. All observations and recommendations relate to the situation as 
at that date. 

The  IAS  auditors  recognised  the  high  expertise  of  the  staff  of  DG  MARE,  and  their strong  commitment  and 
dedication to the objectives despite the high workload, as well as the difficult political context in which they 
operate as regards the SFPAs. They also acknowledged the well-developed and clear procedures available on 
DG  MARE’s  my-intracomm  pages,  which  display  all  the  necessary  information  for  the  staff  in  charge  of 
budgetary and financial management. 

The IAS identified two very important issues concerning the nature of the SFPAs and the financial management 
and monitoring of SFPAs and formulated two very important recommendations. 

On the nature of the SFPAs, DG MARE should: 

• 

• 

clarify, the legal nature of the financial assistance provided to SFPAs and, if necessary, update its own 
guidelines on sectoral support and align the sectoral support provisions of the agreements/protocols 
with the provisions of the Financial Regulation on budget support; 

enhance the coordination process with DG INTPA during the implementation of the SFPA’s sectoral 
support component.  

On the financial management and monitoring of SFPAs, DG MARE should: 

For the future SFPA agreements/protocols: 

• 

systematically  seek  to  include  in  the  agreements/protocols  detailed  provisions  conditioning  the 
payment  of  sectoral  support  to  the  achievement  of  objectives,  and  provisions  allowing  audits  or 
investigations of projects funded under sectoral support as well as providing the possibility to recover 
unduly paid funds (both for access payments and sectoral support); 

•  when  such  conditions  cannot  be  included  due  to  the  outcome  of  negotiations,  DG  MARE  should 
highlight  the  deviations  in  the  Commission  Communication  to  the  Council  on  the  signature  of  the 
agreements/protocols. 

For the current SFPA agreements/protocols: 

• 

For access payment:  

—  further detail and document the checks to be made on the fulfilment of conditions for access 
fees  when  making  the  related  payments.  In  case  the  payment  is  made  although  some 

28 

 
provisions  are  not  complied  with,  prepare  an  exception  decision  at  the  appropriate 
management level. 

• 

For sectoral support:  

—  prepare a guidance  describing the checks to  be  performed, based on the Fishery’s attaché 
documented analysis, to identify possible non-compliance issues prior to the Joint committee 
meeting, where decisions on the level of achievement of objectives are made;  

—  further detail and document checks to be made on compliance with provisions of the protocol. 
In case the payment is made although some provisions are not complied with, ensure that an 
exception decision was taken at the appropriate management level. 

Additional  information provided by DG MARE on the measures defined and/or implemented 
following the Internal Audit Service audit 

The IAS recommendations are being addressed according to the agreed action plan approved by IAS. 
The implementation of IAS recommendations is ongoing and is expected to be completed as planned in 
2025.  

29 

 
 
 
Neighbourhood and the world 

1.18.  Audit on controls over the financial management of the civilian 
Common Security and Defence Policy Missions implemented by 
the Service for Foreign Policy Instruments (FPI) 

The objective of the audit was to assess the design and effectiveness of the internal control system put in place 
by FPI for the implementation of the Common Foreign security Policy budget allocated to Common Security and 
Defence Policy (CSDP) Missions. 

The fieldwork was finalised on 4 December 2024. All observations and recommendations relate to the situation 
as at that date. 

The IAS identified two very important issues concerning the FPI checks on the progress and final reports and the 
audits on final reports and ex-post audits and formulated two very important recommendations. 

On the FPI checks on the progress and final reports, the FPI should: 

• 

develop internal instructions to support its review of the progress and final reports by the Missions to 
define: 

— 

— 

— 

the main operational and financial checks that should be done as regards cost eligibility at 
the stages of the progress and final reports;  

the checks to be done on the procured equipment/ and material and the capital expenditure 
to  ensure  that  the  information  provided  on  the  cost  incurred  matches  the  amount  in  the 
inventory;  

the checks on the completeness of the submitted reports and their annexes (for instance by 
using the checklist on payment of balance included in INTPA Companion); and 

—  where to document the checks done on  cost eligibility and reports completeness to ensure 

proper traceability; 

• 

revise the reporting requirements for the CSDP Missions and request them: 

— 

— 

— 

to  clearly  indicate  the  advance  payments  made  and  report  the  related  amount  separately 
from the costs incurred; 

to report on the amount of the legal commitments; and 

to provide information on their value added tax arrangements and the amount of value added 
tax included in the reported costs (recoverable or non-recoverable); 

• 

• 

• 

clarify the reporting requirements and conditions for the items to be included in the  statement of 
inventory in the progress and final reports, the reporting of donated equipment and purchased with 
previous Mandates’ funds; 

instruct  the  Missions  to  produce  for  the  final  report  the  required  annexes on  the  fixed  assets  and 
transferred equipment and to request the external auditors to certify them; 

request  from  the  external  auditors  to  describe  and  present  the  specific  results  of  the  performed 
physical inventory checks in the audit reports accompanying the final reports of the CSDP Missions. 

On audits on final reports and ex-post audits, the FPI should: 

• 

request  from  the  auditors  performing  mandate  audits  to  provide  an  audit  opinion  covering  the 
functioning of the control systems and the assertions in the management declaration; 

30 

 
• 

• 

• 

• 

require from the external auditors to justify in the audit report the percentages of transactions that 
they  decided  to  test  and  introduce  a  process  of  reliance  on  previous  audit  results  for  the  ex  post 
audits; 

take measures to address the delays encountered in the delivering of the mandate and ex post audit 
reports; 

present in a transparent manner the calculation and input figures used for the detected and residual 
error rate regarding the Common Foreign security Policy budget taking into account the treatment of 
the reported financial findings and the actual amounts to be recovered; 

establish in the control strategy for the CSDP Mission a validation and approval mechanism for the 
cases  when  the  FPI  does  not  implement  (fully)  financial  audit  findings  and  ensure  that  all  such 
decisions are properly documented. 

Additional  information  provided  by  the  FPI  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

In April 2025, the FPI submitted an action plan in response to the IAS audit report on controls over the 
financial management of the civilian Common Security and Defence Policy Missions implemented by 
the FPI. The IAS has approved the FPI action plan, which the FPI aims to fully implement by February 
2026. The IAS has stated it will then assess the effective implementation of the action plan within one 
year.  The  IAS  committed  to  advise  the  FPI,  on  internal  control  and  assurance  building  linked  to  the 
implementation of some of the recommendations of this audit. 

1.19.  Audit on indirect management with partner countries (DG INTPA) 

The objective of the audit was to assess if DG INTPA has designed and if it implements effectively, efficiently, 
and in line with the rules in place an ex ante control system for the award of procurement contracts and grant 
agreements signed under indirect management with partner countries (IMPC). 

There  are  no  observations/reservations  in  the  2023  Annual  Activity  Report  of  DG  INTPA  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 5 December 2024. All observations and recommendations relate to the situation 
as at that date. 

The IAS acknowledged the following strengths: 

• 

In July 2024, DG INTPA decided to cease to implement grants via the IMPC management mode. This 
decision  is  in  line  with  the  results  of  our  sample  testing,  which  revealed  that  the  quality  of 
documentation received from partner countries was not good and required extensive involvement of 
DG INTPA’s staff when performing ex ante controls. According to the information received from DG 
INTPA, the last grant agreements under IMPC are expected to be signed in 2028. 

•  DG  INTPA  has  Portfolio  Dashboard,  a  tool  available  to  all  its  staff, including  in  EU  Delegations,  to 
visualise data coming from various IT tools used by the Directorate-General (amongst others, CRIS 
(13) and OPSYS (14)). The tool enables DG INTPA to monitor various aspects of the actions and contracts 
as well as its key performance indicators. Training on Portfolio Dashboard is available in the form of 
e-learning modules and via dedicated sessions provided by unit INTPA.R2 on request. 

(13)  Common relex information system.  
(14)  The new operational system in external action. 

31 

 
 
 
The  IAS  identified  two  very  important  issues  concerning  the  design  of  the  ex  ante  control  system  and  the 
guidance and training and formulated two very important recommendations. 

On the design of the ex ante control system, DG INTPA should: 

• 

(a) specifically, it should establish timelines for the submission by the contracting authority of the key 
documents  in  the  award  procedures  to  ensure  the  timely  launch  and  finalisation  of  these  award 
procedures;  (b) introduce ex  ante controls for those important stages of the award procedures  for 
which such controls are not yet required; (c) introduce checks to verify that the steps approved ex ante 
by the EU Delegation are effectively implemented by the contracting authority, and (d) instruct the EU 
Delegations to ask for the final version of documents approved conditionally. Finally, (e) DG INTPA 
should monitor the implementation of IMPC on a regular basis and take action in case systemic and 
repetitive issues are detected in EU Delegations.  

•  On the guidance and training, DG INTPA should: 

• 

(a) streamline its guidance on ex ante controls in the practical guidelines on contract procedures, and 
(b) address the weaknesses detected in the existing checklists. (c)&(e) Moreover, it should introduce 
mandatory  attendance  to  training  sessions  on  the  practical  guidelines  on  contract  procedures  for 
operational and financial staff in charge of ex ante controls that (d) should also encompass modules 
on  conflict  of  interest/collusion  in  grant  and  procurement  award  procedures.  (f)  Finally,  DG  INTPA 
should monitor the implementation of the aforementioned training requirements, and take remedial 
action, if needed.  

Additional information provided by DG INTPA on the measures defined and/or implemented 
following the Internal Audit Service audit 

DG INTPA accepted points (b), (c) and (e) of recommendation No 1, action plans are submitted to the 
IAS to address those sub-recommendations and they were accepted by the IASDG INTPA did not accept 
the following sub-recommendations: 

1.a - Defining formal timelines for the submission, by the contracting authority, of the key documents 
in the award  procedures to ensure that they are timely launched and finalised. As a  minimum, such 
timelines should be defined for the key steps of the process such as the submission for the ex-ante 
approval of the guidelines for applicants, the tender dossier, the evaluation report, and the submission 
of the contract for endorsement.  

There is no legal basis for imposing deadlines on the launching of award procedures, there is only a 
deadline for signing contracts. There is already a forecasting exercise (twice per year) for contracts and 
payments. 

1.d - Instructing the EU Delegations to request the partner country to provide the final version of the 
documents approved conditionally to be able to verify if the Delegation’s comments were adequately 
taken into account in the revised version.  

This control is done at the subsequent steps of the procedure and until endorsement, with due regard 
to the balance between the intensity of controls and the need to ensure principle of ownership. 

DG INTPA accepted points (a), (b), (d), (e) and (f) of  recommendation No 2. Action plans are already 
submitted to the IAS to address those sub-recommendations and they were accepted by the IAS 

DG INTPA did not accept sub-recommendation No 2. c - Ensure the regular availability of the advance 
courses on PRAG, as a minimum in English and French. 

32 

 
There are no resources to have advanced PRAG trainings in French. The basic PRAG trainings are already 
available in French. 

 It should be noted that payments under indirect management with partner countries are following a 
downward trend representing 5% of total payments (down from 8% in 2021). For actions decided after 
19 July 2024 and in the context of DG INTPA’s simplification exercise, Programme-Estimates can no 
longer be signed with partner countries. Also, partner countries may no longer award and manage EU-
funded grants in indirect management. 

33 

 
 
 
General services 

1.20.  Audit on the protection of personal data (PMO) 

The  objective  of  the  audit  was  to  assess  whether  PMO  has  put  in  place  an  adequate  and  effective  control 
system  for  the  key  business  processes  handling  (sensitive)  personal  data  to  ensure  compliance  with  the 
provisions of the Internal Data Protection Regulation (IDPR). 

The fieldwork was finalised on 19 June 2024. All observations and recommendations relate to the situation as 
at that date. 

The IAS identified four very important issues concerning (1) the accountability, roles and responsibilities, (2) the 
arrangements  in  case  of  jointly  processing,  international  transfers  of  personal  data  and  service  level 
agreements, (3) the compliance with data protection principles and (4) the IT controls to ensure the integrity, 
confidentiality and availability of personal data, and formulated four very important recommendations. 

On accountability, roles and responsibilities, PMO should:  

• 

• 

• 

• 

• 

• 

formally  define  the  roles  and  responsibilities  of  the  operational  controllers,  the  Data  Protection 
Coordinator (DPC) and his/her assistants; 

approve at the appropriate hierarchical level the job descriptions of the operational controllers and of 
the DPC and his/her assistants; 

introduce mechanisms for the operational controllers to communicate in good time to the IT unit the 
data protection business needs of the supporting IT systems; 

set up (via the DPC) a comprehensive personal data guidance and training plan; 

hold regular meetings with the DPC of DG DIGIT (as IT provider) to discuss data protection issues of 
common interest; and  

ensure that the DPC has a direct reporting line to senior management on all data protection issues. 

On arrangements in case of jointly processing, international transfers of personal data and service 
level agreements, PMO should: 

• 

• 

establish  an  overview  of  all  the  operations  for  which  other  Directorates-General/Services  are  the 
delegated  controller  and  for  which  PMO  carries  out  part  of  the  delegated  controller’s  processing 
operations and formalise internal arrangements with the relevant delegated controllers; 

conclude an internal arrangement with DG DIGIT to define the respective responsibilities regarding 
data  protection  obligations  when  DG  DIGIT  is  the  service  provider  of  the  IT  systems  processing 
personal data; 

•  with regard to the international transfers: confirm under which cases a ‘transfer impact assessment’ 
is needed and, when applicable, carry out such assessment and document (in the record) the method 
used by the Office to lawfully transfer personal data to third countries and international organisations; 
and 

• 

finalise the update of the service level agreements with its clients to reflect the recommendations 
issued by the EDPS on the status of PMO as separate controller. 

On compliance with data protection principles, PMO should:  

• 

• 

regarding the principle of ‘transparency and accountability’, regularly review and update its personal 
data records, the corresponding privacy statements (which have to be effectively communicated to 
the data subjects) and the data protection impact assessment (where required); 

regarding the principle of ‘data minimisation’, for the processing operation of missions’ management, 
share with the travel service provider only the personal data of staff members going on mission; 

34 

 
• 

• 

regarding the principle of ‘storage limitation’: unambiguously state the retention period in its personal 
data records and privacy statements, adopt a procedure for the regular deletion of personal data as 
soon  as  the  applicable  retention  period  has  elapsed,  perform  a  screening  of  all  personal  data 
processed by PMO for which the retention period has elapsed and proceed with the deletion of these 
data without delay; and 

regarding the principle of ‘confidentiality’: use channels for the exchange of personal data that ensure 
an adequate level of security, ensure that any persons who are given access to personal data by PMO 
within their processing operations sign appropriate declarations of confidentiality and liaise with DG 
HR to limit personal data disclosures to the relevant members of the Comité de Gestion du Regime 
Commun d'Assurance Maladie. 

On IT controls to ensure the integrity, confidentiality and availability of personal data, PMO should:  

• 

• 

• 

• 

• 

• 

update its IT security risk assessments and IT security plans to address the gaps and errors identified 
by the auditors; 

only use production data in production and acceptance environments; 

develop a logging and monitoring policy and procedure applicable to all environments (i.e. production 
and non-production) and PMO applications; 

develop a password policy/procedure applicable to all PMO applications and raise awareness on such 
policy/procedure; 

finalise the implementation of the on-going security activities for all PMO systems and report to senior 
management on their implementation; 

establish  a  well-defined  phase-out  process  and  deliverables/artifacts  required,  including  a  clear 
retention period and a procedure for deletion of data for databases of decommissioned applications. 

Additional    information  provided  by  PMO  on  the  measures  defined  and/or  implemented 
following the Internal Audit Service audit 

The  PMO  has  submitted  an  action  plan  that  has  been  accepted  by  the  IAS  in  December  2024.  The 
implementation of the recommendations is on track. Four out of the seven recommendations will be 
implemented before end of June 2025. Other actions require a longer implementation period because 
they involve IT developments and/or cooperation with other services.  

The most urgent and/or important actions have already been implemented, in particular in relation to 
the accountability, roles and responsibilities, the rights of data subjects and the handling of personal 
data  breaches.  Regarding  IT  controls,  the  PMO  has  planned  the  necessary  tasks  to  implement  this 
recommendation, of which 40% will be completed by the end of 2025 and the rest by the end of 2026. 

1.21.  Audit on procurement (DG SCIC) 

The objective of the audit was to assess if the governance, risk management and internal control framework 
set-up  by  SCIC  for  its  procurement  activities  is  adequately  designed,  efficient  and  effective  and  provides 
reasonable assurance that the key internal control objectives are achieved. 

There  are  no  observations/reservations  in  the  2023  Annual  Activity  Report  of  DG  SCIC  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 18 September 2024.  

The IAS noted the efforts made by DG SCIC to improve its internal control framework for procurement activities.  

35 

 
More specifically, the IAS welcomed the existence of a network of Financial Correspondents (FCN) in SCIC, which 
is chaired and coordinated by Unit SCIC C.2 (Budget and Financial Management). The FCN is composed of staff 
from the Budget and Financial Management unit as well as from the operational units dealing with finance and 
procurement files. The FCN has proved to be an effective tool for the effective functioning of the procurement 
activities  by  disseminating  relevant  information,  including  on  procurement  aspects,  in  a  timely  manner  (for 
example on procurement training), sharing best practices or drawing lessons from common errors as well as 
raising awareness on anti-fraud measures and ethical matters. 

The IAS did not formulate any critical or very important recommendations. 

36 

 
 
Information technology 

1.22.  Limited  review  of  SUMMA  in  preparation  for  ‘going  live’  (DG 

BUDG) 

The objective of the limited review was to assess whether DG BUDG has put in place appropriate controls to 
address the main risks regarding the transition from ABAC to SUMMA (15). 

There  are  no  observations/reservations  in  the  2023  Annual  Activity  Report  of  DG  BUDG  that  relate  to  the 
area/process audited. 

The fieldwork was finalised on 20 February 2024. All observations and recommendations relate to the situation 
as of that date. 

The auditors recognised the ongoing efforts made by DG BUDG to bring the SUMMA programme to a successful 
completion. In addition, we noted a number of good practices as follows: 

•  A  regular and  well-established  series  of  programme  management  meetings and  various business, 
technological  and  organisational  activities  which  aim  to  ensure  close  monitoring  and  reporting  on 
potential issues.  

•  An increased formalisation of responsibilities and closer collaboration between DG BUDG and other 
Commission departments owning the IT systems to be integrated with SUMMA since July 2023. 

•  Data  migration  activities aiming  at  achieving  high  levels of  data  quality  and data  migration  script 
success rates, regularly sharing the status, and providing a transparent status of open transactions / 
issues to the departments. 

•  An extensive range of various training activities and support materials / techniques available to current 

/ future SUMMA users. 

•  A change management network defined, established and steered by DG BUDG applying the lessons 

learned and feedback from 2023 activities. 

• 

The synergy between a broad user acceptance testing involving several hundreds of users across the 
Directorates-General,  to  thoroughly  test  the  system  and  at  the  same  time  allow  an  early 
understanding at Directorate- 

•  General level of the changes to be expected at working level.  

• 

The performance of various IT security tests, such as an SAP security audit, vulnerability scans and 
penetration  testing,  aimed  at  supporting  the  identification  and  correction  of  key  IT  security 
vulnerabilities. 

•  A continuous communication on SUMMA programme activities and progress per various streams to 

Commission staff and specific working groups. 

The IAS identified three very important issues concerning the monitoring of the readiness of the SUMMA 
solution,  the  integration  of  local  IT  systems  and  the  IT  security  and  formulated  three  very  important 
recommendations. 

On monitoring of the readiness of the SUMMA solution, DG BUDG should: 

• 

perform a cleaning exercise to obtain a complete and up-to date status of the functional requirements 
and defects. Coupled with other monitoring work plans, this should in turn enable the identification of 
what remains to be finalised, making a clear distinction between mandatory requirements and non-

(15) Tools for accrual based and budgetary accounting. 

37 

 
 
 
 
mandatory  improvements.  In  the  event  of  any  potential  blocking  issues,  which  could  impact  the 
January  2025  go-live  decision,  these  should  be  clearly  communicated  in  the  upcoming  SUMMA 
Steering Committees. 

On integration of local IT systems, DG BUDG should: 

• 

clarify  the  final  list  of  IT  systems  to  be  integrated  with  SUMMA  and report  the  list  to  the  SUMMA 
Steering Committee. It should strengthen the existing close monitoring arrangements to include the 
status  on  acceptance  testing,  training  and  change  management  activities  (once  these  phases  are 
reached). In the event that any delays are identified which could pose a significant risk to the go-live 
of an integrated system appropriate contingency plans should be defined. 

On IT security, DG BUDG should: 

• 

update and formally approve the IT security risk assessment and IT security plan which should cover 
the  complete  scope  of  SUMMA  IT  system  before  the  go-live  (January  2025).  In  line  with  that 
assessment, defined IT security measures should be implemented before the go-live, or residual risks 
above the risk acceptance criteria should be formally identified and a roadmap should be adopted for 
implementing the missing IT security measures. It should report on a regular basis IT security activities 
related to SUMMA (for example risks, status of security measures) to the SUMMA Steering Committee. 
It should also formalise data protection impact assessments and update data processing records for 
SUMMA.  

Additional information provided by DG BUDG on the measures defined and/or implemented 
following the Internal Audit Service audit 

Three very important recommendations were reported as implemented by DG BUDG, and one of them  
has been reviewed and closed by the IAS (on monitoring of the readiness of the SUMMA solution). Two 
recommendations concern the integration of local IT systems and the IT security, and they are being 
reviewed by the IAS. 

1.23.  Audit on IT financing framework (DG DIGIT) 

The objective of the audit was to assess: (1) the adequacy of the design and the effective implementation of 
the control framework put in place by DG DIGIT for the management of the baseline IT services and of the 
charge-back processes, including the adequacy of the tools to effectively monitor and report on these activities; 
and  (2)  whether  the  current  IT  financing  framework  is  adequate  to  enable  DG  DIGIT  to  deliver  sustainable 
corporate IT services going forward. 

The fieldwork was finalised on 7 June 2024. All observations and recommendations relate to the situation as 
at that date. 

The IAS noted the significant progress made by DG DIGIT in the last few years to drive and facilitate the digital 
transformation  of  the  Directorates-General  and  of  the  Commission  as  a  whole,  exploiting  the  capabilities 
offered by the digital technologies. In 2023, DG DIGIT continued to develop the corporate IT infrastructure, with 
a particular emphasis on cloud. This has led to the Directorates-General migrating their existing information 
systems to the cloud. 

DG  DIGIT  has  also  improved  its  services  as  regard  the  Digital  Workplace  (DWP).  For  example,  in  2023,  it 
completed the rollout of the WELCOME domain (i.e. the digital environment of the Commission designed for 
remote and hybrid work), to all headquarter staff. 

The above initiatives are particularly important considering the limitations of the current IT financing framework 
and are aligned with the positive results of the 2023 annual DG DIGIT survey, with 94% of staff satisfaction 

38 

 
with the IT helpdesk, 86% with corporate equipment and 91% of overall satisfaction with the Digital Workplace 
services. 

The IAS identified one very important issue concerning the concept of baseline IT services and the adequacy of 
the current IT financing framework to deliver sustainable corporate IT services going forward and formulated 
one very important recommendation. 

On the concept of baseline IT services and the adequacy of the current IT financing framework, DG 
DIGIT, in cooperation with DG BUDG and the SG, should: 

• 

in the context of the preparation of the next multi-annual financial framework, assess whether the 
current IT financing framework is still fit for purpose and if not, propose a more agile and flexible IT 
financing  framework,  considering  the  current  context  (budgetary  constraints  and  inflationary 
pressure), the  expected  challenges (increasing  demand  of  IT  services),  and  the  EC  Digital  Strategy 
priorities.  This analysis should include an assessment on whether the current concept of baselines for 
IT services is still relevant and if so, for which IT services. 

To  have  a  good  basis  for  the  above  analysis,  DG  DIGIT  should  first  strengthen  the  following 
elements:  

— 

— 

its  costing  model  to  be  able  to  calculate  the  total  IT  costs  and  show  to  the  Information 
Technology and Cybersecurity Board and customers the evolution of those costs as well as to 
have a sound cost-based process for the charged-back amounts; 

the  reporting  to  the 
Information  Technology  and  Cybersecurity  Board  to  provide 
comprehensive information on the evolution of ‘baselines IT services’ for an efficient decision-
making  process  by  the  Information  Technology  and  Cybersecurity  Board  and  a  timely 
identification of potential budget gaps; and 

— 

the IT tools supporting the management of the IT financing to ensure data integrity, effective 
access management and security of the IT tools. 

Additional information provided by DG DIGIT on the measures defined and/or implemented 
following the Internal Audit Service audit 

DIGIT prepared and submitted an action plan, which was accepted by the IAS in January 2025. DIGIT is 
implementing the action plan according to the agreed target dates (Q2 2025 for the ‘very important’ 
recommendation), therefore mitigating the related risks. In coordination with the SG and DG BUDG, DIGIT 
is currently working on a proposal for a revised IT financing framework to address the ‘very important’ 
recommendation issued. 

39 

 
 
Part 2  
Follow-up 
engagements 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Audits  for  which  some  recommendations 
remain open 

2.1. 

Audit on the design and set-up of the Digital Europe Programme 
in DG CNECT and HaDEA 

Follow-up performed in DG CNECT 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented: 

• 

• 

• 

• 

• 

Recommendation  No  1  (important):  preparation  of  the  work programmes  and  calls;  synergies with 
other programmes 

Recommendation No 2 (important): evaluation process 

Recommendation No 4 (very important): conflict of interests and ethics 

Recommendation No 5 (important): conflict of interests and ethics 

Recommendation No 7 (important): checks on financial capacity and ownership control assessment 
for restricted calls 

All recommendations from this audit addressed to DG CNECT have been closed. 

Follow-up performed in HaDEA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 3 (important): evaluation process 

2.2. 

Audit on preparedness of the management and control systems 
regarding  the  implementation  of  the  Citizens,  Equality,  Rights 
and  Values  (CERV)  and  Justice  programmes  in  DG  JUST  and 
EACEA 

Follow-up performed in DG JUST 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (important): selection of experts – evaluation of the proposals and structure 
of the evaluation reports. 

Follow-up performed in EACEA 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented: 

• 

Recommendation  No  1  (important):  calls  for  proposals  with  financial  support  to  third  parties 
(regranting) 

41 

 
• 

• 

Recommendation No 3 (important): selection of experts - evaluation of the proposals and structure of 
evaluation reports 

Recommendation No 5 (important): financial capacity checks and risk monitoring 

All recommendations from this audit addressed to EACEA have been closed. 

2.3. 

Audit on crisis communication in DG COMM, DG ECHO, DG SANTE 
and the SG 

Follow-up performed in DG COMM 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented : 

• 

• 

2.4. 

Recommendation No 2 (important): capacity building – exercising 

Recommendation No 3 (important): capacity building – training 

Audit on European Commission actions against food fraud in DG 
AGRI, OLAF and DG SANTE 

Follow-up performed in DG AGRI 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendations were 
adequately and effectively implemented: 

• 

• 

Recommendation  No  1  (very  important):  allocation  of  tasks  between  DG  AGRI  and  DG  SANTE  as 
regards organic food products 

Recommendation  No  2  (very  important):  screening  of  notifications  and  monitoring  of  detected 
potential issues in Member State control systems 

Follow-up performed in DG SANTE 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 3 (very important): screening of notifications 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation No 5 (downgraded from very important to important): address weaknesses in the 
integrated rapid alert system for food and feed (iRASFF) 

To address the issues identified, DG SANTE improved the links made between the three networks and updated 
the iRASFF privacy statement. It also defined an access control policy/procedure. 

However, the auditors found that while progress had been made to ensure appropriate user access rights in 
iRASSF, some weaknesses remained. 

2.5. 

Audit on the implementation of the Innovation Fund in DG CLIMA 
and CINEA 

Follow-up performed in DG CLIMA 

42 

 
Based on the results of two follow-up audits, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 1 (very important): establishment of the evaluation committee and evaluation 
by external experts 

All recommendations from this audit addressed to DG CLIMA have been closed. 

Follow-up performed in CINEA 

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were 
adequately and effectively implemented: 

• 

• 

• 

Recommendation No 2 (very important): establishment of the evaluation committee and evaluation 
by external experts 

Recommendation No 4 (very important): other elements pertaining to the evaluation process 

Recommendation No 5 (important): redress procedures 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation No 3 (downgraded from very important to important): management of conflict of 
interests (CoI) in the evaluation process 

While CINEA had adequately implemented most of the recommendation in relation to the management of CoI 
in the evaluation process for the Innovation Fund, there remained a need for further clarification in the 
guidelines on ethics rules and conflict of interests for CINEA staff. 

2.6. 

Audit on the management of public cloud services in DG DIGIT, 
DG HR and the SG 

Follow-up performed in DG DIGIT 

Based on the results of follow-up audit, the IAS concluded that the following recommendations were 
adequately and effectively implemented: 

• 

• 

Recommendation No 2 (very important): cloud security services 

Recommendation  No  4  (important):  public  cloud  service  provider  performance  measurement  and 
reporting 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation No 3 (important): cloud-related IT security risk management tool (GovSec) 

DG DIGIT has successfully integrated the GovSec modules for risk management (IT security risk management) 
and  data  protection  impact  assessment  functionalities  into  the  existing  IT  Security  Governance,  Risk  and 
Compliance tool). This has enhanced cloud risk management by facilitating risk assessment, control tracking 
and compliance with security and data protection rules. Additionally, DG DIGIT has actively engaged business 
representatives  and  key  stakeholders  through  the  GovSec  Steering  Committee  and  Cybersecurity  Policy 
Implementation Community meetings, promoting discussions on IT security. However, DG DIGIT did not address 
the  audit  recommendation  to  propose  to  the  Information  Technology  and  Cybersecurity  Board  to  formally 
endorse GovSec (or any other equivalent application) as the corporate tool for IT security risk management, nor 
to mandate its full use for all system owners in conformance with the IT security risk management methodology. 

43 

 
2.7. 

Audit on IT security management in the HR family - DG DIGIT, 
DG HR, EPSO and PMO 

Follow-up performed in DG HR 

Based on the results of the two follow-up audits, the IAS concluded that the recommendation below was not 
fully and/or adequately implemented: 

• 

Recommendation No 1 (downgraded from very important to important): IT security governance 

DG  HR  has  made  significant  progress  in  implementing  the  recommendation.  The  inventory  of  information 
systems is regularly updated, and IT security compliance is monitored and periodically reported to the IT Steering 
Committee. Additionally, the IT security roles and responsibilities have been reviewed and agreed between DG 
HR and DG DIGIT. Moreover, DG HR assigned the system owners and system security officers to all its information 
systems and documented the security plans for SYSPER (16) and COMREF (17), together with their implementation 
roadmaps. According to these two roadmaps, progress has been made to implement security controls for both 
information systems. The controls were expected to be fully implemented by the end of 2024. 

2.8. 

Audit on the protection of personal data under the responsibility 
of DG RTD (CIC), CINEA, EACEA, EISMEA, ERCEA and REA 

Follow-up performed in DG RTD (CIC) 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

Recommendation No 2 (very important): transfer of personal data to third countries 

Recommendation No 3 (important): retention of digital and paper files 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation No 1 (downgraded from very important to important): controllership of the funding 
and tenders’ portal (FTOP) 

DG RTD and the audited executive agencies signed the joint controllership agreement covering the processing 
in the FTOP. During its  45th meeting on 24 November 2023, the eGrants and eProcurement Steering Board, 
which is the overarching governance body for the FTOP, created a new data protection task force. The task force 
decided  to  follow  the  recommendations  of  the  Data  Protection  Officer  of  the  Commission  and  to  publish 
individual corporate records for each processing activity (for example participant registration, external experts) 
instead of a single record covering all activities. The records will be listed in Annex III of the joint controllership 
agreement. Some of these corporate records already exist but need to be updated whilst others need to be 
created to reflect the joint controllership agreement and any processing changes that have taken place in the 
meantime in the FTOP. Until all records covering corporate processes are created, updated and listed in Annex 
III, the risks related to the data processing in FTOP are only partially mitigated. 

(16)  Corporate HR management system. 
(17)  Data hub between Sysper and other IT systems disseminating HR master data.  

44 

 
 
 
 
 
Follow-up performed in ERCEA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (important): record management 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation No 1 (important): controllership of the funding and tenders portal 

The Director of ERCEA signed the joint controllership agreement covering the processing in the FTOP. 

During its 45th meeting on 24 November 2023, the eGrants and eProcurement Steering Board, which is the 
overarching governance body for the FTOP, created a new data protection task force. The task force decided to 
follow  the  recommendations  of  the  Data  Protection  Officer  of  the  Commission  and  to  publish  individual 
corporate records for each processing activity (for example participant registration, external experts) instead of 
a single record covering all activities. The records will be listed in Annex III of the joint controllership agreement. 
Some of these corporate records already exist but need to be updated whilst others need to be created to reflect 
the joint controllership agreement and any processing changes that have taken place in the meantime in the 
FTOP. Until all records covering corporate processes are created, updated and listed in Annex III, the risks related 
to the data processing in FTOP are only partially mitigated. 

2.9. 

Audit on interruptions, suspensions and financial corrections for 
European  Structural  and  Investment  Funds  2014-2020  by  DG 
EMPL, DG MARE and DG REGIO 

Follow-up performed in DG MARE 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 14 (important): monitoring and reporting on interruptions, suspensions, financial 
correction processes 

All recommendations from this audit addressed to DG MARE have been closed. 

2.10.  Audit  on  the  preparedness  for  closing  the  2014-2020 
programming period of the European Structural and Investment 
Funds in DG EMPL, DG MARE and DG REGIO 

Follow-up performed in DG REGIO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 4 (very important): planning of the closure exercise 

45 

 
2.11.  Audit  on  the  management  of  recovery  orders  for  competition 
fines (incl. guarantees for competition fines) and for recovery 
orders in the context of the Commission's 'corrective capacity' 
– Phase II 

Follow-up performed in DG BUDG 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 1 (important): overall coordination and monitoring 

The recommendation listed below was not fully and/or adequately implemented: 

• 

Recommendation No 2 (downgraded from very important to important): dealing with insolvencies and 
bankruptcies 

This recommendation comprises four sub-parts, out of which three have been implemented. The following sub-
point remains open: 

In  February  2024,  the  Commission  adopted  ‘An  enhanced  corporate  strategy  for  the  management  of  the 
Commission’s debtors. Its purpose is to increase the chances of recovery of the Commission’s claims on behalf 
of the Union, by speeding up the recovery process. It introduces four strategic measures, namely: (1) recovery 
performance standards, which quantify the existing requirements of the Financial Regulation; (2) transparent 
compliance monitoring and reporting, allowing for comparisons of performance and enhanced monitoring; (3) 
reinforced accountability, with corporate escalation mechanisms; and (4) synergies and efficiencies brought by 
partial centralisation, including combined waiver decisions.  

DG BUDG provides information on the financial situation (i.e. beyond any latest published annual accounts and 
creditworthiness  from  commercial  databases)  for  overdue  debtors  to  enable  Authorising  Officers  to  take 
preventive and mitigating measures. As per the above corporate strategy, this information might be extended 
‘In the future possibly also on risky contractors and beneficiaries, or even on all legal entities (which are private 
law bodies) that have an ongoing contract or grant agreement with Commission departments.’ 

While  the  IAS  acknowledged  the  efforts  and  progress  made  by  DG  BUDG  to  implement  this point, the  risks 
identified during the audit have not yet been fully mitigated for all categories of contractors and beneficiaries, 
as not all of them are currently being included in the process of exchange of information about their financial 
situation.  

Nevertheless,  the  IAS  concluded  that  the  actions  taken,  together  with  those  which  are  currently  ongoing  or 
planned, effectively reduce the risks initially identified regarding the lack of an effective and efficient exchange 
of  information  on  insolvencies/bankruptcies between  Commission  services,  together  with  weaknesses in  the 
preventive and detective controls over the liquidity status of legal entities. 

2.12.  Audit  on  the  physical  security  of  persons  and  assets  in  the 
Commission – DG COMM, DG DIGIT, DG HR, OIB and OIL 

Follow-up performed in DG COMM 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

46 

 
• 

Recommendation No 2 (very important): governance framework and organisational arrangements for 
physical security at the Commission – DG COMM 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation  No  4  (very  important):  risk  management  framework  for  physical  security  at  the 
Commission – DG COMM 

The IAS acknowledged that some progress has been made to implement the above action plan but one point 
need to be addressed by DG COMM and HR.DS jointly with the European Parliament in December 2023.  

According to recent information provided in February 2025 by DG COMM (after the cut-off date for this report), 
DG  COMM,  jointly  with  HR.DS,  discussed  the  matter  further  with  the  European  Parliament  and  a  pragmatic 
solution was identified with the Parliament. The IAS will follow up the effective implementation of this action in 
due time.  

Follow-up performed in DG HR 

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were not 
fully and/or adequately implemented: 

• 

Recommendation  No  3  (very  important):  risk  management  framework  for  physical  security  at  the 
Commission – DG HR 

While the IAS acknowledged that some progress has been made in the implementation of the action plan, the 
recommendation has not been fully implemented.  Besides the point mentioned above in cooperation with DG 
COMM  and  the  European  Parliament,  another  one  related  to  the  implementation  of  a  new  IT  platform  was 
delayed because of data protection issues linked to the platform initially chosen by the Secretariat General.   

• 

Recommendation No 5 (downgraded from very important to important): internal control measures for 
physical security 

While the IAS acknowledged that some progress has been made in the implementation of the above action plan, 
the recommendation has not been fully implemented. In particular, a feasibility study regarding landlines was 
not implemented as it was not considered effective. to have one sole emergency number across all sites. In 
addition, some key performance indicators  were prepared but not finalised yet. 

Other actions have been adequately addressed. In particular, DG HR updated the crisis manual, developed key 
performance indicators, a dashboard and a governance structure to oversee the guards service and reviewed 
and  updated  the  standard  operating  procedures  for  the  security  inspections,  which  were  endorsed  by  the 
Director of Security. 

In conclusion, the actions taken by DG HR (together with those on-going), reduce the risks initially identified 
regarding weaknesses in the internal control measures for physical security. 

2.13.  Audit on the review of the Commission’s risk at payment in DG 
AGRI, DG BUDG, DG EMPL, DG INTPA, DG NEAR, DG REGIO, DG RTD, 
EISMEA, ERCEA and REA 

Follow-up performed in DG RTD, EISMEA, ERCEA and REA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

47 

 
• 

Recommendations  No  3  (DG  RTD),  No  4  (REA),  No  5  (ERCEA)  and  No  6  (EISMEA)  (very  important): 
analysis and (internal) reporting of the root causes of error in relation with the ECA’s findings 

All  recommendations  from  the  review  on  the  Commission’s  risk  at  payment  addressed  to  DG  RTD,  EISMEA, 
ERCEA and REA have now been closed. 

2.14.  Audit on the performance framework for research 

Follow-up performed in DG RTD 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

• 

• 

• 

• 

Recommendation No 1 (important): monitoring and performance of Horizon 2020 

Recommendation No 2 (very important): reporting on Horizon programmes 

Recommendation No 3 (important): completeness of the performance framework 

Recommendation No 4 (important): Horizon Europe – objectives and indicators 

Recommendation No 5 (important): Horizon Europe – controls on data and guidance 

Recommendation No 6 (important): Horizon Europe – missions 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation No 7 (important): partnerships 

DG  RTD  established  two  working  groups  to  further  refine  the  monitoring  and  performance  framework  for 
European partnerships, namely: 

— 

the Partnership Knowledge  Hub,  gathering as observers the representatives of EU  Member 
States and associated countries, and the 49 EU partnerships, to allow enhanced cooperation 
and coordination with the partnerships; 

—  a dedicated working group gathering the representatives of the units in DG RTD and in the 
other partner Directorates-General in charge of EU partnerships, to facilitate the exchanges 
of information and coordination on the partnerships.  

Moreover, it published the second biennial monitoring report on European partnerships in September 2024.  

However,  the  main  parts  of  the  recommendation  have  not  been  implemented.  In  particular:  The  current 
‘Guidance on the development of key performance indicators for European partnerships, including baseline and 
target setting’ developed by DG RTD, does not:  

—  formulate clear definitions for the terminology used in specific objectives; 

— 

link the partnerships specific impact pathways with the key impact pathways; 

—  provide a robust methodology for target setting and clarify the approach as regards the data 

collection requirements and controls for the partnerships’ common indicators; 

There is no written agreement with the partnerships on the relevant data to be made available and on the data 
collection requirements and controls for the partnerships’ common indicators. 

In addition, the 2024 biennial monitoring report has brought forward a growing gap between partnerships’ input 
(both in quantity and quality) regarding their performance and the monitoring. This resulted in only a minority 
of partnerships presenting a fully completed key performance indicator table. 

48 

 
2.15.  Audit on the pillar assessment in the external action family – 

DG BUDG, DG ECHO, the FPI, DG INTPA and DG NEAR 

Follow-up performed in DG BUDG 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 12 (important): substantive changes 

2.16.  Audit  on  indirect  management  with  entrusted  entities  in  DG 

INTPA and DG NEAR 

Follow-up performed in DG NEAR 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was not fully 
and/or adequately implemented: 

• 

Recommendation No 6 (important): risk-based ex ante checks 

The IAS recommended DG NEAR to use available sources of information to centrally identify systemic issues 
that  would  warrant  intensified  checks  before  the  clearing,  final  payment  or  recovery  and  to  inform  EU 
Delegations and headquarters units about such systemic issues and instruct them when and how to perform 
intensified checks. 

To address this recommendation, DG  NEAR planned to  ‘design an annual process in order to analyse issues 
encountered  in  its  cooperation  with  IMEEs  […]’    and  to  ‘formulate  suitable  follow-up  measures  (including 
intensified/more frequent checks) when issues of a systemic nature are identified’.  

Although DG NEAR has put in place an annual process to analyse such issues, the IAS review of DG NEAR’s 2021 
and 2022 annual analysis identified gaps in relation to the formulation of ‘suitable follow-up  measures’ for 
issues of a systemic nature. More specifically, the main actions are fairly vague and not defined in a ‘SMART’ 
(specific, measurable, attainable, realistic and time-bound) way, which limits DG NEAR’s ability to monitor their 
effective implementation to ensure that such issues will not occur again in the future. 

2.17.  Audit  on  the  implementation  of  bilateral  trade  agreements  in 

DG AGRI, DG ENV and DG TRADE 

Follow-up performed in DG AGRI 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation  No  1  (important):  division  of  responsibilities  and  guidance  on  implementation  of 
bilateral trade agreements 

Follow-up performed in DG TRADE 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

Recommendation  No  1  (important):  guidance  related  to  the  implementation  of  bilateral  trade 
agreements 

49 

 
• 

• 

• 

• 

• 

• 

Recommendation No 2 (important): overview of cooperation structures and of ongoing cooperation 
with third countries 

Recommendation No. 3 (important): functioning of the committees 

Recommendation No. 4 (important): transparency - publication of agreement-related information 

Recommendation No. 5 (important): document management related to bilateral trade agreements 

Recommendation No. 6 (very important): use of ex post evaluations and supporting studies to improve 
the implementation of bilateral trade agreements 

Recommendation No. 8 (very important): trade barriers 

2.18.  Audit  on  contractual  expenditure  verifications  in  the  FPI,  DG 

INTPA and DG NEAR  

Follow-up performed in DG INTPA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 4 (important): quality review of contractual expenditure verification reports 

The recommendations listed below were not fully and/or adequately implemented: 

• 

Recommendation No 1 (important): identification of transactions subject to contractual expenditure 

The IAS recommended to DG INTPA to review the risk assessment criteria and thresholds that trigger mandatory 
contractual expenditure verifications to ensure they remain suitable. 

The  IAS  acknowledged  the  work  done  by  DG  INTPA  to  determine  new  thresholds for  mandatory  contractual 
expenditure verifications. The Directorate-General fixed the threshold for grants and fee-based service contracts 
at  EUR  325  000,  lowered  the  high-value  contract  threshold  from  EUR  5  000  000  to  EUR  3  000  000,  and 
exempted low-risk global price service contracts from mandatory contractual expenditure verifications or agreed 
upon procedures. However, these thresholds are not yet in place as the external action Directorates-General 
have not yet adopted and enforced the new model grant agreement. 

• 

Recommendation No 2 (important): procedure for selecting external auditors 

The recommendation called for an update of the terms of reference, to ensure that external auditors proposed 
to carry out contractual expenditure verifications have the necessary knowledge and experience in verifying EU 
expenditure. It also required to establish guidance for the finance and contracts teams on the approval process 
of the external audit firm and clear criteria for rejecting candidates. 

DG INTPA has updated the terms of reference. However, the guidance for finance and contracts teams on the 
approval process is not complete. In particular, it lacks specifics on who should approve the audit firm, the source 
documents  for  approval,  the  types of  supporting  documents  to  review, and  examples  of  situations  where  a 
proposed external auditor should be rejected. 

• 

Recommendation No 3 (very important): objective and design of contractual expenditure verifications 
as a control 

The IAS recommended to: (1) clarify the objective of the contractual expenditure verifications as a control; (2) 
revise the risk assessment template and sampling methodology for external auditors; and (3) revise the terms 
of reference template for contractual expenditure verifications to clearly describe verification procedures, and 
listing,  where  relevant,  supporting  documents  for  external  auditors,  and  including  standardised  answers  for 
auditors’ conclusions. 

50 

 
DG  INTPA  has  revised  the  terms  of  reference,  which  now  clearly  states  the  objective  of  the  contractual 
expenditure  verifications,  includes a  revised  sampling  methodology  and  contains  detailed  work  programmes 
and guidelines for the external auditors. The changes were communicated to the EU Delegations and relevant 
Directorates-General.  

However, the IAS assessed that, points (2) and (3) of the original recommendation have not yet been effectively 
implemented. In particular: 

• 

Risk assessment methodology and sampling methodology (point (2)): 

— 

— 

— 

the revised terms of reference do not state how the sample should be selected, i.e. whether it 
should be risk-based, random, or follow another methodology (i.e. monetary unit sampling). 
Hence, verifiers may select low-risk, non-problematic transactions to minimise reporting and 
validation efforts, reduce time spent on verification and increase profit margins; 

the sample size indicated in the terms of reference is small and not defined to enable the 
contractual expenditure verifications to be a robust control (i.e. 10% of total expenditure in 
most cost categories (HR, travel, and other costs, services) and 20% of total expenditure for 
equipment or between 5, 10 and 20 transactions whichever number is the highest). This leads 
to a smaller sample size than the one used in DG RTD’s certification of financial statements, 
which DG INTPA claimed to use as benchmarked methodology;  

the sampling instruction requires the external auditor to consider ‘whichever number is the 
highest’ between the number of transactions and the percentage of total costs declared. This 
instruction is unclear as the two elements (number of  transactions and total costs) are not 
comparable; 

— 

there is still no requirement for the verifiers to extend the sampling if errors exceed a certain 
threshold. 

Moreover, the internal procedures (i.e. the Companion) have not be amended to specify what should be done if 
a contractual expenditure verification identifies a significant number of errors. 

• 

Terms of reference: work programme, documentation and guidelines (point (3)): 

— 

— 

the  ISRS  4400  principles  for  agreed  upon  procedures  states  that  ‘the  procedure  and  the 
related findings should be clear, not misleading and not subject to varying interpretations’ (18), 
however the revised terms of reference leaves the external auditor to ‘apply this guideline to 
tailor working papers as appropriate’. This does not remove ambiguity and does not ensure 
consistency in the work performed by the verifiers; 

the  terms  of  reference  mentions  the  existence  of  an  'applicable  Practical  Guide'  for 
procurement  procedures,  but  it  does  not  clarify  what  this  guide  is  about.  Moreover,  the 
provisions  in  the  terms  of  reference  for  the  check  on  the  procurement  procedures  are  not 
aligned with the actual contractual requirements for procurement in force (i.e. Annex IV of the 
grant contract); 

—  as  in  the  previous  version,  the  terms  of  reference  do  not  require  the  verifier  to  clearly 
document  and  report  the  results  of  each  procedure  applied, including  population  sizes and 
items tested, to ensure transparency and the possibility to review the work done by the verifier 
to  increase  transparency  and  the  ability  to  assess  the  quality  of  the  work  performed  by 
verifiers. 

(18)  Point 22 (c) in chapter: ‘Engagement, Acceptance and Continuance – International Standard on Related Services (ISRS) 

4400’, April 2020 

51 

 
 
 
2.19.  Limited review on data protection in DG ECHO, the FPI, DG INTPA, 

DG NEAR, DG TRADE and DG TAXUD 

Follow-up performed in DG ECHO, DG INTPA, DG NEAR, DG TRADE, DG TAXUD and the FPI 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 1-6 (Important): international data transfers 

The aforementioned recommendations from the limited review addressed to the 5 DGs and the FPI have now 
been closed. 

2.20.  Limited review of SUMMA in preparation for ‘going live’ in DG 

BUDG 

Based on the results of the follow-up audit, the IAS concluded that the following recommendations were 
adequately and effectively implemented: 

• 

• 

Recommendation No 1 (very important): monitoring of the readiness of the SUMMA solution 

Recommendation No 7 (important): programme management and contingency planning 

The recommendations listed below were not fully and/or adequately implemented: 

• 

Recommendation No 2 (very important): integration of local IT systems, with original target date for 
implementation of 31 December 2024 

At the time of the IAS follow-up note issued on 13 November 2024, the list of IT systems to be integrated with 
SUMMA is  defined and all the systems considered as  high-risk are monitored and presented to the SUMMA 
Steering Committee.  

In relation to the progress towards the finalisation of the integration, close monitoring has been established. 
Testing is progressing on all integrations and DG BUDG informed the Steering Committee on 16 October that 
there are no blocking points for the go-live (though defects were identified during the testing process and are 
getting resolved or mitigation measures are being defined). Several systems are at risk of delay with further 
testing to be done by the end of November 2024. The IAS invited DG BUDG to continue monitoring closely the 
integrations progress, and the identification and presentation of the risks related to any delay. The preparation 
of  the  necessary  contingency  plans  for  the  business  processes  that  may  not  be  fully  supported  by  the 
integrations at the time of the go-live will also have to be closely monitored. 

• 

Recommendation No 3 (very important): IT security, with original target date for implementation of 
31 December 2024 

The  data  protection  impact  assessments  have  been  performed  and  the  data  processing  record  and  privacy 
statement have been updated. The record and privacy statement are in the workflow to be validated by the data 
protection coordinator and the data protection officer (DPO) before final publication in the DPO register.  

The  IT  security  risk  study  and  IT  security  plan  have  been  drafted  but  not  yet  formally  approved.  The  list  of 
security measures to be implemented as a result of the risk study have also been defined. Through the review 
of the received documents, the IAS has noticed several concerns related to asset modelling (linking assets with 
the primary assets), impact levels, risk acceptance criteria level and status as well as timeline of implementation 
of defined IT security measures. The IAS invited DG BUDG to communicate the risks with their levels to the 
system owner / accounting officer / DG BUDG Director-General for risk approval and acceptance. 

• 

Recommendation No 4 (important): data migration, with original target date for implementation of 31 
December 2024. 

52 

 
Data quality of the Commission departments is continuously improving and on 12 November 2024 (based on 
the Qlik Sense Data quality – SUMMA Readiness Monitoring dashboard), all but one of the departments met the 
score of 99% for SUMMA readiness and all but four had less than 100 pending corrections for SUMMA data 
quality issues. However, these scores can be evolutive as new transactions are encoded and therefore, regular 
monitoring is required until the go-live. 

Regarding data migration scripts, their readiness is improving every month, as presented in the SUMMA Steering 
Committee, however it still does not reach the defined target of 90%. The last migration tests were ongoing 
until  the  end  of  October  (in  the  migration  environment)  and  should  continue  until  the  end  of  November  (in 
preproduction environment).  

The IAS invited DG BUDG to continue close monitoring and communicating to the SUMMA governance bodies 
and  the  Commission  departments  the  data  quality  of  the  department’s  transactions  as  well  as  continue 
improving the data migration scripts to reach the target levels.  

• 

Recommendation No 5 (important): training activities, with original target date for implementation of 
31 March 2025. 

Training is established and provided with regular monitoring by DG BUDG on number of staff trained. Training 
materials  are  available  and  updated  in  function  of  the  needs.  The  statistics  and  cases  of  high  cancellation 
percentage are shared with the Commission departments, asking for feedback to know whether the number of 
relevant  staff  to  be  trained  needs to  be  updated.  Progress  in  the  number  of  staff  trained  is visible, but  the 
targets defined are not yet reached. The IAS invited DG BUDG to continue monitoring and communicating to the 
SUMMA governance bodies and to the Commission departments the progress in the number of relevant staff 
trained. 

Regarding the possibility to establish a playground environment for SUMMA users, the analysis has been made 
and few options have been provided. However, the final decision is still pending. 

• 

Recommendation  No  6  (important):  change  management  activities,  with  original  target  date  for 
implementation of 31 December 2024. 

Change management risks have been identified, assessed and mitigation measures are defined and ongoing for 
the majority of the risks. The SUMMA readiness indicator reported in the SUMMA Steering Committee shows 
that the target of having more than 90% of critical residual risks with mitigation measures has been achieved. 

The network of change management coordinators in DG BUDG has now been established and an activation lab 
meeting  (i.e.  kick-off  meeting)  has  occurred.  The  coordinators  have  been  invited  to  the  monthly  change 
coordinators touchpoint. 

The IAS invited DG BUDG to continue monitoring and communicating to the SUMMA governance bodies and to 
the Commission departments on change management risks and the related mitigation measures before and 
after the go live. 

2.21.  Limited  review  of  the  security  plan  and  associated  security 
measures of the EU emissions trading system (ETS) information 
system managed by DG CLIMA 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 1 (very important): information technology (IT) security plan 

2.22.  Audit on the CASE@EC project in DG COMP 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

53 

 
• 

Recommendation No 5 (important): registration process 

2.23.  Audit on human resources management in DG COMP  

Based on the results of the two follow-up audits, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 1 (important): HR strategic management 

2.24.  Audit on public procurement in DG DIGIT 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 4 (important): risk assessment of the procurement processes 

The recommendation below was not fully and/or adequately implemented: 

• 

Recommendation No 5 (important): controls in pre-tendering and tendering phases (ex ante) 

This  recommendation  comprises  five  sub-points,  out  of  which  four  have  been  implemented  considering  the 
actions taken as follows: 

—  DG DIGIT strengthened its pre-tendering activities by requesting its clients to base their budget 
estimates  as  much  as  possible  on  more  detailed/updated  data  (for  example  lists  of 
projects/activities and the associated budget). More specifically, DG DIGIT updated its template 
note to the EU Institutions prior to the launch of a procedure with additional instructions on 
estimates of future needs and more detailed data to be provided; 

—  DG DIGIT strengthened and documented the controls on low value procedures and very low 
value  procedures by  using  the  public  procurement  management  tool  for  those  procedures, 
thus allowing for a centralised planning and supervision. As from September 2022, the use of 
the public procurement management  and e-submission tools has been made obligatory for 
the low value and very low value procedures. New guidelines, templates and workflows have 
also been developed to assist DG DIGIT’s staff members when managing these procedures; 

—  DG DIGIT reviewed the DIGIT Procurement Board’s terms of reference to monitor and ensure 
compliance  with  the  applicable  deadlines  to  avoid  delays  in  contracting  and  potential 
disruptions in the operational activities. In particular, the revised terms of reference establish 
a regular reporting to the DIGIT Procurement Board, including an overview of the status of 
procedures in preparation. According to Article 5.3 of the revised rules, as a standing point in 
the  agenda  for  each  meeting,  the  DIGIT  Procurement  Board  reviews  DIGIT’s  rolling 
procurement programme; 

—  DG DIGIT uses the monitoring tools currently available (for example ABAC and contractors’ 
reports) to identify major consumption deviations early enough to launch new procurement 
procedures. DG DIGIT’s objective is to have more efficient tools available in e-procurement for 
consumption  monitoring.  In  this  context,  DG  DIGIT  is  currently  discussing  with  multiple  EU 
Institutions on their future use of e-procurement, which  would enable a  wider visibility for 
consumption monitoring.  

Regarding the sub-points not fully implemented, the action plan required DG DIGIT to present its needs (which 
are also corporate) to the members of the Grants and Procurement Steering Board in order to agree on a specific 
action  plan  and  timeline  to  satisfy  those  needs.  While  IAS  acknowledges  that  DG  DIGIT  adopted  the 
eProcurement paper on DIGIT needs and the necessary functionalities to address those needs, the timeline to 
satisfy those needs has not yet been agreed with the parties  concerned. Currently, discussions are foreseen, 
and the timeline is expected to be endorsed by the Grants and Procurement Steering Board in 2025. 

54 

 
2.25.  Audit on the effectiveness of the protection of personal data of 
beneficiaries of and participants in the Erasmus+ and European 
Solidarity Corps programmes managed by DG EAC 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation  No  1  (downgraded  from  very  important  to  important):  information  to  Erasmus+ 
participants during personal data collection 

2.26.  Audit on human resources management in DG ECFIN 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

Recommendation No 6 (important): staff allocation 

Recommendation No 7 (important): monitoring and reporting 

2.27.  Limited review of the Recovery and Resilience Facility control 

and audit strategies in DG ECFIN 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 1 (important): design of control and audit strategy 

2.28.  Audit on the financial management of Humanitarian Aid under 

indirect management in DG ECHO 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 3 (important): verifications of UN/IO 

2.29.  Audit  on  the  effectiveness  and  efficiency  of  Eurostat’s 

performance management system – DG ESTAT 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

Recommendation No 1 (important): activities and outputs 

Recommendation No 3 (important): planning, monitoring and reporting 

2.30.  Audit on performance management in the FPI 

Based on the results of the two follow-up audits, the IAS concluded that the following recommendation was 
adequately and effectively implemented: 

• 

Recommendation No 2 (important): quality of objectives and indicators 

The recommendations below were not fully and/or adequately implemented: 

55 

 
• 

Recommendation No 1 (downgraded from very important to important): performance management 
framework 

The IAS reviewed the actions taken by the FPI for the three sub-points and concluded that two of them have 
been  effectively  implemented,  while  for  the  third  one  some  actions  are  still  to  be  finalised.  The  detailed 
assessment is presented here below:  

• 

The IAS recommended the FPI to assign a central coordination role for developing, monitoring and 
steering the performance management framework, together with sufficient human resources.  

Responsibility for developing, updating, monitoring and steering of the performance management framework 
has  been  centralised  in  Unit  FPI.4  ‘Budget,  Finance,  Relations  with  other  Institutions’.  The  unit  oversaw  the 
revision  of  the  FPI  results  framework  in  the  light  of  the  FPI  strategic  plan  2020-2024  and  of  the  new 
instruments under the 2021-2027 Multi-annual Financial Framework. Two people in the unit specifically focus 
on the results agenda (representing in total one full time equivalent). The IAS considered that sufficient actions 
have been put in place to address the issue originally identified, consequently this part of the recommendation 
is assessed as effectively implemented.  

• 

The IAS recommended the FPI to further develop the performance management framework, so that 
it covers all activities under the FPI’s control in a coherent manner.  

At the end of 2021, the FPI carried out an in-depth revision of the results framework’s performance indicators, 
among others to align them with the NDICI-GE Regulation, the FPI strategic plan 2020-2024 and DG INTPA’s 
Global Europe Results Framework. The FPI results  framework now  covers all FPI instruments and on-budget 
operations. Nevertheless, the FPI considered that a further revision was needed and launched it in 2023. The 
revision is currently ongoing with the updated deadline of 31 December 2024. Considering the progress already 
made in the revision of the results framework in 2021, and the fact that the results framework now covers all 
the FPI’s on-budget instruments, the IAS considered that the residual risk has decreased from ‘high’ to ‘medium’. 

• 

The IAS recommended to rationalise the use of outsourcing contracts by centrally collecting the needs 
of units and pooling contracts across all relevant units with similar needs, wherever possible.  

The FPI centralised the use of contracts related to the results agenda in May 2022 through a common Project 
Implementation Monitoring system support contract, serving all the FPI units implementing the NDICI. As from 
2024, this contract has been replaced by a technical assistance facility for monitoring, design, evaluation and 
knowledge  management,  serving  DG  INTPA,  DG  NEAR  and  the  FPI,  and  funded  by  DG  INTPA  and  DG  NEAR-
managed funds under NDICI. The IAS considered that sufficient actions have been put in place to address the 
issue  originally  identified,  consequently  this  part  of  the  recommendation  was  assessed  as  effectively 
implemented. 

• 

Recommendation No 4 (important): Use of evaluation results for performance monitoring: 

—  guidance on using evaluation results for performance monitoring and sharing evaluations with 
external stakeholders: the evaluation section of the FPI manual (comparing the version of July 
2018 subject to the audit with the current version of January 2022) has not yet been revised 
to clarify how to use in practice evaluation results in the context of performance monitoring 
and how to share evaluation results with external stakeholders;  

—  follow-up of evaluations; use of EVAL module: the integration of the EVAL module in OPSYS 
(19), initially planned for end 2019, was delayed for technical reasons and only happened in 
September 2023. A further revision of the evaluation section in the FPI manual is planned for 
the beginning of 2024, once the revision of the EC evaluation handbook that is currently being 
carried out by DG INTPA is completed. 

(19)  The new operational system in external action. 

56 

 
 
 
2.31.  Audit  on  the  performance  of  the  treatment  of  stakeholders' 
complaints concerning the internal market in DG GROW 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 1 (important): provision of information to complainants 

2.32.  Audit on the European anti-fraud office´s effectiveness in the 

area of fraud prevention activities - OLAF 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendations  were 
adequately and effectively implemented: 

• 

• 

Recommendation No 1 (important): OLAF’s  support to Commission  services in designing their local 
anti-fraud strategies and reporting on their implementation 

Recommendation No 2 (important): the fraud-prevention and detection network and the Commission 
anti-fraud website 

2.33.  Audit  on  the  grant  and  procurement  award  process  under 
European  Neighbourhood  Instrument  (ENI)  direct  management 
in DG NEAR 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was not fully 
and/or adequately implemented: 

• 

Recommendation No 3 (important): supervision missions 

DG NEAR had already implemented part one of the recommendation requiring the updating of the process 
manual as indicated in the previous follow-up note. 

In the second part, the IAS recommended to DG NEAR to ‘adequately follow the provisions of the process manual 
as regards the supervision mission frequency, performance, and follow-up’. 

The  IAS  found  that  the  procedures  described  in  the  process  manual  for  supervision  missions  (hereafter 
supervision manual) are currently not followed in practice. The test of two final reports of recently completed 
supervision revealed that the following procedures related to the action plans were not respected: 

—  provision by the EU Delegation (EUD) of an action plan within 30 working days of receipt of 

the final report; 

—  for  the  two  samples  tested,  the  action  plan  was  only  provided  after  5  and  9  months 

respectively; 

—  assessment  and  approval  of  the  action  plan  by  the  Head  of  Unit  of  the  Geographical  unit 

within 15 working days after receiving the action plan; 

— 

— 

this timeframe  was not  respected for  both sampled reports. Moreover, for one supervision 
mission, the IAS did not find evidence of formal approval of the action plan; 

report by the EUD on its action plan progress within 6 and 12 months after the final mission 
report is issued.  

This timeframe was not respected for both samples tested: in both cases the EUDs only provided one update 
on their action plans (respectively 1 year and 10 months after the issuance of the final report and 9 months 
after the issuance of the final report). 

The  IAS  noted  that  the  2022  Annual  Activity  Report  of  DG  NEAR  included  the  following  statements 
acknowledging the need for further progress in relation to supervision missions: 

57 

 
— 

— 

— 

‘the follow-up of action plans of previous missions needs to be enhanced’, and 

‘it will be enhanced in 2023, on the basis of the revised Supervision Mission Manual’.  

the  revised  2023  version  of  the  supervision  manual  now  includes  a  ‘mandatory  closure 
meeting  between  the  EUD  and  the  supervision  mission  team  to  ensure  that  all 
recommendations are appropriately (and timely) addressed’. 

2.34.  Audit on the annual audit plan in DG NEAR 

Based on the results of the follow-up audit, the IAS concluded that the following recommendation was not fully 
and/or adequately implemented: 

• 

Recommendation No 2 (important): follow-up of audit results 

The IAS recommended to DG NEAR to improve its strategy on the follow-up of financial findings and issue 
corresponding guidance as well as to make full use of findings stemming from verification missions to 
international organisations. 

As  indicated  in  the  closing  note  of  the  first  follow-up,  DG  NEAR  adopted  a  ‘Procedure  to  report  on  findings 
stemming from verification missions to international organisations’ in January 2022, but the guidance on the 
follow up of financial findings was at that time incomplete. 

2.35.  Audit on performance management in DG TAXUD 

Based  on  the  results  of  the  follow-up  audit,  the  IAS  concluded  that  the  following  recommendation  was 
adequately and effectively implemented: 

• 

Recommendation No 2 (important): reporting related issues 

58 

 
 
 
List of audits for which all recommendations 
were closed in 2024  

Based on the results of the follow-up engagements performed in 2024, the IAS concluded that the audits listed 
below could be closed as all the recommendations were assessed as implemented. 

HORIZONTAL AUDITS 

2.36. Audit on planning, programming, governance, and coordination of the Single Market Programme in DG 
COMP, DG ESTAT, DG FISMA, DG GROW, DG JUST, DG SANTE, DG TAXUD, EISMEA and HaDEA 

2.37. Audit on monitoring the implementation and performance of 2014-2020 operational programmes by 
DG EMPL, DG MARE and DG REGIO 

2.38. Audit on the preparation for the 2021-2027 programming period by DG EMPL, DG MARE and DG REGIO 

2.39.  Audit on the cooperation and coordination mechanisms between the European  Training Foundation 
(ETF) and the European Commission services  

2.40. Audit on the Commission’s control system in relation to the reliability of performance information on 
EU financial programmes in DG BUDG and the SG 

2.41. Audit on the management of experts in H2020 grants in DG CNECT, DG RTD, EASME, INEA and REA 

2.42. Audit on the implementation of anti-fraud actions in the research area in DG CNECT, DG RTD, EASME, 
ERCEA and REA 

SINGLE MARKET, INNOVATION AND DIGITAL 

2.43. Audit on the delegations and efficiency of decision making in the European Joint Undertaking for ITER 
and the Development of Fusion for Energy and cooperation mechanisms with DG ENER 

2.44. Audit on the design and early implementation of the European Innovation Council in DG CNECT, DG RTD 
and EISMEA 

2.45. Audit on European Union Finance for Innovators in DG RTD  

NATURAL RESOURCES AND ENVIRONMENT 

2.46. Audit on LIFE implementation in DG CLIMA, DG ENER, DG ENV, and CINEA 

2.47. Audit on DG AGRI’s management of the wine market – DG AGRI (20) 

2.48. Audit on the financial clearance of accounts in DG AGRI 

SECURITY AND DEFENCE 

2.49. Audit on the preparedness of DG DEFIS for the management of the European Defence Fund – DG DEFIS 

NEIGHBOURHOOD AND THE WORLD 

2.50. Audit on the control strategy for humanitarian aid actions in DG ECHO  

2.51. Audit on the control strategy for grant management under the Union Civil Protection Mechanism in DG 
ECHO 

GENERAL SERVICES 

(20)  Recommendation 3 on control statistics on wine crisis measures (important) was only partly implemented. The residual 

risk was accepted by DG AGRI. 

59 

 
 
 
2.52. Limited review of HERA’s assessment of its Internal Control Framework for the 2022 Annual Activity 
Report – HERA 

2.53. Audit on the Joint Research Centre’s support to European Union policy and knowledge management - 
JRC 

INFORMATION TECHNOLOGY 

2.54. Audit on IT governance and management in DG HOME and DG JUST 

2.55. Audit on the progress in the implementation of the European Commission digital strategy in DIGIT 

2.56.  Audit  on  the  management  and  monitoring  of  compliance  with  the  Commission’s  information 

technology (IT) security framework in DG DIGIT 

60 

 
 
Part 3 - Summary of 
long overdue 
recommendations 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
At the end of the reporting period, 31 January 2025, there were 6 very important long overdue recommendations, overdue by more than six months compared to the original 
expected completion dates set in the auditees’ initial action plans. In the meantime, one of those has been downgraded from very important to important. 

No. 

Entity 

Audit title 

Recommendation title 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

I 

DG INTPA  

IAS.C4-2022-Y COMM-001: 
Contractual expenditure 
verifications 

Clarify the objective of the 
CEV, revise the terms of 
reference and prepare 
guidance 

31.1.2023 

31.12.2023 

31.12.2025 

Unknown  but 
more  than  1 
year 

Contractual expenditure verifications in the external action Directorates-General take the form of ‘agreed-upon procedures’ pursuant international standard ISRS 4400, 
according to which the external auditor is obliged to do only those tests that are explicitly prescribed in the terms of reference, which should be clear, not misleading and 
not subject to varying interpretations. This is a fundamentally different concept from ‘audits’, where the international standards on auditing instruct the external auditor 
what to test and how. 

The IAS found that the terms of reference for contractual expenditure verifications (CEV) are not sufficiently detailed regarding the verifications to be done and there is no 
standard work programme to follow. In addition, the external auditor is not required to report in detail on the exact verification procedures performed. As a result, most 
CEV reports reviewed by the IAS did not allow the reader to understand on which basis the external auditor concluded on the eligibility of the expenditure. 

Due to unclear or incomplete instructions, guidance and templates, the external auditor may not acquire the level of knowledge of the EU context and the expenditure 
eligibility rules that would enable their proper application during the expenditure verifications. This may ultimately weaken the reliability of CEV reports in detecting irregular 
expenditure. 

An IAS follow-up found that the recommendation has only partly been implemented, hence the residual risk remains high. 

No. 

Entity 

Audit title 

Recommendation title 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

II 

DG HR 

IAS.B4-2021-Y COMM-002: 
Physical security of persons and 
assets in the Commission 

Risk management 
framework for physical 
security at the Commission 

4.10.2022 

31.12.2023 

31.10.2025 

1  year  and 
10 months 

While the IAS acknowledged that some progress has been made in the implementation of the action plan, the recommendation has not been fully implemented. In particular, 
one point needed to be addressed by DG COMM and HR.DS jointly with the European Parliament. According to recent information provided in February 2025 by DG COMM 
(after the cut-off date for this report), DG COMM jointly with HR.DS discussed the matter further with the European Parliament and a pragmatic solution was identified 

62 

 
 
 
 
with the Parliament. Another outstanding point is related to the implementation of a new IT platform which was delayed because of data protection issues linked to the 
platform initially chosen by the Secretariat General. 

No. 

Entity 

Audit title 

Recommendation title 

III 

DG COMM 

IAS.B4-2021-Y COMM-002: 
Physical security of persons 
and assets in the Commission 

Risk management 
framework for physical 
security at the Commission 

Final report 
date 

Original agreed 
completion date 

Revised 
expected 
completion date 

Expected 
delay 

4.10.2022 

31.12.2023 

15.5.2025 

1 year and 6 
months 

While the IAS acknowledged that some progress has been made in the implementation of the action plan, the recommendation has not been fully implemented. In particular, 
one point needed to be addressed by DG COMM and HR.DS jointly with the European Parliament. According to recent information provided in February 2025 by DG COMM 
(after the cut-off date for this report), DG COMM, jointly with HR.DS, discussed the matter further with the European Parliament and a pragmatic solution was identified 
with the Parliament.   

No. 

Entity 

Audit title 

Recommendation title 

IV 

DG HR 

IAS.B4-2021-Y COMM-002: 
Physical security of persons 
and assets in the Commission 

Governance framework and 
organisational 
arrangements for physical 
security at the Commission 

Final report 
date 

Original agreed 
completion date 

Revised 
expected 
completion date 

Expected 
delay 

4.10.2022 

31.12.2023 

30.6.2026 

2 years and 
6 months 

The formalisation and validation of a comprehensive security strategy was delayed, given that  discussions at the  political level (beyond DG  HR's control) are ongoing 
regarding  the  potential  administrative  reorganisation  of  internal/corporate  security.  To  ensure  coherence  in  steering  the  security  guards’  service  provision,  HR.DS.1  is 
responsible for the overall governance of the cooperation with the security guard service contractors.  

Concerning the establishment of a formal agreement with DG COMM on delineating their roles and responsibilities as regards physical security, the Corporate Management 
Board decided on 20 November 2024 to transfer the security of the Commission representations from DG COMM to DG HR (HR.DS) as domain leader. The work undertaken 
with the JRC is close to finalisation. 

63 

 
 
 
 
A new intranet site for Local Security Officers (LSOs) was created in September 2023, accessible only to officially nominated LSOs, which gathers all security information 
and procedures necessary for the implementation of LSOs responsibilities. A new checklist for LSOs was prepared with all HR.DS Units to ensure LSOs are consistently 
informed of all tasks associated with their responsibilities. 

As regards the Commission representations (EU Houses), DG COMM and DG HR jointly established in March 2023 a roadmap with six actions to implement the EC/EP 
Security framework. Actions of the roadmaps are being implemented. 

No. 

Entity 

Audit title 

Recommendation title 

Final report 
date 

Original agreed 
completion date 

Revised 
expected 
completion date 

Expected 
delay 

V 

DG DIGIT 

IAS.B4-2021-DIGIT-001 Public 
procurement in DG DIGIT and 
assets in the Commission 

Steering of ICT 

28.7.2022 

31.12.2023 

30.6.2025 

1 year and 6 
months 

DG DIGIT reported the implementation of four of the five sub-recommendations: DG DIGIT adopted the Strategy Paper on DG DIGIT’s new ICT Procurement Delivery Model 
(sub-recommendation A), proposed to the Information Technology and Cybersecurity Board the creation of a corporate IT Procurement Board (ITPB) with a view of 
obtaining an overview across the Commission of all ICT high value procurements and contracts (sub-recommendation C), the use of the Public Procurement Management 
(PPMT) and eSubmission tools has been made obligatory for the procedures with low and middle value and it is supported by the new guidelines (sub-recommendation D) 
and DG DIGIT’s Orientation Document templates have been updated to include a new section on sustainability aspects (sub-recommendation E). 

For the remaining sub-recommendation B, actions are still pending. According to DG DIGIT: 

•  DIGIT worked on the set-up of the professional services broker, which will include an advisory function to support the migration from ‘Time and Means’ contracts 
to other delivery modes. The delay on this sub-recommendation is linked to the cancellation of the Cloud II DPS2 MC12 (DAFNE) procedure, and the time needed 
to prepare a replacement procurement procedure for result-based projects. 

• 

In the meantime, DIGIT has launched: 

—  MAIA procurement procedure to award framework contracts that will cover the acquisition of IT professional services covering development, maintenance, 
migration, support and operations in fixed price and quoted time and means modes where the main lot is awarded through reopening of competition; 

—  FREIA procurement procedure to award framework contracts in the cybersecurity domain to be executed partly through result-oriented contracts awarded 

through reopening of competition; 

—  PROSERV DPS,  which enables competitions for IT studies, consulting, managed services and development in fixed price or quoted time and means modes. 

64 

 
 
 
 
The above actions complete the part of sub-recommendation B related to “set up a comprehensive set of procurement tools enabling result-oriented alternatives to the 
use of time and means contracts”. The experience gained on these alternative contractual models will then feed into the proposal for a roadmap for the progressive 
reduction of time and means, to be submitted to the ITCB for endorsement. 

No. 

Entity 

Audit title 

Recommendation title 

Final report 
date 

Original agreed 
completion date 

Revised expected 
completion date 

Expected 
delay 

VI 

DG EAC 

IAS.C2-2019-EAC-001: 
Effectiveness of the 
protection of personal data of 
beneficiaries of and 
participants in the Erasmus+ 
and European Solidarity Corps 
programmes managed by DG 
EAC 

Transfer of personal data 
to third countries 

28.1.2021 

15.12.2021 

31.3.2025 

3 years 
and 3 
months 

The IAS  recommended that  DG EAC should analyse, with the support of the data protection officer (DPO),  how  compliance of its  programmes with the internal data 
protection regulation (IDPR) concerning international transfers of data can be ensured in the context of the order (21) and the announced guidance of the European Data 
Protection Supervisor (EDPS). The DG reported that it analysed with DG JUST, the Legal Service and the DPO different possibilities to ensure compliance of the transfers 
to third countries with the IDPR. A suitable transfer tool (i.e. adequate and robust safeguard measures that protect the rights and freedoms  of the data subjects) has 
been identified and the EDPS has been consulted formally on this solution - as requested by the IDPR; their analysis of the latest contribution to the EDPS is now pending. 

(21)  On 14 October 2020, the EDPS gave all European institutions a formal order to a) perform a mapping exercise to provide information concerning processing operations that involve international 
transfers of data and b) report to it any identified risks and gaps, in accordance with the order. The EDPS also asked the European institutions to perform, in a second phase, a case-by-case 
‘transfer impact assessment’ to identify the level of protection provided by the third country of destination of the data. To facilitate this assessment, the EDPS will provide in due time specific 
guidance 

65